@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-2

package/src/kernels/js/worker-runtime.js

@@ -1,8 +1,7 @@
 // allow: SIZE_OK — private runtime state and installed globals must stay in one worker module.
 import { pathToFileURL } from "node:url";
 import { createCellRequire, createRequire } from "./worker-require.js";
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
+import { createFileHelpers } from "./worker-file-helpers.js";
 import { inspect } from "node:util";
 import { encodeDisplayImage, resolveDisplayOps } from "./display-image.js";
 import { terminateProcessGroups, terminateProcessTrees } from "./process-tree.js";
@@ -24,12 +23,10 @@ const PRELUDE_SOURCE_URL = "senpi:kernel-prelude";
 // How long a child gets to honour SIGTERM before SIGKILL. Short, because the
 // cell has already produced its value and the caller is waiting on settle.
 const CHILD_TERMINATION_GRACE_MS = 1_000;
-const INTERNAL_URL = /^([a-z][a-z0-9+.-]*):\/\/(.*)$/iu;
 
 export class JsWorkerRuntime {
-	#cwd;
 	#parallelPoolWidth;
-	#localRoots;
+	#files;
 	#env = new Map();
 	#hooks = null;
 	#pendingDisplays = [];
@@ -44,12 +41,10 @@ export class JsWorkerRuntime {
 	#tools;
 
 	constructor(options) {
-		this.#cwd = options.cwd;
 		this.#parallelPoolWidth = options.parallelPoolWidth;
 		this.#onChildEvent = typeof options.onChildEvent === "function" ? options.onChildEvent : null;
 		this.#onShellWaitChange = options.onShellWaitChange;
-		this.#localRoots = { ...(options.localRoots ?? {}) };
-		if (options.artifactsDir && !this.#localRoots.local) this.#localRoots.local = join(options.artifactsDir, "local");
+		this.#files = createFileHelpers(options, (event) => this.#emitStatus(event));
 		this.#tools = createKernelToolRegistry({
 			generation: options.kernelGeneration ?? 1,
 			hostToolNames: options.hostToolNames ?? [],
@@ -166,8 +161,8 @@ export class JsWorkerRuntime {
 		globalThis.log = message => this.#hooks?.emit({ type: "log", message: String(message) });
 		globalThis.phase = title => this.#hooks?.emit({ type: "phase", title: String(title) });
 		globalThis.env = (key, value) => this.#envHelper(key, value);
-		globalThis.read = async (path, options, ...rest) => await this.#read(path, helperOptions("read", options, rest));
-		globalThis.write = async (path, content) => await this.#write(path, content);
+		globalThis.read = async (path, options, ...rest) => await this.#files.read(path, helperOptions("read", options, rest));
+		globalThis.write = async (path, content) => await this.#files.write(path, content);
 		globalThis.output = async (...args) => await this.#output(args);
 		globalThis.tool_schema = async name => await this.#toolSchema(name);
 		globalThis.agent = async (prompt, options, ...rest) => await this.#agent(prompt, options, rest);
@@ -297,53 +292,6 @@ export class JsWorkerRuntime {
 		return result;
 	}
 
-	async #read(rawPath, options) {
-		const path = this.#resolvePath(String(rawPath), "read");
-		const info = await stat(path);
-		if (info.isDirectory()) throw new Error(`Directory paths are not supported by read(): ${path}`);
-		let text = await readFile(path, "utf8");
-		const offset = typeof options.offset === "number" ? options.offset : 1;
-		const limit = typeof options.limit === "number" ? options.limit : undefined;
-		if (offset > 1 || limit !== undefined) {
-			const lines = text.split(/\r?\n/u);
-			const start = Math.max(0, offset - 1);
-			text = lines.slice(start, limit === undefined ? undefined : start + limit).join("\n");
-		}
-		this.#emitStatus({ op: "read", path, bytes: info.size, chars: text.length });
-		return text;
-	}
-
-	async #write(rawPath, content) {
-		const path = this.#resolvePath(String(rawPath), "write");
-		const data = await writeData(content);
-		await mkdir(dirname(path), { recursive: true });
-		await writeFile(path, data);
-		this.#emitStatus({ op: "write", path, bytes: typeof data === "string" ? Buffer.byteLength(data) : data.byteLength });
-		return path;
-	}
-
-	#resolvePath(rawPath, operation) {
-		const match = INTERNAL_URL.exec(rawPath);
-		if (!match) return isAbsolute(rawPath) ? normalize(rawPath) : resolve(this.#cwd, rawPath);
-		const scheme = match[1].toLowerCase();
-		const root = this.#localRoots[scheme];
-		if (!root) throw new Error(`Protocol paths are not supported by ${operation}(): ${rawPath}`);
-		let relative;
-		try {
-			relative = decodeURIComponent(match[2].replaceAll("\\", "/"));
-		} catch (error) {
-			if (error instanceof URIError) throw new Error(`Invalid URL encoding in ${scheme}:// path: ${rawPath}`);
-			throw error;
-		}
-		if (isAbsolute(relative) || relative.split("/").includes("..")) {
-			throw new Error(`Path traversal is not allowed in ${scheme}:// URLs: ${rawPath}`);
-		}
-		const rootPath = resolve(root);
-		const path = resolve(rootPath, relative);
-		if (path !== rootPath && !path.startsWith(`${rootPath}${sep}`)) throw new Error(`${scheme}:// path escapes its root`);
-		return path;
-	}
-
 	async #output(args) {
 		let ids = args;
 		let options = {};
@@ -502,14 +450,6 @@ function reservedTool(globalName, helperName) {
 	return value;
 }
 
-async function writeData(value) {
-	if (typeof value === "string" || value instanceof Uint8Array) return value;
-	if (value instanceof Blob) return new Uint8Array(await value.arrayBuffer());
-	if (value instanceof ArrayBuffer) return new Uint8Array(value);
-	if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
-	throw new TypeError("write() expects string, Blob, ArrayBuffer, or TypedArray data");
-}
-
 function chunkToString(chunk, encoding) {
 	if (typeof chunk === "string") return chunk;
 	if (chunk instanceof Uint8Array) return Buffer.from(chunk).toString(encoding ?? "utf8");

package/src/kernels/js/worker-slot.ts

@@ -3,6 +3,7 @@ import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/prot
 import type { WorkerLike } from "./inline-worker.ts";
 import { retireWorker, type WorkerRetirement } from "./interrupt-bounds.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 import type { JavaScriptKernelOptions } from "./local-module-loader.ts";
 import { KernelWebViewClients } from "./webview-host.ts";
 import { WorkerStartupCancelledError } from "./worker-host.ts";
@@ -18,6 +19,7 @@ export interface WorkerSlotListeners {
 export class WorkerSlot {
 	readonly #options: JavaScriptKernelOptions;
 	readonly #listeners: WorkerSlotListeners;
+	readonly #permissions?: KernelPermissionHost;
 	#worker: WorkerLike | null = null;
 	#lastProcessPid: number | undefined;
 	#webViews: KernelWebViewClients | null = null;
@@ -26,9 +28,10 @@ export class WorkerSlot {
 	#ready: Promise<void> | null = null;
 	#startupAbort: AbortController | null = null;
 
-	constructor(options: JavaScriptKernelOptions, listeners: WorkerSlotListeners) {
+	constructor(options: JavaScriptKernelOptions, listeners: WorkerSlotListeners, permissions?: KernelPermissionHost) {
 		this.#options = options;
 		this.#listeners = listeners;
+		this.#permissions = permissions;
 	}
 
 	get mode(): JavaScriptKernelMode {
@@ -65,6 +68,7 @@ export class WorkerSlot {
 			const ready = startWorkerWithInlineFallback(
 				{
 					options: this.#options,
+					permissions: this.#permissions,
 					kernelGeneration: generation,
 					publish: (worker) => this.#publish(worker, generation),
 					isCurrent: (worker) => this.#isCurrent(worker, generation),

package/src/kernels/js/worker-startup.ts

@@ -4,6 +4,7 @@ import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } fro
 import { createInlineWorker, type WorkerLike } from "./inline-worker.ts";
 import { retireWorker } from "./interrupt-bounds.ts";
 import { resolveKernelToolNameSource } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 import { type JavaScriptKernelOptions, localBridgeConnection } from "./local-module-loader.ts";
 import { resolveJsProcessEntryUrl, spawnProcessWorker } from "./process-worker.ts";
 import { spawnNodeWorker, WorkerStartupCancelledError, waitForReady } from "./worker-host.ts";
@@ -35,6 +36,7 @@ export class ProcessKernelStartupTimeoutError extends Error {
 export interface WorkerStartupHooks {
 	readonly options: JavaScriptKernelOptions;
 	readonly kernelGeneration: number;
+	readonly permissions?: KernelPermissionHost;
 	/** Wires the worker into the kernel; throws `WorkerStartupCancelledError` once the generation is stale. */
 	publish(worker: WorkerLike): void;
 	isCurrent(worker: WorkerLike): boolean;
@@ -43,7 +45,7 @@ export interface WorkerStartupHooks {
 }
 
 export async function startWorkerWithInlineFallback(hooks: WorkerStartupHooks, signal: AbortSignal): Promise<void> {
-	let worker = spawnWorker(hooks.options);
+	let worker = spawnWorker(hooks.options, hooks.permissions);
 	hooks.publish(worker);
 	try {
 		await initializeWorker(worker, hooks, signal);
@@ -65,12 +67,12 @@ export async function startWorkerWithInlineFallback(hooks: WorkerStartupHooks, s
 		await worker.terminate();
 	}
 	if (!hooks.canFallBackInline()) throw new WorkerStartupCancelledError();
-	worker = createInlineWorker(hooks.options.cwd, hooks.options.parallelPoolWidth);
+	worker = createInlineWorker(hooks.options.cwd, hooks.options.parallelPoolWidth, hooks.permissions);
 	hooks.publish(worker);
 	await initializeWorker(worker, hooks, signal);
 }
 
-function spawnWorker(options: JavaScriptKernelOptions): WorkerLike {
+function spawnWorker(options: JavaScriptKernelOptions, permissions?: KernelPermissionHost): WorkerLike {
 	if (options.isolation === "process") {
 		const url = resolveJsProcessEntryUrl();
 		return spawnProcessWorker(url, {
@@ -82,10 +84,10 @@ function spawnWorker(options: JavaScriptKernelOptions): WorkerLike {
 	}
 	try {
 		const url = options.workerEntryUrl ?? resolveJsWorkerEntryUrl();
-		return spawnNodeWorker(url, options.cwd, options.parallelPoolWidth);
+		return spawnNodeWorker(url, options.cwd, options.parallelPoolWidth, "worker", permissions);
 	} catch (error) {
 		if (!(error instanceof Error)) throw error;
-		return createInlineWorker(options.cwd, options.parallelPoolWidth);
+		return createInlineWorker(options.cwd, options.parallelPoolWidth, permissions);
 	}
 }
 

package/src/kernels/js/worker-webview.js

@@ -1,10 +1,11 @@
 import { onCellRelease } from "./cell-run-context.js";
 import { DELIVER_EVENT, WebViewPortClient, webViewError } from "./worker-webview-client.js";
 
-// Bun constructs "chrome"-backend WebViews only on the process main thread, and this kernel runs in
-// a worker where `globalThis.Bun` and `Bun.WebView` are non-writable. Cells therefore run with a
-// `Bun` parameter bound to a stand-in whose `WebView` forwards Chrome-backed views to the
-// main-thread service over a private port; every other `Bun.*` member is the real one.
+// Bun's WebViews are only safe on the process main thread (Chrome is constructed nowhere else, and
+// the WebKit host client is bound to one thread), and this kernel runs in a worker where
+// `globalThis.Bun` and `Bun.WebView` are non-writable. Cells therefore run with a `Bun` parameter
+// bound to a stand-in whose `WebView` forwards every view to the main-thread service over a private
+// port; every other `Bun.*` member is the real one.
 const KERNEL_BUN = Symbol.for("senpi.kernel.bun");
 const KERNEL_PROCESS_MODE = Symbol.for("senpi.kernel.processMode");
 
@@ -27,7 +28,8 @@ function shadowBun(real, WebView) {
 	return new Proxy(
 		{},
 		{
-			get: (_target, key) => (key === "WebView" ? WebView : Reflect.get(real, key)),
+			get: (_target, key) => key === "WebView" ? WebView
+				: key === "plugin" ? globalThis[Symbol.for("senpi.kernel.permissionBunPlugin")] ?? real.plugin : Reflect.get(real, key),
 			set: (_target, key, value) => Reflect.set(real, key, value),
 			has: (_target, key) => key === "WebView" || Reflect.has(real, key),
 			ownKeys: () => Reflect.ownKeys(real),
@@ -40,14 +42,13 @@ function shadowBun(real, WebView) {
 	);
 }
 
-// The macOS default (WebKit) stays a native worker view: its host process serves any thread.
-// A process-mode kernel already runs its cells on the child's main thread, so the native
-// WebView constructs there directly and no MessagePort proxy is ever needed.
-function needsMainThread(options) {
-	if (globalThis[KERNEL_PROCESS_MODE]) return false;
-	const backend = options?.backend;
-	if (backend === undefined) return process.platform !== "darwin";
-	return backend === "chrome" || (typeof backend === "object" && backend !== null && backend.type === "chrome");
+// Every backend goes to the main thread, WebKit included (senpi#4794): Bun's WebKit host client is
+// one per process, bound to the thread that first spawned it, and it settles every view's replies
+// in that thread's heap. A second kernel worker's views then corrupt the process heap, and once the
+// binding worker exits no later view can spawn the host. A process-mode kernel already runs its
+// cells on the child's main thread, so the native WebView constructs there directly.
+function needsMainThread() {
+	return !globalThis[KERNEL_PROCESS_MODE];
 }
 
 function closedError(method) {
@@ -96,7 +97,7 @@ function createKernelWebView(NativeWebView, requestPort) {
 		onNavigationFailed = null;
 
 		constructor(options = {}) {
-			if (!needsMainThread(options)) {
+			if (!needsMainThread()) {
 				const view = new NativeWebView(options);
 				const ref = new WeakRef(view);
 				natives.add(ref);
@@ -141,8 +142,8 @@ function createKernelWebView(NativeWebView, requestPort) {
 		scroll(dx, dy) { return this.#call("scroll", [dx, dy]); }
 		scrollTo(...args) { return this.#call("scrollTo", args); }
 		resize(width, height) { return this.#call("resize", [width, height]); }
-		back() { return this.#call("back", []); }
-		forward() { return this.#call("forward", []); }
+		goBack() { return this.#call("goBack", []); }
+		goForward() { return this.#call("goForward", []); }
 		reload() { return this.#call("reload", []); }
 		cdp(...args) { return this.#call("cdp", args); }