@code-yeongyu/senpi-codemode 2026.9.17 → 2026.9.18

package/CHANGELOG.md

@@ -12,6 +12,56 @@
 
 ### Removed
 
+## [2026.9.18] - 2026-09-18
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.9.17-4] - 2026-09-17
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.9.17-3] - 2026-09-17
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [2026.9.17-2] - 2026-09-17
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+- JS eval kernel: a cell whose top-level declaration (`const`/`let`/`var`, plain or destructured) names an existing platform or prelude global (for example `const fetch = ...`) is now rejected before execution with an error naming the identifier and the rename remedy, instead of silently replacing that global for every later cell and wedging the session until a kernel reset. Cell-created globals stay re-declarable across cells, and explicit `globalThis.<name> = ...` assignments remain untouched as the deliberate escape hatch. (#1784)
+
+### Removed
+
 ## [2026.9.17] - 2026-09-17
 
 ### Breaking Changes

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.9.17",
+	"version": "2026.9.18",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -30,14 +30,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.17",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.9.18",
 		"typebox": "1.3.27"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.9.17"
+		"@code-yeongyu/senpi": "2026.9.18"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.9.17"
+		"@code-yeongyu/senpi": "2026.9.18"
 	},
 	"keywords": [
 		"senpi",

package/src/kernels/js/worker-indirect-eval.js

@@ -1,3 +1,5 @@
+import { findShadowedGlobalName } from "./worker-shadow-guard.js";
+
 export function indirectEval(source, filename) {
 	const withPragma = filename ? `${source}\n//# sourceURL=${filename}` : source;
 	const geval = globalThis.eval;
@@ -265,6 +267,12 @@ function rewriteDeclaration(code, declarationStart, start, end, keyword) {
 		const bindings = [];
 		collectPatternNames(pattern, bindings);
 		if (bindings.length === 0) return undefined;
+		const shadowed = findShadowedGlobalName(bindings);
+		if (shadowed !== undefined) {
+			throw new Error(
+				`eval cell declares top-level \`${shadowed}\`, but a global with that name already exists in the JS kernel. Persisting it would replace that global for every later cell. Rename the binding (for example \`${shadowed}Local\`), or assign globalThis.${shadowed} explicitly if replacing it is truly intended.`,
+			);
+		}
 		if (preserveDeclaration) {
 			for (const name of bindings) assignments.push(`globalThis[${JSON.stringify(name)}] = ${name};`);
 			continue;

package/src/kernels/js/worker-shadow-guard.js

@@ -0,0 +1,21 @@
+// Snapshot is lazy on purpose: the first guard call is the first cell's
+// transform, when prelude globals exist but no cell-created global does.
+// A module-level snapshot would miss prelude globals; re-snapshotting later
+// would wrongly protect cell-created names that must stay re-declarable.
+
+let protectedGlobalNames;
+
+function protectedGlobals() {
+	if (protectedGlobalNames === undefined) {
+		protectedGlobalNames = new Set(Object.getOwnPropertyNames(globalThis));
+	}
+	return protectedGlobalNames;
+}
+
+export function findShadowedGlobalName(bindings) {
+	const names = protectedGlobals();
+	for (const name of bindings) {
+		if (names.has(name)) return name;
+	}
+	return undefined;
+}