kimi-code (target after pi) ships a single self-contained dist/main.mjs (15MB, stock Node ≥22.19) that bundles an in-process fastify-based server ("kap-server"). That stack performs mandatory runtime code generation with no fallback:
- ajv:
new Function(self, scope, sourceCode)(this, this.scope.get()) — validator compilation.
- fast-json-stringify:
new Function(scope, sourceCode)(...) — serializer codegen; same for its parser.
- fastify/find-my-way: router codegen —
this.matchPrefix = new Function("path", "i", ...), this.deriveSyncConstraints = new Function("req", "ctx", ...), handler-constraint matchers.
13 new Function sites total in the shipped bundle (verified by inspection of @moonshot-ai/kimi-code@0.27.0 dist/main.mjs). Unlike zod's codegen probe (#6031 — zod falls back when new Function throws), these libraries have no non-codegen path: if new Function can't evaluate generated source, route registration throws and the server can't boot.
What's needed
Some form of runtime dynamic-code evaluation. Options, roughly in ascending ambition:
- Bundle-time patching per target: pre-compile ajv validators / fast-json-stringify serializers at build time (ajv standalone mode), patch find-my-way's codegen into an equivalent interpreted matcher. Gets kimi booting without runtime eval, but is per-app work that won't scale across the ecosystem (fastify is everywhere).
- Scoped interpreter: a small JS interpreter invoked by
new Function/eval for runtime-generated source. The code these libs generate is restricted (no with, no generators, straight-line + loops + closures over injected scope args), so a subset interpreter may suffice — but the subset is de facto unbounded across libraries, so design for graceful "unsupported construct" errors.
- Full eval support — long-term parity answer.
Suggested sequencing: (2) targeted at the ajv/fast-json-stringify/find-my-way generated-code shapes, validated by booting kimi's server subcommand end-to-end; keep (1) as the fallback if the interpreter slips.
Acceptance: kimi TUI + kimi server run boot from the compiled binary; fastify routes register; a request round-trips through an ajv-validated, fast-json-stringify-serialized handler.
kimi-code (target after pi) ships a single self-contained
dist/main.mjs(15MB, stock Node ≥22.19) that bundles an in-process fastify-based server ("kap-server"). That stack performs mandatory runtime code generation with no fallback:new Function(self, scope, sourceCode)(this, this.scope.get())— validator compilation.new Function(scope, sourceCode)(...)— serializer codegen; same for its parser.this.matchPrefix = new Function("path", "i", ...),this.deriveSyncConstraints = new Function("req", "ctx", ...), handler-constraint matchers.13
new Functionsites total in the shipped bundle (verified by inspection of@moonshot-ai/kimi-code@0.27.0dist/main.mjs). Unlike zod's codegen probe (#6031 — zod falls back whennew Functionthrows), these libraries have no non-codegen path: ifnew Functioncan't evaluate generated source, route registration throws and the server can't boot.What's needed
Some form of runtime dynamic-code evaluation. Options, roughly in ascending ambition:
new Function/evalfor runtime-generated source. The code these libs generate is restricted (nowith, no generators, straight-line + loops + closures over injected scope args), so a subset interpreter may suffice — but the subset is de facto unbounded across libraries, so design for graceful "unsupported construct" errors.Suggested sequencing: (2) targeted at the ajv/fast-json-stringify/find-my-way generated-code shapes, validated by booting kimi's server subcommand end-to-end; keep (1) as the fallback if the interpreter slips.
Acceptance:
kimiTUI +kimi server runboot from the compiled binary; fastify routes register; a request round-trips through an ajv-validated, fast-json-stringify-serialized handler.