@code-yeongyu/senpi-codemode 2026.10.9 → 2026.10.10-11

package/src/kernels/js/windows-tree-kill.js

@@ -0,0 +1,100 @@
+import { execFile } from "node:child_process";
+
+// Plain JS (with windows-tree-kill.d.ts) because the worker runtime imports it. `taskkill /T`
+// adopts every process whose recorded ParentProcessId equals the root's pid, and Windows never rewrites that
+// field when a parent exits and reuses pids (senpi#2999). The tree is computed from one process listing instead: a process
+// belongs to it only when it started at or after the parent it names, and each pid is killed by name.
+
+const LISTING_TIMEOUT_MS = 5_000;
+const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+
+const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
+$created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
+"{0} {1} {2} {3}" -f $_.ProcessId, $_.ParentProcessId, $created, $_.Name }`;
+
+const PROTECTED_IMAGES = new Set([
+	"system",
+	"smss.exe",
+	"csrss.exe",
+	"wininit.exe",
+	"winlogon.exe",
+	"services.exe",
+	"lsass.exe",
+	"lsaiso.exe",
+	"svchost.exe",
+]);
+
+export function parseWindowsRows(stdout) {
+	const rows = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const [pidText, parentText, createdText, ...nameParts] = line.trim().split(/\s+/u);
+		const pid = Number(pidText);
+		const parentPid = Number(parentText);
+		if (!Number.isInteger(pid) || pid <= 0 || !Number.isInteger(parentPid) || !/^\d+$/u.test(createdText ?? "")) continue;
+		rows.push({ pid, parentPid, createdAt: BigInt(createdText ?? "0"), name: nameParts.join(" ") });
+	}
+	return rows;
+}
+
+/** The root and its genuine descendants; any protected image or ancestor of `selfPid` in it shrinks the kill to the root. */
+export function windowsTreeKillPids(rows, rootPid, selfPid) {
+	const byPid = new Map(rows.map((row) => [row.pid, row]));
+	if (!byPid.has(rootPid)) return [];
+	const tree = new Set([rootPid]);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		for (const row of rows) {
+			if (tree.has(row.pid) || !tree.has(row.parentPid)) continue;
+			const parent = byPid.get(row.parentPid);
+			if (parent === undefined || row.createdAt < parent.createdAt) continue;
+			tree.add(row.pid);
+			grew = true;
+		}
+	}
+	const ancestors = new Set([selfPid]);
+	for (let current = byPid.get(selfPid); current !== undefined; ) {
+		const parent = byPid.get(current.parentPid);
+		if (parent === undefined || ancestors.has(parent.pid) || parent.createdAt > current.createdAt) break;
+		ancestors.add(parent.pid);
+		current = parent;
+	}
+	const refused = [...tree].some((pid) => PROTECTED_IMAGES.has((byPid.get(pid)?.name ?? "").toLowerCase()) || ancestors.has(pid));
+	if (!refused) return [...tree];
+	const rootRefused = PROTECTED_IMAGES.has(byPid.get(rootPid).name.toLowerCase()) || ancestors.has(rootPid);
+	return rootRefused ? [] : [rootPid];
+}
+
+/** `taskkill` arguments: the checked tree pid by pid, or `/T` on the root when no listing could be read. */
+export function windowsTreeKillArgs(rootPid, rows, selfPid = process.pid) {
+	if (rows === undefined) return ["/F", "/T", "/PID", String(rootPid)];
+	const pids = windowsTreeKillPids(rows, rootPid, selfPid);
+	if (pids.length === 0) return [];
+	return ["/F", ...pids.flatMap((pid) => ["/PID", String(pid)])];
+}
+
+export function listWindowsRows() {
+	return new Promise((resolve) => {
+		execFile(
+			"powershell.exe",
+			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
+			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
+			(error, stdout) => {
+				const rows = error ? [] : parseWindowsRows(String(stdout ?? ""));
+				resolve(rows.length > 0 ? rows : undefined);
+			},
+		);
+	});
+}
+
+/**
+ * Kills the checked process tree rooted at `pid`; resolves once taskkill has run (or nothing needed killing).
+ * A batch passes one shared `listing` so every tree is planned from the same snapshot.
+ */
+export async function killWindowsTree(pid, listing = listWindowsRows()) {
+	const args = windowsTreeKillArgs(pid, await listing);
+	if (args.length === 0) return;
+	await new Promise((resolve) => {
+		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+	});
+}

package/src/kernels/js/worker-core.js

@@ -1,9 +1,13 @@
+import { installCellOwnership } from "./cell-ownership.js";
+import { releaseCell, releasedCellError, runInCell } from "./cell-run-context.js";
 import { kernelToolCallContext } from "./kernel-tools-context.js";
 import { kernelToolError } from "./kernel-tools-errors.js";
 import { createKernelToolPump } from "./kernel-tools-pump.js";
 import { hostDeniedError, hostToolRefusal } from "./kernel-tools-scope.js";
 import { installSessionCwd } from "./worker-cwd.js";
+import { installPackageResolver } from "./worker-package-resolve.js";
 import { createHeapProbe } from "./worker-heap.js";
+import { createRejectionReports } from "./rejection-reports.js";
 import { createWorkerMemory } from "./worker-memory.js";
 import { JsWorkerRuntime } from "./worker-runtime.js";
 import { installKernelWebView } from "./worker-webview.js";
@@ -28,10 +32,17 @@ const SESSION_ENVIRONMENT_KEYS = [
 ];
 
 export function createWorkerCore(transport, options) {
+	const restoreOwnership = installCellOwnership();
 	let runtime = null;
 	let memory = null;
 	let heapProbe = null;
 	let activeCell = null;
+	const rejections = createRejectionReports({
+		activeCell: () => activeCell,
+		emitText: (data) => emit({ type: "text", stream: "stderr", data }),
+	});
+	const reportRejection = (reason) => rejections.report(reason);
+	process.on("unhandledRejection", reportRejection);
 	const pendingTools = new Map();
 	const pendingWebViewPorts = new Map();
 	const nestedInvokes = new Map();
@@ -45,23 +56,38 @@ export function createWorkerCore(transport, options) {
 		transport.send(message);
 	}
 
+	function stopProblem(cell, what, error) {
+		const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+		emit({ type: "text", stream: "stderr", data: `Stopping cell ${cell.cellId}: ${what}: ${detail}\n` });
+	}
+
 	async function runCell(message) {
 		if (!runtime) {
 			emit({ type: "result", cellId: message.cellId, ok: false, error: { message: "JS runtime not initialized" }, durationMs: 0 });
 			return;
 		}
 		const startedAtMs = performance.now();
-		activeCell = { cellId: message.cellId, interruption: null };
+		const release = Promise.withResolvers();
+		const cell = { cellId: message.cellId, interruption: null, released: false, release: release.reject };
+		activeCell = cell;
+		rejections.startCell(cell);
 		try {
-			const value = await runtime.run(message.code, message.cellId, {
-				emit,
-				callTool: async (toolName, args) => await callTool(toolName, args),
-			});
+			const run = runInCell(cell, () =>
+				runtime.run(message.code, message.cellId, {
+					emit: (event) => {
+						if (releasedCellError() === undefined) emit(event);
+					},
+					callTool: async (toolName, args) => await callTool(toolName, args),
+				}),
+			);
+			const value = await Promise.race([run, release.promise]);
+			rejections.finishCell(cell);
 			emit({ type: "result", cellId: message.cellId, ok: true, valueRepr: valueRepr(value), durationMs: durationMs(startedAtMs), ...memoryReport() });
 		} catch (error) {
+			rejections.finishCell(cell);
 			emit({ type: "result", cellId: message.cellId, ok: false, error: bridgeError(error), durationMs: durationMs(startedAtMs), ...memoryReport() });
 		} finally {
-			activeCell = null;
+			if (activeCell === cell) activeCell = null;
 		}
 	}
 
@@ -70,6 +96,8 @@ export function createWorkerCore(transport, options) {
 	}
 
 	async function callTool(toolName, args) {
+		const released = releasedCellError();
+		if (released !== undefined) throw released;
 		const nested = kernelToolCallContext.getStore();
 		if (!nested && activeCell?.interruption) throw activeCell.interruption;
 		if (nested?.signal.aborted) throw nested.signal.reason;
@@ -104,6 +132,17 @@ export function createWorkerCore(transport, options) {
 		}
 		kernelTools.abortAll(kernelToolError("kernel_tool_stale", interruption.message));
 		runtime.interrupt();
+		// A free event loop with no Bun.$ wait can let the cell go and keep the VM. A Bun.$ wait keeps the
+		// restart (#2453): the shell cannot be cancelled, so only retiring the worker ends it.
+		if (runtime.shellWaitActive) return;
+		const cell = activeCell;
+		for (const error of releaseCell(cell)) stopProblem(cell, "a resource it opened would not close", error);
+		// The result settles after the cell's children are gone, so the next cell never overlaps them. A failed release
+		// is reported as such, never left to surface as an unhandled rejection blamed on the stopped cell.
+		void runtime
+			.release()
+			.catch((error) => stopProblem(cell, "releasing its work failed", error))
+			.finally(() => cell.release(interruption));
 	}
 
 	function acknowledgeInterrupt() {
@@ -127,8 +166,9 @@ export function createWorkerCore(transport, options) {
 		}
 		if (message.type === "init") {
 			applySessionEnvironment(message.sessionEnv);
-			installSessionCwd(options.cwd);
+			installSessionCwd(options.cwd, options.cwdInstallOptions);
 			installKernelWebView(requestWebViewPort);
+			installPackageResolver();
 			runtime = new JsWorkerRuntime({
 				cwd: options.cwd,
 				parallelPoolWidth: options.parallelPoolWidth,
@@ -137,12 +177,15 @@ export function createWorkerCore(transport, options) {
 				kernelGeneration: message.kernelGeneration ?? 1,
 				hostToolNames: message.hostToolNames ?? [],
 				foreignLanguageNames: message.foreignLanguageNames ?? [],
+				kernelToolsDisabled: message.kernelToolsDisabled === true,
 				onChildEvent: (event) => emit({ type: "status", event: { op: CHILD_LIFECYCLE_OP, ...event } }),
 				onShellWaitChange: () => {
 					if (activeCell?.interruption) acknowledgeInterrupt();
 				},
 			});
-			if (message.memory) {
+			// A process-mode kernel measures its memory host-side as a footprint; the in-heap
+			// worker reading would contradict it, so the child keeps memory collection off.
+			if (message.memory && !options.processModeMemory) {
 				memory = createWorkerMemory(message.memory, (report) => emit({ type: "status", event: { op: MEMORY_COLLECTED_OP, ...report } }));
 				memory.captureBaseline();
 			}
@@ -181,6 +224,8 @@ export function createWorkerCore(transport, options) {
 	return {
 		dispose() {
 			unsubscribe();
+			restoreOwnership();
+			process.off("unhandledRejection", reportRejection);
 			globalThis.__senpi_restore_console__?.();
 		},
 	};

package/src/kernels/js/worker-cwd.js

@@ -51,9 +51,13 @@ const FS_PATH_ARGS = {
 
 const CHILD_PROCESS_FILE_ARGS = ["spawn", "spawnSync", "execFile", "execFileSync", "fork"];
 const CHILD_PROCESS_COMMAND_ARGS = ["exec", "execSync"];
+const ASYNC_GROUP_SPAWNERS = new Set(["spawn", "fork"]);
 
-export function installSessionCwd(cwd) {
-	if (isMainThread) throw new Error("installSessionCwd must only run inside a kernel worker thread");
+export function installSessionCwd(cwd, options) {
+	// A process-mode kernel child IS the main thread; the worker guard relaxes only for that entry.
+	if (isMainThread && options?.allowMainThread !== true) {
+		throw new Error("installSessionCwd must only run inside a kernel worker thread");
+	}
 	const root = resolve(cwd);
 	const rootBytes = Buffer.from(root.endsWith(sep) ? root : `${root}${sep}`);
 	// fs also takes Buffer/Uint8Array paths; a relative one gets the session root prepended as bytes,
@@ -92,7 +96,9 @@ function patchFs(fs, promises, at, root) {
 function patchChildProcess(childProcess, at, root) {
 	for (const name of CHILD_PROCESS_FILE_ARGS) {
 		replace(childProcess, name, (fn) => {
-			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root);
+			// Only asynchronous spawners start a new group: a synchronous call keeps the terminal (ssh/sudo/git prompts),
+			// and Bun ignores `detached` for execFile. Those calls get a notice instead (group-signal-notice.js).
+			const withCwd = withOptionsCwd(fn, fileOptionsIndex, root, ASYNC_GROUP_SPAWNERS.has(name));
 			return name === "fork" ? resolvingArgs(withCwd, [0], at) : withCwd;
 		});
 	}
@@ -104,7 +110,7 @@ function patchBun(bun, at, root) {
 	replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
 	replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
 	replace(bun, "spawn", (fn) => withBunSpawnCwd(fn, root));
-	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root));
+	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root, false));
 	if (typeof bun.$?.cwd === "function") bun.$.cwd(root);
 	const glob = bun.Glob?.prototype;
 	if (glob) {
@@ -146,32 +152,60 @@ function fileOptionsIndex(args) {
 	return Array.isArray(args[1]) || (args[1] == null && args.length > 2) ? 2 : 1;
 }
 
-function withOptionsCwd(fn, optionsIndex, root) {
+function withOptionsCwd(fn, optionsIndex, root, inOwnGroup = false) {
+	const group = inOwnGroup ? ownGroup : (options) => options;
 	return function withSessionCwd(...args) {
 		const index = optionsIndex(args);
 		const options = args[index];
-		if (options === undefined || options === null) args[index] = { cwd: root };
-		else if (typeof options === "function") args.splice(index, 0, { cwd: root });
-		else if (typeof options === "object") args[index] = { ...options, cwd: cwdFrom(options.cwd, root) };
-		return fn.apply(this, args);
+		if (options === undefined || options === null) args[index] = group({ cwd: root });
+		else if (typeof options === "function") args.splice(index, 0, group({ cwd: root }));
+		else if (typeof options === "object") args[index] = group({ ...options, cwd: cwdFrom(options.cwd, root) });
+		if (!inOwnGroup || process.platform === "win32" || (isPlainOptions(options) && options.detached !== undefined)) {
+			return fn.apply(this, args);
+		}
+		// Bun's child_process spawns through Bun.spawn, whose child tracking skips `detached` children as ones the
+		// cell keeps on purpose. While this call runs, `detached` is ours, so the child is still retired with the cell.
+		const depth = globalThis[INJECTED_GROUP] ?? 0;
+		globalThis[INJECTED_GROUP] = depth + 1;
+		try {
+			return fn.apply(this, args);
+		} finally {
+			globalThis[INJECTED_GROUP] = depth;
+		}
 	};
 }
 
-function withBunSpawnCwd(fn, root) {
+function withBunSpawnCwd(fn, root, inOwnGroup = true) {
+	const group = inOwnGroup ? ownGroup : (options) => options;
 	return function spawnInSessionCwd(...args) {
 		const [first, second] = args;
 		if (Array.isArray(first)) {
 			const options = second === undefined || second === null ? {} : second;
 			if (typeof options !== "object") return fn.apply(this, args);
-			return fn.call(this, first, { ...options, cwd: cwdFrom(options.cwd, root) }, ...args.slice(2));
+			return fn.call(this, first, group({ ...options, cwd: cwdFrom(options.cwd, root) }), ...args.slice(2));
 		}
 		if (first !== null && typeof first === "object") {
-			return fn.call(this, { ...first, cwd: cwdFrom(first.cwd, root) }, ...args.slice(1));
+			return fn.call(this, group({ ...first, cwd: cwdFrom(first.cwd, root) }), ...args.slice(1));
 		}
 		return fn.apply(this, args);
 	};
 }
 
+// senpi#2995: a JS kernel runs inside the agent process, so a child spawned from a cell would join the agent's
+// process group, and a cell that later signals that group (`kill -TERM -- -$PGID`) stops the agent itself. On
+// POSIX every cell child starts its own group instead; kernel teardown still retires it by pid and descendants.
+// A cell that sets `detached` itself keeps its choice. Windows is left alone: there `detached` opens a console.
+export const INJECTED_GROUP = Symbol.for("senpi.kernel.injectedProcessGroup");
+
+function isPlainOptions(value) {
+	return value !== null && typeof value === "object";
+}
+
+function ownGroup(options) {
+	if (process.platform === "win32" || options.detached !== undefined) return options;
+	return { ...options, detached: true };
+}
+
 function globScanOptions(options, root) {
 	if (options === undefined || options === null) return { cwd: root };
 	if (typeof options === "string") return cwdFrom(options, root);

package/src/kernels/js/worker-host.ts

@@ -1,6 +1,7 @@
 import type { EventEmitter } from "node:events";
 import { Worker } from "node:worker_threads";
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
+import { describeExit } from "../shared/kernel-death.ts";
 import type { WorkerLike } from "./inline-worker.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
 
@@ -22,10 +23,16 @@ export class WorkerStartupCancelledError extends Error {
 export class JavaScriptWorkerExitedError extends Error {
 	readonly name = "JavaScriptWorkerExitedError";
 	readonly exitCode: number;
+	readonly exitSignal: string | null;
 
-	constructor(exitCode: number) {
-		super(`JavaScript worker exited with code ${exitCode}`);
+	constructor(exitCode: number, exitSignal: string | null = null) {
+		super(
+			exitSignal === null
+				? `JavaScript worker exited with code ${exitCode}`
+				: `JavaScript worker exited with ${describeExit(null, exitSignal)} (code ${exitCode})`,
+		);
 		this.exitCode = exitCode;
+		this.exitSignal = exitSignal;
 	}
 }
 

package/src/kernels/js/worker-indirect-eval.js

@@ -1,4 +1,13 @@
-import { findShadowedGlobalName } from "./worker-shadow-guard.js";
+import { isKernelGlobal } from "./worker-shadow-guard.js";
+
+// A cell may declare a name the kernel or the platform already defines (`const log = []`, `const fetch = ...`). The
+// binding lives in a per-kernel user scope that later cells read through `with`, so it persists for the user's cells
+// while the kernel, its prelude and imported libraries keep the original global. `delete <name>` in a cell restores it.
+const USER_SCOPE_KEY = Symbol.for("senpi.kernel.userScope");
+const USER_SCOPE = "__senpiUserScope";
+// The persistence rewrite itself writes through `globalThis`, so that one name cannot be shadowed.
+const UNSHADOWABLE = new Set(["globalThis"]);
+let shadowedNames = null;
 
 export function indirectEval(source, filename) {
 	const withPragma = filename ? `${source}\n//# sourceURL=${filename}` : source;
@@ -11,10 +20,31 @@ export async function awaitMaybePromise(value) {
 	return await value;
 }
 
-export function wrapUserCode(code) {
-	const persistentCode = persistTopLevelDeclarations(code);
-	if (scanTopLevelStatements(persistentCode).hasTopLevelReturn) return `(async () => {\n${persistentCode}\n})()`;
-	return `(async () => {\n${captureLastExpression(persistentCode)}\n})()`;
+/** Wraps a cell for persistent evaluation; `shadowed` receives the kernel-global names the cell declares. */
+export function wrapUserCode(code, shadowed = []) {
+	shadowedNames = shadowed;
+	let persistentCode;
+	try {
+		persistentCode = persistTopLevelDeclarations(code);
+	} finally {
+		shadowedNames = null;
+	}
+	const body = scanTopLevelStatements(persistentCode).hasTopLevelReturn ? persistentCode : captureLastExpression(persistentCode);
+	const scope = globalThis[USER_SCOPE_KEY];
+	if (shadowed.length === 0 && (scope === undefined || Object.keys(scope).length === 0)) return `(async () => {\n${body}\n})()`;
+	globalThis[USER_SCOPE_KEY] ??= Object.create(null);
+	return `(async (${USER_SCOPE}) => { with (${USER_SCOPE}) { return await (async () => {\n${body}\n})(); } })(globalThis[Symbol.for("senpi.kernel.userScope")])`;
+}
+
+function persistTarget(name) {
+	if (UNSHADOWABLE.has(name)) {
+		throw new Error(
+			`eval cell declares top-level \`${name}\`, which the JS kernel needs to keep cell variables between cells. Rename the binding (for example \`${name}Local\`).`,
+		);
+	}
+	if (!isKernelGlobal(name)) return `globalThis[${JSON.stringify(name)}]`;
+	if (shadowedNames !== null && !shadowedNames.includes(name)) shadowedNames.push(name);
+	return `${USER_SCOPE}[${JSON.stringify(name)}]`;
 }
 
 const IDENTIFIER_START_RE = /[$_\p{ID_Start}]/u;
@@ -267,14 +297,8 @@ function rewriteDeclaration(code, declarationStart, start, end, keyword) {
 		const bindings = [];
 		collectPatternNames(pattern, bindings);
 		if (bindings.length === 0) return undefined;
-		const shadowed = findShadowedGlobalName(bindings);
-		if (shadowed !== undefined) {
-			throw new Error(
-				`eval cell declares top-level \`${shadowed}\`, but a global with that name already exists in the JS kernel. Persisting it would replace that global for every later cell. Rename the binding (for example \`${shadowed}Local\`), or assign globalThis.${shadowed} explicitly if replacing it is truly intended.`,
-			);
-		}
 		if (preserveDeclaration) {
-			for (const name of bindings) assignments.push(`globalThis[${JSON.stringify(name)}] = ${name};`);
+			for (const name of bindings) assignments.push(`${persistTarget(name)} = ${name};`);
 			continue;
 		}
 		const target = rewriteBindingPattern(pattern);
@@ -296,7 +320,7 @@ function rewriteBindingPattern(source) {
 		const target = rewriteBindingPattern(pattern.slice(0, defaultStart));
 		return target === undefined ? undefined : `${target} = ${pattern.slice(defaultStart + 1).trim()}`;
 	}
-	if (IDENTIFIER_RE.test(pattern)) return `globalThis[${JSON.stringify(pattern)}]`;
+	if (IDENTIFIER_RE.test(pattern)) return persistTarget(pattern);
 	if (pattern.startsWith("{") && pattern.endsWith("}")) {
 		const properties = splitPatternElements(pattern.slice(1, -1)).map((property) => rewriteObjectBinding(property));
 		if (properties.some((property) => property === undefined)) return undefined;

package/src/kernels/js/worker-package-resolve.js

@@ -0,0 +1,153 @@
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { isBuiltin } from "node:module";
+import { dirname, join, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// A cell's bare import runs `import()` from this worker's own module, so the runtime resolves it from Senpi's install
+// tree, not the session's project or its managed package revision. This resolver walks `node_modules` from each root
+// the cell names, in order, and resolves the package entry the way ESM does (the `exports` field with import
+// conditions), so ESM-only packages load and the first root that has the package wins.
+const RESOLVE_PACKAGE = Symbol.for("senpi.kernel.resolvePackage");
+const CONDITIONS = typeof globalThis.Bun === "object" ? ["bun", "node", "import", "default"] : ["node", "import", "default"];
+
+function isFile(path) {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+
+function splitSpecifier(specifier) {
+	const parts = specifier.split("/");
+	const nameParts = specifier.startsWith("@") ? 2 : 1;
+	if (parts.length < nameParts || parts.slice(0, nameParts).some((part) => part === "" || part === "." || part === ".."))
+		return undefined;
+	const rest = parts.slice(nameParts).join("/");
+	return { name: parts.slice(0, nameParts).join("/"), subpath: rest === "" ? "." : `./${rest}` };
+}
+
+function conditionalTarget(target) {
+	if (typeof target === "string") return target;
+	if (Array.isArray(target)) {
+		for (const candidate of target) {
+			const resolved = conditionalTarget(candidate);
+			if (resolved !== undefined) return resolved;
+		}
+		return undefined;
+	}
+	if (target === null || typeof target !== "object") return undefined;
+	for (const [condition, value] of Object.entries(target)) {
+		if (condition !== "default" && !CONDITIONS.includes(condition)) continue;
+		const resolved = conditionalTarget(value);
+		if (resolved !== undefined) return resolved;
+	}
+	return undefined;
+}
+
+function exportsTarget(exportsField, subpath) {
+	const subpathKeyed =
+		exportsField !== null &&
+		typeof exportsField === "object" &&
+		!Array.isArray(exportsField) &&
+		Object.keys(exportsField).some((key) => key.startsWith("."));
+	if (!subpathKeyed) return subpath === "." ? conditionalTarget(exportsField) : undefined;
+	if (Object.hasOwn(exportsField, subpath)) return conditionalTarget(exportsField[subpath]);
+	let best;
+	for (const key of Object.keys(exportsField)) {
+		const star = key.indexOf("*");
+		if (star < 0 || key.includes("*", star + 1)) continue;
+		const prefix = key.slice(0, star);
+		const suffix = key.slice(star + 1);
+		if (!subpath.startsWith(prefix) || !subpath.endsWith(suffix) || subpath.length < prefix.length + suffix.length)
+			continue;
+		if (best === undefined || prefix.length > best.prefix.length) {
+			best = { key, prefix, match: subpath.slice(prefix.length, subpath.length - suffix.length) };
+		}
+	}
+	if (best === undefined || hasInvalidSegment(best.match)) return undefined;
+	const target = conditionalTarget(exportsField[best.key]);
+	return target === undefined ? undefined : target.replaceAll("*", best.match);
+}
+
+// Node refuses a pattern match or target with "." / ".." / "node_modules" segments (ERR_INVALID_MODULE_SPECIFIER).
+function hasInvalidSegment(path) {
+	return path.split(/[\\/]/).some((segment) => segment === "." || segment === ".." || segment === "node_modules");
+}
+
+function legacyFile(path) {
+	for (const candidate of [path, `${path}.js`, `${path}.mjs`, `${path}.cjs`, join(path, "index.js")]) {
+		if (isFile(candidate)) return candidate;
+	}
+	return undefined;
+}
+
+function packageEntry(packageDir, subpath, specifier) {
+	let manifest;
+	try {
+		manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+	} catch {
+		return legacyFile(join(packageDir, subpath === "." ? "index.js" : subpath));
+	}
+	if (manifest.exports !== undefined && manifest.exports !== null) {
+		const target = exportsTarget(manifest.exports, subpath);
+		if (typeof target !== "string" || !target.startsWith("./") || hasInvalidSegment(target.slice(2))) {
+			const error = new Error(`Package subpath '${subpath}' is not exported for import by '${specifier}'`);
+			error.code = "ERR_PACKAGE_PATH_NOT_EXPORTED";
+			throw error;
+		}
+		return join(packageDir, target);
+	}
+	if (subpath !== ".") return legacyFile(join(packageDir, subpath));
+	const moduleEntry = typeof globalThis.Bun === "object" && typeof manifest.module === "string" ? manifest.module : undefined;
+	const main = moduleEntry ?? (typeof manifest.main === "string" ? manifest.main : "index.js");
+	return legacyFile(join(packageDir, main));
+}
+
+function findPackageDir(name, rootUrl) {
+	let directory = fileURLToPath(rootUrl);
+	for (;;) {
+		const candidate = join(directory, "node_modules", name);
+		if (isDirectory(candidate)) return candidate;
+		const parent = dirname(directory);
+		if (parent === directory) return undefined;
+		directory = parent;
+	}
+}
+
+/**
+ * The file URL the bare `specifier` resolves to from the first of `rootUrls` whose `node_modules` chain has its
+ * package, or undefined when it names a builtin or no root has the package (the caller then imports it natively).
+ */
+export function resolvePackage(specifier, rootUrls) {
+	if (specifier.includes(":") || isBuiltin(specifier)) return undefined;
+	const parts = splitSpecifier(specifier);
+	if (parts === undefined) return undefined;
+	for (const rootUrl of rootUrls) {
+		if (typeof rootUrl !== "string") continue;
+		const packageDir = findPackageDir(parts.name, rootUrl);
+		if (packageDir === undefined) continue;
+		const entry = packageEntry(packageDir, parts.subpath, specifier);
+		if (entry === undefined) continue;
+		let real = entry;
+		try {
+			real = realpathSync(entry);
+		} catch {
+			// A missing target fails in the import itself, with the runtime's own error.
+		}
+		return pathToFileURL(real.endsWith(sep) ? real.slice(0, -1) : real).href;
+	}
+	return undefined;
+}
+
+export function installPackageResolver() {
+	globalThis[RESOLVE_PACKAGE] = resolvePackage;
+}

package/src/kernels/js/worker-require.d.ts

@@ -0,0 +1,19 @@
+export interface CellRequireContext {
+	readonly cwdUrl: string;
+	readonly packageRootUrl?: string | null;
+}
+
+export interface CellResolve {
+	(specifier: string, options?: { readonly paths?: readonly string[] }): string;
+	paths(specifier: string): string[] | null;
+}
+
+export interface CellRequire {
+	(specifier: string): unknown;
+	readonly resolve: CellResolve;
+	readonly cache: Record<string, unknown>;
+}
+
+export function createCellRequire(context: () => CellRequireContext): CellRequire;
+
+export { createRequire } from "node:module";