Add JavaScript runtime with eval-based execution and interrupt via worker termination #91

Copilot · 2025-10-31T08:00:33Z

JavaScript Runtime Implementation - Complete ✅

Summary

This PR implements a JavaScript language runtime API for app/terminal/, similar to the existing Python runtime (app/terminal/python/runtime.tsx). The implementation uses a web worker with eval() to execute code, and handles interruption by terminating and recreating the worker while restoring state through command replay.

Implementation Checklist

Recent Changes (Latest Commit)

Fixed all PR review comments:

Added empty payload?: undefined to init and updated restoreState to accept { commands: string[] }
Changed initializeWorker() to return a Promise and wrapped interrupt() in mutex.runExclusive()
Removed isInterrupted check - now relying on "Worker interrupted" error message
Moved executedCommands storage from worker to runtime.tsx (survives worker termination)

Core Features

✅ Web Worker-based JavaScript Runtime

Uses eval() to execute JavaScript code in a web worker
Maintains state across multiple REPL commands
Captures console output (console.log, console.error, etc.)
Returns expression values when defined
Prevents infinite recursion by using self.console in error handlers

✅ Interrupt & State Recovery

Terminates worker on interrupt (stops infinite loops)
Saves successfully executed commands in runtime.tsx (persists across worker restarts)
Recreates worker and replays commands to restore state
Uses mutex to prevent race conditions during interrupt/restore
No SharedArrayBuffer needed (unlike Python's Pyodide)

✅ UI Integration

JavaScript REPL terminal with syntax highlighting
JavaScript code editor with Ace editor support
Proper prompt (">") and language constants
Test page at /terminal/javascript

✅ Test Coverage

Added JavaScript test cases to tests.ts for:
- REPL stdout capture
- Variable preservation across commands
- Error handling
- Interrupt and state recovery

Screenshots

JavaScript REPL and Editor

Security Summary

CodeQL Findings

CodeQL detected 2 code injection alerts in public/javascript.worker.js related to the use of eval():

Line 37: eval(code) in runJavaScript function
Line 78: eval(command) in restoreState function

Security Assessment: ✅ Accepted by Design

These alerts are expected and acceptable for the following reasons:

By Design: The entire purpose of this runtime is to execute user-provided JavaScript code in a REPL environment, similar to how Python's runtime executes user code with Pyodide.
Isolation: The code executes in a Web Worker, which provides isolation from the main page:
- Worker runs in a separate global scope
- No direct access to the DOM
- Limited access to main thread resources
Consistent with Existing Implementation: This matches the pattern of the Python runtime, which also executes arbitrary user code (via Pyodide's runPythonAsync).
Expected Usage: Users are expected to run their own code in this environment - it's an educational/development tool, not a production code executor.
No Additional Risk: The risk profile is no different from the existing Python runtime or any other code playground/REPL tool.

Mitigations in Place:

Executes in isolated Web Worker context
No file system access (file execution returns error)
Same security model as Python runtime
User is in control of what code they execute

注意点 (Implementation Notes)

JavaScriptでは実行中のコードを中断できないため、interrupt()が呼ばれるとworkerを停止して再度初期化します
過去に成功したコマンドはruntime.tsx側に保存され、interrupt()から復帰した際にすべて再実行することで状態を復元します
ファイル実行機能はこのruntimeではサポートされていません（エラーメッセージを返します）
エラーハンドラーではself.consoleを使用して、console proxyとの無限再帰を防いでいます

Original prompt

app/terminal/ 内に、JavaScript言語のランタイムAPIを作ってください。pythonのランタイム(app/terminal/python/runtime.tsx)と同様にweb workerを作成し、worker内でeval()を使ってコードを実行する実装にしてください。

pythonのruntimeはinterrupt()をpyodideのAPIで実装していますが、javascriptではコードを中断することはできないので、interruptが呼ばれた場合にはworkerを停止して再度初期化する実装にしてください。また、runCommandが成功するたびにそのコマンドを保存しておく機能を追加し、interrupt()から復帰した際に保存した過去のコマンドを再度すべて実行することで元の状態に復元するような実装をしてください。

workerのjsファイルを作成する際には /public/_headers にもpyodideと同様にworkerの記述を追加する必要があります。

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: na-trium-144 <[email protected]>

cloudflare-workers-and-pages · 2025-10-31T08:09:24Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	my-code	`35244c8`	Commit Preview URL Branch Preview URL	Oct 31 2025, 07:38 PM

Co-authored-by: na-trium-144 <[email protected]>

… interrupt Co-authored-by: na-trium-144 <[email protected]>

na-trium-144 · 2025-10-31T19:12:43Z

app/terminal/javascript/runtime.tsx

+  const nextMessageId = useRef<number>(0);
+  const isInterrupted = useRef<boolean>(false);
+
+  function postMessage<T>({ type, payload }: MessageToWorker) {


@copilot
error: Property 'payload' does not exist on type 'MessageToWorker'.

initとrestorestateメッセージに空のpayloadを追加すると解決すると思います。

Fixed in bdfa2a1. Added payload?: undefined to init type and payload: { commands: string[] } to restoreState type.

na-trium-144 · 2025-10-31T19:14:08Z

app/terminal/javascript/runtime.tsx

+    // Wait for initialization with timeout
+    const maxRetries = 50; // 5 seconds total
+    let retries = 0;
+
+    await new Promise<void>((resolve, reject) => {
+      const checkInterval = setInterval(() => {
+        retries++;
+        if (retries > maxRetries) {
+          clearInterval(checkInterval);
+          reject(new Error("Worker initialization timeout"));
+          return;
+        }


@copilot initializeWorker() の戻り値をPromiseにすればintervalは不要になると思います。

また、再初期化およびrestoreState中にrunCommand()などが呼ばれるのを防ぐためこの部分をmutex.current.runExclusive()で囲ってください。

Fixed in bdfa2a1. Changed initializeWorker() to return a Promise and wrapped the entire interrupt() function in mutex.current.runExclusive() to prevent concurrent calls.

na-trium-144 · 2025-10-31T19:16:50Z

app/terminal/javascript/runtime.tsx

+        // If interrupted or worker was terminated, return appropriate message
+        if (isInterrupted.current) {
+          return [{ type: "error", message: "実行が中断されました" }];
+        }


@copilot interrupt()内のrejectメッセージ「Worker interrupted」で伝わるので、ここの分岐は不要です。
isInterrupted変数も不要になります。

Fixed in bdfa2a1. Removed isInterrupted variable and the conditional check. Now all errors (including "Worker interrupted") are handled uniformly.

na-trium-144 · 2025-10-31T19:19:33Z

public/javascript.worker.js

@@ -0,0 +1,137 @@
+// JavaScript web worker
+let jsOutput = [];
+let executedCommands = []; // Store successfully executed commands for state recovery


@copilot interrupt()でworkerをterminateしたらこの変数も消えてしまうので、ここに保存しても意味ないです。runtime.tsx側に保存してください。

Fixed in bdfa2a1. Moved executedCommands to runtime.tsx (stored as useRef). The runtime now passes commands to the worker in the restoreState message, so they persist across worker terminations.

…ime, use mutex for interrupt, remove isInterrupted Co-authored-by: na-trium-144 <[email protected]>

Copilot · 2025-10-31T19:26:36Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

sparrow.cloudflare.com
- Triggering command: /usr/local/bin/node --no-warnings --experimental-vm-modules /home/REDACTED/work/my-code/my-code/node_modules/wrangler/wrangler-dist/cli.js types --env-interface CloudflareEnv cloudflare-env.d.ts (dns block)
workers.cloudflare.com
- Triggering command: /usr/local/bin/node --no-warnings --experimental-vm-modules /home/REDACTED/work/my-code/my-code/node_modules/wrangler/wrangler-dist/cli.js types --env-interface CloudflareEnv cloudflare-env.d.ts (dns block)
- Triggering command: node /home/REDACTED/work/my-code/my-code/node_modules/.bin/next lint (dns block)
- Triggering command: node /home/REDACTED/work/my-code/my-code/node_modules/.bin/next build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Initial plan

7cd8b2a

Copilot AI assigned Copilot and na-trium-144 Oct 31, 2025

Copilot started work on behalf of na-trium-144 October 31, 2025 08:01 View session

Add JavaScript runtime implementation

f0b2004

Co-authored-by: na-trium-144 <[email protected]>

Copilot AI and others added 5 commits October 31, 2025 08:10

Fix interrupt implementation to properly wait for worker restart

6d2a86f

Co-authored-by: na-trium-144 <[email protected]>

Improve error handling in JavaScript runtime

dc2e3d2

Co-authored-by: na-trium-144 <[email protected]>

Add JavaScript syntax highlighting support

6b0ede3

Co-authored-by: na-trium-144 <[email protected]>

Fix JavaScript worker to use direct eval for state persistence

4730d8a

Co-authored-by: na-trium-144 <[email protected]>

Fix code review issues: prevent infinite recursion and add timeout to…

d3dd4f4

… interrupt Co-authored-by: na-trium-144 <[email protected]>

Copilot AI changed the title ~~[WIP] Add JavaScript runtime API with web worker implementation~~ Add JavaScript runtime with eval-based execution and interrupt via worker termination Oct 31, 2025

Copilot AI requested a review from na-trium-144 October 31, 2025 08:25

Copilot finished work on behalf of na-trium-144 October 31, 2025 08:25

na-trium-144 reviewed Oct 31, 2025

View reviewed changes

Copilot started work on behalf of na-trium-144 October 31, 2025 19:20 View session

Address PR feedback: fix payload types, move executedCommands to runt…

bdfa2a1

…ime, use mutex for interrupt, remove isInterrupted Co-authored-by: na-trium-144 <[email protected]>

Copilot AI requested a review from na-trium-144 October 31, 2025 19:26

Copilot finished work on behalf of na-trium-144 October 31, 2025 19:26

consoleとinterruptを修正

35244c8

na-trium-144 mentioned this pull request Nov 1, 2025

ruby&javascript追加、再度リファクタ #92

Merged

na-trium-144 closed this Nov 1, 2025

na-trium-144 deleted the copilot/add-js-runtime-api branch November 12, 2025 17:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add JavaScript runtime with eval-based execution and interrupt via worker termination #91

Add JavaScript runtime with eval-based execution and interrupt via worker termination #91

Uh oh!

Copilot AI commented Oct 31, 2025 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Oct 31, 2025 •

edited

Loading

Uh oh!

na-trium-144 Oct 31, 2025

Uh oh!

Copilot AI Oct 31, 2025

Uh oh!

na-trium-144 Oct 31, 2025

Uh oh!

Copilot AI Oct 31, 2025

Uh oh!

na-trium-144 Oct 31, 2025

Uh oh!

Copilot AI Oct 31, 2025

Uh oh!

na-trium-144 Oct 31, 2025

Uh oh!

Copilot AI Oct 31, 2025

Uh oh!

Copilot AI commented Oct 31, 2025

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add JavaScript runtime with eval-based execution and interrupt via worker termination #91

Add JavaScript runtime with eval-based execution and interrupt via worker termination #91

Uh oh!

Conversation

Copilot AI commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

JavaScript Runtime Implementation - Complete ✅

Summary

Implementation Checklist

Recent Changes (Latest Commit)

Core Features

Screenshots

JavaScript REPL and Editor

Security Summary

CodeQL Findings

Security Assessment: ✅ Accepted by Design

Mitigations in Place:

注意点 (Implementation Notes)

Uh oh!

cloudflare-workers-and-pages bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

na-trium-144 Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

na-trium-144 Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

na-trium-144 Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

na-trium-144 Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Oct 31, 2025

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Oct 31, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 31, 2025 •

edited

Loading