dsh-ptc-plus 0.4.8 → 0.5.0

package/internal/execution-seam-compat.js

@@ -1,39 +1,11 @@
-/**
- * Own how PTC Plus attaches to the host's program-execution seam.
- *
- * DSH registers one execution seam per generation. The current release
- * registers `ctx.ptcRuntime` (`@deepseek-ai/dsh-ptc-runtime`); the preceding one
- * registered `ctx.codeRuntime` (`@deepseek-ai/dsh-code-runtime`). Both run one
- * model-written program against host async bindings. They differ in the service
- * name, in the call shape (`resolve(request)` then `run(spec)` against a single
- * `run(request)`), and in the capability descriptors a provider publishes.
- * Which seam is live is decided by the registered service, never by a version
- * string, so a deployment on either generation obtains the same behavior.
- *
- * PTC Plus replaces the execution of session cells with its own persistent
- * REPL. The object DSH describes to the model is therefore the plugin's
- * execution, not the wrapped provider's, so `takeOver()` answers the
- * descriptors the plugin can honor and withholds the ones it cannot. The REPL
- * runs every cell in one long-lived worker rather than a fresh process per
- * call, applies the session's configured budgets rather than a per-call host
- * deadline, and performs no file confinement. DSH gates `timeoutMs` on
- * `timeout` and resolves or escalates file policy on `sandboxMode`, so
- * withholding those descriptors keeps DSH's authority decisions with DSH
- * instead of having this plugin accept an input it would then ignore.
- *
- * A seam-neutral request carries exactly `program`, `bindings`, and `signal`:
- * the fields PTC Plus consumes. A resolved spec's directory, deadline, and
- * authority describe the provider whose execution was replaced, and are neither
- * forwarded to the session kernel nor re-derived here.
- */
-
-/** Cordis service name registered by the current DSH generation. */
+/** Resolved-spec Cordis execution contract. */
 export const EXECUTION_SEAM_SERVICE = 'ptcRuntime'
 
-/** Cordis service name registered by the preceding DSH generation. */
+/** Request-only Cordis execution contract. */
 export const LEGACY_EXECUTION_SEAM_SERVICE = 'codeRuntime'
 
 const SEAM_SERVICES = Object.freeze([EXECUTION_SEAM_SERVICE, LEGACY_EXECUTION_SEAM_SERVICE])
+const PLUGIN_EXECUTION_SEAM = Symbol.for('dsh-ptc-plus.execution-seam')
 
 /**
  * How long the plugin waits for the host's execution seam before it reports the
@@ -48,34 +20,12 @@ const SEAM_SERVICES = Object.freeze([EXECUTION_SEAM_SERVICE, LEGACY_EXECUTION_SE
  */
 const SEAM_ATTACHMENT_TIMEOUT_MS = 30_000
 
-/**
- * Descriptors the plugin replaces with the capabilities of its own execution.
- * `executionInstructions` describes the wrapped provider's program model, which
- * no longer applies; `timeout` and `sandboxMode` gate host inputs the plugin
- * cannot honor. Withdrawal is unconditional because the rule is a property of
- * the plugin's execution, not of a generation: the preceding generation's
- * contract defines none of these members and nothing in its install closure
- * reads them, so withdrawing there is inert, while a provider that published
- * them stays unable to outlive the takeover.
- */
-const WITHHELD_DESCRIPTORS = Object.freeze(['executionInstructions', 'sandboxMode', 'timeout'])
-
 /** Read a registered service without declaring an injection requirement. */
 function readService(ctx, name) {
   if (typeof ctx?.get === 'function') return ctx.get(name)
   return ctx?.[name]
 }
 
-function descriptorsMatch(left, right) {
-  if (left === undefined || right === undefined) return left === right
-  return left.value === right.value
-    && left.get === right.get
-    && left.set === right.set
-    && left.writable === right.writable
-    && left.enumerable === right.enumerable
-    && left.configurable === right.configurable
-}
-
 /**
  * Build the seam handle for one live execution service.
  * @param {object} service - the registered `ctx.ptcRuntime` or `ctx.codeRuntime`.
@@ -85,6 +35,7 @@ export function createExecutionSeam(service, serviceName) {
   if (service === null || typeof service !== 'object') {
     throw new TypeError(`ptc-plus: ${serviceName} must be an execution service object`)
   }
+  if (typeof service[PLUGIN_EXECUTION_SEAM] === 'function') return service[PLUGIN_EXECUTION_SEAM]()
   const current = serviceName === EXECUTION_SEAM_SERVICE
   const upstreamRun = service.run
   if (typeof upstreamRun !== 'function') {
@@ -95,90 +46,95 @@ export function createExecutionSeam(service, serviceName) {
     throw new TypeError('ptc-plus: ptcRuntime.resolve must be a function')
   }
   let installed
-  return Object.freeze({
+  const sourceListeners = new Set()
+  let available = true
+  const requireAvailable = () => {
+    if (!available) throw new Error(`ptc-plus: original ${serviceName} generation is unavailable`)
+  }
+  const requireCompatible = () => {
+    requireAvailable()
+    if (installed !== undefined && service.language !== installed.language) {
+      throw new Error(`ptc-plus: current original language ${JSON.stringify(service.language)} is incompatible with the active ${JSON.stringify(installed.language)} runtime`)
+    }
+  }
+  const provider = Object.freeze({
+    get language() { requireCompatible(); return service.language },
+    get isolation() { requireCompatible(); return installed === undefined ? service.isolation : 'worker-thread' },
+    get executionInstructions() { requireCompatible(); return installed === undefined ? service.executionInstructions ?? '' : '' },
+    get sandboxMode() { requireCompatible(); return installed === undefined ? service.sandboxMode : undefined },
+    get timeout() { requireCompatible(); return installed === undefined ? service.timeout : undefined },
+    resolve(request) {
+      requireCompatible()
+      return current ? upstreamResolve.call(service, request) : request
+    },
+    run(input) {
+      requireCompatible()
+      return installed === undefined ? upstreamRun.call(service, input) : installed.execute(input)
+    },
+    [PLUGIN_EXECUTION_SEAM]() { return seam },
+  })
+  const seam = Object.freeze({
     serviceName,
-    language: service.language,
+    get language() { requireAvailable(); return service.language },
+    provider,
+    get active() { return installed !== undefined && service.language === installed.language },
+    onSourceChange(listener) {
+      sourceListeners.add(listener)
+      return () => sourceListeners.delete(listener)
+    },
+    sourceChanged() {
+      return Promise.all([...sourceListeners].map(listener => listener())).then(() => undefined)
+    },
     /**
-     * Run one program through the provider this plugin wraps. The current
-     * generation resolves the request before running it, exactly as its own
-     * consumer does; the preceding generation accepts the request directly.
+     * Run one program through the provider this plugin wraps. The resolved-spec
+     * contract resolves the request before running it, exactly as its consumer
+     * does; the request-only contract accepts the request directly.
      */
     invokeUpstream(request) {
+      requireCompatible()
       return current
         ? upstreamRun.call(service, upstreamResolve.call(service, request))
         : upstreamRun.call(service, request)
     },
-    /**
-     * Install the plugin's execution entry, and its capability descriptors, on
-     * the live service. Only one takeover is live at a time.
-     * @param {(request: object) => Promise<object>} execute - the plugin's entry.
-     * @returns {() => void} restores every descriptor this call replaced.
-     */
-    takeOver(execute) {
-      if (installed !== undefined) throw new Error('ptc-plus: execution seam already taken over')
-      const saved = new Map()
-      const written = new Map()
-      const requested = new Map()
-      requested.set('run', {
-        configurable: true,
-        writable: true,
-        value: current
-          ? spec => execute({
-              program: spec.program,
-              bindings: spec.bindings,
-              signal: spec.signal,
-            })
-          : request => execute(request),
-      })
-      for (const name of WITHHELD_DESCRIPTORS) {
-        requested.set(name, { configurable: true, value: name === 'executionInstructions' ? '' : undefined })
-      }
-      const extensible = Object.isExtensible(service)
-      for (const [name, descriptor] of requested) {
-        const previous = Object.getOwnPropertyDescriptor(service, name)
-        saved.set(name, previous)
-        const next = { enumerable: previous?.enumerable ?? false, ...descriptor }
-        requested.set(name, next)
-        const probe = {}
-        if (previous !== undefined) Object.defineProperty(probe, name, previous)
-        if (!extensible) Object.preventExtensions(probe)
-        Object.defineProperty(probe, name, next)
-      }
-      try {
-        for (const [name, descriptor] of requested) {
-          Object.defineProperty(service, name, descriptor)
-          written.set(name, Object.getOwnPropertyDescriptor(service, name))
-        }
-      } catch (error) {
-        for (const name of [...written.keys()].reverse()) {
-          if (!descriptorsMatch(Object.getOwnPropertyDescriptor(service, name), written.get(name))) continue
-          const descriptor = saved.get(name)
-          if (descriptor === undefined) delete service[name]
-          else Object.defineProperty(service, name, descriptor)
-        }
-        throw error
-      }
+    runUpstream(spec) {
+      requireCompatible()
+      return upstreamRun.call(service, spec)
+    },
+    installExecute(execute) {
+      requireAvailable()
+      if (typeof execute !== 'function') throw new TypeError('ptc-plus: execution entry must be a function')
+      if (installed !== undefined) throw new Error('ptc-plus: execution seam already installed')
+      const entry = { execute, language: service.language }
+      installed = entry
       const restore = () => {
-        if (installed !== restore) return
+        if (installed !== entry) return
         installed = undefined
-        for (const [name, descriptor] of saved) {
-          if (!descriptorsMatch(Object.getOwnPropertyDescriptor(service, name), written.get(name))) continue
-          if (descriptor === undefined) delete service[name]
-          else Object.defineProperty(service, name, descriptor)
-        }
       }
-      installed = restore
       return restore
     },
+    retire() {
+      available = false
+      installed = undefined
+      sourceListeners.clear()
+    },
   })
+  return seam
+}
+
+function registeredExecutionSeam(service, serviceName) {
+  const seam = createExecutionSeam(service, serviceName)
+  if (typeof service[PLUGIN_EXECUTION_SEAM] !== 'function') {
+    throw new Error(`ptc-plus: ${serviceName} requires the public execution-provider bundle composition`)
+  }
+  return seam
 }
 
 /**
  * Wait for the host's execution seam and attach the plugin to the live one.
  *
- * The current service is preferred whenever both are live; the preceding
- * generation attaches only when the current one is absent, and a current
- * service registered later retires the live legacy injection before attaching.
+ * The resolved-spec service is preferred whenever both contracts are live; the
+ * request-only service attaches when it is absent. A resolved-spec service
+ * registered later retires the request-only injection before attaching.
  * The injected scope requires the plugin's own core
  * services as well, so the callback receives a context the plugin can work in,
  * and everything the plugin registers there belongs to the seam the host
@@ -259,7 +215,7 @@ export function installExecutionSeam(ctx, {
         entry = { name, scope }
         live = entry
         registerLifecycle(entry, name, scope)
-        const attached = attach(scope, createExecutionSeam(scope?.[name] ?? readService(ctx, name), name))
+        const attached = attach(scope, registeredExecutionSeam(scope?.[name] ?? readService(ctx, name), name))
         entry.attached = attached
         return attached
       })
@@ -292,7 +248,7 @@ export function installExecutionSeam(ctx, {
     const entry = { name, scope }
     live = entry
     try {
-      entry.attached = attach(scope, createExecutionSeam(scope?.[name] ?? readService(ctx, name), name))
+      entry.attached = attach(scope, registeredExecutionSeam(scope?.[name] ?? readService(ctx, name), name))
     } catch (error) {
       live = undefined
       throw error

package/internal/isolated-worker.js

@@ -15,6 +15,17 @@ const ISOLATED_STOP_MS = 5000
 /** Bound on the helper's output pipes really ending after its process exited. */
 const ISOLATED_OUTPUT_MS = 5000
 
+export function isolatedWorkerEntry(entry) {
+  if (!(entry instanceof URL) && (typeof entry !== 'string' || entry.length === 0)) {
+    throw new TypeError('isolated worker entry must be a URL or a non-empty string filename')
+  }
+  return entry instanceof URL
+    ? entry.href
+    : entry.slice(0, 5).toLowerCase() === 'file:'
+      ? new URL(entry).href
+      : pathToFileURL(resolve(entry)).href
+}
+
 /**
  * A worker-shaped transport whose worker lives in a killable helper process.
  *
@@ -29,17 +40,10 @@ export class IsolatedWorker extends EventEmitter {
     super()
     // The entry follows the worker constructor's contract: a URL or a string
     // filename. Anything else fails here, before a helper process exists.
-    if (!(entry instanceof URL) && (typeof entry !== 'string' || entry.length === 0)) {
-      throw new TypeError('isolated worker entry must be a URL or a non-empty string filename')
-    }
     // The init message crosses advanced IPC, which cannot rebuild a URL object, so
     // the boundary normalizes it to one absolute file URL string. A path follows
     // the worker constructor's rule: resolved from the current working directory.
-    const entrySpec = entry instanceof URL
-      ? entry.href
-      : entry.slice(0, 5).toLowerCase() === 'file:'
-        ? new URL(entry).href
-        : pathToFileURL(resolve(entry)).href
+    const entrySpec = isolatedWorkerEntry(entry)
     this.stdout = new PassThrough()
     this.stderr = new PassThrough()
     this.protocol = protocol

package/internal/kernel-worker.js

@@ -8,13 +8,13 @@ import { USER_BINDING_TRANSFORM, LEGACY_USER_BINDING_TRANSFORM } from './module-
 import { isAbsolute, resolve } from 'node:path'
 import repl from 'node:repl'
 import { PassThrough, Writable } from 'node:stream'
-import { pathToFileURL } from 'node:url'
+import { pathToFileURL } from './module-runtime-platform.js'
 import { MessageChannel, parentPort, workerData } from 'node:worker_threads'
 import { synchronizeBuiltinEsmExports } from './builtin-esm-sync.js'
 import { createPrivateAsyncLocalStorage } from './async-local-storage-intrinsics.js'
 import { createExceptionOriginScope, errorDetails, messageOf, programBindingError } from './failure-reporting.js'
 import { DURABLE_IMPORTS, FORBIDDEN_IMPORTS } from './module-policy.js'
-import { decodeValue, encodeValue } from './value-wire.js'
+import { decodeValue, encodeValue, encodeValueAtBoundary, valueEncodingFailure } from './value-wire.js'
 import { LEGACY_USER_BINDINGS_REUSE_POLICY, LIVE_USER_BINDINGS_SHADOW_POLICY, normalizeUserBindingNames } from './session-journal-schema.js'
 import { installWorkerCwdVirtualization } from './worker-cwd-virtualization.js'
 import {
@@ -114,6 +114,15 @@ const output = new PassThrough()
 output.resume()
 const evaluationScope = createPrivateAsyncLocalStorage()
 const sessionCwd = typeof workerData?.cwd === 'string' ? workerData.cwd : undefined
+// The module source base is fixed when a cell starts; the operation directory
+// follows the Session's working directory while the cell runs, so a confirmed
+// `tools.working_directory` change rebases the rest of the cell exactly as the
+// Host tools, which resolve at call time, already do.
+let executionCwd = sessionCwd
+let cellOperationCwd = sessionCwd
+const resolveModuleFilename = resolve
+const isAbsoluteDirectory = isAbsolute
+const nativeCreateRequire = createRequire
 if (sessionCwd !== undefined && !isAbsolute(sessionCwd)) {
   throw new Error(`ptc-plus session cwd must be absolute, got ${jsonStringify(sessionCwd)}`)
 }
@@ -145,7 +154,7 @@ const completionObserver = createCellCompletionObserver(runInWorkerReplRealm('Fu
 let replModuleRealm
 const statefulRoots = createStatefulRootRuntime({
   refresh: name => refreshLegacyPublication(name),
-  importModule: (source, options) => managedModuleImport(replParent, source, options, replModuleRealm),
+  importModule: moduleImportFor(),
   errors: runInWorkerReplRealm('({ ReferenceError, TypeError })'),
   dynamicIntrinsics: runInWorkerReplRealm('({intrinsicEval:eval,realmFunction:Function,globalObject:globalThis,errors:{ReferenceError,TypeError,SyntaxError},reflect:Reflect,object:Object})'),
   readAmbient: name => runInWorkerReplRealm(name),
@@ -169,7 +178,7 @@ const statefulRoots = createStatefulRootRuntime({
 const nativeRootDynamic = createNativeRootDynamic({
   logicalReference: (name, writable) => statefulRoots.legacyReference(name, writable),
   intrinsics: runInWorkerReplRealm('({intrinsicEval:eval,realmFunction:Function,globalObject:globalThis,errors:{ReferenceError,TypeError,SyntaxError},reflect:Reflect,object:Object})'),
-  importModule: (source, options) => managedModuleImport(replParent, source, options, replModuleRealm),
+  importModule: moduleImportFor(),
   read: name => runInWorkerReplRealm(name),
   typeOf: name => runInWorkerReplRealm(`typeof ${name}`),
   write(name, value, strict) {
@@ -181,11 +190,11 @@ const nativeRootDynamic = createNativeRootDynamic({
 let valueObserver
 const REPL_IMPORT_CANARY = 'data:text/javascript,export default 1'
 let replParent
-const sessionReplParent = sessionCwd === undefined ? undefined : pathToFileURL(resolve(sessionCwd, 'repl')).href
-const staticAdapterParents = new Set()
+const cellModuleParent = () => executionCwd === undefined ? replParent : pathToFileURL(resolveModuleFilename(executionCwd, 'repl')).href
+const staticAdapterParents = new Map()
 const userBindingModuleParents = new Map()
 const userModuleCompilation = createUserModuleCompilationHooks({
-  transformForParent: parent => (parent === replParent || parent === sessionReplParent) && activeExecution !== undefined
+  transformForParent: parent => (parent === replParent || parent === cellModuleParent()) && activeExecution !== undefined
     ? activeExecution.moduleTransform : undefined,
 })
 registerHooks({
@@ -193,10 +202,11 @@ registerHooks({
     if (specifier === REPL_IMPORT_CANARY && replParent === undefined) replParent = context.parentURL
     return userModuleCompilation.resolve(specifier, context, (source, resolvedContext) => {
       const userBindingParent = mapGet(userBindingModuleParents, resolvedContext.parentURL)
+      const adapterParent = mapGet(staticAdapterParents, resolvedContext.parentURL)
       return nextResolve(source, userBindingParent !== undefined
         ? { ...resolvedContext, parentURL: userBindingParent }
-        : resolvedContext.parentURL === replParent || setHas(staticAdapterParents, resolvedContext.parentURL)
-          ? { ...resolvedContext, parentURL: sessionReplParent ?? replParent }
+        : adapterParent !== undefined
+          ? { ...resolvedContext, parentURL: adapterParent }
           : resolvedContext)
     })
   },
@@ -356,23 +366,53 @@ installWorkerCwdVirtualization(sessionCwd, originalRequire, reason => {
     return
   }
   markVolatile(reason)
-})
+}, () => cellOperationCwd)
 synchronizeBuiltinEsmExports()
-const providedRequire = sessionReplParent === undefined ? originalRequire : createRequire(sessionReplParent)
-function selectProvidedRequire(args) {
-  const specifier = args[0]
-  if (setHas(FORBIDDEN_IMPORTS, specifier)) throw new Error(`module ${specifier} is forbidden because it exposes kernel control`)
-  if (!setHas(DURABLE_IMPORTS, specifier)) markVolatile(`require(${jsonStringify(specifier)})`)
-  return managedRequire(activeExecution?.languageSemantics === 'legacy-v1' ? replParent : sessionReplParent ?? replParent,
-    activeExecution?.languageSemantics === 'legacy-v1' ? originalRequire : providedRequire)
+function recordCellModuleResolution(transform) {
+  // An escaped loader retains its source generation. Native resolution still
+  // selects the URL; the module compiler owns adaptation before its first load.
+  return (parent, source, attributes, resolution) => userModuleCompilation.recordResolution(
+    parent, source, attributes, resolution, transform)
 }
-defineWorkerRealmProperty(WORKER_REALM_MUTATION.STABLE, 'cell module metadata', context, 'require', {
-  configurable: true,
-  value: new Proxy(providedRequire, {
-    apply: (_, receiver, args) => privateReflect.apply(selectProvidedRequire(args), receiver, args),
-    construct: (_, args, newTarget) => privateReflect.construct(selectProvidedRequire(args), args, newTarget),
-  }),
-})
+
+function moduleImportFor(parent, recordResolution) {
+  return (source, options) => managedModuleImport(parent ?? replParent, source, options, replModuleRealm, recordResolution)
+}
+
+function cellImportModuleFor(parent, transform) {
+  return moduleImportFor(parent, recordCellModuleResolution(transform))
+}
+
+function providedRequireFor(parent, legacy, transform, explicitCwd) {
+  const recordResolution = recordCellModuleResolution(transform)
+  const nativeRequire = legacy || !explicitCwd ? originalRequire : nativeCreateRequire(parent)
+  const select = args => {
+    const specifier = args[0]
+    if (setHas(FORBIDDEN_IMPORTS, specifier)) throw new Error(`module ${specifier} is forbidden because it exposes kernel control`)
+    if (!setHas(DURABLE_IMPORTS, specifier)) markVolatile(`require(${jsonStringify(specifier)})`)
+    return managedRequire(legacy ? replParent : parent ?? replParent, legacy ? originalRequire : nativeRequire, recordResolution)
+  }
+  return new Proxy(nativeRequire, {
+    apply: (_, receiver, args) => privateReflect.apply(select(args), receiver, args),
+    construct: (_, args, newTarget) => privateReflect.construct(select(args), args, newTarget),
+  })
+}
+let providedRequireParent = cellModuleParent()
+let providedRequireLegacy = false
+let providedRequireTransform
+let providedRequireExplicitCwd
+function installProvidedRequire(parent, legacy = false, transform, explicitCwd = executionCwd !== undefined) {
+  defineWorkerRealmProperty(WORKER_REALM_MUTATION.STABLE, 'cell module metadata', context, 'require', {
+    configurable: true,
+    value: providedRequireFor(parent, legacy, transform, explicitCwd),
+  })
+  providedRequireParent = parent
+  providedRequireLegacy = legacy
+  providedRequireTransform = transform
+  providedRequireExplicitCwd = explicitCwd
+}
+installProvidedRequire(providedRequireParent)
+
 function evaluate(program, completionSignal, asyncCompletion = false) {
   return new ControlPromise((resolve, reject) => {
     let settled = false
@@ -483,14 +523,16 @@ function staticAdapterSource(load) {
 }
 
 async function loadStaticModule(load) {
+  const parent = cellModuleParent()
+  const importModule = cellImportModuleFor(parent, activeExecution?.moduleTransform)
   if (load.operation === 'native-dynamic') return { namespace: nativeRootDynamic.environment(load.callableSources,
     load.awaitRoot === true, filterArray(load.logicalRoots, name => statefulRoots.has(name)
-      && rootBindingStorage(name, moduleRuntimeIntrinsics.includes(load.nativeLexicals, name)) !== 'lexical'), load.writableRoots) }
+      && rootBindingStorage(name, moduleRuntimeIntrinsics.includes(load.nativeLexicals, name)) !== 'lexical'), load.writableRoots, importModule) }
   if (load.operation === 'import') {
-    return { namespace: (source, options) => managedModuleImport(replParent, source, options, replModuleRealm) }
+    return { namespace: importModule }
   }
   const adapter = `data:text/javascript,${encodeURIComponent(staticAdapterSource(load))}#${++nextStaticAdapterId}`
-  setAdd(staticAdapterParents, adapter)
+  mapSet(staticAdapterParents, adapter, cellModuleParent())
   userModuleCompilation.mark(adapter, { compiled: true,
     transform: activeExecution?.moduleTransform })
   try {
@@ -499,7 +541,7 @@ async function loadStaticModule(load) {
     const namespace = readModuleImport(adapter, load.source, null, () => completion.value.namespace, load.options?.with)
     return { namespace }
   } finally {
-    setDelete(staticAdapterParents, adapter)
+    mapDelete(staticAdapterParents, adapter)
   }
 }
 
@@ -510,6 +552,18 @@ function hasExecutionLease(runId) {
 // BoundError is the error class installed by this cell's wrapper, not a name
 // looked up later: the cell can replace or delete the context binding while a
 // call is pending, and the call must keep its submitted error identity.
+// A confirmed Session directory change rebases the rest of the cell: Host tools
+// resolve against the session service at call time, and this worker's relative
+// operations now resolve against the same directory. The cell's module source
+// base (imports, import.meta, provided require) stays fixed at its start.
+function adoptConfirmedCellDirectory(call, value) {
+  if (call.global !== 'tools' || call.member !== 'working_directory') return
+  if (activeRun !== call.runId) return
+  const cwd = value?.cwd
+  if (typeof cwd !== 'string' || cwd.length === 0 || !isAbsoluteDirectory(cwd)) return
+  cellOperationCwd = cwd
+}
+
 function callHost(runId, global, member, args, BoundError) {
   if (!hasExecutionLease(runId)) {
     return promiseReject(programBindingError('lease', 'PTC execution lease expired'))
@@ -528,11 +582,11 @@ function callHost(runId, global, member, args, BoundError) {
   const settled = new ControlPromise(resolve => {
     moduleRuntimeIntrinsics.Reflect.apply(moduleRuntimeIntrinsics.promiseThen, result, [resolve, resolve])
   })
-  mapSet(pending, id, { ...settle, runId, valueLimits, settled, member, BoundError })
+  mapSet(pending, id, { ...settle, runId, valueLimits, settled, global, member, BoundError })
   try {
     channel.postMessage({
       type: 'call', runId, id, global, member,
-      args: encodeValue(args, valueLimits),
+      args: encodeValueAtBoundary(args, valueLimits, 'parameter'),
     })
   } catch (error) {
     mapDelete(pending, id)
@@ -1213,7 +1267,7 @@ async function closeExecution(execution) {
 }
 
 function failureOutcome(error, phase, program) {
-  if (phase === 'encode') return { invalidOutput: messageOf(error) }
+  if (phase === 'encode') return { invalidOutput: messageOf(error), valueFailure: valueEncodingFailure(error) }
   const failure = error instanceof StaticImportFailure ? error.error : error
   // The V8 frame is reported in the executed text; validate it there so an
   // out-of-range frame is an explicit absence instead of a mapped position.
@@ -1225,6 +1279,7 @@ function failureOutcome(error, phase, program) {
   return {
     error: detail.message,
     errorName: detail.name,
+    valueFailure: valueEncodingFailure(failure),
     ...(detail.toolName === undefined ? {} : { toolName: detail.toolName }),
     ...(error instanceof StaticImportFailure ? { moduleLoadFailed: true } : {}),
     ...(position === undefined ? {} : { position }),
@@ -1306,6 +1361,18 @@ async function sendCompletion(message, execution, userBindings, committedRedecla
 
 async function runCell(message) {
   if (activeExecution !== undefined) throw new Error('kernel received overlapping cells')
+  if (message.cwd !== undefined && (typeof message.cwd !== 'string' || !isAbsoluteDirectory(message.cwd))) {
+    throw new Error('ptc-plus cell cwd must be absolute')
+  }
+  executionCwd = message.cwd ?? sessionCwd
+  cellOperationCwd = executionCwd
+  const parent = cellModuleParent()
+  const legacyRequire = message.languageSemantics === 'legacy-v1'
+  const explicitCwd = executionCwd !== undefined
+  if (parent !== providedRequireParent || legacyRequire !== providedRequireLegacy || message.moduleTransform !== providedRequireTransform
+    || explicitCwd !== providedRequireExplicitCwd) {
+    installProvidedRequire(parent, legacyRequire, message.moduleTransform, explicitCwd)
+  }
   await writeOutputFence(nativeStdoutWrite, outputFenceMarker(message.outputFence, 'stdout', 'start'))
   await writeOutputFence(nativeStderrWrite, outputFenceMarker(message.outputFence, 'stderr', 'start'))
   await new ControlPromise(resolve => {
@@ -1368,6 +1435,7 @@ async function runCell(message) {
             context, message.rootRuntimeName, {
             configurable: true,
             value: statefulRoots.begin({ ...message.rootBindings,
+              importModule: cellImportModuleFor(parent, message.moduleTransform),
               legacyLexicals,
               legacyWritable,
               legacyObjects: filterArray(legacyWritable, name => mapGet(legacyStorage, name) !== 'lexical'),
@@ -1486,7 +1554,11 @@ channel.on('message', (message) => {
     if (call === undefined || call.runId !== message.runId) return
     mapDelete(pending, message.id)
     try {
-      if (message.ok) call.resolve(decodeValue(message.value, call.valueLimits))
+      if (message.ok) {
+        const value = decodeValue(message.value, call.valueLimits)
+        adoptConfirmedCellDirectory(call, value)
+        call.resolve(value)
+      }
       else if (call.BoundError === undefined) {
         const error = new Error(message.error)
         if (message.cause !== undefined) error.ptcCause = message.cause

package/internal/native-root-dynamic.js

@@ -6,26 +6,25 @@ const { Map, Set, mapGet, mapSet, mapHas, mapDelete, setHas, setAdd, appendArray
 /** Native storage and catalog-proved logical roots share a captured legacy view. */
 export function createNativeRootDynamic({ intrinsics, importModule, read, write, typeOf, remove, logicalReference }) {
   const interfaceOwner = {}
-  const runtime = createDynamicEnvironmentRuntime({ ...intrinsics, importModule, interfaceOwner }).installIntrinsics()
   const descriptor = name => ({ kind: 'var', get: () => read(name),
     set: (value, strict) => write(name, value, strict), delete: () => remove(name), typeof: () => typeOf(name) })
-  const environment = runtime.environment({
-    ambient(name, strict) {
-      return runtime.reference(name, descriptor(name), undefined, strict)
-    },
-    declareVars: runtime.declareGlobals,
-    createVar: descriptor,
-  })
-  runtime.setRootEnvironment(() => environment)
   return {
-    environment(callableSources, awaitRoot = false, logicalRoots = [], writableRoots = []) {
+    environment(callableSources, awaitRoot = false, logicalRoots = [], writableRoots = [], cellImportModule = importModule) {
       if (logicalRoots.length === 0) {
-        runtime.registerSources(callableSources)
-        return awaitRoot ? environment.awaitActivation() : environment
+        const cellRuntime = createDynamicEnvironmentRuntime({ ...intrinsics,
+          importModule: cellImportModule, interfaceOwner }).installIntrinsics()
+        const captured = cellRuntime.environment({
+          ambient: (name, strict) => cellRuntime.reference(name, descriptor(name), undefined, strict),
+          declareVars: cellRuntime.declareGlobals,
+          createVar: descriptor,
+        })
+        cellRuntime.setRootEnvironment(() => captured)
+        cellRuntime.registerSources(callableSources)
+        return awaitRoot ? captured.awaitActivation() : captured
       }
       // Each captured legacy environment keeps its own root view. Installing a
       // later bridge must not change escaped eval/Function calls from old cells.
-      const bridgedRuntime = createDynamicEnvironmentRuntime({ ...intrinsics, importModule, interfaceOwner }).installIntrinsics()
+      const bridgedRuntime = createDynamicEnvironmentRuntime({ ...intrinsics, importModule: cellImportModule, interfaceOwner }).installIntrinsics()
       const writable = new Set()
       for (let index = 0; index < writableRoots.length; index++) setAdd(writable, writableRoots[index])
       const bindings = new Map(), varFrame = new Map(), roots = new Map()