@code-yeongyu/senpi-codemode 2026.10.27-1 → 2026.10.30-1

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## [2026.10.30-1] - 2026-10-30
+
+### Breaking Changes
+
+### Added
+
+- Added the host-decider core for JS eval permission checks on `child_process.spawnSync`, `Bun.spawnSync`, and `fs.writeFileSync`, with per-invocation authority, bounded shared-memory checks, instrumented Workers and fail-closed revocation. Permission-extension integration and broader API coverage follow separately ([#4387](https://github.com/code-yeongyu/senpi/pull/4387)).
+- No-deny async continuations and Workers remain usable across cells, including after a cell times out or is interrupted. Worker data, messages, transferred MessagePorts and lifecycle events are preserved; a Worker message the host cannot forward arrives as `messageerror`; and interrupted permission checks release their shared slots.
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Refuse cross-session JavaScript and Python kernel tools before their bodies run when either session enforces a deny rule, and mint invoker-scoped JS tokens when neither enforces ([#4390](https://github.com/code-yeongyu/senpi/pull/4390), part of #4309).
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Extend eval permission checks across JS filesystem, process, Bun resource, and SQLite APIs, including descriptor grants and relative/absolute module imports ([#4391](https://github.com/code-yeongyu/senpi/pull/4391)).
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Known limitation: in natively loaded dependencies, Bun.plugin registration and non-literal eval are not refused (Bun 1.4.4 makes Bun.plugin immutable); code loaded that way still runs under the enforced spawn and write checks; tracked in #4380.
+- Known limitation: file reads through Bun.fetch on file: URLs (immutable in Bun 1.4.4) and native consumers of a handle obtained that way. Writes through such a handle are refused at each enumerated write sink: filesystem operations, Bun.write destinations and parts, BunFile write/writer/delete/unlink, and every Bun.spawn/Bun.spawnSync redirect, meaning the stdout/stderr keys and each stdio[] slot, including descriptors at index 3 and above. Every one of those sinks is a row in the operation sink table and the mutation driver, so a sink that is not listed there is not proven.
+- Eval cells now send the path they execute in addition to the path as written, together with its canonical form, so permission rules for `read`, `edit`, `list` and `grep` paths apply to the same file under every spelling that resolves to it; a module's own imports and top-level file access are decided under the importing cell's authority instead of being refused as unavailable ([#4391](https://github.com/code-yeongyu/senpi/pull/4391)).
+- Known limitation: path rules do not follow hard links; tracked in #4576.
+- Enforce host-supplied deny decisions inside Python eval cells and callbacks, including file modes, descriptor grants, process APIs, SQLite, module sources, and package resources; refuse Ruby and Julia cells while enforcement is active ([#4392](https://github.com/code-yeongyu/senpi/pull/4392), part of #4309).
+- Revoke Python invocation authority immediately and wait for observed interpreter retirement before admitting a replacement ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Keep Python permission checks intact after stdlib rebinding, guard native aliases and direct extension entry points, and preserve cross-cell background I/O when no deny applies ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Leave the interpreter's own import registries in place while guarding them, so C-level imports such as `pickle`, `datetime.strptime` and `xml.etree.ElementTree` keep working inside Python cells ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.
+- Python eval cells now send the path they execute in addition to the path as written, so permission rules for `read`, `edit`, `list` and `grep` paths apply to the same file under every spelling a Python cell resolves to it, including relative spellings after `os.chdir`; a path spelling that is not valid UTF-8 is refused as uncheckable ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+- Python eval cells supply the same versioned native path identity as JavaScript cells, preserving identity-based decisions when the host resolver is unavailable; inputs without an exact local representation retain host fallback ([#4392](https://github.com/code-yeongyu/senpi/pull/4392)).
+
+### Changed
+
+### Fixed
+
+- On macOS, eval cells that open a `Bun.WebView` no longer crash the process (SIGSEGV) when another kernel uses one too, WebViews keep working after a kernel reset, and `goBack()`/`goForward()` work on every eval-cell view ([#4797](https://github.com/code-yeongyu/senpi/pull/4797))
+- The Python eval kernel starts again on interpreters built without `ctypes`: it then sends no canonical path form, and the host decides as it does for any request without one ([#4895](https://github.com/code-yeongyu/senpi/pull/4895), fixes #4894).
+
+### Removed
+
+## [2026.10.27-2] - 2026-10-27
+
+### Breaking Changes
+
+### Added
+
+### Changed
+
+### Fixed
+
+### Removed
+
 ## [2026.10.27-1] - 2026-10-26
 
 ### Breaking Changes

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.10.27-1",
+	"version": "2026.10.30-1",
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -33,15 +33,15 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.27-1",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.10.30-1",
 		"quickjs-wasi": "3.6.2",
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.10.27-1"
+		"@code-yeongyu/senpi": "2026.10.30-1"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.10.27-1"
+		"@code-yeongyu/senpi": "2026.10.30-1"
 	},
 	"keywords": [
 		"senpi",

package/src/bridge/http-server.ts

@@ -1,6 +1,7 @@
 import { once } from "node:events";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import type { AddressInfo, Socket } from "node:net";
+import { permissionCheck } from "./permission-check.ts";
 import { type BridgeError, generateBridgeToken, verifyBridgeToken } from "./protocol.ts";
 
 const DEFAULT_BODY_LIMIT_BYTES = 1024 * 1024;
@@ -42,7 +43,7 @@ export interface BridgeServerHandle {
 }
 
 type JsonReply = { ok: true; value: unknown } | { ok: false; error: BridgeError };
-type Route = "/call" | "/emit" | "/completion";
+type Route = "/call" | "/emit" | "/completion" | "/permission_check";
 
 export async function startBridgeServer(options: BridgeServerOptions): Promise<BridgeServerHandle> {
 	const token = options.token ?? generateBridgeToken();
@@ -94,7 +95,7 @@ async function handleRequest(
 		return;
 	}
 	const auth = parseBearerToken(request.headers.authorization);
-	if (!auth || !verifyBridgeToken(token, auth).ok) {
+	if (route !== "/permission_check" && (!auth || !verifyBridgeToken(token, auth).ok)) {
 		sendJson(response, 401, { ok: false, error: transportError("unauthorized", "Bridge authorization failed") });
 		return;
 	}
@@ -104,6 +105,14 @@ async function handleRequest(
 		sendJson(response, parsed.status, { ok: false, error: transportError(parsed.code, parsed.message) });
 		return;
 	}
+	if (route === "/permission_check") {
+		try {
+			sendJson(response, 200, { ok: true, value: await permissionCheck(parsed.value) });
+		} catch (error) {
+			sendJson(response, 200, { ok: false, error: bridgeError(error) });
+		}
+		return;
+	}
 
 	if (route === "/emit") {
 		const event = parseEmitEvent(parsed.value);
@@ -209,7 +218,7 @@ function parseEmitEvent(value: unknown): { ok: true; event: BridgeHttpEmitEvent
 
 function routeFromUrl(rawUrl: string): Route | undefined {
 	const path = new URL(rawUrl, "http://127.0.0.1").pathname;
-	if (path === "/call" || path === "/emit" || path === "/completion") return path;
+	if (path === "/call" || path === "/emit" || path === "/completion" || path === "/permission_check") return path;
 	return undefined;
 }
 
@@ -221,8 +230,12 @@ function parseBearerToken(header: string | undefined): string | undefined {
 
 function sendJson(response: ServerResponse, status: number, body: JsonReply): void {
 	if (response.destroyed) return;
-	response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
-	response.end(JSON.stringify(body));
+	const encoded = JSON.stringify(body);
+	response.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"content-length": Buffer.byteLength(encoded),
+	});
+	response.end(encoded);
 }
 
 function bridgeError(error: unknown): BridgeError {

package/src/bridge/permission-check.ts

@@ -0,0 +1,76 @@
+import type { CellDecision, CellOperation } from "../kernels/js/permission-slots.mjs";
+
+const checks = new Map<string, (call: CellOperation) => Promise<CellDecision>>();
+
+/** Only the host registers invocation capabilities. The ordinary bridge bearer is not one. */
+export function registerPermissionCheck(
+	token: string,
+	check: (call: CellOperation) => Promise<CellDecision>,
+): () => void {
+	checks.set(token, check);
+	return () => checks.delete(token);
+}
+
+export async function permissionCheck(body: unknown): Promise<unknown> {
+	if (
+		typeof body !== "object" ||
+		body === null ||
+		!("token" in body) ||
+		typeof body.token !== "string" ||
+		!("nonce" in body) ||
+		typeof body.nonce !== "string" ||
+		!("call" in body)
+	) {
+		throw new Error("Invalid permission request");
+	}
+	const call = body.call;
+	if (
+		typeof call !== "object" ||
+		call === null ||
+		!("tool" in call) ||
+		!("input" in call) ||
+		typeof call.input !== "object" ||
+		call.input === null
+	)
+		throw new Error("Invalid permission operation");
+	if (call.tool !== "bash" && call.tool !== "write" && call.tool !== "read" && call.tool !== "ls")
+		throw new Error("Invalid permission tool");
+	const input = call.input;
+	if (
+		call.tool === "bash"
+			? !("command" in input && typeof input.command === "string")
+			: !("path" in input && typeof input.path === "string")
+	)
+		throw new Error("Invalid permission input");
+	if ("cwd" in call && typeof call.cwd !== "string") throw new Error("Invalid execution cwd");
+	const check = checks.get(body.token);
+	if (!check) throw new Error("Permission authority unavailable");
+	const canonical = "canonical" in input ? input.canonical : undefined;
+	const validCanonical =
+		typeof canonical === "object" &&
+		canonical !== null &&
+		"v" in canonical &&
+		typeof canonical.v === "number" &&
+		"path" in canonical &&
+		typeof canonical.path === "string" &&
+		"foldCase" in canonical &&
+		typeof canonical.foldCase === "boolean"
+			? { v: canonical.v, path: canonical.path, foldCase: canonical.foldCase }
+			: undefined;
+	const operation: CellOperation = {
+		tool: call.tool,
+		input: {
+			...("command" in input && typeof input.command === "string" ? { command: input.command } : {}),
+			...("path" in input && typeof input.path === "string" ? { path: input.path } : {}),
+			...("executedPath" in input && typeof input.executedPath === "string"
+				? { executedPath: input.executedPath }
+				: {}),
+			...(validCanonical === undefined ? {} : { canonical: validCanonical }),
+			...("unresolvable" in input && typeof input.unresolvable === "string"
+				? { unresolvable: input.unresolvable }
+				: {}),
+		},
+		...("cwd" in call && typeof call.cwd === "string" ? { cwd: call.cwd } : {}),
+	};
+	return { nonce: body.nonce, decision: await check(operation) };
+}

package/src/bridge/protocol.ts

@@ -16,6 +16,13 @@ const bridgeErrorSchema = Type.Object({
 	message: Type.String(),
 	stack: Type.Optional(Type.String()),
 	code: Type.Optional(Type.String()),
+	permissionRule: Type.Optional(
+		Type.Object({
+			permission: Type.String(),
+			pattern: Type.String(),
+			layer: Type.String(),
+		}),
+	),
 });
 
 const statusEventSchema = Type.Object({ op: Type.String() }, { additionalProperties: true });

package/src/kernels/jl/kernel.ts

@@ -2,11 +2,13 @@ import { join } from "node:path";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { SessionEnvironment } from "../session-env.ts";
 import type { KernelLifecycle } from "../shared/kernel-death.ts";
+import type { InvocationPermissions } from "../shared/invocation-authority.ts";
 import { readProcessGroupCpuTime } from "../shared/process-group-cpu.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { SubprocessKernel, type SubprocessKernelMemory, type SubprocessSpawn } from "../shared/subprocess-kernel.ts";
 
 export interface JuliaKernelStartOptions extends KernelLifecycle {
+	readonly permissions?: InvocationPermissions;
 	readonly cwd: string;
 	readonly sessionId: string;
 	readonly connection: BridgeConnectionConfig;
@@ -55,6 +57,7 @@ export class JuliaKernel extends SubprocessKernel {
 			onMessage: options.onMessage,
 			memory: options.memory && { language: "jl", ...options.memory },
 			onDeath: options.onDeath,
+			permissions: options.permissions,
 			startup: { label: "Julia", readGroupCpuTime: readProcessGroupCpuTime },
 		});
 	}

package/src/kernels/js/context-manager.ts

@@ -28,6 +28,9 @@ import { ToolCallQueue } from "./tool-call-queue.ts";
 import { WorkerChildren } from "./worker-children.ts";
 import { WorkerRecovery } from "./worker-recovery.ts";
 import { WorkerSlot } from "./worker-slot.ts";
+import { KernelPermissionHost } from "./permission-host.ts";
+
+export { revokeSessionKernels } from "./permission-host.ts";
 
 export { JavaScriptKernelClosedError, type JavaScriptKernelMode, type JavaScriptRunInput } from "./kernel-contract.ts";
 export type { JavaScriptMemoryReading } from "./kernel-memory-bridge.ts";
@@ -47,6 +50,7 @@ export class JavaScriptKernel {
 	readonly #options: JavaScriptKernelOptions;
 	readonly #moduleLoader: LocalModuleLoader;
 	readonly #slot: WorkerSlot;
+	readonly #permissions: KernelPermissionHost;
 	#lifecycle: LifecycleState = "open";
 	#activation: Promise<void> | null = null;
 	#closePromise: Promise<void> | null = null;
@@ -54,6 +58,7 @@ export class JavaScriptKernel {
 	readonly #kernelTools = new KernelToolHostPump(
 		(message) => this.#slot.postMessage(message),
 		() => this.#lifecycle === "open" && this.#slot.present,
+		(request, options) => this.#permissions.invocation(request, options),
 	);
 	readonly #toolCalls = new ToolCallQueue();
 	readonly #children: WorkerChildren;
@@ -68,6 +73,10 @@ export class JavaScriptKernel {
 
 	constructor(options: JavaScriptKernelOptions) {
 		this.#options = options;
+		this.#permissions = new KernelPermissionHost(options, async () => {
+			this.#runs.settleAll("Permission rules changed; kernel revoked");
+			return await this.#terminate();
+		});
 		this.#activeCell = new ActiveCellControl({
 			runs: this.#runs,
 			bounds: options.interruptBounds ?? DEFAULT_INTERRUPT_BOUNDS,
@@ -79,11 +88,15 @@ export class JavaScriptKernel {
 		this.#memory = new JavaScriptKernelMemory(options, () => this.#slot.processPid);
 		this.#children = new WorkerChildren(options.collectOrphanedChildren);
 		this.#moduleLoader = new LocalModuleLoader(options);
-		this.#slot = new WorkerSlot(options, {
-			isOpen: () => this.#lifecycle === "open",
-			onMessage: (message) => this.#handleMessage(message),
-			onCrash: (error) => this.#handleCrash(error),
-		});
+		this.#slot = new WorkerSlot(
+			options,
+			{
+				isOpen: () => this.#lifecycle === "open",
+				onMessage: (message) => this.#handleMessage(message),
+				onCrash: (error) => this.#handleCrash(error),
+			},
+			this.#permissions,
+		);
 	}
 
 	get mode(): JavaScriptKernelMode {
@@ -114,15 +127,17 @@ export class JavaScriptKernel {
 		return this.#kernelTools.describe(names);
 	}
 
-	invokeKernelTool(
+	async invokeKernelTool(
 		request: KernelToolsInvokeRequest,
 		options?: AbortSignal | KernelToolsInvokeOptions,
 	): Promise<unknown> {
-		return this.#kernelTools.invoke(request, options);
+		await this.#permissions.admit();
+		return await this.#kernelTools.invoke(request, options);
 	}
 
 	async run(input: JavaScriptRunInput): Promise<ResultMessage> {
 		assertJavaScriptKernelOpen(this.#lifecycle, "run");
+		this.#permissions.assertSessionLive();
 		const promise = this.#runs.enqueue(input);
 		this.#activate();
 		return await promise;
@@ -189,6 +204,7 @@ export class JavaScriptKernel {
 			if (recovery) await recovery;
 			await this.#terminate();
 		})().finally(() => {
+			this.#permissions.dispose();
 			this.#lifecycle = "closed";
 		});
 		this.#closePromise = closePromise;
@@ -206,6 +222,7 @@ export class JavaScriptKernel {
 	}
 
 	async #ensureReady(): Promise<void> {
+		await this.#permissions.admit();
 		assertJavaScriptKernelOpen(this.#lifecycle, "run");
 		try {
 			await this.#slot.ensureReady();
@@ -217,7 +234,7 @@ export class JavaScriptKernel {
 	}
 
 	#startNext(): void {
-		if (this.#lifecycle !== "open" || this.#runs.active || !this.#slot.present) return;
+		if (this.#permissions.blocked || this.#lifecycle !== "open" || this.#runs.active || !this.#slot.present) return;
 		const next = this.#runs.startNext(performance.now());
 		if (!next) return;
 		const dispatch = dispatchCell(next.input, this.#moduleLoader, this.#options);
@@ -254,6 +271,7 @@ export class JavaScriptKernel {
 	}
 
 	#handleCrash(error: Error): void {
+		if (this.#permissions.blocked) return;
 		const active = this.#runs.active;
 		if (!active && this.#slot.startingUp) return;
 		this.#activeCell.disarm();

package/src/kernels/js/inline-worker-entry.js

@@ -1,23 +1 @@
-import { parentPort, workerData } from "node:worker_threads";
-import { createWorkerCore } from "./worker-core.js";
-
-if (!parentPort) throw new Error("JS kernel inline fallback worker missing parentPort");
-
-const transport = {
-	send(message) {
-		parentPort.postMessage(message);
-	},
-	onMessage(handler) {
-		parentPort.on("message", handler);
-		return () => parentPort.off("message", handler);
-	},
-	close() {
-		parentPort.close();
-		setTimeout(() => process.exit(0), 0);
-	},
-};
-
-createWorkerCore(transport, {
-	cwd: workerData.cwd,
-	parallelPoolWidth: workerData.parallelPoolWidth,
-});
+import "./interpose.js";

package/src/kernels/js/inline-worker.ts

@@ -4,6 +4,7 @@ import type { MessagePort } from "node:worker_threads";
 import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 import { spawnNodeWorker } from "./worker-host.ts";
 
 export interface JavaScriptInlineWorkerEntryUrlOptions extends CodemodeRuntimeAssetEnvironment {
@@ -27,6 +28,10 @@ export interface WorkerLike {
 	terminate(): Promise<void>;
 }
 
-export function createInlineWorker(cwd: string, parallelPoolWidth: number): WorkerLike {
-	return spawnNodeWorker(resolveInlineWorkerEntryUrl(), cwd, parallelPoolWidth, "inline");
+export function createInlineWorker(
+	cwd: string,
+	parallelPoolWidth: number,
+	permissions?: KernelPermissionHost,
+): WorkerLike {
+	return spawnNodeWorker(resolveInlineWorkerEntryUrl(), cwd, parallelPoolWidth, "inline", permissions);
 }

package/src/kernels/js/interpose-bun.js

@@ -0,0 +1,220 @@
+import { checkPath, executionPath, replaceMethod } from "./interpose-paths.js";
+
+const READERS = ["text", "json", "bytes", "arrayBuffer", "stream", "formData", "image"];
+const ignore = () => {};
+const WRITERS = ["write", "delete", "unlink"];
+
+export function installBunPermissions(check, resources) {
+	const bun = globalThis.Bun;
+	const stand = new WeakMap();
+	const unwrap = (value) => stand.get(value) ?? value;
+	const files = { source: () => {}, destination: () => {}, handle: () => false };
+	if (typeof bun?.file === "function") {
+		const originalFile = bun.file;
+		const proto = Object.getPrototypeOf(originalFile(new URL(import.meta.url)));
+		// Captured before any cell runs, so a per-instance "name" cannot redirect a decision away
+		// from the path the runtime will actually open.
+		const nativePath = Object.getOwnPropertyDescriptor(proto, "name").get;
+		const nativeStat = proto.stat;
+		// A memory Blob carries no file and answers nothing; anything the native stat does answer for is
+		// backed by a file this decision cannot name, which is what makes it undecidable rather than safe.
+		const fileBacked = (value) => {
+			let pending;
+			try {
+				pending = nativeStat.call(value);
+			} catch {
+				return true;
+			}
+			if (pending === undefined) return false;
+			if (typeof pending?.then === "function") pending.then(ignore, ignore);
+			return true;
+		};
+		const pathOf = (value) => {
+			try {
+				return nativePath.call(unwrap(value));
+			} catch {
+				return undefined;
+			}
+		};
+		const granted = (value, mode) => {
+			const grant = resources.path(value);
+			if (grant === undefined) return false;
+			resources.use(typeof grant === "number" ? grant : value, mode);
+			return true;
+		};
+		const handle = (value, mode) => {
+			if (typeof value === "number") return granted(value, mode);
+			if (value === null || typeof value !== "object") return false;
+			const path = pathOf(value);
+			if (typeof path === "string") {
+				checkPath(check, mode, path);
+				return true;
+			}
+			if (granted(unwrap(value), mode)) return true;
+			if (!(unwrap(value) instanceof Blob)) return false;
+			// A file-backed handle whose path cannot be read cannot be decided, so it never receives bytes
+			// and never hands any out either.
+			if (mode === "write") check(() => ({ unsupported: true }));
+			if (mode === "read") check(() => (fileBacked(unwrap(value)) ? { unsupported: true } : { granted: true })); // sink:undecidable-read
+			return true;
+		};
+		const source = (value) => {
+			for (const part of Array.isArray(value) ? value : [value]) handle(part, "read");
+		};
+		const destination = (value) => {
+			if (typeof value === "number") resources.use(value, "write");
+			else if (!handle(value, "write")) checkPath(check, "write", value);
+		};
+		const native = (value) => (Array.isArray(value) ? value.map(unwrap) : unwrap(value));
+		Object.assign(files, { source, destination, handle });
+		const standIn = (file) => {
+			// Metadata answers for the same file the content was refused for, so it is decided the same way.
+			const metadata = () => checkPath(check, "read", nativePath.call(file));
+			const surface = {
+				exists: (...args) => {
+					metadata(); // sink:standin-metadata
+					return proto.exists.apply(file, args);
+				},
+				stat: (...args) => {
+					metadata(); // sink:standin-metadata
+					return nativeStat.apply(file, args);
+				},
+				slice: (...args) => standIn(proto.slice.apply(file, args)),
+			};
+			// The native accessors live on the prototype, so these stay off the own enumerable surface too:
+			// a structured-clone walk still fails on the missing internal slots rather than on a check.
+			Object.defineProperties(surface, {
+				name: { get: () => nativePath.call(file), configurable: true },
+				type: { get: () => file.type, configurable: true },
+				size: {
+					get: () => {
+						metadata(); // sink:standin-metadata
+						return file.size;
+					},
+					configurable: true,
+				},
+				lastModified: {
+					get: () => {
+						metadata(); // sink:standin-metadata
+						return file.lastModified;
+					},
+					configurable: true,
+				},
+			});
+			for (const name of [...READERS, ...WRITERS, "writer"]) {
+				surface[name] = (...args) => proto[name].apply(file, args);
+			}
+			stand.set(surface, file);
+			return surface;
+		};
+		for (const name of READERS) {
+			replaceMethod(proto, name, (original) => function (...args) {
+				source(this); // sink:bunfile-read
+				return original.apply(unwrap(this), args);
+			});
+		}
+		for (const name of WRITERS) {
+			replaceMethod(proto, name, (original) => function (...args) {
+				destination(this); // sink:bunfile-write
+				if (name === "write") source(args[0]); // sink:bunfile-write-parts
+				return original.apply(unwrap(this), name === "write" ? [native(args[0]), ...args.slice(1)] : args);
+			});
+		}
+		replaceMethod(proto, "writer", (original) => function (...args) {
+			destination(this); // sink:bunfile-writer
+			const writer = original.apply(unwrap(this), args);
+			resources.record(writer, pathOf(this), ["write"]);
+			for (const name of ["write", "flush", "end"]) {
+				replaceMethod(writer, name, (fn) => function (...parameters) {
+					resources.use(this, "write");
+					return fn.apply(this, parameters);
+				});
+			}
+			return writer;
+		});
+		bun.file = function (path, ...args) {
+			const file = originalFile.call(this, executionPath(path), ...args);
+			if (typeof path === "number") return resources.record(file, path, ["read", "write"]);
+			try {
+				checkPath(check, "read", path); // sink:bun-file-mint
+			} catch (error) {
+				if (error?.code !== "cell_permission_denied") throw error;
+				// A denied path yields a stand-in with no internal slots, so every native consumer
+				// of a file handle refuses it instead of reading the file behind our back.
+				return standIn(file);
+			}
+			return file;
+		};
+		replaceMethod(bun, "write", (original) => function (target, data, ...args) {
+			destination(target); // sink:bun-write-destination
+			source(data); // sink:bun-write-parts
+			return original.call(this, executionPath(unwrap(target)), native(data), ...args);
+		});
+		// A route value may be a per-method map ({'/f':{GET: handle}}), which Bun reads the handle out of
+		// exactly like the flat form, so every nested value is decided too.
+		const nestedRoutes = (value, depth, seen) => {
+			if (value === null || typeof value !== "object" || depth === 0 || seen.has(value)) return;
+			if (unwrap(value) instanceof Blob) return;
+			seen.add(value);
+			for (const inner of Object.values(value)) {
+				source(inner);
+				nestedRoutes(inner, depth - 1, seen);
+			}
+		};
+		replaceMethod(bun, "serve", (original) => function (options, ...args) {
+			for (const map of [options?.routes, options?.static]) {
+				for (const value of map === null || typeof map !== "object" ? [] : Object.values(map)) {
+					source(value); // sink:bun-serve
+					nestedRoutes(value, 3, new Set()); // sink:bun-serve-nested
+				}
+			}
+			return original.call(this, options, ...args);
+		});
+		const buffer = process.getBuiltinModule("node:buffer");
+		for (const name of ["Blob", "File", "Response", "Request"]) {
+			const original = globalThis[name];
+			const guarded = new Proxy(original, {
+				construct(target, args, newTarget) {
+					if (name === "Blob" || name === "File") source(args[0]);
+					else source(name === "Response" ? args[0] : args[1]?.body);
+					return Reflect.construct(target, args, newTarget);
+				},
+			});
+			globalThis[name] = guarded;
+			if (buffer[name] === original) buffer[name] = guarded;
+			if (original.prototype.constructor === original) {
+				Object.defineProperty(original.prototype, "constructor", { value: guarded });
+			}
+		}
+		for (const name of ["append", "set"]) {
+			replaceMethod(FormData.prototype, name, (original) => function (key, value, ...args) {
+				source(value);
+				return original.call(this, key, value, ...args);
+			});
+		}
+	}
+	if (bun?.Glob) {
+		for (const name of ["scan", "scanSync"]) {
+			replaceMethod(bun.Glob.prototype, name, (original) => function (options) {
+				const cwd = typeof options === "string" ? options : (options?.cwd ?? process.cwd());
+				checkPath(check, "ls", cwd);
+				return original.call(
+					this,
+					typeof options === "string" ? executionPath(cwd) : { ...options, cwd: executionPath(cwd) },
+				);
+			});
+		}
+	}
+	replaceMethod(bun, "mmap", (original) => function (path, options) {
+		check(() => ({ granted: true, unsupported: options?.shared !== false }));
+		checkPath(check, "read", path);
+		return original.call(this, executionPath(path), options);
+	});
+	replaceMethod(globalThis, "fetch", (original) => function (input, ...args) {
+		const href = input instanceof Request ? input.url : String(input);
+		if (href.startsWith("file:")) checkPath(check, "read", new URL(href));
+		files.source(args[0]?.body);
+		return original.call(this, input, ...args);
+	});
+	return files;
+}

package/src/kernels/js/interpose-capabilities.js

@@ -0,0 +1,29 @@
+import { replaceMethod } from "./interpose-paths.js";
+
+export function installCapabilityPermissions(check) {
+	const refuse = () => check(() => ({ unsupported: true }));
+	for (const name of ["binding", "_linkedBinding", "dlopen"]) {
+		replaceMethod(process, name, (original) => function (...args) {
+			refuse();
+			return original.apply(this, args);
+		});
+	}
+	if (globalThis.Bun) {
+		const original = globalThis.Bun.plugin;
+		Object.defineProperty(globalThis, Symbol.for("senpi.kernel.permissionBunPlugin"), { value: function (...args) {
+			refuse();
+			return original(...args);
+		} });
+	}
+	const module = process.getBuiltinModule("node:module");
+	replaceMethod(module, "register", (original) => function (...args) {
+		refuse();
+		return original.apply(this, args);
+	});
+	let load = module._load;
+	Object.defineProperty(module, "_load", {
+		configurable: true, enumerable: true,
+		get: () => load,
+		set(value) { refuse(); load = value; },
+	});
+}