feat(code-execution): remote kernel host — session persistence for docker/ssh/modal (closes #96873)

[teknium1]

Implements #96873 (maintainer-directed): remote terminal backends get the same always-on session-kernel semantics local received in #94647/#96787. The maintainer's framing drove the design: remote never needed anything special — it needed the three things local gets from owning a child process, rebuilt on the run-to-completion env.execute() primitive.

Design (tools/code_kernel_remote.py, ~450 lines)

1. Process that outlives one env.execute(): kernel runner started detached (nohup … & echo PID:$!), PID recorded; every later cell probes kill -0 first. Runner self-reaps after kernel_idle_timeout of silence (no host-side reaper thread needed for a process we don't own).
2. Cell protocol over files: cells/cell_req_NNNNNN.json → cells/cell_res_NNNNNN.json (atomic tmp+rename both directions), sibling to the existing tool-RPC file protocol which is reused unchanged. The host-side _rpc_poll_loop is armed per cell with the calling thread's context — the remote analogue of local's CellAuthority (per-cell tool authority; stale rpc req/res files swept before each cell).
3. Death detection, never a hang: every wait is bounded by the cell timeout; a failed liveness probe (ssh drop, container restart, OOM, idle self-exit) reads as kernel died: state lost, reported in kernel.note, fresh respawn. Cell timeout = kill kernel + report state loss (same contract as local).

Same invariants as local: owner resolution imported from tools.code_kernel._resolve_owner — one resolver, so the ::child::{id} delegated-child qualifier (the #94647 review fix) cannot drift; same generated tool stubs; same output pipeline (truncation → ANSI strip → secret redaction). reset=true honored. Session-close disposal wired into the same clear_session hook as local kernels.

Fail-open: spawn failure (can't fork, no nohup, read-only tmp) falls back to the untouched per-call path with a log note — a degraded remote host never blocks execution. Hosts that can't sustain a background process keep exactly today's behavior.

Verification

Live E2E on real detached processes (contract-faithful env harness: every env.execute() is a real bash run-to-completion subprocess; real nohup, real files, real kill — only the network hop is absent). All six probes green:

• state persists across cells (reused: true) · exception keeps kernel alive · reset=true wipes
• kill the kernel between cells → next call: state_lost: true, fresh kernel, no hang
• delegated-child isolation on remote: parent-planted global → child sees ISOLATED
• cell timeout → kernel killed, loss reported, next call respawns clean

Unit tests (9, CI-runnable, no bash needed): scripted contract-fake env pins spawn parsing, single-spawn reuse, fail-open on no-PID, reset respawn, death detection + state_lost note, timeout kill, child/sibling owner isolation, owner-scoped disposal, and both _execute_remote dispatch branches (kernel-result and fall-open-to-per-call).

Existing suites: 86 passed; 1 pre-existing failure (TestRpcTokenAuthorization, predates this branch). One existing remote test updated from index-pinned to search-based command assertions (the kernel attempt now precedes the per-call commands).

Refs: #94647 (kernel machinery + isolation fix), #96787 (always-on + corrected remote framing), #88637 (@z80dev — lifecycle model).

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 89d1dfc — feat(code-execution): remote kernel host — session persisten}

⚠️ Warnings

OSV vulnerability scan · View job

6 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 3m45s vs 3m57s (-5.1%). 5 job(s) slower, 7 faster,

• Python tests / Run tests: -27.0s
• OS-specific tests / macOS-only tests: -26.0s
• OS-specific tests / Windows-only tests: -16.0s
• Detect affected areas: +13.0s
• Check contributors / check-attribution: +10.0s