@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-2

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## [2026.10.30-2] - 2026-10-30
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+- Group-signal notices ignore inert quoted text and shell comments without hiding commands inside executable substitutions ([#3019](https://github.com/code-yeongyu/senpi/issues/3019)).
+- Keep held permission decisions parked until their two-second deadline when the host claims the shared slot before the worker waits (#4709).
+
+### Removed
+
+## [2026.10.30-1] - 2026-10-30
+
+### Breaking Changes
+
+### Added
+
+- Added the host-decider core for JS eval permission checks on `child_process.spawnSync`, `Bun.spawnSync`, and `fs.writeFileSync`, with per-invocation authority, bounded shared-memory checks, instrumented Workers and fail-closed revocation. Permission-extension integration and broader API coverage follow separately ([#4387](https://github.com/code-yeongyu/senpi/pull/4387)).
+- No-deny async continuations and Workers remain usable across cells, including after a cell times out or is interrupted. Worker data, messages, transferred MessagePorts and lifecycle events are preserved; a Worker message the host cannot forward arrives as `messageerror`; and interrupted permission checks release their shared slots.
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Refuse cross-session JavaScript and Python kernel tools before their bodies run when either session enforces a deny rule, and mint invoker-scoped JS tokens when neither enforces ([#4390](https://github.com/code-yeongyu/senpi/pull/4390), part of #4309).
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Extend eval permission checks across JS filesystem, process, Bun resource, and SQLite APIs, including descriptor grants and relative/absolute module imports ([#4391](https://github.com/code-yeongyu/senpi/pull/4391)).
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Known limitation: in natively loaded dependencies, Bun.plugin registration and non-literal eval are not refused (Bun 1.4.4 makes Bun.plugin immutable); code loaded that way still runs under the enforced spawn and write checks; tracked in #4380.
+- Known limitation: file reads through Bun.fetch on file: URLs (immutable in Bun 1.4.4) and native consumers of a handle obtained that way. Writes through such a handle are refused at each enumerated write sink: filesystem operations, Bun.write destinations and parts, BunFile write/writer/delete/unlink, and every Bun.spawn/Bun.spawnSync redirect, meaning the stdout/stderr keys and each stdio[] slot, including descriptors at index 3 and above. Every one of those sinks is a row in the operation sink table and the mutation driver, so a sink that is not listed there is not proven.
+- Eval cells now send the path they execute in addition to the path as written, together with its canonical form, so permission rules for `read`, `edit`, `list` and `grep` paths apply to the same file under every spelling that resolves to it; a module's own imports and top-level file access are decided under the importing cell's authority instead of being refused as unavailable ([#4391](https://github.com/code-yeongyu/senpi/pull/4391)).
+- Known limitation: path rules do not follow hard links; tracked in #4576.
+- Enforce host-supplied deny decisions inside Python eval cells and callbacks, including file modes, descriptor grants, process APIs, SQLite, module sources, and package resources; refuse Ruby and Julia cells while enforcement is active ([#4392](https://github.com/code-yeongyu/senpi/pull/4392), part of #4309).
+- Revoke Python invocation authority immediately and wait for observed interpreter retirement before admitting a replacement ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Keep Python permission checks intact after stdlib rebinding, guard native aliases and direct extension entry points, and preserve cross-cell background I/O when no deny applies ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Leave the interpreter's own import registries in place while guarding them, so C-level imports such as `pickle`, `datetime.strptime` and `xml.etree.ElementTree` keep working inside Python cells ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Python eval cells now send the path they execute in addition to the path as written, so permission rules for `read`, `edit`, `list` and `grep` paths apply to the same file under every spelling a Python cell resolves to it, including relative spellings after `os.chdir`; a path spelling that is not valid UTF-8 is refused as uncheckable ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Python eval cells supply the same versioned native path identity as JavaScript cells, preserving identity-based decisions when the host resolver is unavailable; inputs without an exact local representation retain host fallback ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+
+### Changed
+
+### Fixed
+
+- On macOS, eval cells that open a `Bun.WebView` no longer crash the process (SIGSEGV) when another kernel uses one too, WebViews keep working after a kernel reset, and `goBack()`/`goForward()` work on every eval-cell view ([#4797](https://github.com/code-yeongyu/senpi/pull/4797))
+- The Python eval kernel starts again on interpreters built without `ctypes`: it then sends no canonical path form, and the host decides as it does for any request without one ([#4895](https://github.com/code-yeongyu/senpi/pull/4895), fixes #4894).
+
+### Removed
+
 ## [2026.10.27-2] - 2026-10-27
 
 ### Breaking Changes

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.27-2",
+	"version": "2026.10.30-2",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -33,15 +33,15 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.27-2",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.30-2",
 		"quickjs-wasi": "3.6.2",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.27-2"
+		"@code-yeongyu/senpi": "2026.10.30-2"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.27-2"
+		"@code-yeongyu/senpi": "2026.10.30-2"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/http-server.ts

@@ -1,6 +1,7 @@
 import { once } from "node:events";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import type { AddressInfo, Socket } from "node:net";
+import { permissionCheck } from "./permission-check.ts";
 import { type BridgeError, generateBridgeToken, verifyBridgeToken } from "./protocol.ts";
 
 const DEFAULT_BODY_LIMIT_BYTES = 1024 * 1024;
@@ -42,7 +43,7 @@ export interface BridgeServerHandle {
 }
 
 type JsonReply = { ok: true; value: unknown } | { ok: false; error: BridgeError };
-type Route = "/call" | "/emit" | "/completion";
+type Route = "/call" | "/emit" | "/completion" | "/permission_check";
 
 export async function startBridgeServer(options: BridgeServerOptions): Promise<BridgeServerHandle> {
 	const token = options.token ?? generateBridgeToken();
@@ -94,7 +95,7 @@ async function handleRequest(
 		return;
 	}
 	const auth = parseBearerToken(request.headers.authorization);
-	if (!auth || !verifyBridgeToken(token, auth).ok) {
+	if (route !== "/permission_check" && (!auth || !verifyBridgeToken(token, auth).ok)) {
 		sendJson(response, 401, { ok: false, error: transportError("unauthorized", "Bridge authorization failed") });
 		return;
 	}
@@ -104,6 +105,14 @@ async function handleRequest(
 		sendJson(response, parsed.status, { ok: false, error: transportError(parsed.code, parsed.message) });
 		return;
 	}
+	if (route === "/permission_check") {
+		try {
+			sendJson(response, 200, { ok: true, value: await permissionCheck(parsed.value) });
+		} catch (error) {
+			sendJson(response, 200, { ok: false, error: bridgeError(error) });
+		}
+		return;
+	}
 
 	if (route === "/emit") {
 		const event = parseEmitEvent(parsed.value);
@@ -209,7 +218,7 @@ function parseEmitEvent(value: unknown): { ok: true; event: BridgeHttpEmitEvent
 
 function routeFromUrl(rawUrl: string): Route | undefined {
 	const path = new URL(rawUrl, "http://127.0.0.1").pathname;
-	if (path === "/call" || path === "/emit" || path === "/completion") return path;
+	if (path === "/call" || path === "/emit" || path === "/completion" || path === "/permission_check") return path;
 	return undefined;
 }
 
@@ -221,8 +230,12 @@ function parseBearerToken(header: string | undefined): string | undefined {
 
 function sendJson(response: ServerResponse, status: number, body: JsonReply): void {
 	if (response.destroyed) return;
-	response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
-	response.end(JSON.stringify(body));
+	const encoded = JSON.stringify(body);
+	response.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"content-length": Buffer.byteLength(encoded),
+	});
+	response.end(encoded);
 }
 
 function bridgeError(error: unknown): BridgeError {

package/src/bridge/permission-check.ts

@@ -0,0 +1,76 @@
+import type { CellDecision, CellOperation } from "../kernels/js/permission-slots.mjs";
+
+const checks = new Map<string, (call: CellOperation) => Promise<CellDecision>>();
+
+/** Only the host registers invocation capabilities. The ordinary bridge bearer is not one. */
+export function registerPermissionCheck(
+	token: string,
+	check: (call: CellOperation) => Promise<CellDecision>,
+): () => void {
+	checks.set(token, check);
+	return () => checks.delete(token);
+}
+
+export async function permissionCheck(body: unknown): Promise<unknown> {
+	if (
+		typeof body !== "object" ||
+		body === null ||
+		!("token" in body) ||
+		typeof body.token !== "string" ||
+		!("nonce" in body) ||
+		typeof body.nonce !== "string" ||
+		!("call" in body)
+	) {
+		throw new Error("Invalid permission request");
+	}
+	const call = body.call;
+	if (
+		typeof call !== "object" ||
+		call === null ||
+		!("tool" in call) ||
+		!("input" in call) ||
+		typeof call.input !== "object" ||
+		call.input === null
+	)
+		throw new Error("Invalid permission operation");
+	if (call.tool !== "bash" && call.tool !== "write" && call.tool !== "read" && call.tool !== "ls")
+		throw new Error("Invalid permission tool");
+	const input = call.input;
+	if (
+		call.tool === "bash"
+			? !("command" in input && typeof input.command === "string")
+			: !("path" in input && typeof input.path === "string")
+	)
+		throw new Error("Invalid permission input");
+	if ("cwd" in call && typeof call.cwd !== "string") throw new Error("Invalid execution cwd");
+	const check = checks.get(body.token);
+	if (!check) throw new Error("Permission authority unavailable");
+	const canonical = "canonical" in input ? input.canonical : undefined;
+	const validCanonical =
+		typeof canonical === "object" &&
+		canonical !== null &&
+		"v" in canonical &&
+		typeof canonical.v === "number" &&
+		"path" in canonical &&
+		typeof canonical.path === "string" &&
+		"foldCase" in canonical &&
+		typeof canonical.foldCase === "boolean"
+			? { v: canonical.v, path: canonical.path, foldCase: canonical.foldCase }
+			: undefined;
+	const operation: CellOperation = {
+		tool: call.tool,
+		input: {
+			...("command" in input && typeof input.command === "string" ? { command: input.command } : {}),
+			...("path" in input && typeof input.path === "string" ? { path: input.path } : {}),
+			...("executedPath" in input && typeof input.executedPath === "string"
+				? { executedPath: input.executedPath }
+				: {}),
+			...(validCanonical === undefined ? {} : { canonical: validCanonical }),
+			...("unresolvable" in input && typeof input.unresolvable === "string"
+				? { unresolvable: input.unresolvable }
+				: {}),
+		},
+		...("cwd" in call && typeof call.cwd === "string" ? { cwd: call.cwd } : {}),
+	};
+	return { nonce: body.nonce, decision: await check(operation) };
+}

package/src/bridge/protocol.ts

@@ -16,6 +16,13 @@ const bridgeErrorSchema = Type.Object({
 	message: Type.String(),
 	stack: Type.Optional(Type.String()),
 	code: Type.Optional(Type.String()),
+	permissionRule: Type.Optional(
+		Type.Object({
+			permission: Type.String(),
+			pattern: Type.String(),
+			layer: Type.String(),
+		}),
+	),
 });
 
 const statusEventSchema = Type.Object({ op: Type.String() }, { additionalProperties: true });

package/src/kernels/jl/kernel.ts

@@ -2,11 +2,13 @@ import { join } from "node:path";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { SessionEnvironment } from "../session-env.ts";
 import type { KernelLifecycle } from "../shared/kernel-death.ts";
+import type { InvocationPermissions } from "../shared/invocation-authority.ts";
 import { readProcessGroupCpuTime } from "../shared/process-group-cpu.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { SubprocessKernel, type SubprocessKernelMemory, type SubprocessSpawn } from "../shared/subprocess-kernel.ts";
 
 export interface JuliaKernelStartOptions extends KernelLifecycle {
+	readonly permissions?: InvocationPermissions;
 	readonly cwd: string;
 	readonly sessionId: string;
 	readonly connection: BridgeConnectionConfig;
@@ -55,6 +57,7 @@ export class JuliaKernel extends SubprocessKernel {
 			onMessage: options.onMessage,
 			memory: options.memory && { language: "jl", ...options.memory },
 			onDeath: options.onDeath,
+			permissions: options.permissions,
 			startup: { label: "Julia", readGroupCpuTime: readProcessGroupCpuTime },
 		});
 	}

package/src/kernels/js/context-manager.ts

@@ -28,6 +28,9 @@ import { ToolCallQueue } from "./tool-call-queue.ts";
 import { WorkerChildren } from "./worker-children.ts";
 import { WorkerRecovery } from "./worker-recovery.ts";
 import { WorkerSlot } from "./worker-slot.ts";
+import { KernelPermissionHost } from "./permission-host.ts";
+
+export { revokeSessionKernels } from "./permission-host.ts";
 
 export { JavaScriptKernelClosedError, type JavaScriptKernelMode, type JavaScriptRunInput } from "./kernel-contract.ts";
 export type { JavaScriptMemoryReading } from "./kernel-memory-bridge.ts";
@@ -47,6 +50,7 @@ export class JavaScriptKernel {
 	readonly #options: JavaScriptKernelOptions;
 	readonly #moduleLoader: LocalModuleLoader;
 	readonly #slot: WorkerSlot;
+	readonly #permissions: KernelPermissionHost;
 	#lifecycle: LifecycleState = "open";
 	#activation: Promise<void> | null = null;
 	#closePromise: Promise<void> | null = null;
@@ -54,6 +58,7 @@ export class JavaScriptKernel {
 	readonly #kernelTools = new KernelToolHostPump(
 		(message) => this.#slot.postMessage(message),
 		() => this.#lifecycle === "open" && this.#slot.present,
+		(request, options) => this.#permissions.invocation(request, options),
 	);
 	readonly #toolCalls = new ToolCallQueue();
 	readonly #children: WorkerChildren;
@@ -68,6 +73,10 @@ export class JavaScriptKernel {
 
 	constructor(options: JavaScriptKernelOptions) {
 		this.#options = options;
+		this.#permissions = new KernelPermissionHost(options, async () => {
+			this.#runs.settleAll("Permission rules changed; kernel revoked");
+			return await this.#terminate();
+		});
 		this.#activeCell = new ActiveCellControl({
 			runs: this.#runs,
 			bounds: options.interruptBounds ?? DEFAULT_INTERRUPT_BOUNDS,
@@ -79,11 +88,15 @@ export class JavaScriptKernel {
 		this.#memory = new JavaScriptKernelMemory(options, () => this.#slot.processPid);
 		this.#children = new WorkerChildren(options.collectOrphanedChildren);
 		this.#moduleLoader = new LocalModuleLoader(options);
-		this.#slot = new WorkerSlot(options, {
-			isOpen: () => this.#lifecycle === "open",
-			onMessage: (message) => this.#handleMessage(message),
-			onCrash: (error) => this.#handleCrash(error),
-		});
+		this.#slot = new WorkerSlot(
+			options,
+			{
+				isOpen: () => this.#lifecycle === "open",
+				onMessage: (message) => this.#handleMessage(message),
+				onCrash: (error) => this.#handleCrash(error),
+			},
+			this.#permissions,
+		);
 	}
 
 	get mode(): JavaScriptKernelMode {
@@ -114,15 +127,17 @@ export class JavaScriptKernel {
 		return this.#kernelTools.describe(names);
 	}
 
-	invokeKernelTool(
+	async invokeKernelTool(
 		request: KernelToolsInvokeRequest,
 		options?: AbortSignal | KernelToolsInvokeOptions,
 	): Promise<unknown> {
-		return this.#kernelTools.invoke(request, options);
+		await this.#permissions.admit();
+		return await this.#kernelTools.invoke(request, options);
 	}
 
 	async run(input: JavaScriptRunInput): Promise<ResultMessage> {
 		assertJavaScriptKernelOpen(this.#lifecycle, "run");
+		this.#permissions.assertSessionLive();
 		const promise = this.#runs.enqueue(input);
 		this.#activate();
 		return await promise;
@@ -189,6 +204,7 @@ export class JavaScriptKernel {
 			if (recovery) await recovery;
 			await this.#terminate();
 		})().finally(() => {
+			this.#permissions.dispose();
 			this.#lifecycle = "closed";
 		});
 		this.#closePromise = closePromise;
@@ -206,6 +222,7 @@ export class JavaScriptKernel {
 	}
 
 	async #ensureReady(): Promise<void> {
+		await this.#permissions.admit();
 		assertJavaScriptKernelOpen(this.#lifecycle, "run");
 		try {
 			await this.#slot.ensureReady();
@@ -217,7 +234,7 @@ export class JavaScriptKernel {
 	}
 
 	#startNext(): void {
-		if (this.#lifecycle !== "open" || this.#runs.active || !this.#slot.present) return;
+		if (this.#permissions.blocked || this.#lifecycle !== "open" || this.#runs.active || !this.#slot.present) return;
 		const next = this.#runs.startNext(performance.now());
 		if (!next) return;
 		const dispatch = dispatchCell(next.input, this.#moduleLoader, this.#options);
@@ -254,6 +271,7 @@ export class JavaScriptKernel {
 	}
 
 	#handleCrash(error: Error): void {
+		if (this.#permissions.blocked) return;
 		const active = this.#runs.active;
 		if (!active && this.#slot.startingUp) return;
 		this.#activeCell.disarm();

package/src/kernels/js/group-signal-notice.js

@@ -26,10 +26,286 @@ const PKILL_GROUP = new RegExp(String.raw`${COMMAND_POSITION}pkill\b[^\n;|&]*\s(
 // can include the agent's own (bun, node, senpi). Inside an `echo` string it is only text.
 const KILLALL = new RegExp(String.raw`${COMMAND_POSITION}killall\s`, "mu");
 
+// senpi#3019: a keyword inside quoted text is not a command position, so the scan runs on a copy whose inert text is
+// blanked: single-quoted strings, comments, and the literal parts of double-quoted strings and heredoc bodies (all of a
+// body whose delimiter is quoted). A command substitution, `$(...)` or a backtick pair, runs even inside double quotes
+// and unquoted heredoc bodies, so it keeps its text, as a `-c` script does; both are command lines, with their own inert
+// text blanked in turn. A `<<` whose delimiter line never comes blanks nothing.
+const SCRIPT_FLAG_BEFORE_QUOTE = /(?:^|\s)-[A-Za-z]*c\s+$/u;
+const WORD_END = /[\s;&|<>()]/u;
+const BEFORE_COMMENT = /[\s;&|()]/u;
+const MAX_SCAN_WORK = 262_144;
+const SCAN_LIMIT = Symbol("advisory scan limit");
+
+function scanStep(scan, nesting, work = 1) {
+	scan.remaining -= work;
+	if (scan.remaining < 0 || nesting > 64) throw SCAN_LIMIT;
+}
+
+function blank(text) {
+	return text.replace(/[^\n]/gu, "x");
+}
+
+// For a `$(` or a backtick at `index`: the index of the `)` or backtick that closes it, or -1 when none does. Anything
+// else: undefined.
+function substitutionEnd(text, index, scan, nesting) {
+	if (text[index] === "`") {
+		const end = text.indexOf("`", index + 1);
+		scanStep(scan, nesting, (end === -1 ? text.length : end) - index);
+		return end;
+	}
+	if (text[index] !== "$" || text[index + 1] !== "(") return undefined;
+	let depth = 0;
+	const cases = [];
+	let commandStart = true;
+	for (let at = index + 1; at < text.length; at++) {
+		scanStep(scan, nesting);
+		const char = text[at];
+		const currentCase = cases.at(-1);
+		const atCaseDepth = currentCase?.depth === depth;
+		if (char === "\\") {
+			if (text[at + 1] !== "\n") {
+				if (atCaseDepth && currentCase.header === 2) currentCase.header = 1;
+				if (atCaseDepth && currentCase.pattern) currentCase.patternStarted = true;
+				commandStart = false;
+			}
+			at++;
+		} else if (char === "#" && BEFORE_COMMENT.test(text[at - 1])) {
+			const end = text.indexOf("\n", at);
+			scanStep(scan, nesting, (end === -1 ? text.length : end) - at);
+			if (end === -1) return -1;
+			at = end;
+			commandStart = true;
+		} else if (char === "'" || char === '"' || char === "`") {
+			if (atCaseDepth && currentCase.header === 2) currentCase.header = 1;
+			if (atCaseDepth && currentCase.pattern) currentCase.patternStarted = true;
+			at = closingQuote(text, at, scan, nesting + 1);
+			commandStart = false;
+		} else if (char === "(") {
+			// A case pattern may open with "(", but its mandatory ")" never closes the substitution.
+			if (atCaseDepth && currentCase.pattern && !currentCase.patternStarted) currentCase.patternStarted = true;
+			else depth++;
+			commandStart = !currentCase?.pattern || text[at - 1] === "$";
+		} else if (char === ")") {
+			if (atCaseDepth && currentCase.pattern) {
+				currentCase.pattern = false;
+				commandStart = true;
+				continue;
+			}
+			depth--;
+			if (depth === 0) return at;
+			commandStart = false;
+		} else if (char === ";") {
+			const terminator = text.startsWith(";;&", at) ? 3 : text[at + 1] === ";" || text[at + 1] === "&" ? 2 : 0;
+			if (atCaseDepth && currentCase.header === 0 && !currentCase.pattern && terminator > 0) {
+				currentCase.pattern = true;
+				currentCase.patternStarted = false;
+				at += terminator - 1;
+			}
+			commandStart = true;
+		} else if (char === "\n" || char === "|" || char === "&") {
+			commandStart = true;
+		} else if (!WORD_END.test(char)) {
+			let end = at + 1;
+			while (end < text.length && !WORD_END.test(text[end]) && !["'", '"', "\\", "`"].includes(text[end])) {
+				scanStep(scan, nesting);
+				end++;
+			}
+			const word = text.slice(at, end);
+			if (atCaseDepth && currentCase.header === 2) {
+				currentCase.header = 1;
+				commandStart = false;
+			} else if (atCaseDepth && currentCase.header === 1 && word === "in") {
+				currentCase.header = 0;
+				currentCase.pattern = true;
+				commandStart = false;
+			} else if (atCaseDepth && currentCase.pattern) {
+				if (word === "esac" && !currentCase.patternStarted) cases.pop();
+				else currentCase.patternStarted = true;
+				commandStart = false;
+			} else if (word === "case" && commandStart) {
+				cases.push({ depth, header: 2, pattern: false, patternStarted: false });
+				commandStart = false;
+			} else if (word === "esac" && commandStart && atCaseDepth) {
+				cases.pop();
+				commandStart = false;
+			} else {
+				commandStart = commandStart && /^(?:if|then|do|else|elif|while|until|!|\{)$/u.test(word);
+			}
+			at = end - 1;
+		}
+	}
+	return -1;
+}
+
+// The index of the quote that closes the one at `open`, or the text length. A substitution inside double quotes is a
+// context of its own, so a quote inside it does not close the string.
+function closingQuote(text, open, scan, nesting) {
+	const quote = text[open];
+	let backslashes = 0;
+	if (quote === "'" && text[open - 1] === "$") {
+		for (let at = open - 2; text[at] === "\\"; at--) {
+			scanStep(scan, nesting);
+			backslashes++;
+		}
+	}
+	const ansi = quote === "'" && text[open - 1] === "$" && backslashes % 2 === 0;
+	for (let index = open + 1; index < text.length; index++) {
+		scanStep(scan, nesting);
+		if (text[index] === quote) return index;
+		if (ansi && text[index] === "\\") {
+			index++;
+			continue;
+		}
+		if (quote === "'") continue;
+		const end = substitutionEnd(text, index, scan, nesting + 1);
+		if (end === -1) return text.length;
+		if (end !== undefined) index = end;
+		else if (text[index] === "\\") index++;
+	}
+	return text.length;
+}
+
+function blankLiteralText(text, scan, nesting) {
+	let out = "";
+	let index = 0;
+	while (index < text.length) {
+		scanStep(scan, nesting);
+		const end = substitutionEnd(text, index, scan, nesting + 1);
+		if (end !== undefined && end !== -1) {
+			const open = text[index] === "`" ? 1 : 2;
+			out += text.slice(index, index + open) + blankQuotedText(text.slice(index + open, end), scan, nesting + 1) + text[end];
+			index = end + 1;
+			continue;
+		}
+		const step = text[index] === "\\" ? 2 : 1;
+		out += blank(text.slice(index, index + step));
+		index += step;
+	}
+	return out;
+}
+
+// `<<` or `<<-`, optional blanks, then the delimiter word up to an unquoted blank or operator. Quote removal gives the
+// delimiter, and any quoting in the word leaves the body unexpanded.
+function readHeredoc(text, at, scan, nesting) {
+	let index = at + 2;
+	const stripTabs = text[index] === "-";
+	if (stripTabs) index++;
+	while (text[index] === " " || text[index] === "\t") {
+		scanStep(scan, nesting);
+		index++;
+	}
+	let delimiter = "";
+	let quoted = false;
+	while (index < text.length && !WORD_END.test(text[index])) {
+		scanStep(scan, nesting);
+		const char = text[index];
+		if (char === "'" || char === '"') {
+			const end = text.indexOf(char, index + 1);
+			scanStep(scan, nesting, (end === -1 ? text.length : end) - index);
+			if (end === -1) return undefined;
+			delimiter += text.slice(index + 1, end);
+			quoted = true;
+			index = end + 1;
+		} else if (char === "\\") {
+			delimiter += text[index + 1] ?? "";
+			quoted = true;
+			index += 2;
+		} else {
+			delimiter += char;
+			index++;
+		}
+	}
+	return delimiter ? { delimiter, quoted, stripTabs, end: index } : undefined;
+}
+
+function closingLine(text, from, { delimiter, stripTabs }, scan, nesting) {
+	let start = from;
+	while (start < text.length) {
+		const newline = text.indexOf("\n", start);
+		const end = newline === -1 ? text.length : newline;
+		scanStep(scan, nesting, end - start + 1);
+		const line = text.slice(start, end);
+		if ((stripTabs ? line.replace(/^\t+/u, "") : line) === delimiter) return { start, end };
+		start = end + 1;
+	}
+	return undefined;
+}
+
+function blankQuotedText(text, scan, nesting) {
+	let out = "";
+	const heredocs = [];
+	let index = 0;
+	while (index < text.length) {
+		scanStep(scan, nesting);
+		const char = text[index];
+		if (char === "\\") {
+			out += text.slice(index, index + 2);
+			index += 2;
+			continue;
+		}
+		if (char === "'" || char === '"') {
+			const end = closingQuote(text, index, scan, nesting + 1);
+			const inner = text.slice(index + 1, end);
+			scanStep(scan, nesting, out.length);
+			if (SCRIPT_FLAG_BEFORE_QUOTE.test(out)) out += char + blankQuotedText(inner, scan, nesting + 1);
+			else out += char + (char === "'" ? blank(inner) : blankLiteralText(inner, scan, nesting + 1));
+			if (end < text.length) out += char;
+			index = end + 1;
+			continue;
+		}
+		if (char === "#" && (index === 0 || BEFORE_COMMENT.test(text[index - 1]))) {
+			const newline = text.indexOf("\n", index);
+			const end = newline === -1 ? text.length : newline;
+			scanStep(scan, nesting, end - index);
+			out += blank(text.slice(index, end));
+			index = end;
+			continue;
+		}
+		if (text.startsWith("<<<", index)) {
+			out += "<<<";
+			index += 3;
+			continue;
+		}
+		const heredoc = text.startsWith("<<", index) ? readHeredoc(text, index, scan, nesting) : undefined;
+		if (heredoc) {
+			heredocs.push(heredoc);
+			out += text.slice(index, heredoc.end);
+			index = heredoc.end;
+			continue;
+		}
+		out += char;
+		index++;
+		if (char !== "\n") continue;
+		// Each body starts on the line after its `<<` and ends at a line holding only its delimiter.
+		for (const pending of heredocs.splice(0)) {
+			const close = closingLine(text, index, pending, scan, nesting);
+			if (!close) break;
+			const body = text.slice(index, close.start);
+			out += (pending.quoted ? blank(body) : blankLiteralText(body, scan, nesting + 1)) + text.slice(close.start, close.end);
+			index = close.end;
+			if (text[index] === "\n") {
+				out += "\n";
+				index++;
+			}
+		}
+	}
+	return out;
+}
+
 export const GROUP_SIGNAL_NOTICE_TAG = "[senpi:group-signal]";
 
 export function signalsProcessGroup(commandText) {
-	return KILL_GROUP.test(commandText) || PKILL_GROUP.test(commandText) || KILLALL.test(commandText);
+	// Bound quote masking, but keep a conservative raw-text notice when the scan cannot finish.
+	let text = commandText;
+	if (commandText.length <= MAX_SCAN_WORK) {
+		try {
+			text = blankQuotedText(commandText, { remaining: MAX_SCAN_WORK }, 0);
+		} catch (error) {
+			if (error !== SCAN_LIMIT) throw error;
+		}
+	}
+	return KILL_GROUP.test(text) || PKILL_GROUP.test(text) || KILLALL.test(text);
 }
 
 export function groupSignalNotice(api, readGroup = agentProcessGroup) {