@gajae-code/coding-agent 0.5.1 → 0.5.3

package/src/dap/session.ts

@@ -1,7 +1,8 @@
 import * as path from "node:path";
 import * as timers from "node:timers/promises";
-import { logger, ptree, untilAborted } from "@gajae-code/utils";
+import { logger, untilAborted } from "@gajae-code/utils";
 import { NON_INTERACTIVE_ENV } from "../exec/non-interactive-env";
+import { type OwnedProcess, spawnOwnedProcess } from "../runtime/process-lifecycle";
 import { DapClient } from "./client";
 import type {
 	DapAttachArguments,
@@ -63,6 +64,24 @@ import type {
 	DapWriteMemoryResponse,
 } from "./types";
 
+function drainStream(stream: ReadableStream<Uint8Array> | null | undefined): void {
+	if (!stream) return;
+	void (async () => {
+		try {
+			const reader = stream.getReader();
+			try {
+				while (!(await reader.read()).done) {
+					// drain only
+				}
+			} finally {
+				reader.releaseLock();
+			}
+		} catch {
+			// Process stream closed or was already consumed.
+		}
+	})();
+}
+
 interface DapSession {
 	id: string;
 	adapter: DapResolvedAdapter;
@@ -87,6 +106,7 @@ interface DapSession {
 	initializedSeen: boolean;
 	needsConfigurationDone: boolean;
 	configurationDoneSent: boolean;
+	runInTerminalProcesses: Set<OwnedProcess>;
 }
 
 export interface DapOutputSnapshot {
@@ -948,6 +968,7 @@ export class DapSessionManager {
 			initializedSeen: false,
 			needsConfigurationDone: false,
 			configurationDoneSent: false,
+			runInTerminalProcesses: new Set(),
 		};
 		client.onReverseRequest("runInTerminal", async rawArgs => {
 			const args = (rawArgs ?? {}) as DapRunInTerminalArguments;
@@ -957,17 +978,21 @@ export class DapSessionManager {
 			const env = Object.fromEntries(
 				Object.entries(args.env ?? {}).filter((entry): entry is [string, string] => entry[1] !== null),
 			);
-			const proc = ptree.spawn(args.args, {
+			const owner = spawnOwnedProcess(args.args, {
 				cwd: args.cwd ?? session.cwd,
-				stdin: "pipe",
+				stdin: "ignore",
 				env: {
 					...Bun.env,
 					...NON_INTERACTIVE_ENV,
 					...env,
 				},
-				detached: true,
+				name: `dap:${session.id}:runInTerminal`,
 			});
-			return { processId: proc.pid } satisfies DapRunInTerminalResponse;
+			drainStream(owner.child.stdout);
+			drainStream(owner.child.stderr);
+			session.runInTerminalProcesses.add(owner);
+			owner.exited.finally(() => session.runInTerminalProcesses.delete(owner));
+			return { processId: owner.pid } satisfies DapRunInTerminalResponse;
 		});
 		client.onReverseRequest("startDebugging", async rawArgs => {
 			const startArgs = (rawArgs ?? {}) as Partial<DapStartDebuggingArguments>;
@@ -1294,12 +1319,24 @@ export class DapSessionManager {
 		return session;
 	}
 
-	#disposeSession(session: DapSession) {
+	async #disposeSession(session: DapSession) {
 		if (this.#activeSessionId === session.id) {
 			this.#activeSessionId = null;
 		}
 		this.#sessions.delete(session.id);
-		void session.client.dispose().catch(() => {});
+		await this.#disposeRunInTerminalProcesses(session);
+		await session.client.dispose().catch(() => {});
+	}
+
+	async #disposeRunInTerminalProcesses(session: DapSession): Promise<void> {
+		const owners = [...session.runInTerminalProcesses];
+		session.runInTerminalProcesses.clear();
+		await Promise.allSettled(
+			owners.map(async owner => {
+				await owner.dispose();
+				await owner.awaitExit({ timeoutMs: 1_000 });
+			}),
+		);
 	}
 }
 

package/src/defaults/gjc/skills/ultragoal/SKILL.md

@@ -191,10 +191,10 @@ An ultragoal story cannot be checkpointed `complete` until the active agent has
    - code-side: maintainability, tests, integration points, and unsafe shortcuts.
 5. Delegate an `executor` QA/red-team lane to build and run the e2e/read-teaming QA suite appropriate for the story. This lane must try to break the change, not just confirm the happy path. It must start from the approved plan/spec/acceptance criteria, then user-facing contracts, and only then implementation code as supporting evidence. Plan/code mismatches are blockers, not items to paper over with implementation intent.
 6. The executor QA/red-team lane must prove evidence by the real surface under test:
-   - GUI/web surfaces require browser automation plus a screenshot or image verdict.
-   - CLI surfaces require logs or terminal transcripts from real invocation.
-   - API/package surfaces require external consumer or black-box tests through the public interface.
-   - Algorithm/math surfaces require boundary, property, adversarial, and failure-mode cases.
+   - GUI/web surfaces require a valid automation transcript plus a non-uniform screenshot. Bare `inlineEvidence` text or typed receipts never prove live GUI/web execution.
+   - CLI surfaces require runtime argv replay: `replaySafe: true`, an allowlisted argv `command`, and replayed normalized stdout matching `recordedStdout`; unsafe commands require audited `replayExempt` metadata plus a structurally valid fallback artifact.
+   - Native/desktop/tui surfaces require a structurally valid screenshot, PTY capture with terminal control codes, or app-automation transcript.
+   - API/package/algorithm/math surfaces require a real artifact file or typed receipt. Bare `inlineEvidence` text alone is not sufficient for any surface.
 7. The executor QA/red-team lane must report a matrix using `executorQa.contractCoverage`, `executorQa.surfaceEvidence`, `executorQa.adversarialCases`, and `executorQa.artifactRefs`. Not-applicable rows are allowed only in `contractCoverage` and `surfaceEvidence`; each `status: "not_applicable"` row requires `contractRef` plus `reason`. `adversarialCases` rows cannot be not-applicable.
 8. Run a final code review pass and fold it into the strict quality gate. Clean means `architectReview.architectureStatus`, `architectReview.productStatus`, and `architectReview.codeStatus` are all `"CLEAR"`, `architectReview.recommendation` is `"APPROVE"`, executor QA statuses are `"passed"`, iteration is `"passed"` with `fullRerun: true`, every evidence field is non-empty, every required matrix row is present, and every blockers array is empty. `COMMENT`, `WATCH`, `REQUEST CHANGES`, `BLOCK`, missing evidence, missing or shallow matrix rows, plan/code mismatches, or non-empty blockers are non-clean.
 9. If any lane finds an issue, do **not** checkpoint `complete` and do **not** call `goal({"op":"complete"})`. Record durable blocker work instead:
@@ -204,6 +204,8 @@ An ultragoal story cannot be checkpointed `complete` until the active agent has
 10. Complete or steer through the blocker story, then rerun the full blocking verification loop. Repeat until all verifier lanes are clean.
 11. Only after the loop is clean, checkpoint the story as complete with a structured quality gate and a fresh active `goal({"op":"get"})` snapshot. The checkpoint creates a receipt; `goals.json.status` alone is not proof. In aggregate mode, the final aggregate receipt must exist before `goal({"op":"complete"})` is allowed.
 
+While an Ultragoal run is active, the `ask` tool is blocked for all agents. Record unresolved review decisions as durable blockers with `gjc ultragoal record-review-blockers` instead of prompting interactively.
+
 The native `checkpoint --status complete` command rejects missing or shallow gates. `--quality-gate-json` must include:
 
 ```json
@@ -229,13 +231,19 @@ The native `checkpoint --status complete` command rejects missing or shallow gat
         "id": "browser-run",
         "kind": "browser-automation",
         "path": "artifacts/browser-run.json",
-        "description": "browser automation transcript invoking the approved user-facing flow"
+        "description": "valid automation transcript with actions, monotonic timestamps, and selectors"
       },
       {
         "id": "gui-screenshot",
         "kind": "screenshot",
         "path": "artifacts/gui-screenshot.png",
-        "description": "screenshot or image-verdict evidence for the GUI/web result"
+        "description": "non-uniform screenshot evidence for the GUI/web result"
+      },
+      {
+        "id": "cli-replay",
+        "kind": "command-replay",
+        "path": "artifacts/cli-replay.json",
+        "description": "artifact file containing argv-only CLI replay JSON: schemaVersion 1, kind cli-replay, replaySafe true, allowlisted command, recordedStdout"
       },
       {
         "id": "adversarial-report",
@@ -265,15 +273,23 @@ The native `checkpoint --status complete` command rejects missing or shallow gat
       {
         "id": "surface-gui",
         "contractRef": "user-facing surface or public interface under test",
-        "surface": "gui|web|cli|api|package|algorithm|math",
+        "surface": "gui|web|cli|api|package|algorithm|math|native|desktop|tui",
         "invocation": "real browser action, CLI command, API/package consumer call, or algorithm/property check",
         "verdict": "passed",
         "artifactRefs": ["browser-run", "gui-screenshot"]
       },
+      {
+        "id": "surface-cli",
+        "contractRef": "CLI or command-line interface under test",
+        "surface": "cli",
+        "invocation": "argv replay executed by the Ultragoal runtime",
+        "verdict": "passed",
+        "artifactRefs": ["cli-replay"]
+      },
       {
         "id": "surface-out-of-scope",
         "contractRef": "surface intentionally outside this story",
-        "surface": "gui|web|cli|api|package|algorithm|math",
+        "surface": "gui|web|cli|api|package|algorithm|math|native|desktop|tui",
         "status": "not_applicable",
         "reason": "why this surface does not apply to the current story"
       }
@@ -300,6 +316,12 @@ The native `checkpoint --status complete` command rejects missing or shallow gat
 }
 ```
 
+For CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"recordedStdout":"ultragoal-cli-ok\n"}`. Use `replayExempt` only for audited unsafe/non-deterministic invocations, with a substantive reason, approver, and same-surface fallback artifacts.
+
+## Review mode
+
+`gjc ultragoal review` runs the same hardened gate against an already implemented PR, branch, or worktree. Use `--pr <number>` for a PR, `--branch <ref>` for a branch diff, omit both for the current worktree, and pass `--spec <path>` when a real contract exists. `--mode review-only` emits the verdict/findings without creating fix work; `--mode review-start` records review blockers for follow-up. Review mode validates the same `executorQa` shape and live-surface artifacts as `checkpoint --status complete`. A thin or derived-only contract can never clean-pass: the verdict is capped at `inconclusive: weak-contract` until a supplied spec or equivalent strong acceptance criteria are available.
+
 Receipts are freshness-scoped:
 - Per-goal receipts remain fresh for their target goal unless that goal, its blocker metadata, or its supersession metadata changes.
 - Normal later `goal_started` or clean receipt-backed `goal_checkpointed` events for other goals do not stale older per-goal receipts.

package/src/edit/read-file.ts

@@ -7,10 +7,28 @@
 import { isEnoent } from "@gajae-code/utils";
 import { isNotebookPath, readEditableNotebookText, serializeEditedNotebookText } from "./notebook";
 
+/**
+ * Max byte size of a file the edit modes will load whole. Editing loads + normalizes +
+ * fuzzy-matches + diffs the entire file on the main thread, so a multi-MB/generated file
+ * would block the event loop (F19). Above this, fail fast with an actionable error.
+ */
+export const MAX_EDIT_FILE_BYTES = 8 * 1024 * 1024;
+
 export async function readEditFileText(absolutePath: string, path: string): Promise<string> {
 	try {
+		const file = Bun.file(absolutePath);
+		const size = file.size; // 0 for a missing file; the read below then throws ENOENT.
+		if (size > MAX_EDIT_FILE_BYTES) {
+			throw new Error(
+				`File too large to edit safely: ${path} is ${size} bytes (limit ${MAX_EDIT_FILE_BYTES}). ` +
+					`Editing loads and diffs the whole file on the main thread; make a more targeted change, ` +
+					`split the file, or use a specialized tool.`,
+			);
+		}
+		// Guard BEFORE the notebook fast-path: a >8 MiB .ipynb would otherwise load + JSON-parse
+		// + convert the whole file via readEditableNotebookText, bypassing the F19 freeze guard.
 		if (isNotebookPath(absolutePath)) return await readEditableNotebookText(absolutePath, path);
-		return await Bun.file(absolutePath).text();
+		return await file.text();
 	} catch (error) {
 		if (isEnoent(error)) {
 			throw new Error(`File not found: ${path}`);

package/src/eval/js/context-manager.ts

@@ -1,4 +1,5 @@
 import { isCompiledBinary, logger, Snowflake } from "@gajae-code/utils";
+import { registerResourceOwner } from "../../runtime/process-lifecycle";
 import type { ToolSession } from "../../tools";
 import { ToolAbortError, ToolError } from "../../tools/tool-errors";
 import { callSessionTool, type JsStatusEvent } from "./tool-bridge";
@@ -43,22 +44,66 @@ interface PendingRun {
 	settled: boolean;
 }
 
+interface ReadyDeferred {
+	promise: Promise<JsSession>;
+	resolve(session: JsSession): void;
+	reject(error: Error): void;
+}
+
+interface QueueDeferred {
+	promise: Promise<void>;
+	resolve(): void;
+	reject(error: Error): void;
+}
+
 interface JsSession {
 	sessionKey: string;
-	worker: WorkerHandle;
-	state: "alive" | "dead";
+	worker?: WorkerHandle;
+	state: "starting" | "alive" | "dead";
+	ownerId?: string;
 	pending: Map<string, PendingRun>;
 	queue: Promise<void>;
+	queuedWaiters: Set<(error: Error) => void>;
+	queueTail: QueueDeferred;
+	controllers: Set<AbortController>;
+	runSignal?: AbortSignal;
+	ready: ReadyDeferred;
+	unsubscribe?: () => void;
+	unregistered?: () => void;
 }
 
 const sessions = new Map<string, JsSession>();
+const sessionWaiters = new Map<string, Set<(error: Error) => void>>();
+let vmResourceCleanupRegistered = false;
+
+function ensureVmResourceCleanup(): void {
+	if (vmResourceCleanupRegistered) return;
+	vmResourceCleanupRegistered = true;
+	registerResourceOwner("js-vm-contexts", async () => {
+		try {
+			await disposeAllVmContexts();
+		} finally {
+			vmResourceCleanupRegistered = false;
+		}
+	});
+}
 const READY_TIMEOUT_MS_DEFAULT = 5_000;
 
+function getSessionWaiters(sessionKey: string): Set<(error: Error) => void> {
+	let waiters = sessionWaiters.get(sessionKey);
+	if (!waiters) {
+		waiters = new Set();
+		sessionWaiters.set(sessionKey, waiters);
+	}
+	return waiters;
+}
+
 export async function executeInVmContext(options: {
 	sessionKey: string;
 	sessionId: string;
 	cwd: string;
 	session: ToolSession;
+	ownerId?: string;
 	reset?: boolean;
 	code: string;
 	filename: string;
@@ -68,40 +113,84 @@ export async function executeInVmContext(options: {
 	if (options.reset) {
 		await resetVmContext(options.sessionKey);
 	}
-	const session = await acquireSession(
-		options.sessionKey,
-		{ cwd: options.cwd, sessionId: options.sessionId },
-		options.timeoutMs,
-	);
-	return await runQueued(session, () => runOnce(session, options));
+	const waiters = getSessionWaiters(options.sessionKey);
+	const { promise: contextResetPromise, reject: rejectContextReset } = Promise.withResolvers<never>();
+	contextResetPromise.catch(() => undefined);
+	waiters.add(rejectContextReset);
+	const runPromise = (async (): Promise<{ value: unknown }> => {
+		const session = await acquireSession(
+			options.sessionKey,
+			{ cwd: options.cwd, sessionId: options.sessionId },
+			options.ownerId,
+			options.timeoutMs,
+		);
+		return await runQueued(session, () => runOnce(session, options));
+	})();
+	try {
+		return await Promise.race([runPromise, contextResetPromise]);
+	} finally {
+		waiters.delete(rejectContextReset);
+	}
 }
 
 export async function resetVmContext(sessionKey: string): Promise<void> {
 	const session = sessions.get(sessionKey);
 	if (!session) return;
 	sessions.delete(sessionKey);
+	const waiters = sessionWaiters.get(sessionKey);
+	if (waiters) for (const reject of [...waiters]) reject(new ToolError("JS context reset"));
 	await killSession(session, new ToolError("JS context reset"));
 }
 
+export async function disposeVmContextsByOwner(ownerId: string): Promise<void> {
+	const owned = [...sessions.entries()].filter(
+		([sessionKey, session]) =>
+			session.ownerId === ownerId || sessionKey === ownerId || sessionKey === `js:${ownerId}`,
+	);
+	for (const [sessionKey, session] of owned) {
+		if (sessions.get(sessionKey) === session) sessions.delete(sessionKey);
+	}
+	await Promise.all(owned.map(([, session]) => killSession(session, new ToolError("JS context disposed"))));
+}
+
 export async function disposeAllVmContexts(): Promise<void> {
 	const all = [...sessions.values()];
 	sessions.clear();
 	await Promise.all(all.map(session => killSession(session, new ToolError("JS context disposed"))));
 }
 
+export function liveVmContextCount(): number {
+	return [...sessions.values()].filter(session => session.state !== "dead").length;
+}
+
 async function runQueued<T>(session: JsSession, work: () => Promise<T>): Promise<T> {
+	if (session.state !== "alive") throw new ToolError("JS worker is not alive");
 	const previous = session.queue;
-	const { promise, resolve } = Promise.withResolvers<void>();
-	session.queue = promise;
-	try {
-		await previous;
-	} catch {
-		// Previous run's failure must not poison this one.
-	}
+	const { promise, resolve, reject } = Promise.withResolvers<void>();
+	const queueController = new AbortController();
+	const queueItem: QueueDeferred = { promise, resolve, reject };
+	const rejectWaiter = (error: Error): void => queueItem.reject(error);
+	session.queuedWaiters.add(rejectWaiter);
+	session.controllers.add(queueController);
+	session.queueTail = queueItem;
+	session.queue = (async () => {
+		await previous.catch(() => undefined);
+		await queueItem.promise;
+	})().catch(() => undefined);
 	try {
-		return await work();
+		await Promise.race([previous.catch(() => undefined), queueItem.promise, abortPromise(queueController.signal)]);
+		if (session.runSignal?.aborted) throw reasonToError(session.runSignal.reason, "JS worker is not alive");
+		if (session.state !== "alive") throw new ToolError("JS worker is not alive");
+		session.queuedWaiters.delete(rejectWaiter);
+		return await Promise.race([
+			work(),
+			queueItem.promise.then(() => new Promise<never>(() => {})),
+			abortPromise(queueController.signal),
+		]);
 	} finally {
-		resolve();
+		session.queuedWaiters.delete(rejectWaiter);
+		session.controllers.delete(queueController);
+		queueItem.resolve();
 	}
 }
 
@@ -118,6 +207,7 @@ async function runOnce(
 ): Promise<{ value: unknown }> {
 	const runId = `r-${Snowflake.next()}`;
 	const { promise, resolve, reject } = Promise.withResolvers<{ value: unknown }>();
+	const sessionSignal = session.runSignal;
 	const pending: PendingRun = {
 		runId,
 		runState: options.runState,
@@ -145,13 +235,19 @@ async function runOnce(
 	}
 
 	try {
-		session.worker.send({
-			type: "run",
-			runId,
-			code: options.code,
-			filename: options.filename,
-			snapshot: { cwd: options.cwd, sessionId: options.sessionId },
-		});
+		if (sessionSignal?.aborted) throw reasonToError(sessionSignal.reason, "JS worker is not alive");
+		if (
+			!safeSend(session, {
+				type: "run",
+				runId,
+				code: options.code,
+				filename: options.filename,
+				snapshot: { cwd: options.cwd, sessionId: options.sessionId },
+			})
+		) {
+			settleRunWithError(session, pending, new ToolError("JS worker send failed"));
+			return await promise;
+		}
 		return await promise;
 	} finally {
 		options.runState.signal?.removeEventListener("abort", onAbort);
@@ -159,46 +255,76 @@ async function runOnce(
 	}
 }
 
-async function acquireSession(sessionKey: string, snapshot: SessionSnapshot, timeoutMs?: number): Promise<JsSession> {
+async function acquireSession(
+	sessionKey: string,
+	snapshot: SessionSnapshot,
+	ownerId: string | undefined,
+	timeoutMs?: number,
+): Promise<JsSession> {
+	ensureVmResourceCleanup();
 	const existing = sessions.get(sessionKey);
-	if (existing && existing.state === "alive") return existing;
+	if (existing && existing.state !== "dead") return await existing.ready.promise;
 
-	const worker = await spawnJsWorker();
+	const { promise: ready, resolve: resolveSession, reject: rejectSession } = Promise.withResolvers<JsSession>();
+	ready.catch(() => undefined);
 	const session: JsSession = {
 		sessionKey,
-		worker,
-		state: "alive",
+		state: "starting",
+		ownerId,
 		pending: new Map(),
 		queue: Promise.resolve(),
+		queuedWaiters: new Set(),
+		queueTail: settledQueueDeferred(),
+		controllers: new Set(),
+		ready: { promise: ready, resolve: resolveSession, reject: rejectSession },
 	};
-	const { promise: readyPromise, resolve: resolveReady, reject: rejectReady } = Promise.withResolvers<void>();
-	let resolved = false;
-	const unsubscribe = worker.onMessage(msg => {
-		if (!resolved && msg.type === "ready") {
-			resolved = true;
-			resolveReady();
-			return;
-		}
-		if (!resolved && msg.type === "init-failed") {
-			resolved = true;
-			rejectReady(errorFromPayload(msg.error));
-			return;
-		}
-		handleSessionMessage(session, msg);
-	});
+	sessions.set(sessionKey, session);
+
+	let worker: WorkerHandle | undefined;
 	try {
-		// Cold-start can exceed 5s on slow hosts. Let the caller's per-cell timeout dominate so
-		// users can grant more headroom when they raise `timeout` on a cell.
+		worker = await spawnJsWorker();
+		const current = sessions.get(sessionKey);
+		if (current !== session) {
+			await worker.terminate().catch(() => undefined);
+			return (
+				(await current?.ready.promise) ?? Promise.reject(new ToolError("JS context replaced during initialization"))
+			);
+		}
+		session.worker = worker;
+		const { promise: readyPromise, resolve: resolveReady, reject: rejectReady } = Promise.withResolvers<void>();
+		let resolved = false;
+		session.unsubscribe = worker.onMessage(msg => {
+			if (!resolved && msg.type === "ready") {
+				resolved = true;
+				resolveReady();
+				return;
+			}
+			if (!resolved && msg.type === "init-failed") {
+				resolved = true;
+				rejectReady(errorFromPayload(msg.error));
+				return;
+			}
+			handleSessionMessage(session, msg);
+		});
 		const readyTimeoutMs = Math.max(READY_TIMEOUT_MS_DEFAULT, timeoutMs ?? 0);
 		await raceWithTimeout(readyPromise, readyTimeoutMs, "Timed out initializing JS eval worker");
+		if (sessions.get(sessionKey) !== session) {
+			await killSession(session, new ToolError("JS context replaced during initialization"));
+			return (
+				(await sessions.get(sessionKey)?.ready.promise) ??
+				Promise.reject(new ToolError("JS context replaced during initialization"))
+			);
+		}
+		worker.send({ type: "init", snapshot });
+		session.state = "alive";
+		session.ready.resolve(session);
+		return session;
 	} catch (error) {
-		unsubscribe();
-		await worker.terminate().catch(() => undefined);
+		if (sessions.get(sessionKey) === session) sessions.delete(sessionKey);
+		await killSession(session, error instanceof Error ? error : new Error(String(error)));
+		session.ready.reject(error instanceof Error ? error : new Error(String(error)));
 		throw error;
 	}
-	worker.send({ type: "init", snapshot });
-	sessions.set(sessionKey, session);
-	return session;
 }
 
 function handleSessionMessage(session: JsSession, msg: WorkerOutbound): void {
@@ -276,22 +402,54 @@ async function killSessionFor(session: JsSession, error: Error): Promise<void> {
 async function killSession(session: JsSession, error: Error): Promise<void> {
 	if (session.state === "dead") return;
 	session.state = "dead";
-	for (const pending of session.pending.values()) {
-		if (pending.settled) continue;
-		pending.settled = true;
-		for (const ctrl of pending.toolCalls.values()) ctrl.abort(error);
-		pending.reject(error);
-	}
+	const unsubscribe = session.unsubscribe;
+	session.unsubscribe = undefined;
+	unsubscribe?.();
+	session.ready.reject(error);
+	session.queueTail.reject(error);
+	for (const controller of [...session.controllers]) controller.abort(error);
+	session.controllers.clear();
+	session.runSignal = AbortSignal.abort(error);
+	for (const reject of [...session.queuedWaiters]) reject(error);
+	session.queuedWaiters.clear();
+	for (const pending of [...session.pending.values()]) settleRunWithError(session, pending, error);
 	session.pending.clear();
-	await session.worker.terminate().catch(() => undefined);
+	void session.worker?.terminate().catch(() => undefined);
+}
+
+function settleRunWithError(session: JsSession, pending: PendingRun, error: Error): void {
+	if (pending.settled) return;
+	pending.settled = true;
+	for (const ctrl of pending.toolCalls.values()) ctrl.abort(error);
+	pending.toolCalls.clear();
+	session.pending.delete(pending.runId);
+	pending.reject(error);
 }
 
-function safeSend(session: JsSession, msg: WorkerInbound): void {
-	if (session.state !== "alive") return;
+function settledQueueDeferred(): QueueDeferred {
+	const { promise, resolve, reject } = Promise.withResolvers<void>();
+	resolve();
+	return { promise, resolve, reject };
+}
+
+function abortPromise(signal: AbortSignal): Promise<never> {
+	if (signal.aborted) return Promise.reject(reasonToError(signal.reason, "JS worker is not alive"));
+	const { promise, reject } = Promise.withResolvers<never>();
+	const onAbort = (): void => reject(reasonToError(signal.reason, "JS worker is not alive"));
+	signal.addEventListener("abort", onAbort, { once: true });
+	promise.finally(() => signal.removeEventListener("abort", onAbort)).catch(() => undefined);
+	return promise;
+}
+
+function safeSend(session: JsSession, msg: WorkerInbound): boolean {
+	if (session.state !== "alive") return false;
 	try {
-		session.worker.send(msg);
+		session.worker?.send(msg);
+		return true;
 	} catch (err) {
 		logger.debug("js worker send failed", { error: err instanceof Error ? err.message : String(err) });
+		void killSessionFor(session, err instanceof Error ? err : new Error(String(err)));
+		return false;
 	}
 }
 
@@ -352,10 +510,15 @@ async function spawnJsWorker(): Promise<WorkerHandle> {
 			: new Worker(new URL("./worker-entry.ts", import.meta.url).href, { type: "module" });
 		return wrapBunWorker(worker);
 	} catch (err) {
-		logger.warn("Bun Worker spawn failed; using inline JS eval worker (no sync-loop guard)", {
-			error: err instanceof Error ? err.message : String(err),
-		});
-		return spawnInlineWorker();
+		if (process.env.GAJAE_CODE_JS_EVAL_INLINE_WORKER === "1") {
+			logger.warn("Bun Worker spawn failed; using test-only inline JS eval worker", {
+				error: err instanceof Error ? err.message : String(err),
+			});
+			return spawnInlineWorker();
+		}
+		throw new ToolError(
+			`JS eval worker is unavailable and inline fallback is disabled because it cannot interrupt synchronous user code: ${err instanceof Error ? err.message : String(err)}`,
+		);
 	}
 }
 

package/src/eval/js/executor.ts

@@ -10,6 +10,7 @@ export interface JsExecutorOptions {
 	onChunk?: (chunk: string) => Promise<void> | void;
 	signal?: AbortSignal;
 	sessionId: string;
+	ownerId?: string;
 	reset?: boolean;
 	sessionFile?: string;
 	artifactPath?: string;
@@ -68,6 +69,7 @@ export async function executeJs(code: string, options: JsExecutorOptions): Promi
 		await executeInVmContext({
 			sessionKey: options.sessionId,
 			sessionId: options.sessionId,
+			ownerId: options.ownerId,
 			cwd: options.cwd ?? options.session.cwd,
 			session: options.session,
 			reset: options.reset,

package/src/eval/js/index.ts

@@ -23,6 +23,7 @@ export default {
 			deadlineMs: opts.deadlineMs,
 			signal: opts.signal,
 			sessionId: namespaceSessionId(opts.sessionId),
+			ownerId: opts.kernelOwnerId,
 			sessionFile: opts.sessionFile,
 			reset: opts.reset,
 			artifactPath: opts.artifactPath,