pi-ast-sgrep 2.0.2 → 2.2.0

package/dist/codemode/guest-api.js

@@ -0,0 +1,194 @@
+/** Guest-call packing so the first shape a model tries actually works. */
+import { CODEMODE_HOST_METHODS } from "./types.js";
+const QUERY_METHODS = new Set([
+    "search",
+    "find",
+    "semantic",
+    "chain",
+    "catalogSearch",
+]);
+const SYMBOL_METHODS = new Set(["defs", "callers"]);
+/** Catalog / common-misname aliases. Resolved before packing so defs vs search keys stay correct. */
+const METHOD_ALIASES = {
+    index_status: "indexStatus",
+    index_repo: "indexRepo",
+    catalog_search: "catalogSearch",
+    catalog_describe: "catalogDescribe",
+    define: "defs",
+    definition: "defs",
+    definitions: "defs",
+    grep: "find",
+    keyword: "find",
+    keywordSearch: "find",
+    references: "callers",
+};
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function mergeRest(base, rest) {
+    if (!isPlainObject(rest))
+        return base;
+    return { ...rest, ...base };
+}
+function scopeToken(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const path = value.trim();
+    if (!path || path.split(/[/\\]/u).includes(".."))
+        return undefined;
+    return path;
+}
+function editDistance(a, b) {
+    const rows = a.length + 1;
+    const cols = b.length + 1;
+    const prev = new Array(cols);
+    const cur = new Array(cols);
+    for (let j = 0; j < cols; j++)
+        prev[j] = j;
+    for (let i = 1; i < rows; i++) {
+        cur[0] = i;
+        for (let j = 1; j < cols; j++) {
+            const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+            cur[j] = Math.min((prev[j] ?? 0) + 1, (cur[j - 1] ?? 0) + 1, (prev[j - 1] ?? 0) + cost);
+        }
+        for (let j = 0; j < cols; j++)
+            prev[j] = cur[j] ?? 0;
+    }
+    return prev[b.length] ?? a.length;
+}
+function suggestMethod(name) {
+    const needle = name.toLowerCase();
+    if (!needle)
+        return undefined;
+    const maxDistance = Math.max(1, Math.floor(needle.length / 3));
+    let best;
+    for (const candidate of CODEMODE_HOST_METHODS) {
+        const lower = candidate.toLowerCase();
+        const distance = lower.includes(needle) || needle.includes(lower)
+            ? Math.min(1, editDistance(needle, lower))
+            : editDistance(needle, lower);
+        if (distance > maxDistance)
+            continue;
+        if (!best || distance < best.distance || (distance === best.distance && candidate.length < best.candidate.length)) {
+            best = { candidate, distance };
+        }
+    }
+    return best?.candidate;
+}
+export function resolveHostMethod(method) {
+    if (CODEMODE_HOST_METHODS.includes(method)) {
+        return method;
+    }
+    const aliased = METHOD_ALIASES[method] ?? METHOD_ALIASES[method.toLowerCase()];
+    if (aliased)
+        return aliased;
+    const camel = method.replace(/_([a-z])/gu, (_all, letter) => letter.toUpperCase());
+    if (camel !== method && CODEMODE_HOST_METHODS.includes(camel)) {
+        return camel;
+    }
+    return undefined;
+}
+/** Turn positional guest calls into the host object shape. */
+export function packGuestCall(method, args) {
+    if (args.length === 0)
+        return {};
+    const first = args[0];
+    const rest = args[1];
+    if (typeof first === "string") {
+        if (SYMBOL_METHODS.has(method))
+            return mergeRest({ symbol: first }, rest);
+        if (method === "imports")
+            return mergeRest({ module: first }, rest);
+        if (method === "read") {
+            if (typeof args[1] === "number") {
+                const packed = { path: first, start: args[1] };
+                if (typeof args[2] === "number")
+                    packed.end = args[2];
+                return packed;
+            }
+            return mergeRest({ path: first }, rest);
+        }
+        if (method === "edit" && typeof args[1] === "string") {
+            return { path: first, oldText: args[1], newText: typeof args[2] === "string" ? args[2] : "" };
+        }
+        if (method === "catalogDescribe")
+            return mergeRest({ name: first }, rest);
+        if (method === "indexRepo" || method === "indexStatus" || method === "doctor") {
+            return isPlainObject(rest) ? { ...rest } : {};
+        }
+        return mergeRest({ query: first }, rest);
+    }
+    if (isPlainObject(first))
+        return { ...first };
+    throw new Error(`asgrep.${method}: pass a string or object (got ${typeof first}). Example: asgrep.search("auth") or asgrep.search({ query: "auth" })`);
+}
+/** Accept query as a symbol alias and fold in:/fileFilter into the query string. */
+export function coerceHostArgs(method, input) {
+    const args = { ...input };
+    if (SYMBOL_METHODS.has(method) && typeof args.symbol !== "string") {
+        const alias = args.query;
+        if (typeof alias === "string" && alias.trim())
+            args.symbol = alias.trim();
+    }
+    if (QUERY_METHODS.has(method)) {
+        const query = typeof args.query === "string" ? args.query : "";
+        const scoped = applyQueryScope(query, args);
+        if (scoped)
+            args.query = scoped;
+    }
+    return args;
+}
+export function applyQueryScope(query, args) {
+    const scope = scopeToken(args.in) ?? scopeToken(args.fileFilter) ?? scopeToken(args.file_filter);
+    if (!scope)
+        return query.trim() ? query : undefined;
+    if (query.split(/\s+/u).some((token) => token.startsWith("in:")))
+        return query;
+    const trimmed = query.trim();
+    return trimmed ? `in:${scope} ${trimmed}` : `in:${scope}`;
+}
+export function unknownMethodError(method) {
+    const close = suggestMethod(method);
+    const hint = close ? ` Did you mean ${close}?` : "";
+    return `unknown asgrep method '${method}'.${hint} Use search, find, defs, callers, read, edit, indexStatus. Example: asgrep.search("auth")`;
+}
+export function timeoutHint(message) {
+    if (!/timeout after \d+ms|timed out after \d+ms/i.test(message))
+        return message;
+    return `${message}; narrow with asgrep.search(query, { in: "src" }), lower limit, or split the program`;
+}
+function looksLikeBareExpression(code) {
+    const trimmed = code.trim().replace(/;\s*$/u, "");
+    if (!trimmed || /\breturn\b/.test(trimmed))
+        return false;
+    if (/^(?:const|let|var|function|class|if|for|while|switch|try|async|import|export|throw|do|break|continue|debugger|yield|with|else|case|default)\b/u.test(trimmed))
+        return false;
+    if (/;\s*\S/u.test(trimmed))
+        return false;
+    return true;
+}
+/**
+ * Strip fences and invoke a function expression, including non-async arrows.
+ * A single expression with no `return` is returned automatically.
+ * Bare statements still wrap in an async IIFE.
+ */
+export function normalizeCode(raw) {
+    let code = raw.trim();
+    if (code.startsWith("```")) {
+        code = code.replace(/^```(?:javascript|js|typescript|ts)?\s*/i, "").replace(/\s*```$/u, "").trim();
+    }
+    const trimmed = code.replace(/;\s*$/u, "");
+    if (/^async\s*(?:function\b|\()/u.test(trimmed)) {
+        return `(${trimmed})()`;
+    }
+    if (/^function\b/u.test(trimmed)) {
+        return `(async ${trimmed})()`;
+    }
+    if (/^(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>/u.test(trimmed)) {
+        return `(async ${trimmed})()`;
+    }
+    if (looksLikeBareExpression(code)) {
+        return `(async () => {\nreturn ${trimmed}\n})()`;
+    }
+    return `(async () => {\n${code}\n})()`;
+}

package/dist/codemode/guest-worker.mjs

@@ -0,0 +1,287 @@
+// Guest worker for asgrep Code Mode. A REAL FILE (not an embedded template
+// string) so it gets syntax checking, real line numbers in stack traces, and
+// normal review. Loaded by runner.ts via new URL("./guest-worker.mjs", ...) and
+// spawned through an eval'd `import()` bootstrap so host execArgv flags never
+// leak into the isolate.
+//
+// Protocol (all messages carry runId; stale-runId frames are dropped):
+//   in:  { op: "run", runId, code, timeoutMs }
+//        { op: "call-result", runId, id, body }
+//   out: { op: "call-batch", runId, calls: [{ id, method, payload }] }
+//        { op: "log", runId, line }
+//        { op: "result", runId, serialized }
+//        { op: "error", runId, error }
+import { parentPort } from "node:worker_threads";
+import vm from "node:vm";
+
+// In-guest caps are a second fence; the host enforces the same bounds on its
+// side (runner.ts owns the authoritative limits).
+const MAX_RESULT_JSON_CHARS = 1_000_000;
+const MAX_BRIDGE_REQUEST_CHARS = 64_000;
+const MAX_LOG_LINE_CHARS = 4_096;
+const MAX_ERROR_CHARS = 8_192;
+const RESULT_SERIALIZE_TIMEOUT_MS = 1_000;
+
+const BLOCKED_GLOBALS = [
+  "ArrayBuffer", "SharedArrayBuffer", "DataView", "Atomics", "WebAssembly",
+  "eval", "Function", "AsyncFunction", "GeneratorFunction",
+  "Int8Array", "Uint8Array", "Uint8ClampedArray", "Int16Array", "Uint16Array",
+  "Int32Array", "Uint32Array", "Float32Array", "Float64Array",
+  "BigInt64Array", "BigUint64Array",
+];
+
+// Mirrors CODEMODE_HOST_METHODS (types.ts); duplicated so this file stays
+// dependency-free plain JS.
+const KNOWN_METHODS = [
+  "search", "find", "read", "edit", "semantic", "chain", "defs", "callers",
+  "imports", "indexStatus", "indexRepo", "doctor", "catalogSearch", "catalogDescribe",
+];
+
+let runId = -1;
+let callSeq = 0;
+const pendingCalls = new Map();
+let outbox = [];
+let outboxScheduled = false;
+
+const post = (msg) => {
+  try {
+    parentPort.postMessage({ ...msg, runId });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// Calls issued in one guest microtask burst travel as ONE message so the host
+// dispatcher sees them in a single tick and can coalesce the wave (sticky
+// batch / runBatch). Per-message posts arrive on separate host turns and
+// would silently defeat batching.
+const bridge = (method, payload) => new Promise((resolve, reject) => {
+  const id = "c" + callSeq++;
+  pendingCalls.set(id, { resolve, reject });
+  outbox.push({ id, method, payload });
+  if (outboxScheduled) return;
+  outboxScheduled = true;
+  queueMicrotask(() => {
+    const calls = outbox;
+    outbox = [];
+    outboxScheduled = false;
+    if (!post({ op: "call-batch", calls })) {
+      for (const call of calls) {
+        const pending = pendingCalls.get(call.id);
+        if (pending) {
+          pendingCalls.delete(call.id);
+          pending.resolve(JSON.stringify({ ok: false, error: "codemode call failed" }));
+        }
+      }
+    }
+  });
+});
+
+const logSink = (line) => {
+  post({ op: "log", line: String(line) });
+};
+
+// NAPI u64/i64 fields cross the bridge as BigInt; a guest re-passing them must
+// not die on "Do not know how to serialize a BigInt".
+const jsonSafe = (_key, item) =>
+  typeof item === "bigint"
+    ? (item >= -9007199254740991n && item <= 9007199254740991n ? Number(item) : item.toString())
+    : item;
+
+const stringify = JSON.stringify;
+const stringifyBounded = (value, maxChars, label) => {
+  const serialized = stringify(value, jsonSafe);
+  if (serialized === undefined) return serialized;
+  if (serialized.length > maxChars) {
+    throw new Error("codemode " + label + " exceeds " + maxChars + " characters");
+  }
+  return serialized;
+};
+
+const sealCtor = (obj) => {
+  if (obj === null || obj === undefined) return;
+  try {
+    Object.defineProperty(obj, "constructor", { value: undefined, configurable: false, writable: false });
+  } catch {}
+};
+
+// Everything below runs INSIDE the vm context once, installing the sandbox
+// surface: blocked globals, sealed constructors, the asgrep proxy, console.
+function installSandbox(contextObject) {
+  const context = vm.createContext(contextObject, { codeGeneration: { strings: false, wasm: false } });
+  const install = new vm.Script(INSTALL_SOURCE, { filename: "asgrep-codemode-bootstrap.js" });
+  return { context, install };
+}
+
+const INSTALL_SOURCE = `
+{
+  const hostCall = globalThis.__asgrepBridge;
+  const hostLog = globalThis.__asgrepLog;
+  delete globalThis.__asgrepBridge;
+  delete globalThis.__asgrepLog;
+
+  for (const name of ${JSON.stringify(BLOCKED_GLOBALS)}) {
+    Object.defineProperty(globalThis, name, {
+      value: undefined, configurable: false, writable: false,
+    });
+  }
+
+  const sealCtor = (obj) => {
+    if (obj === null || obj === undefined) return;
+    try {
+      Object.defineProperty(obj, "constructor", {
+        value: undefined, configurable: false, writable: false,
+      });
+    } catch {}
+  };
+  sealCtor(globalThis);
+  sealCtor(Object); sealCtor(Object.prototype);
+  sealCtor(Array); sealCtor(Array.prototype);
+  sealCtor(Number); sealCtor(Number.prototype);
+  sealCtor(String); sealCtor(String.prototype);
+  sealCtor(Boolean); sealCtor(Boolean.prototype);
+  sealCtor(Error); sealCtor(Error.prototype);
+  sealCtor(RegExp); sealCtor(RegExp.prototype);
+  sealCtor(Date); sealCtor(Date.prototype);
+  sealCtor(Promise); sealCtor(Promise.prototype);
+  sealCtor(JSON); sealCtor(Math);
+  sealCtor(Reflect); sealCtor(Proxy); sealCtor(Symbol);
+  sealCtor(Map); sealCtor(Set); sealCtor(WeakMap); sealCtor(WeakSet);
+  sealCtor(hostCall); sealCtor(hostLog);
+
+  let resultValue;
+  const setResult = (value) => { resultValue = value; };
+  const stringify = JSON.stringify;
+  const jsonSafe = (_key, item) => typeof item === "bigint"
+    ? (item >= -9007199254740991n && item <= 9007199254740991n ? Number(item) : item.toString())
+    : item;
+  const stringifyBounded = (value, maxChars, label) => {
+    const serialized = stringify(value, jsonSafe);
+    if (serialized === undefined) return serialized;
+    if (serialized.length > maxChars) {
+      throw new Error("codemode " + label + " exceeds " + maxChars + " characters");
+    }
+    return serialized;
+  };
+  const serializeResult = () => stringifyBounded(resultValue, ${MAX_RESULT_JSON_CHARS}, "result");
+  Object.freeze(setResult);
+  Object.freeze(serializeResult);
+  Object.defineProperty(globalThis, "__asgrepSetResult", {
+    value: setResult, configurable: false, writable: false,
+  });
+  Object.defineProperty(globalThis, "__asgrepSerializeResult", {
+    value: serializeResult, configurable: false, writable: false,
+  });
+
+  const invoke = async (method, args = {}) => {
+    const payload = stringifyBounded(args, ${MAX_BRIDGE_REQUEST_CHARS}, "call arguments");
+    const response = JSON.parse(await hostCall(method, payload));
+    if (!response.ok) throw new Error(response.error || ("asgrep." + method + " failed"));
+    return response.value;
+  };
+  const known = ${JSON.stringify(KNOWN_METHODS)};
+  const blocked = new Set(["then", "constructor", "prototype", "__proto__"]);
+  const call = (method) => (...guestArgs) => invoke(method, { __guestArgs: guestArgs });
+  const api = new Proxy(Object.create(null), {
+    get(_target, prop) {
+      if (typeof prop !== "string" || blocked.has(prop)) return undefined;
+      return call(prop);
+    },
+    has(_target, prop) {
+      return typeof prop === "string" && !blocked.has(prop);
+    },
+    ownKeys() { return known.slice(); },
+    getOwnPropertyDescriptor(_target, prop) {
+      if (typeof prop !== "string" || blocked.has(prop)) return undefined;
+      return { enumerable: known.includes(prop), configurable: true, value: call(prop) };
+    },
+    set() { return false; },
+    defineProperty() { return false; },
+    deleteProperty() { return false; },
+  });
+
+  const formatLog = (value) => {
+    if (typeof value === "string") return value.slice(0, ${MAX_LOG_LINE_CHARS});
+    try { return stringifyBounded(value, ${MAX_LOG_LINE_CHARS}, "log line"); }
+    catch { return "[unserializable or oversized log value]"; }
+  };
+  const consoleApi = Object.create(null);
+  for (const level of ["log", "info", "warn", "error", "debug"]) {
+    Object.defineProperty(consoleApi, level, {
+      enumerable: true,
+      value: (...args) => {
+        let line = "";
+        for (const arg of args) {
+          const part = formatLog(arg);
+          const prefix = line.length === 0 ? "" : " ";
+          const remaining = ${MAX_LOG_LINE_CHARS} - line.length;
+          if (remaining <= 0) break;
+          line += (prefix + part).slice(0, remaining);
+        }
+        hostLog(line);
+      },
+    });
+  }
+  Object.freeze(consoleApi);
+
+  Object.defineProperty(globalThis, "asgrep", { value: api, configurable: false, writable: false });
+  Object.defineProperty(globalThis, "console", { value: consoleApi, configurable: false, writable: false });
+  sealCtor(api); sealCtor(consoleApi); sealCtor(setResult); sealCtor(serializeResult); sealCtor(invoke);
+}
+`;
+
+async function runProgram(msg) {
+  const contextObject = Object.create(null);
+  Object.defineProperty(bridge, "constructor", { value: undefined });
+  Object.defineProperty(logSink, "constructor", { value: undefined });
+  contextObject.__asgrepBridge = bridge;
+  contextObject.__asgrepLog = logSink;
+  const { context, install } = installSandbox(contextObject);
+  try {
+    install.runInContext(context, { timeout: Math.min(msg.timeoutMs, 1000) });
+    const script = new vm.Script(msg.code, { filename: "asgrep-codemode.js" });
+    const value = await script.runInContext(context, {
+      displayErrors: true,
+      timeout: msg.timeoutMs,
+    });
+    const setResult = context.__asgrepSetResult;
+    if (typeof setResult !== "function") {
+      throw new Error("codemode result bridge is unavailable");
+    }
+    setResult(value);
+    const serializeScript = new vm.Script("globalThis.__asgrepSerializeResult()", {
+      filename: "asgrep-codemode-result.js",
+    });
+    const serialized = serializeScript.runInContext(context, {
+      displayErrors: true,
+      timeout: Math.min(msg.timeoutMs, RESULT_SERIALIZE_TIMEOUT_MS),
+    });
+    post({ op: "result", serialized });
+  } catch (cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    post({ op: "error", error: message.slice(0, MAX_ERROR_CHARS) });
+  }
+}
+
+parentPort.on("message", (msg) => {
+  if (!msg || typeof msg !== "object") return;
+  // "run" claims the runId; every later frame must carry it or be dropped.
+  if (msg.op === "run") {
+    if (runId !== -1) return;
+    runId = msg.runId;
+    void runProgram(msg);
+    return;
+  }
+  if (typeof msg.runId === "number" && msg.runId !== runId) return;
+  if (msg.op === "call-result") {
+    const pending = pendingCalls.get(msg.id);
+    if (pending) {
+      pendingCalls.delete(msg.id);
+      pending.resolve(msg.body);
+    }
+    return;
+  }
+});
+
+post({ op: "ready" });

package/dist/codemode/index.d.ts

@@ -10,9 +10,10 @@
  * client. They never import each other. Do not install both for the same agent.
  */
 export { createAsgrepConnector, type AsgrepConnector, type ConnectorHost, type DispatchSurface, type ConnectorBundle, } from "./connector.js";
-export { runCodemode, normalizeCode, type CodemodeRunResult, type CodemodeRunSuccess, type CodemodeRunFailure } from "./runner.js";
-export { CODEMODE_TYPES_FOR_MODEL, type SearchArgs, type ChainArgs } from "./types.js";
+export { runCodemode, normalizeCode, warmCodemodeSandbox, resetCodemodeSandboxForTests, type CodemodeRunResult, type CodemodeRunSuccess, type CodemodeRunFailure } from "./runner.js";
+export { applyQueryScope, packGuestCall, coerceHostArgs, resolveHostMethod } from "./guest-api.js";
+export { CODEMODE_TYPES_FOR_MODEL, CODEMODE_HOST_METHODS, type SearchArgs, type FindArgs, type ReadArgs, type EditArgs, type ChainArgs, type CodemodeHostMethod } from "./types.js";
 export { createCodemodeDispatcher, runNativeBatch, argvFor, asEnvelope, type DispatchStats, type BatchCapableHost, type StickyWorker, type BatchResult, } from "./dispatch.js";
 export { startStickyWorker, runBatchViaStdin } from "./worker.js";
-export { NativeSessionPool, sharedNativePool } from "./session-pool.js";
+export { NativeSessionPool, sharedNativePool, isClosedWorkerError } from "./session-pool.js";
 export { loadCodemodeNative, nativeAvailable, resetNativeCache, type CodemodeNativeBinding, type NativeSession, } from "./native.js";

package/dist/codemode/index.js

@@ -10,9 +10,10 @@
  * client. They never import each other. Do not install both for the same agent.
  */
 export { createAsgrepConnector, } from "./connector.js";
-export { runCodemode, normalizeCode } from "./runner.js";
-export { CODEMODE_TYPES_FOR_MODEL } from "./types.js";
+export { runCodemode, normalizeCode, warmCodemodeSandbox, resetCodemodeSandboxForTests } from "./runner.js";
+export { applyQueryScope, packGuestCall, coerceHostArgs, resolveHostMethod } from "./guest-api.js";
+export { CODEMODE_TYPES_FOR_MODEL, CODEMODE_HOST_METHODS } from "./types.js";
 export { createCodemodeDispatcher, runNativeBatch, argvFor, asEnvelope, } from "./dispatch.js";
 export { startStickyWorker, runBatchViaStdin } from "./worker.js";
-export { NativeSessionPool, sharedNativePool } from "./session-pool.js";
+export { NativeSessionPool, sharedNativePool, isClosedWorkerError } from "./session-pool.js";
 export { loadCodemodeNative, nativeAvailable, resetNativeCache, } from "./native.js";

package/dist/codemode/native.d.ts

@@ -9,7 +9,7 @@
  * 2. `@ast-sgrep/<platform>/ast-sgrep-codemode.node` via launcher (release install)
  * 3. Local `extension/native/` / cargo `target/release` (dev builds)
  */
-export declare const CODEMODE_BINDING_VERSION = "2.0.0";
+export declare const CODEMODE_BINDING_VERSION = "2.1.0";
 export type NativeSessionConfig = {
     root?: string;
     indexPath?: string;

package/dist/codemode/native.js

@@ -13,7 +13,7 @@ import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-export const CODEMODE_BINDING_VERSION = "2.0.0";
+export const CODEMODE_BINDING_VERSION = "2.1.0";
 let cached;
 function platformTriple() {
     const { platform, arch } = process;

package/dist/codemode/runner.d.ts

@@ -1,6 +1,8 @@
 import type { AsgrepConnector } from "./connector.js";
 import type { DispatchStats } from "./dispatch.js";
-/** Closed sum: success|failure — `ok:true` with `error` (or `ok:false` without) is unrepresentable. */
+import { normalizeCode } from "./guest-api.js";
+export { normalizeCode };
+/** Closed sum: success|failure — ok:true with error (or ok:false without) is unrepresentable. */
 export type CodemodeRunSuccess = {
     ok: true;
     result: unknown;
@@ -19,16 +21,18 @@ export type CodemodeRunFailure = {
     wallMs: number;
 };
 export type CodemodeRunResult = CodemodeRunSuccess | CodemodeRunFailure;
-/** Strip markdown fences and normalize to an async IIFE expression. */
-export declare function normalizeCode(raw: string): string;
+/** Spawn the warm standby isolate (session_start / pre-call). */
+export declare function warmCodemodeSandbox(): Promise<void>;
+/** Drop the standby isolate and any in-flight runs (tests / session shutdown). */
+export declare function resetCodemodeSandboxForTests(): Promise<void>;
 /**
- * Run model-generated JavaScript against the typed `asgrep` connector.
+ * Run model-generated JavaScript against the typed asgrep connector.
  *
- * Model-generated code is not trusted with the extension host's ambient Node
- * authority. A dedicated worker contains CPU/microtask denial of service; its
- * VM hides `process`, module loading, and host constructors, with a JSON bridge
- * as the only exposed capability. This is not an OS sandbox, so deployments
- * requiring adversarial-code isolation should still restrict the Pi process.
+ * Execution happens in a single-use worker_threads isolate: the guest gets a
+ * node:vm context inside the worker; asgrep/console are built there; the only
+ * host channel is a JSON postMessage bridge carrying runId envelopes. Timeout
+ * and abort call worker.terminate(), which is the only mechanism that actually
+ * stops a detached guest microtask or a runaway heap.
  */
 export declare function runCodemode(rawCode: string, asgrep: AsgrepConnector, options?: {
     timeoutMs?: number;