@oh-my-pi/pi-coding-agent 16.5.0 → 16.5.2

package/src/eval/executor-base.ts

@@ -3,7 +3,7 @@ import { Settings } from "../config/settings";
 import { OutputSink } from "../session/streaming-output";
 import type { ToolSession } from "../tools";
 import { resolveOutputMaxColumns, resolveOutputSinkHeadBytes } from "../tools/output-meta";
-import { isEvalTimeoutControlEvent } from "./bridge-timeout";
+import { EVAL_TIMEOUT_PAUSE_OP, EVAL_TIMEOUT_RESUME_OP, isEvalTimeoutControlEvent } from "./bridge-timeout";
 import type { JsStatusEvent } from "./js/shared/types";
 import type { KernelDisplayOutput } from "./py/display";
 import { registerPyToolBridge } from "./py/tool-bridge";
@@ -158,6 +158,77 @@ export async function waitForPromiseWithCancellation<T>(
 	return await resultPromise;
 }
 
+interface BridgeAbortShield {
+	signal: AbortSignal | undefined;
+	abortRequested: boolean;
+	timedOut: boolean;
+	handleStatus?: (event: JsStatusEvent) => void;
+	dispose?: () => void;
+}
+
+function createBridgeAbortShield(source: AbortSignal | undefined): BridgeAbortShield {
+	const shield: BridgeAbortShield = {
+		signal: undefined,
+		abortRequested: false,
+		timedOut: false,
+	};
+	if (!source) return shield;
+
+	const controller = new AbortController();
+	let pauseDepth = 0;
+	let abortReason: unknown;
+	let removeAbortListener: (() => void) | undefined;
+
+	const requestAbort = (reason: unknown): void => {
+		shield.abortRequested = true;
+		shield.timedOut =
+			shield.timedOut ||
+			(typeof DOMException !== "undefined" && reason instanceof DOMException
+				? reason.name === "TimeoutError"
+				: reason instanceof Error && reason.name === "TimeoutError");
+		abortReason = reason;
+		if (pauseDepth > 0 || controller.signal.aborted) return;
+		controller.abort(reason);
+	};
+
+	const onAbort = (): void => {
+		const reason = source.reason;
+		requestAbort(reason);
+	};
+
+	shield.signal = controller.signal;
+	shield.handleStatus = (event: JsStatusEvent): void => {
+		if (event.deferExternalAbort !== true) return;
+		if (event.op === EVAL_TIMEOUT_PAUSE_OP) {
+			pauseDepth++;
+			return;
+		}
+		if (event.op !== EVAL_TIMEOUT_RESUME_OP || pauseDepth === 0) return;
+		pauseDepth--;
+		if (shield.abortRequested && !controller.signal.aborted) controller.abort(abortReason);
+	};
+	shield.dispose = (): void => {
+		removeAbortListener?.();
+		removeAbortListener = undefined;
+	};
+
+	if (source.aborted) {
+		requestAbort(source.reason);
+	} else {
+		source.addEventListener("abort", onAbort, { once: true });
+		removeAbortListener = () => {
+			source.removeEventListener("abort", onAbort);
+		};
+		if (source.aborted) {
+			source.removeEventListener("abort", onAbort);
+			removeAbortListener = undefined;
+			requestAbort(source.reason);
+		}
+	}
+
+	return shield;
+}
+
 export function createCancelledKernelResult(output: string): KernelExecutionResult {
 	const outputBytes = Buffer.byteLength(output, "utf-8");
 	const outputLines = output.length > 0 ? 1 : 0;
@@ -304,9 +375,11 @@ export async function executeWithKernelBase<
 	const displayOutputs: KernelDisplayOutput[] = [];
 	const deadlineMs = (resolveDeadlineMs ?? getExecutionDeadlineMs)(options);
 	let executionTimeoutMs: number | undefined;
+	const abortShield = createBridgeAbortShield(options?.signal);
 
 	const collectDisplay = (output: KernelDisplayOutput): void => {
 		if (output.type === "status") {
+			abortShield.handleStatus?.(output.event);
 			options?.onStatus?.(output.event);
 			if (!isJulia && isEvalTimeoutControlEvent(output.event)) return;
 		}
@@ -320,8 +393,11 @@ export async function executeWithKernelBase<
 		options?.toolSession && options?.bridgeSessionId
 			? registerPyToolBridge(options.bridgeSessionId, runId, {
 					toolSession: options.toolSession,
-					signal: options.signal,
+					signal: abortShield.signal,
 					emitStatus,
+					abortRequested: () => {
+						return abortShield.abortRequested;
+					},
 				})
 			: null;
 
@@ -338,14 +414,15 @@ export async function executeWithKernelBase<
 			cwd: options?.cwd,
 			env: buildKernelEnvPatch(options ?? ({} as TOptions)),
 			id: runId,
-			signal: options?.signal,
+			signal: abortShield.signal,
 			timeoutMs: executionTimeoutMs,
 			onChunk: text => sink.push(text),
 			onDisplay: output => collectDisplay(output),
 		});
 
-		if (result.cancelled) {
-			const annotation = result.timedOut
+		if (result.cancelled || abortShield.abortRequested) {
+			const timedOut = result.timedOut || abortShield.timedOut;
+			const annotation = timedOut
 				? formatKernelTimeoutAnnotation(executionTimeoutMs ?? options?.idleTimeoutMs, result.kernelKilled ?? false)
 				: undefined;
 			const dumped = await sink.dump(annotation);
@@ -397,8 +474,8 @@ export async function executeWithKernelBase<
 			stdinRequested: false,
 		};
 	} catch (err) {
-		if (isCancellationError(err, cancelledErrorClass) || options?.signal?.aborted) {
-			const timedOut = isTimedOutCancellation(err, cancelledErrorClass, options?.signal);
+		if (isCancellationError(err, cancelledErrorClass) || abortShield.abortRequested || abortShield.signal?.aborted) {
+			const timedOut = abortShield.timedOut || isTimedOutCancellation(err, cancelledErrorClass, abortShield.signal);
 			const dumped = await sink.dump(
 				timedOut ? formatTimeoutAnnotation(executionTimeoutMs ?? options?.idleTimeoutMs) : undefined,
 			);
@@ -421,5 +498,6 @@ export async function executeWithKernelBase<
 		throw error;
 	} finally {
 		unregisterBridge?.();
+		abortShield.dispose?.();
 	}
 }

package/src/eval/jl/kernel.ts

@@ -13,7 +13,7 @@ import { $ } from "bun";
 import { Settings } from "../../config/settings";
 import { BaseKernel, getRemainingTimeMs, type KernelStartOptions } from "../kernel-base";
 import type { KernelDisplayOutput } from "../py/display";
-import { hostHasInheritableConsole, shouldHideKernelWindow } from "../py/spawn-options";
+import { hostHasInheritableConsole, shouldDetachKernel, shouldHideKernelWindow } from "../py/spawn-options";
 import { JULIA_PRELUDE } from "./prelude";
 import RUNNER_SCRIPT from "./runner.jl" with { type: "text" };
 import {
@@ -187,6 +187,7 @@ export class JuliaKernel extends BaseKernel<KernelExecuteOptions> {
 			[runtime.juliaPath, "--startup-file=no", "--history-file=no", "--color=no", "--project=@.", scriptPath],
 			{
 				cwd: options.cwd,
+				detached: shouldDetachKernel(process.platform),
 				env: spawnEnv,
 				stdin: "pipe",
 				stdout: "pipe",

package/src/eval/js/context-manager.ts

@@ -1,6 +1,14 @@
-import { logger, Snowflake, workerHostEntry } from "@oh-my-pi/pi-utils";
+import { logger, postmortem, Snowflake, workerHostEntry } from "@oh-my-pi/pi-utils";
+import {
+	createWorkerHandle,
+	createWorkerSubprocess,
+	resolveWorkerSpawnCmd,
+	workerEnvFromParent,
+} from "../../subprocess/worker-client";
 import type { ToolSession } from "../../tools";
 import { ToolAbortError, ToolError } from "../../tools/tool-errors";
+import { safeSend as safeSendIpc } from "../../utils/ipc";
+import { shouldDetachKernel } from "../py/spawn-options";
 import { callSessionTool, type JsStatusEvent } from "./tool-bridge";
 import { WorkerCore } from "./worker-core";
 // Coding-agent binary/bundle workers route through the CLI entrypoint with a
@@ -24,7 +32,7 @@ export interface VmRunState {
 }
 
 interface WorkerHandle {
-	mode: "worker" | "inline";
+	mode: "process" | "worker" | "inline";
 	send(msg: WorkerInbound): void;
 	onMessage(handler: (msg: WorkerOutbound) => void): () => void;
 	onError(handler: (error: Error) => void): () => void;
@@ -57,16 +65,18 @@ const resettingSessions = new Map<string, Promise<void>>();
 // Worker startup (module-graph import + WorkerCore construction) is infrastructure
 // cost, not user compute. Floor it independently of Bun's 5s default per-test timeout
 // so a slow cold-start under load isn't aborted mid-init — terminating a still-
-// initializing Bun worker triggers the same kind of terminate-race that motivates
+// initializing eval runtime triggers the same kind of terminate-race that motivates
 // avoiding `vm.runInContext` (see shared/indirect-eval.ts), here surfacing as a
 // SIGILL/SIGSEGV. Callers that pass a larger per-cell budget still dominate.
 const WORKER_INIT_TIMEOUT_MS = 15_000;
 const WORKER_CLOSE_TIMEOUT_MS = 1_000;
+const JS_EVAL_PROCESS_ARG = "__omp_worker_js_eval_process";
 // Active graceful-close grace period before a worker that ack'd `close` but never
 // emitted its `close` event is force-terminated. Defaults to the production floor;
 // tests override it (and restore it) to exercise the close-timeout -> terminate
 // path without a real wall-clock wait.
 let workerCloseTimeoutMs: number = WORKER_CLOSE_TIMEOUT_MS;
+let useWorkerThreadForTests = false;
 
 /**
  * Test-only seam: override the graceful-close grace period (ms). Returns the
@@ -79,6 +89,13 @@ export function setWorkerCloseTimeoutMsForTests(ms: number): number {
 	return previous;
 }
 
+/** Test-only seam for the legacy Worker lifecycle mocks. */
+export function setJsEvalWorkerThreadForTests(enabled: boolean): boolean {
+	const previous = useWorkerThreadForTests;
+	useWorkerThreadForTests = enabled;
+	return previous;
+}
+
 export async function executeInVmContext(options: {
 	sessionKey: string;
 	sessionId: string;
@@ -144,9 +161,9 @@ export async function disposeAllVmContexts(): Promise<void> {
 }
 
 /**
- * Smoke probe: spawn the JS eval worker through the worker-host entry and prove
- * it answers the `init` handshake on a real worker thread (not the inline
- * fallback). Catches the silent worker-load and init-message-drop regressions
+ * Smoke probe: spawn the JS evaluator through the worker-host entry and prove
+ * it answers the `init` handshake in a real isolated subprocess (not the inline
+ * fallback). Catches silent process-load and init-message regressions
  * that otherwise strand every cell on the init timeout in a distribution build —
  * the failure mode that motivated `installWorkerInbox`. Wired into
  * `omp --smoke-test` so binary / source / tarball installs all exercise it.
@@ -163,8 +180,8 @@ export async function smokeTestJsEvalWorker(): Promise<void> {
 	};
 	try {
 		await initWorker(session, { cwd: process.cwd(), sessionId: "smoke" }, WORKER_INIT_TIMEOUT_MS);
-		if (worker.mode !== "worker") {
-			throw new Error("JS eval worker smoke fell back to the inline worker (real worker failed to start)");
+		if (worker.mode !== "process") {
+			throw new Error("JS eval worker smoke fell back from the isolated subprocess");
 		}
 	} finally {
 		await worker.terminate().catch(() => undefined);
@@ -237,10 +254,8 @@ async function acquireSession(sessionKey: string, snapshot: SessionSnapshot, tim
 	if (starting) return await starting;
 
 	const startup = (async (): Promise<JsSession> => {
-		// The message listener must be attached synchronously after `new Worker`:
-		// Bun drops messages posted before a listener exists, and WorkerCore emits
-		// `ready` from its constructor on load. `spawnJsWorker` + `initWorker` run with
-		// no intervening await, so `ready` can never race the attach.
+		// Attach the message listener before sending init. Both Bun Worker messages
+		// and subprocess IPC can arrive immediately after the evaluator loads.
 		const worker = spawnJsWorker();
 		const session: JsSession = {
 			sessionKey,
@@ -253,27 +268,29 @@ async function acquireSession(sessionKey: string, snapshot: SessionSnapshot, tim
 		// Init headroom is the fixed infrastructure floor; the caller's per-cell timeout
 		// dominates when larger so users can grant more by raising `timeout` on a cell.
 		const readyTimeoutMs = Math.max(WORKER_INIT_TIMEOUT_MS, timeoutMs ?? 0);
-		try {
-			await initWorker(session, snapshot, readyTimeoutMs);
-		} catch (error) {
-			// Worker-thread crash/load failures surface asynchronously via the worker
-			// `error` event — after `spawnJsWorker`'s synchronous try/catch already
-			// returned — so the only signal is the rejected handshake. Retry on the
-			// inline worker so a broken module graph fails fast instead of stalling
-			// every cell on the init timeout and then dying with exitCode 1.
-			await worker.terminate().catch(() => undefined);
-			if (worker.mode === "inline") throw error;
-			logger.warn("JS eval worker init failed; retrying with inline worker (no sync-loop guard)", {
-				error: error instanceof Error ? error.message : String(error),
-			});
-			const inline = spawnInlineWorker();
-			session.worker = inline;
-			session.state = "alive";
+		while (true) {
 			try {
 				await initWorker(session, snapshot, readyTimeoutMs);
-			} catch (inlineError) {
-				await inline.terminate().catch(() => undefined);
-				throw inlineError;
+				break;
+			} catch (error) {
+				// Runtime crash/load failures surface asynchronously via the runtime's
+				// error callback, after the synchronous spawn try/catch has returned.
+				// Preserve the full process -> Worker -> inline ladder for those failures.
+				const failed = session.worker;
+				await failed.terminate().catch(() => undefined);
+				if (failed.mode === "inline") throw error;
+				if (failed.mode === "process") {
+					logger.warn("JS eval subprocess init failed; retrying with a Bun Worker", {
+						error: error instanceof Error ? error.message : String(error),
+					});
+					session.worker = spawnBunWorker();
+				} else {
+					logger.warn("JS eval worker init failed; retrying with inline worker (no sync-loop guard)", {
+						error: error instanceof Error ? error.message : String(error),
+					});
+					session.worker = spawnInlineWorker();
+				}
+				session.state = "alive";
 			}
 		}
 		sessions.set(sessionKey, session);
@@ -480,6 +497,22 @@ async function raceWithTimeout<T>(promise: Promise<T>, timeoutMs: number, reason
 }
 
 function spawnJsWorker(): WorkerHandle {
+	if (!useWorkerThreadForTests) {
+		try {
+			return spawnJsProcess();
+		} catch (err) {
+			// Fall through to the Bun Worker rung: a worker thread still interrupts
+			// synchronous infinite loops via terminate(), which the inline fallback
+			// cannot.
+			logger.warn("JS eval subprocess spawn failed; falling back to a Bun Worker", {
+				error: err instanceof Error ? err.message : String(err),
+			});
+		}
+	}
+	return spawnBunWorker();
+}
+
+function spawnBunWorker(): WorkerHandle {
 	try {
 		const hostEntry = workerHostEntry();
 		const worker = hostEntry
@@ -494,6 +527,47 @@ function spawnJsWorker(): WorkerHandle {
 	}
 }
 
+function spawnJsProcess(): WorkerHandle {
+	const spawned = createWorkerSubprocess<WorkerOutbound>({
+		spawnCommand: resolveWorkerSpawnCmd(JS_EVAL_PROCESS_ARG),
+		env: workerEnvFromParent(),
+		exitLabel: "JS eval worker",
+		detached: shouldDetachKernel(process.platform),
+		reportCleanExit: true,
+		unref: false,
+	});
+	const base = createWorkerHandle<WorkerInbound, WorkerOutbound>(spawned, message =>
+		safeSendIpc(spawned.proc, message, "js-eval"),
+	);
+	return {
+		mode: "process",
+		send: message => base.send(message),
+		onMessage: handler => base.onMessage(handler),
+		onError: handler => base.onError(handler),
+		async close() {
+			const { promise, resolve } = Promise.withResolvers<boolean>();
+			let settled = false;
+			let timeout: NodeJS.Timeout | undefined;
+			let unsubscribe = (): void => {};
+			const finish = (value: boolean): void => {
+				if (settled) return;
+				settled = true;
+				if (timeout) clearTimeout(timeout);
+				unsubscribe();
+				resolve(value);
+			};
+			unsubscribe = base.onMessage(message => {
+				if (message.type !== "closed") return;
+				void base.terminate().finally(() => finish(true));
+			});
+			timeout = setTimeout(() => finish(false), workerCloseTimeoutMs);
+			base.send({ type: "close" });
+			return await promise;
+		},
+		terminate: () => base.terminate(),
+	};
+}
+
 function wrapBunWorker(worker: Worker): WorkerHandle {
 	return {
 		mode: "worker",
@@ -582,7 +656,10 @@ function spawnInlineWorker(): WorkerHandle {
 		},
 		close: () => {},
 	};
-	const core = new WorkerCore(workerTransport);
+	const core = new WorkerCore(workerTransport, {
+		mode: "inline",
+		interceptUnhandledRejections: postmortem.interceptUnhandledRejections,
+	});
 	return {
 		mode: "inline",
 		send: msg =>

package/src/eval/js/process-entry.ts

@@ -0,0 +1,27 @@
+import { WorkerCore } from "./worker-core";
+import type { WorkerInbound, WorkerOutbound } from "./worker-protocol";
+
+/** Start the JavaScript evaluator inside a subprocess IPC transport. */
+export function startJsEvalProcess(transport: {
+	send(message: WorkerOutbound): void;
+	onMessage(handler: (message: WorkerInbound) => void): () => void;
+}): void {
+	new WorkerCore(
+		{
+			send: message => transport.send(message),
+			onMessage: handler => transport.onMessage(handler),
+			// The parent owns process lifetime and kills the subprocess after the
+			// WorkerCore `closed` acknowledgement has crossed IPC.
+			close: () => {},
+		},
+		{
+			mode: "isolated",
+			// The subprocess starts with its real cwd at the worker-host entry dir
+			// (a `resolveWorkerSpawnCmd` requirement); mirror the session cwd so
+			// cell code using relative paths or spawning children resolves against
+			// the project instead of the install dir. Worker threads cannot pass
+			// this — `process.chdir` is unavailable there.
+			chdir: cwd => process.chdir(cwd),
+		},
+	);
+}

package/src/eval/js/shared/runtime.ts

@@ -6,7 +6,7 @@ import * as path from "node:path";
 import { Writable } from "node:stream";
 import * as util from "node:util";
 
-import { logger } from "@oh-my-pi/pi-utils";
+import * as logger from "@oh-my-pi/pi-utils/logger";
 
 import { createHelpers, type HelperBundle } from "./helpers";
 import { awaitMaybePromise, indirectEval } from "./indirect-eval";

package/src/eval/js/worker-core.ts

@@ -1,5 +1,3 @@
-import { isMainThread } from "node:worker_threads";
-import { postmortem } from "@oh-my-pi/pi-utils";
 import { ToolError } from "../../tools/tool-errors";
 import { JsRuntime, type RuntimeHooks } from "./shared/runtime";
 import type {
@@ -27,6 +25,23 @@ interface ActiveRun {
 
 type RunResult = Extract<WorkerOutbound, { type: "result" }>;
 
+export type WorkerCoreOptions =
+	| {
+			mode: "isolated";
+			/**
+			 * Mirror the session cwd onto the real process cwd so cell code using
+			 * `process.cwd()`, relative paths, or child processes without an explicit
+			 * `cwd` resolves against the project. Only the dedicated subprocess may
+			 * pass this: `process.chdir` is unavailable in Worker threads and would
+			 * mutate the host's own cwd on the inline fallback.
+			 */
+			chdir?: (cwd: string) => void;
+	  }
+	| {
+			mode: "inline";
+			interceptUnhandledRejections(handler: (reason: unknown) => boolean): () => void;
+	  };
+
 /** Finished-cell filenames retained for attributing rejections that surface after the run settled. */
 const RECENT_CELL_FILES_MAX = 256;
 
@@ -82,9 +97,11 @@ export class WorkerCore {
 	#recentCellFiles = new Set<string>();
 	#unsubscribe: () => void;
 	#uninstallRejectionGuard: () => void;
+	#options: WorkerCoreOptions;
 
-	constructor(transport: Transport) {
+	constructor(transport: Transport, options: WorkerCoreOptions) {
 		this.#transport = transport;
+		this.#options = options;
 		this.#unsubscribe = transport.onMessage(msg => this.#handle(msg));
 		this.#uninstallRejectionGuard = this.#installRejectionGuard();
 	}
@@ -98,8 +115,8 @@ export class WorkerCore {
 	 * without a usable stack, while anything else keeps its default fatality.
 	 */
 	#installRejectionGuard(): () => void {
-		if (isMainThread) {
-			return postmortem.interceptUnhandledRejections(reason => this.#consumeRejection(reason));
+		if (this.#options.mode === "inline") {
+			return this.#options.interceptUnhandledRejections(reason => this.#consumeRejection(reason));
 		}
 		const onRejection = (reason: unknown): void => {
 			if (this.#consumeRejection(reason)) return;
@@ -161,7 +178,7 @@ export class WorkerCore {
 				return true;
 			}
 		}
-		if (!isMainThread && this.#runs.size > 0) {
+		if (this.#options.mode === "isolated" && this.#runs.size > 0) {
 			// Dedicated eval worker: during a live run, a rejection without a cell
 			// frame (e.g. `Promise.reject("msg")` or a library-created reason) is
 			// still cell activity — nothing else runs user code in this realm.
@@ -206,7 +223,8 @@ export class WorkerCore {
 		}
 	}
 
-	#ensureRuntime(snapshot: SessionSnapshot): JsRuntime {
+	#ensureRuntime(snapshot: SessionSnapshot, currentRunId?: string): JsRuntime {
+		this.#syncProcessCwd(snapshot.cwd, currentRunId);
 		if (this.#runtime) {
 			this.#runtime.setCwd(snapshot.cwd);
 			return this.#runtime;
@@ -219,6 +237,41 @@ export class WorkerCore {
 		return this.#runtime;
 	}
 
+	#syncProcessCwd(cwd: string, currentRunId?: string): void {
+		if (this.#options.mode !== "isolated" || !this.#options.chdir) return;
+		try {
+			if (process.cwd() === cwd) return;
+		} catch {
+			// The current cwd was deleted; the chdir below is the recovery.
+		}
+		// Process cwd is realm-wide state. Moving it while another cell is mid-run
+		// would silently redirect that cell's `process.cwd()`, relative fs access,
+		// and child spawns, so keep it in place; this run still resolves against
+		// its own virtual cwd, and the next cell to start alone lands the move.
+		for (const runId of this.#runs.keys()) {
+			if (runId === currentRunId) continue;
+			this.#transport.send({
+				type: "log",
+				level: "warn",
+				msg: "JS eval subprocess kept its process cwd: other cells are mid-run",
+				meta: { cwd },
+			});
+			return;
+		}
+		try {
+			this.#options.chdir(cwd);
+		} catch (error) {
+			// `process.chdir` throws when the session cwd no longer exists; keep
+			// the cell on the runtime's virtual cwd instead of failing the run.
+			this.#transport.send({
+				type: "log",
+				level: "warn",
+				msg: "JS eval subprocess could not enter the session cwd",
+				meta: { cwd, error: errorPayload(error) },
+			});
+		}
+	}
+
 	async #runOne(runId: string, code: string, filename: string, snapshot: SessionSnapshot): Promise<void> {
 		const active: ActiveRun = { runId, filename, pendingTools: new Map(), floatingRejections: [] };
 		this.#runs.set(runId, active);
@@ -229,7 +282,7 @@ export class WorkerCore {
 		};
 		let result: RunResult;
 		try {
-			const runtime = this.#ensureRuntime(snapshot);
+			const runtime = this.#ensureRuntime(snapshot, runId);
 			runtime.setCwd(snapshot.cwd);
 			const value = await runtime.run(code, filename, hooks, { runId, cwd: snapshot.cwd });
 			runtime.displayValue(value, hooks);
@@ -263,7 +316,15 @@ export class WorkerCore {
 		const id = `tc-${active.runId}-${crypto.randomUUID()}`;
 		const { promise, resolve, reject } = Promise.withResolvers<unknown>();
 		active.pendingTools.set(id, { runId: active.runId, resolve, reject });
-		this.#transport.send({ type: "tool-call", id, runId: active.runId, name, args });
+		try {
+			this.#transport.send({ type: "tool-call", id, runId: active.runId, name, args });
+		} catch (error) {
+			// Non-serializable args (DataCloneError from postMessage / IPC send).
+			// No reply will ever arrive; fail this call instead of stranding a
+			// pending entry until close.
+			active.pendingTools.delete(id);
+			reject(error);
+		}
 		return await promise;
 	}
 

package/src/eval/js/worker-entry.ts

@@ -34,4 +34,4 @@ const transport: Transport = {
 	},
 };
 
-new WorkerCore(transport);
+new WorkerCore(transport, { mode: "isolated" });

package/src/eval/py/__tests__/prelude.test.ts

@@ -1,6 +1,30 @@
 import { describe, expect, it } from "bun:test";
 import { PYTHON_PRELUDE } from "../prelude";
 
+const pythonPath = Bun.env.PYTHON ?? "python3";
+
+async function runPrelude(
+	code: string,
+	env: Record<string, string>,
+): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+	const prelude = PYTHON_PRELUDE.replace(
+		"from __future__ import annotations",
+		"from __future__ import annotations\n__omp_display = lambda *args, **kwargs: None",
+	);
+	const script = `${prelude}\n${code}`;
+	const proc = Bun.spawn([pythonPath, "-c", script], {
+		stdout: "pipe",
+		stderr: "pipe",
+		env: { ...process.env, ...env },
+	});
+	const [stdout, stderr, exitCode] = await Promise.all([
+		new Response(proc.stdout).text(),
+		new Response(proc.stderr).text(),
+		proc.exited,
+	]);
+	return { stdout, stderr, exitCode };
+}
+
 describe("python prelude", () => {
 	it("exposes read(path, offset?, limit?) with positional optional args", () => {
 		// The eval docs advertise `read(path, offset?=1, limit?=None)`. A
@@ -17,6 +41,54 @@ describe("python prelude", () => {
 		expect(signature).toContain("limit");
 	});
 
+	it("appends line selectors to delegated URI paths", async () => {
+		const requests: unknown[] = [];
+		const server = Bun.serve({
+			hostname: "127.0.0.1",
+			port: 0,
+			fetch: async request => {
+				requests.push(await request.json());
+				return Response.json({
+					ok: true,
+					value: { text: "resource contents", details: { resolvedPath: "/tmp/resource.txt" } },
+				});
+			},
+		});
+
+		try {
+			const result = await runPrelude(
+				[`print(read("artifact://21", 3, 2))`, `print(read("mcp://server/resource", 10, 5))`].join("\n"),
+				{
+					PI_TOOL_BRIDGE_URL: server.url.toString(),
+					PI_TOOL_BRIDGE_TOKEN: "test-token",
+					PI_TOOL_BRIDGE_SESSION: "test-session",
+				},
+			);
+
+			expect(result).toEqual({
+				stdout: "resource contents\nresource contents\n",
+				stderr: "",
+				exitCode: 0,
+			});
+			expect(requests).toEqual([
+				{
+					session: "test-session",
+					run: null,
+					name: "read",
+					args: { path: "artifact://21:3-4" },
+				},
+				{
+					session: "test-session",
+					run: null,
+					name: "read",
+					args: { path: "mcp://server/resource:10-14" },
+				},
+			]);
+		} finally {
+			server.stop(true);
+		}
+	});
+
 	it("exposes isolation artifacts on the agent() handle node", () => {
 		// agent(..., handle=True) is the only escape hatch for
 		// recovering apply=False patch/branch/nested artifacts (the bare

package/src/eval/py/kernel.ts

@@ -23,7 +23,7 @@ import {
 	resolveExplicitPythonRuntime,
 	resolvePythonRuntime,
 } from "./runtime";
-import { hostHasInheritableConsole, shouldHideKernelWindow } from "./spawn-options";
+import { hostHasInheritableConsole, shouldDetachKernel, shouldHideKernelWindow } from "./spawn-options";
 
 export type {
 	KernelExecuteOptions,
@@ -193,6 +193,7 @@ export class PythonKernel extends BaseKernel {
 
 		const proc = Bun.spawn([runtime.pythonPath, "-u", scriptPath], {
 			cwd: options.cwd,
+			detached: shouldDetachKernel(process.platform),
 			env: spawnEnv,
 			stdin: "pipe",
 			stdout: "pipe",