dsh-ptc-plus 0.4.1 → 0.4.3

package/internal/edit-transport-owner.js

@@ -238,11 +238,34 @@ export function createEditTransportOwner(ctx, {
     }
   }
 
+  const disposeInstalled = (installed) => {
+    const failures = []
+    for (const key of ['disposePresentation', 'disposeRegistration']) {
+      const dispose = installed[key]
+      if (dispose === undefined) continue
+      try {
+        dispose()
+        installed[key] = undefined
+      } catch (error) {
+        failures.push(error)
+      }
+    }
+    if (failures.length > 0) {
+      throw new AggregateError(failures, 'ptc-plus: edit_run_code scope disposal failed')
+    }
+  }
+
   const uninstall = (agent) => {
     const installed = installedScopes.get(agent)
     if (installed === undefined) return
-    installedScopes.delete(agent)
-    installed.dispose()
+    try {
+      disposeInstalled(installed)
+    } finally {
+      if (installed.disposePresentation === undefined
+        && installed.disposeRegistration === undefined) {
+        installedScopes.delete(agent)
+      }
+    }
   }
 
   return Object.freeze({
@@ -251,11 +274,19 @@ export function createEditTransportOwner(ctx, {
       currentDurableReplay = nextConfig.durableReplay
     },
     isInstalled(agent) {
-      return installedScopes.has(agent)
+      const installed = installedScopes.get(agent)
+      return installed?.disposePresentation !== undefined
+        && installed.disposeRegistration !== undefined
     },
     ensureInstalled(agent) {
       const installed = installedScopes.get(agent)
-      if (installed !== undefined) return installed.definition
+      if (installed !== undefined) {
+        if (installed.disposePresentation !== undefined
+          && installed.disposeRegistration !== undefined) {
+          return installed.definition
+        }
+        uninstall(agent)
+      }
       const liveSchemas = typeof toolSchemasForAgent === 'function'
         ? toolSchemasForAgent(agent)
         : []
@@ -271,24 +302,31 @@ export function createEditTransportOwner(ctx, {
       if (typeof disposeRegistration !== 'function') {
         throw new Error('ptc-plus: DSH tools.register did not return a disposer')
       }
-      let disposePresentation
+      const nextInstalled = {
+        definition,
+        disposePresentation: undefined,
+        disposeRegistration,
+        sessionId: sessionId(agent),
+      }
+      installedScopes.set(agent, nextInstalled)
       try {
-        disposePresentation = scopedTools.presentAs('both')
+        const disposePresentation = scopedTools.presentAs('both')
         if (typeof disposePresentation !== 'function') {
           throw new Error('ptc-plus: DSH tools.presentAs did not return a disposer')
         }
+        nextInstalled.disposePresentation = disposePresentation
       } catch (error) {
-        disposeRegistration()
+        try {
+          uninstall(agent)
+        } catch (cleanupError) {
+          throw new AggregateError(
+            [error, cleanupError],
+            'ptc-plus: edit_run_code installation and rollback failed',
+            { cause: error },
+          )
+        }
         throw error
       }
-      let active = true
-      const dispose = () => {
-        if (!active) return
-        active = false
-        disposePresentation()
-        disposeRegistration()
-      }
-      installedScopes.set(agent, { definition, dispose, sessionId: sessionId(agent) })
       return definition
     },
     handleResult(exec, result) {
@@ -305,28 +343,50 @@ export function createEditTransportOwner(ctx, {
       releaseClaim(pending.id, pending.targetCallSeq)
     },
     disposeAgent(agent) {
-      uninstall(agent)
+      let failure
+      try {
+        uninstall(agent)
+      } catch (error) {
+        failure = error
+      }
       const id = sessionId(agent)
       if (id !== undefined) {
         discardSettlements(id)
         editClaims.delete(id)
       }
+      if (failure !== undefined) throw failure
     },
     disposeSession(session) {
       const id = String(session.id)
+      const failures = []
       for (const [agent, installed] of installedScopes) {
         if (installed.sessionId !== id) continue
-        installedScopes.delete(agent)
-        installed.dispose()
+        try {
+          uninstall(agent)
+        } catch (error) {
+          failures.push(error)
+        }
       }
       discardSettlements(id)
       editClaims.delete(id)
+      if (failures.length > 0) {
+        throw new AggregateError(failures, 'ptc-plus: edit_run_code session disposal failed')
+      }
     },
     dispose() {
       discardSettlements()
       editClaims.clear()
-      for (const installed of installedScopes.values()) installed.dispose()
-      installedScopes.clear()
+      const failures = []
+      for (const agent of [...installedScopes.keys()]) {
+        try {
+          uninstall(agent)
+        } catch (error) {
+          failures.push(error)
+        }
+      }
+      if (failures.length > 0) {
+        throw new AggregateError(failures, 'ptc-plus: edit_run_code owner disposal failed')
+      }
     },
   })
 }

package/internal/execution-seam-compat.js

@@ -35,6 +35,19 @@ export const LEGACY_EXECUTION_SEAM_SERVICE = 'codeRuntime'
 
 const SEAM_SERVICES = Object.freeze([EXECUTION_SEAM_SERVICE, LEGACY_EXECUTION_SEAM_SERVICE])
 
+/**
+ * How long the plugin waits for the host's execution seam before it reports the
+ * deployment as unsupported.
+ *
+ * Both seam names belong to the host's code-runtime row, so a composed host
+ * publishes one while the loader settles its entries. A profile that never
+ * registers either one cannot be served, and its activation promise must settle
+ * with a diagnostic: the host awaits loader settlement before it becomes
+ * usable, so an unbounded wait would park the whole host instead of failing
+ * this entry.
+ */
+const SEAM_ATTACHMENT_TIMEOUT_MS = 30_000
+
 /**
  * Descriptors the plugin replaces with the capabilities of its own execution.
  * `executionInstructions` describes the wrapped provider's program model, which
@@ -105,15 +118,8 @@ export function createExecutionSeam(service, serviceName) {
       if (installed !== undefined) throw new Error('ptc-plus: execution seam already taken over')
       const saved = new Map()
       const written = new Map()
-      const define = (name, descriptor) => {
-        const previous = Object.getOwnPropertyDescriptor(service, name)
-        if (!saved.has(name)) saved.set(name, previous)
-        // Preserve the shadowed property's visibility so a consumer that
-        // enumerates the provider sees the same member set.
-        Object.defineProperty(service, name, { enumerable: previous?.enumerable ?? false, ...descriptor })
-        written.set(name, Object.getOwnPropertyDescriptor(service, name))
-      }
-      define('run', {
+      const requested = new Map()
+      requested.set('run', {
         configurable: true,
         writable: true,
         value: current
@@ -125,7 +131,32 @@ export function createExecutionSeam(service, serviceName) {
           : request => execute(request),
       })
       for (const name of WITHHELD_DESCRIPTORS) {
-        define(name, { configurable: true, value: name === 'executionInstructions' ? '' : undefined })
+        requested.set(name, { configurable: true, value: name === 'executionInstructions' ? '' : undefined })
+      }
+      const extensible = Object.isExtensible(service)
+      for (const [name, descriptor] of requested) {
+        const previous = Object.getOwnPropertyDescriptor(service, name)
+        saved.set(name, previous)
+        const next = { enumerable: previous?.enumerable ?? false, ...descriptor }
+        requested.set(name, next)
+        const probe = {}
+        if (previous !== undefined) Object.defineProperty(probe, name, previous)
+        if (!extensible) Object.preventExtensions(probe)
+        Object.defineProperty(probe, name, next)
+      }
+      try {
+        for (const [name, descriptor] of requested) {
+          Object.defineProperty(service, name, descriptor)
+          written.set(name, Object.getOwnPropertyDescriptor(service, name))
+        }
+      } catch (error) {
+        for (const name of [...written.keys()].reverse()) {
+          if (!descriptorsMatch(Object.getOwnPropertyDescriptor(service, name), written.get(name))) continue
+          const descriptor = saved.get(name)
+          if (descriptor === undefined) delete service[name]
+          else Object.defineProperty(service, name, descriptor)
+        }
+        throw error
       }
       const restore = () => {
         if (installed !== restore) return
@@ -145,9 +176,10 @@ export function createExecutionSeam(service, serviceName) {
 /**
  * Wait for the host's execution seam and attach the plugin to the live one.
  *
- * A deployment registers one generation, so the current service is preferred
- * whenever both are live; the preceding generation attaches only when the
- * current one is absent. The injected scope requires the plugin's own core
+ * The current service is preferred whenever both are live; the preceding
+ * generation attaches only when the current one is absent, and a current
+ * service registered later retires the live legacy injection before attaching.
+ * The injected scope requires the plugin's own core
  * services as well, so the callback receives a context the plugin can work in,
  * and everything the plugin registers there belongs to the seam the host
  * registered: unloading that service unloads the plugin, and registering it
@@ -157,16 +189,107 @@ export function createExecutionSeam(service, serviceName) {
  * @param {object} ctx - the plugin context.
  * @param {object} options - `services` are the plugin's own required services,
  *   and `attach` is invoked with the injected scope and the seam handle.
- * @returns {Promise<unknown>} settles with the attach result.
+ *   `attachmentTimeoutMs` bounds the wait for a seam that never appears.
+ * @returns {Promise<void>} settles after attachment with a valid Cordis effect value.
  */
-export function installExecutionSeam(ctx, { services = [], attach }) {
+export function installExecutionSeam(ctx, {
+  services = [],
+  attach,
+  reportFailure,
+  attachmentTimeoutMs = SEAM_ATTACHMENT_TIMEOUT_MS,
+}) {
   let live
+  let stopping = false
+  let startWatcher
+  let unusableCurrent
+  const report = (error, name) => {
+    try {
+      reportFailure?.(error, name)
+    } catch {
+      // A reporting failure cannot replace the seam failure it describes.
+    }
+  }
+  const registerLifecycle = (entry, name, scope) => scope.effect?.(() => () => {
+    if (live !== entry) return
+    if (entry.retiring !== undefined) return
+    live = undefined
+    if (!stopping && name === EXECUTION_SEAM_SERVICE
+      && readService(ctx, EXECUTION_SEAM_SERVICE) === undefined
+      && readService(ctx, LEGACY_EXECUTION_SEAM_SERVICE) !== undefined) {
+      startWatcher(LEGACY_EXECUTION_SEAM_SERVICE)
+    }
+  }, 'ptc-plus execution seam lifecycle')
   const select = (name, scope) => {
-    if (live !== undefined) return live.attached
-    if (name === LEGACY_EXECUTION_SEAM_SERVICE && readService(ctx, EXECUTION_SEAM_SERVICE) !== undefined) {
+    const currentService = readService(ctx, EXECUTION_SEAM_SERVICE)
+    if (unusableCurrent !== undefined && currentService !== unusableCurrent) {
+      unusableCurrent = undefined
+    }
+    if (name === EXECUTION_SEAM_SERVICE && currentService === unusableCurrent) {
+      // A current service whose attach already failed cannot supersede the live
+      // legacy attachment. A replacement service object clears the marker above.
+      return live?.attached
+    }
+    if (live !== undefined) {
+      if (name !== EXECUTION_SEAM_SERVICE || live.name === EXECUTION_SEAM_SERVICE) return live.attached
+      const previous = live
+      if (previous.retiring !== undefined) return previous.retiring
+      const disposeLegacy = previous.scope?.fiber?.dispose
+      if (typeof disposeLegacy !== 'function') {
+        throw new Error('ptc-plus: live codeRuntime attachment cannot be superseded without a disposable injected scope')
+      }
+      let resolveActivation
+      let rejectActivation
+      const activation = new Promise((resolve, reject) => {
+        resolveActivation = resolve
+        rejectActivation = reject
+      })
+      previous.retiring = activation
+      let retirement
+      try {
+        retirement = disposeLegacy.call(previous.scope.fiber)
+      } catch (error) {
+        previous.retiring = undefined
+        rejectActivation(error)
+        return activation
+      }
+      let entry
+      const operation = Promise.resolve(retirement).then(() => {
+        if (live !== previous) return undefined
+        previous.retiring = undefined
+        entry = { name, scope }
+        live = entry
+        registerLifecycle(entry, name, scope)
+        const attached = attach(scope, createExecutionSeam(scope?.[name] ?? readService(ctx, name), name))
+        entry.attached = attached
+        return attached
+      })
+      operation.then(resolveActivation, error => {
+        if (live === previous) previous.retiring = undefined
+        else if (live === entry) {
+          // The current attach failed after the legacy fiber was retired. Keep
+          // the plugin attached by re-arming the preceding generation instead
+          // of silently returning run_code to the host provider.
+          live = undefined
+          unusableCurrent = readService(ctx, EXECUTION_SEAM_SERVICE)
+          if (readService(ctx, LEGACY_EXECUTION_SEAM_SERVICE) !== undefined) {
+            try {
+              startWatcher(LEGACY_EXECUTION_SEAM_SERVICE)
+            } catch (fallbackError) {
+              report(fallbackError, LEGACY_EXECUTION_SEAM_SERVICE)
+            }
+          }
+        }
+        report(error, name)
+        rejectActivation(error)
+      })
+      return activation
+    }
+    if (name === LEGACY_EXECUTION_SEAM_SERVICE
+      && currentService !== undefined
+      && currentService !== unusableCurrent) {
       return undefined
     }
-    const entry = { name }
+    const entry = { name, scope }
     live = entry
     try {
       entry.attached = attach(scope, createExecutionSeam(scope?.[name] ?? readService(ctx, name), name))
@@ -174,20 +297,59 @@ export function installExecutionSeam(ctx, { services = [], attach }) {
       live = undefined
       throw error
     }
-    scope.effect?.(() => () => {
-      if (live === entry) live = undefined
-    }, 'ptc-plus execution seam lifecycle')
+    registerLifecycle(entry, name, scope)
     return entry.attached
   }
+  startWatcher = (name, settlement) => ctx.inject([...services, name], scope => {
+    let selected
+    try {
+      selected = select(name, scope)
+    } catch (error) {
+      settlement?.reject(error)
+      report(error, name)
+      throw error
+    }
+    if (selected !== null && typeof selected === 'object' && typeof selected.then === 'function') {
+      const operation = Promise.resolve(selected)
+      operation.then(
+        value => settlement?.resolve(value),
+        error => settlement?.reject(error),
+      )
+      return operation.then(() => undefined)
+    }
+    settlement?.resolve(selected)
+    return undefined
+  })
   const pending = SEAM_SERVICES.map(name => new Promise((resolve, reject) => {
-    ctx.inject([...services, name], scope => {
-      try {
-        resolve(select(name, scope))
-      } catch (error) {
-        reject(error)
-        throw error
-      }
-    })
+    startWatcher(name, { resolve, reject })
   }))
-  return Promise.race(pending)
+  ctx.effect?.(() => () => { stopping = true }, 'ptc-plus execution seam watcher lifecycle')
+  const bound = seamWaitBound(ctx, attachmentTimeoutMs)
+  return Promise.race([Promise.race(pending), bound.promise])
+    .then(() => undefined)
+    .finally(bound.cancel)
+}
+
+/**
+ * Bound the wait for a seam the deployment never registers.
+ *
+ * @param {object} ctx - the plugin context owning the timer.
+ * @param {number} timeoutMs - positive bound, or a non-positive value for none.
+ * @returns the rejection promise and the disposer that clears its timer.
+ */
+function seamWaitBound(ctx, timeoutMs) {
+  if (!(timeoutMs > 0)) return { promise: new Promise(() => {}), cancel: () => {} }
+  let timer
+  const promise = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error(
+      `ptc-plus: no host execution seam (${SEAM_SERVICES.join(' or ')}) is registered; this deployment does not publish a code runtime`,
+    )), timeoutMs)
+  })
+  // The timer is not unref'd: this rejection is the only thing that settles the
+  // activation promise on a deployment that never registers a seam, and an
+  // unref'd timer would let the process drain before it fires. It is cleared as
+  // soon as the race settles so an attached seam never holds the loop open.
+  const cancel = () => clearTimeout(timer)
+  ctx.effect?.(() => () => cancel(), 'ptc-plus execution seam wait bound')
+  return { promise, cancel }
 }

package/internal/failure-reporting.js

@@ -1,15 +1,19 @@
 import { diagnostic } from './diagnostic.js'
-import { AsyncLocalStorage } from 'node:async_hooks'
 import { createHash } from 'node:crypto'
-import { moduleRuntimeIntrinsics as internal } from './compiler-intrinsics.js'
+import { createPrivateAsyncLocalStorage } from './async-local-storage-intrinsics.js'
+import { runtimeIntrinsics as internal } from './runtime-intrinsics.js'
 
+const { Object, RegExp, isArray, numberIsSafeInteger, toNumber, toString,
+  splitString, startsWith, endsWith, sliceString, searchString, replaceString,
+  trimString, regexpExec, prependArray, join, bufferByteLength, bufferIsBuffer,
+  bufferSubarray, bufferToString } = internal
 export const MAX_ERROR_LOG_BYTES = 4 * 1024
 export const FAILURE_HINT_THRESHOLD = 3
 export const LONG_CELL_CODE_UNITS = 2_000
 const BINDING_FAILURE = Symbol('binding failure')
 const PROGRAM_FAILURES = new internal.WeakMap()
 const MAX_CAUSE_CODE_UNITS = 2048
-const exceptionOrigins = new AsyncLocalStorage()
+const exceptionOrigins = createPrivateAsyncLocalStorage()
 const runExceptionScope = exceptionOrigins.run.bind(exceptionOrigins)
 const currentExceptionScope = exceptionOrigins.getStore.bind(exceptionOrigins)
 
@@ -36,14 +40,14 @@ export function recordExceptionOrigin(error, origin, { reset = false, sourceFail
 }
 
 const SOURCE_LINE_BREAK = /\r\n|[\n\r\u2028\u2029]/
-const sourceLines = source => source.split(SOURCE_LINE_BREAK)
+const sourceLines = source => splitString(source, SOURCE_LINE_BREAK)
 
 /** A cell position is a 1-based line and column inside its source. The column
  * may address the position just after the last character of a line. */
 function boundedPosition(position, lines) {
   if (position === null || typeof position !== 'object'
-    || !Number.isSafeInteger(position.line) || position.line < 1
-    || !Number.isSafeInteger(position.column) || position.column < 1
+    || !numberIsSafeInteger(position.line) || position.line < 1
+    || !numberIsSafeInteger(position.column) || position.column < 1
     || position.line > lines.length || position.column > lines[position.line - 1].length + 1) return undefined
   return { line: position.line, column: position.column }
 }
@@ -55,14 +59,15 @@ export function cellPosition(position, source) {
 
 /** Only a fact belonging to the current original source can bypass its map. */
 export function exceptionOriginPosition(origins, source) {
-  if (!Array.isArray(origins)) return undefined
+  if (!isArray(origins)) return undefined
   const prefix = `eval:${createHash('sha256').update(source).digest('hex')}:`
   const lines = sourceLines(source)
-  for (const origin of origins) {
-    if (typeof origin !== 'string' || !origin.startsWith(prefix)) continue
-    const match = /^(\d+):(\d+)$/.exec(origin.slice(prefix.length))
+  for (let index = 0; index < origins.length; index += 1) {
+    const origin = origins[index]
+    if (typeof origin !== 'string' || !startsWith(origin, prefix)) continue
+    const match = regexpExec(/^(\d+):(\d+)$/, sliceString(origin, prefix.length))
     if (match === null) continue
-    const position = boundedPosition({ line: Number(match[1]), column: Number(match[2]) }, lines)
+    const position = boundedPosition({ line: toNumber(match[1]), column: toNumber(match[2]) }, lines)
     if (position !== undefined) return position
   }
   return undefined
@@ -124,7 +129,7 @@ export function messageOf(error, fallback = 'Unprintable error') {
   const message = safeProperty(error, 'message')
   if (typeof message === 'string') return message
   try {
-    return String(error)
+    return toString(error)
   } catch {
     return fallback
   }
@@ -139,20 +144,21 @@ export function processExitDescription(code, signal) {
 
 export function firstLine(value, fallback = undefined) {
   if (typeof value !== 'string') return fallback
-  const line = value.split(/[\r\n]/, 1)[0]
+  const line = splitString(value, /[\r\n]/, 1)[0]
   return line.length > 0 ? line : fallback
 }
 
 export function oneLineMessage(error) {
-  return firstLine(messageOf(error), 'Unknown error').replace(/\s+\(\d+:\d+\)$/, '')
+  return replaceString(firstLine(messageOf(error), 'Unknown error'), /\s+\(\d+:\d+\)$/, '')
 }
 
 /** Return DSH's reported missing-description property path when it is actionable. */
 export function missingDescriptionPath(error) {
-  const violations = messageOf(error).matchAll(/missing required property ["']([^"']+)["']/g)
-  for (const match of violations) {
+  const pattern = /missing required property ["']([^"']+)["']/g
+  const message = messageOf(error)
+  for (let match = regexpExec(pattern, message); match !== null; match = regexpExec(pattern, message)) {
     const path = match[1]
-    if (path === 'description' || path.endsWith('.description')) return path
+    if (path === 'description' || endsWith(path, '.description')) return path
   }
   return undefined
 }
@@ -167,18 +173,18 @@ export function limitLogs(logs) {
   let bytes = 0
   const tail = []
   for (let index = logs.length - 1; index >= 0; index -= 1) {
-    const size = Buffer.byteLength(logs[index], 'utf8') + 1
+    const size = bufferByteLength(logs[index], 'utf8') + 1
     if (bytes + size > MAX_ERROR_LOG_BYTES) break
     bytes += size
-    tail.unshift(logs[index])
+    prependArray(tail, logs[index])
   }
   return tail
 }
 
 /** A frame is only useful when its 1-based line and column are safe integers. */
 function structuralPosition(position) {
-  return Number.isSafeInteger(position.line) && position.line >= 1
-    && Number.isSafeInteger(position.column) && position.column >= 1 ? position : undefined
+  return numberIsSafeInteger(position.line) && position.line >= 1
+    && numberIsSafeInteger(position.column) && position.column >= 1 ? position : undefined
 }
 
 /** Extract the first frame for the active cell. The frame is reported in the
@@ -187,10 +193,10 @@ function structuralPosition(position) {
 export function errorPosition(error, filename, source) {
   const stack = safeProperty(error, 'stack')
   if (typeof stack !== 'string') return undefined
-  const escaped = filename.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-  const match = new RegExp(`${escaped}:(\\d+):(\\d+)`).exec(stack)
+  const escaped = replaceString(filename, /[.*+?^${}()|[\]\\]/g, '\\$&')
+  const match = regexpExec(new RegExp(`${escaped}:(\\d+):(\\d+)`), stack)
   if (match === null) return undefined
-  const position = { line: Number(match[1]), column: Number(match[2]) }
+  const position = { line: toNumber(match[1]), column: toNumber(match[2]) }
   return source === undefined ? structuralPosition(position) : cellPosition(position, source)
 }
 
@@ -206,12 +212,14 @@ export function errorDetails(error, filename, source) {
   const causeMessage = firstLine(safeProperty(candidate, 'message'))
   const causeCode = firstLine(safeProperty(candidate, 'code'))
   const stderr = safeProperty(error, 'stderr')
-  const stderrText = typeof stderr === 'string' ? stderr.slice(0, MAX_CAUSE_CODE_UNITS)
-    : Buffer.isBuffer(stderr) ? stderr.subarray(0, MAX_CAUSE_CODE_UNITS).toString('utf8') : ''
-  const boundedMessage = message.slice(0, MAX_CAUSE_CODE_UNITS)
-  const continuation = boundedMessage.search(/[\r\n]/)
-  const detail = [continuation < 0 ? '' : boundedMessage.slice(continuation + 1), stderrText]
-    .join(' ').slice(0, MAX_CAUSE_CODE_UNITS).replace(/\s+/g, ' ').trim()
+  const stderrText = typeof stderr === 'string' ? sliceString(stderr, 0, MAX_CAUSE_CODE_UNITS)
+    : bufferIsBuffer(stderr)
+      ? bufferToString(bufferSubarray(stderr, 0, MAX_CAUSE_CODE_UNITS), 'utf8') : ''
+  const boundedMessage = sliceString(message, 0, MAX_CAUSE_CODE_UNITS)
+  const continuation = searchString(boundedMessage, /[\r\n]/)
+  const detailParts = [continuation < 0 ? '' : sliceString(boundedMessage, continuation + 1), stderrText]
+  const detail = trimString(replaceString(
+    sliceString(join(detailParts, ' '), 0, MAX_CAUSE_CODE_UNITS), /\s+/g, ' '))
   const cause = causeMessage === undefined
     ? detail.length === 0 ? undefined : { message: detail }
     : {

package/internal/isolated-worker.js

@@ -3,6 +3,7 @@ import { EventEmitter } from 'node:events'
 import { resolve } from 'node:path'
 import { PassThrough } from 'node:stream'
 import { pathToFileURL } from 'node:url'
+import { helperProcessEnvironment, isElectronHost } from './worker-environment.js'
 
 /**
  * Fallback bound for a helper that answers the stop request and then keeps the
@@ -43,6 +44,7 @@ export class IsolatedWorker extends EventEmitter {
     this.stderr = new PassThrough()
     this.protocol = protocol
     this.exited = false
+    this.exitedPromise = new Promise(resolve => { this.resolveExited = resolve })
     this.exitCode = undefined
     this.exitSignal = undefined
     this.released = false
@@ -63,12 +65,15 @@ export class IsolatedWorker extends EventEmitter {
     }
     // child_process.fork mutates the env object it receives by copying
     // NODE_V8_COVERAGE into it. Snapshot the caller's projection first so the
-    // inner Worker receives exactly the projected user environment, while the
-    // helper process can still carry the host's coverage variable.
-    const workerEnvironment = env === undefined ? undefined : { ...env }
+    // inner Worker receives exactly the projected user environment. An Electron
+    // Host also needs a helper-only startup override; it must not reach user code.
+    const electronHost = isElectronHost()
+    const projectedEnvironment = env === undefined && electronHost ? process.env : env
+    const workerEnvironment = projectedEnvironment === undefined ? undefined : { ...projectedEnvironment }
+    const forkEnvironment = helperProcessEnvironment(projectedEnvironment, process.platform, electronHost)
     this.child = fork(helper, [], {
       stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-      env,
+      env: forkEnvironment,
       serialization: 'advanced',
       // The helper starts with the host's own startup arguments removed, matching
       // the isolation the in-host worker had with execArgv: [].
@@ -80,6 +85,7 @@ export class IsolatedWorker extends EventEmitter {
       this.exited = true
       this.exitCode = code
       this.exitSignal = signal
+      this.resolveExited()
       this.#rejectUtilizationRequests(new Error('kernel helper exited before answering utilization sampling'))
     })
     // A ChildProcess 'close' follows 'exit' once its stdio has really ended, which
@@ -264,7 +270,7 @@ export class IsolatedWorker extends EventEmitter {
     const started = Date.now()
     const killAt = started + ISOLATED_RELEASE_MS
     const confirmBy = started + ISOLATED_STOP_MS
-    const exited = new Promise(resolve => { this.child.once('exit', resolve) })
+    const exited = this.exitedPromise
     const onReleased = message => {
       if (message?.type === 'worker-message' && message.value?.type === 'shutdown-released') this.released = true
     }
@@ -278,18 +284,19 @@ export class IsolatedWorker extends EventEmitter {
         // The channel is closed; the kill path below owns the instance.
       }
       if (!await leftWithin(this, remaining(killAt))) {
+        let killFailure
         if (!this.exited) {
           try {
             await this.kill()
           } catch (error) {
-            // Reclamation failed: keep the failure observable on the transport so
-            // the owner can retain responsibility for this instance.
-            this.reclamationFailure = error
-            throw error
+            // On Windows a process that has already left can report a refused
+            // kill before Node delivers its exit event. The real exit observation
+            // decides whether this instance was reclaimed.
+            killFailure = error
           }
         }
         if (!this.exited && !await leftWithin(this, remaining(confirmBy))) {
-          const failure = new Error('kernel helper did not exit before the close deadline')
+          const failure = killFailure ?? new Error('kernel helper did not exit before the close deadline')
           this.reclamationFailure = failure
           throw failure
         }