@code-yeongyu/senpi-codemode 2026.10.27-1 → 2026.10.30-1

package/src/kernels/js/worker-cwd.js

@@ -2,6 +2,7 @@ import { Buffer } from "node:buffer";
 import { syncBuiltinESMExports } from "node:module";
 import { isAbsolute, resolve, sep } from "node:path";
 import { isMainThread } from "node:worker_threads";
+import { FS_PERMISSION_PATHS } from "./interpose-fs.js";
 
 // A worker thread cannot chdir (process.chdir throws ERR_WORKER_UNSUPPORTED_OPERATION under Node
 // and Bun), so every relative path a cell used resolved against the host process directory: in a
@@ -73,19 +74,22 @@ export function installSessionCwd(cwd, options) {
 	const path = process.getBuiltinModule("node:path");
 	const resolveFromProcess = path.resolve;
 	path.resolve = (...segments) => resolveFromProcess(root, ...segments);
-	patchFs(process.getBuiltinModule("node:fs"), process.getBuiltinModule("node:fs/promises"), at, root);
+	patchFs(process.getBuiltinModule("node:fs"), process.getBuiltinModule("node:fs/promises"), at, root, options?.permissionInterposed);
 	patchChildProcess(process.getBuiltinModule("node:child_process"), at, root);
-	patchBun(globalThis.Bun, at, root);
+	patchBun(globalThis.Bun, at, root, options?.permissionInterposed);
 	syncBuiltinESMExports();
 }
 
-function patchFs(fs, promises, at, root) {
+function patchFs(fs, promises, at, root, permissionInterposed) {
 	const promiseModules = [...new Set([fs.promises, promises])];
 	for (const [name, indexes] of Object.entries(FS_PATH_ARGS)) {
+		if (permissionInterposed && FS_PERMISSION_PATHS.has(name)) continue;
 		replace(fs, name, (fn) => resolvingArgs(fn, indexes, at));
-		replace(fs, `${name}Sync`, (fn) => resolvingArgs(fn, indexes, at));
+		// The early wrapper must see the requested spelling before cwd resolution (#4309).
+		if (!(permissionInterposed && name === "writeFile")) replace(fs, `${name}Sync`, (fn) => resolvingArgs(fn, indexes, at));
 		for (const target of promiseModules) replace(target, name, (fn) => resolvingArgs(fn, indexes, at));
 	}
+	if (permissionInterposed) return;
 	replace(fs.realpath, "native", (fn) => resolvingArgs(fn, [0], at));
 	replace(fs.realpathSync, "native", (fn) => resolvingArgs(fn, [0], at));
 	for (const target of [fs, ...promiseModules]) {
@@ -105,15 +109,17 @@ function patchChildProcess(childProcess, at, root) {
 	for (const name of CHILD_PROCESS_COMMAND_ARGS) replace(childProcess, name, (fn) => withOptionsCwd(fn, () => 1, root));
 }
 
-function patchBun(bun, at, root) {
+function patchBun(bun, at, root, permissionInterposed) {
 	if (bun === null || typeof bun !== "object") return;
-	replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
-	replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
+	if (!permissionInterposed) {
+		replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
+		replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
+	}
 	replace(bun, "spawn", (fn) => withBunSpawnCwd(fn, root));
 	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root, false));
 	if (typeof bun.$?.cwd === "function") bun.$.cwd(root);
 	const glob = bun.Glob?.prototype;
-	if (glob) {
+	if (glob && !permissionInterposed) {
 		for (const name of ["scan", "scanSync"]) {
 			replace(glob, name, (fn) =>
 				function scan(options) {

package/src/kernels/js/worker-entry.js

@@ -1,23 +1 @@
-import { parentPort, workerData } from "node:worker_threads";
-import { createWorkerCore } from "./worker-core.js";
-
-if (!parentPort) throw new Error("JS kernel worker missing parentPort");
-
-const transport = {
-	send(message) {
-		parentPort.postMessage(message);
-	},
-	onMessage(handler) {
-		parentPort.on("message", handler);
-		return () => parentPort.off("message", handler);
-	},
-	close() {
-		parentPort.close();
-		setTimeout(() => process.exit(0), 0);
-	},
-};
-
-createWorkerCore(transport, {
-	cwd: workerData.cwd,
-	parallelPoolWidth: workerData.parallelPoolWidth,
-});
+import "./interpose.js";

package/src/kernels/js/worker-file-helpers.js

@@ -0,0 +1,58 @@
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
+
+export function createFileHelpers(options, emit) {
+	const roots = { ...options.localRoots };
+	if (options.artifactsDir && !roots.local) roots.local = join(options.artifactsDir, "local");
+	const resolvePath = (raw, operation) => {
+		const match = /^([a-z][a-z0-9+.-]*):\/\/(.*)$/iu.exec(raw);
+		if (!match) return isAbsolute(raw) ? normalize(raw) : resolve(options.cwd, raw);
+		const scheme = match[1].toLowerCase();
+		const root = roots[scheme];
+		if (!root) throw new Error(`Protocol paths are not supported by ${operation}(): ${raw}`);
+		let relative;
+		try { relative = decodeURIComponent(match[2].replaceAll("\\", "/")); }
+		catch (error) {
+			if (error instanceof URIError) throw new Error(`Invalid URL encoding in ${scheme}:// path: ${raw}`);
+			throw error;
+		}
+		if (isAbsolute(relative) || relative.split("/").includes("..")) throw new Error(`Path traversal is not allowed in ${scheme}:// URLs: ${raw}`);
+		const rootPath = resolve(root);
+		const path = resolve(rootPath, relative);
+		if (path !== rootPath && !path.startsWith(`${rootPath}${sep}`)) throw new Error(`${scheme}:// path escapes its root`);
+		return path;
+	};
+	return {
+		async read(rawPath, settings) {
+			const path = resolvePath(String(rawPath), "read");
+			const info = await stat(path);
+			if (info.isDirectory()) throw new Error(`Directory paths are not supported by read(): ${path}`);
+			let text = options.permissionIO
+				? await options.permissionIO.read(String(rawPath), path) : await readFile(path, "utf8");
+			const offset = typeof settings.offset === "number" ? settings.offset : 1;
+			const limit = typeof settings.limit === "number" ? settings.limit : undefined;
+			if (offset > 1 || limit !== undefined) {
+				const start = Math.max(0, offset - 1);
+				text = text.split(/\r?\n/u).slice(start, limit === undefined ? undefined : start + limit).join("\n");
+			}
+			emit({ op: "read", path, bytes: info.size, chars: text.length });
+			return text;
+		},
+		async write(rawPath, content) {
+			const path = resolvePath(String(rawPath), "write");
+			const data = await writeData(content);
+			if (options.permissionIO) await options.permissionIO.write(String(rawPath), path, data);
+			else { await mkdir(dirname(path), { recursive: true }); await writeFile(path, data); }
+			emit({ op: "write", path, bytes: typeof data === "string" ? Buffer.byteLength(data) : data.byteLength });
+			return path;
+		},
+	};
+}
+
+async function writeData(value) {
+	if (typeof value === "string" || value instanceof Uint8Array) return value;
+	if (value instanceof Blob) return new Uint8Array(await value.arrayBuffer());
+	if (value instanceof ArrayBuffer) return new Uint8Array(value);
+	if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+	throw new TypeError("write() expects string, Blob, ArrayBuffer, or TypedArray data");
+}

package/src/kernels/js/worker-host.ts

@@ -4,6 +4,7 @@ import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import { describeExit } from "../shared/kernel-death.ts";
 import type { WorkerLike } from "./inline-worker.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 
 declare global {
 	// Inert outside the gate. Bun does not refresh named builtin constructor exports.
@@ -41,10 +42,16 @@ export function spawnNodeWorker(
 	cwd: string,
 	parallelPoolWidth: number,
 	mode: JavaScriptKernelMode = "worker",
+	permissions?: KernelPermissionHost,
 ): WorkerLike {
-	const worker = new Worker(url, { workerData: { cwd, parallelPoolWidth } });
+	const permission = permissions?.bootstrap();
+	const worker = new Worker(url, {
+		workerData: { cwd, parallelPoolWidth, permission },
+		transferList: permission ? [permission.port] : [],
+	});
+	const exited = new Promise<void>((resolve) => worker.once("exit", () => resolve()));
 	globalThis.__senpiCodemodeGateObserveResource?.("workers", worker, "exit");
-	return wrapNodeWorker(worker, mode);
+	return wrapNodeWorker(worker, mode, exited, permissions);
 }
 
 export function waitForReady(worker: WorkerLike, signal: AbortSignal): Promise<void> {
@@ -106,13 +113,21 @@ export function crashedResult(
 	return { type: "result", cellId, ok: false, error: bridgeError(error), durationMs };
 }
 
-function wrapNodeWorker(worker: Worker, mode: JavaScriptKernelMode): WorkerLike {
+function wrapNodeWorker(
+	worker: Worker,
+	mode: JavaScriptKernelMode,
+	exited: Promise<void>,
+	permissions?: KernelPermissionHost,
+): WorkerLike {
 	return {
 		mode,
 		postMessage: (message, transfer) =>
-			worker.postMessage(message, transfer === undefined ? undefined : [...transfer]),
+			worker.postMessage(permissions?.frame(message) ?? message, transfer === undefined ? undefined : [...transfer]),
 		onMessage(handler) {
-			const listener = (message: KernelToHostMessage): void => handler(message);
+			const listener = (message: KernelToHostMessage): void => {
+				permissions?.settle(message);
+				handler(message);
+			};
 			worker.on("message", listener);
 			return () => worker.off("message", listener);
 		},
@@ -133,7 +148,10 @@ function wrapNodeWorker(worker: Worker, mode: JavaScriptKernelMode): WorkerLike
 			};
 		},
 		async terminate() {
-			await worker.terminate();
+			permissions?.revoke();
+			const children = permissions?.terminateChildren();
+			void worker.terminate();
+			await Promise.all([exited, children]);
 		},
 	};
 }

package/src/kernels/js/worker-package-resolve.js

@@ -9,6 +9,14 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 // conditions), so ESM-only packages load and the first root that has the package wins.
 const RESOLVE_PACKAGE = Symbol.for("senpi.kernel.resolvePackage");
 const CONDITIONS = typeof globalThis.Bun === "object" ? ["bun", "node", "import", "default"] : ["node", "import", "default"];
+let resolverIO = { readFileSync, realpathSync };
+let initializedIO = false;
+
+export function initializeResolverIO(io) {
+	if (initializedIO) throw new Error("Resolver IO already initialized");
+	initializedIO = true;
+	resolverIO = { readFileSync: io.readFileSync, realpathSync: io.realpathSync };
+}
 
 function isFile(path) {
 	try {
@@ -93,7 +101,7 @@ function legacyFile(path) {
 function packageEntry(packageDir, subpath, specifier) {
 	let manifest;
 	try {
-		manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+		manifest = JSON.parse(resolverIO.readFileSync(join(packageDir, "package.json"), "utf8"));
 	} catch {
 		return legacyFile(join(packageDir, subpath === "." ? "index.js" : subpath));
 	}
@@ -139,7 +147,7 @@ export function resolvePackage(specifier, rootUrls) {
 		if (entry === undefined) continue;
 		let real = entry;
 		try {
-			real = realpathSync(entry);
+			real = resolverIO.realpathSync(entry);
 		} catch {
 			// A missing target fails in the import itself, with the runtime's own error.
 		}

package/src/kernels/js/worker-runtime.js

@@ -1,8 +1,7 @@
 // allow: SIZE_OK — private runtime state and installed globals must stay in one worker module.
 import { pathToFileURL } from "node:url";
 import { createCellRequire, createRequire } from "./worker-require.js";
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
+import { createFileHelpers } from "./worker-file-helpers.js";
 import { inspect } from "node:util";
 import { encodeDisplayImage, resolveDisplayOps } from "./display-image.js";
 import { terminateProcessGroups, terminateProcessTrees } from "./process-tree.js";
@@ -24,12 +23,10 @@ const PRELUDE_SOURCE_URL = "senpi:kernel-prelude";
 // How long a child gets to honour SIGTERM before SIGKILL. Short, because the
 // cell has already produced its value and the caller is waiting on settle.
 const CHILD_TERMINATION_GRACE_MS = 1_000;
-const INTERNAL_URL = /^([a-z][a-z0-9+.-]*):\/\/(.*)$/iu;
 
 export class JsWorkerRuntime {
-	#cwd;
 	#parallelPoolWidth;
-	#localRoots;
+	#files;
 	#env = new Map();
 	#hooks = null;
 	#pendingDisplays = [];
@@ -44,12 +41,10 @@ export class JsWorkerRuntime {
 	#tools;
 
 	constructor(options) {
-		this.#cwd = options.cwd;
 		this.#parallelPoolWidth = options.parallelPoolWidth;
 		this.#onChildEvent = typeof options.onChildEvent === "function" ? options.onChildEvent : null;
 		this.#onShellWaitChange = options.onShellWaitChange;
-		this.#localRoots = { ...(options.localRoots ?? {}) };
-		if (options.artifactsDir && !this.#localRoots.local) this.#localRoots.local = join(options.artifactsDir, "local");
+		this.#files = createFileHelpers(options, (event) => this.#emitStatus(event));
 		this.#tools = createKernelToolRegistry({
 			generation: options.kernelGeneration ?? 1,
 			hostToolNames: options.hostToolNames ?? [],
@@ -166,8 +161,8 @@ export class JsWorkerRuntime {
 		globalThis.log = message => this.#hooks?.emit({ type: "log", message: String(message) });
 		globalThis.phase = title => this.#hooks?.emit({ type: "phase", title: String(title) });
 		globalThis.env = (key, value) => this.#envHelper(key, value);
-		globalThis.read = async (path, options, ...rest) => await this.#read(path, helperOptions("read", options, rest));
-		globalThis.write = async (path, content) => await this.#write(path, content);
+		globalThis.read = async (path, options, ...rest) => await this.#files.read(path, helperOptions("read", options, rest));
+		globalThis.write = async (path, content) => await this.#files.write(path, content);
 		globalThis.output = async (...args) => await this.#output(args);
 		globalThis.tool_schema = async name => await this.#toolSchema(name);
 		globalThis.agent = async (prompt, options, ...rest) => await this.#agent(prompt, options, rest);
@@ -297,53 +292,6 @@ export class JsWorkerRuntime {
 		return result;
 	}
 
-	async #read(rawPath, options) {
-		const path = this.#resolvePath(String(rawPath), "read");
-		const info = await stat(path);
-		if (info.isDirectory()) throw new Error(`Directory paths are not supported by read(): ${path}`);
-		let text = await readFile(path, "utf8");
-		const offset = typeof options.offset === "number" ? options.offset : 1;
-		const limit = typeof options.limit === "number" ? options.limit : undefined;
-		if (offset > 1 || limit !== undefined) {
-			const lines = text.split(/\r?\n/u);
-			const start = Math.max(0, offset - 1);
-			text = lines.slice(start, limit === undefined ? undefined : start + limit).join("\n");
-		}
-		this.#emitStatus({ op: "read", path, bytes: info.size, chars: text.length });
-		return text;
-	}
-
-	async #write(rawPath, content) {
-		const path = this.#resolvePath(String(rawPath), "write");
-		const data = await writeData(content);
-		await mkdir(dirname(path), { recursive: true });
-		await writeFile(path, data);
-		this.#emitStatus({ op: "write", path, bytes: typeof data === "string" ? Buffer.byteLength(data) : data.byteLength });
-		return path;
-	}
-
-	#resolvePath(rawPath, operation) {
-		const match = INTERNAL_URL.exec(rawPath);
-		if (!match) return isAbsolute(rawPath) ? normalize(rawPath) : resolve(this.#cwd, rawPath);
-		const scheme = match[1].toLowerCase();
-		const root = this.#localRoots[scheme];
-		if (!root) throw new Error(`Protocol paths are not supported by ${operation}(): ${rawPath}`);
-		let relative;
-		try {
-			relative = decodeURIComponent(match[2].replaceAll("\\", "/"));
-		} catch (error) {
-			if (error instanceof URIError) throw new Error(`Invalid URL encoding in ${scheme}:// path: ${rawPath}`);
-			throw error;
-		}
-		if (isAbsolute(relative) || relative.split("/").includes("..")) {
-			throw new Error(`Path traversal is not allowed in ${scheme}:// URLs: ${rawPath}`);
-		}
-		const rootPath = resolve(root);
-		const path = resolve(rootPath, relative);
-		if (path !== rootPath && !path.startsWith(`${rootPath}${sep}`)) throw new Error(`${scheme}:// path escapes its root`);
-		return path;
-	}
-
 	async #output(args) {
 		let ids = args;
 		let options = {};
@@ -502,14 +450,6 @@ function reservedTool(globalName, helperName) {
 	return value;
 }
 
-async function writeData(value) {
-	if (typeof value === "string" || value instanceof Uint8Array) return value;
-	if (value instanceof Blob) return new Uint8Array(await value.arrayBuffer());
-	if (value instanceof ArrayBuffer) return new Uint8Array(value);
-	if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
-	throw new TypeError("write() expects string, Blob, ArrayBuffer, or TypedArray data");
-}
-
 function chunkToString(chunk, encoding) {
 	if (typeof chunk === "string") return chunk;
 	if (chunk instanceof Uint8Array) return Buffer.from(chunk).toString(encoding ?? "utf8");

package/src/kernels/js/worker-slot.ts

@@ -3,6 +3,7 @@ import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/prot
 import type { WorkerLike } from "./inline-worker.ts";
 import { retireWorker, type WorkerRetirement } from "./interrupt-bounds.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 import type { JavaScriptKernelOptions } from "./local-module-loader.ts";
 import { KernelWebViewClients } from "./webview-host.ts";
 import { WorkerStartupCancelledError } from "./worker-host.ts";
@@ -18,6 +19,7 @@ export interface WorkerSlotListeners {
 export class WorkerSlot {
 	readonly #options: JavaScriptKernelOptions;
 	readonly #listeners: WorkerSlotListeners;
+	readonly #permissions?: KernelPermissionHost;
 	#worker: WorkerLike | null = null;
 	#lastProcessPid: number | undefined;
 	#webViews: KernelWebViewClients | null = null;
@@ -26,9 +28,10 @@ export class WorkerSlot {
 	#ready: Promise<void> | null = null;
 	#startupAbort: AbortController | null = null;
 
-	constructor(options: JavaScriptKernelOptions, listeners: WorkerSlotListeners) {
+	constructor(options: JavaScriptKernelOptions, listeners: WorkerSlotListeners, permissions?: KernelPermissionHost) {
 		this.#options = options;
 		this.#listeners = listeners;
+		this.#permissions = permissions;
 	}
 
 	get mode(): JavaScriptKernelMode {
@@ -65,6 +68,7 @@ export class WorkerSlot {
 			const ready = startWorkerWithInlineFallback(
 				{
 					options: this.#options,
+					permissions: this.#permissions,
 					kernelGeneration: generation,
 					publish: (worker) => this.#publish(worker, generation),
 					isCurrent: (worker) => this.#isCurrent(worker, generation),

package/src/kernels/js/worker-startup.ts

@@ -4,6 +4,7 @@ import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } fro
 import { createInlineWorker, type WorkerLike } from "./inline-worker.ts";
 import { retireWorker } from "./interrupt-bounds.ts";
 import { resolveKernelToolNameSource } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 import { type JavaScriptKernelOptions, localBridgeConnection } from "./local-module-loader.ts";
 import { resolveJsProcessEntryUrl, spawnProcessWorker } from "./process-worker.ts";
 import { spawnNodeWorker, WorkerStartupCancelledError, waitForReady } from "./worker-host.ts";
@@ -35,6 +36,7 @@ export class ProcessKernelStartupTimeoutError extends Error {
 export interface WorkerStartupHooks {
 	readonly options: JavaScriptKernelOptions;
 	readonly kernelGeneration: number;
+	readonly permissions?: KernelPermissionHost;
 	/** Wires the worker into the kernel; throws `WorkerStartupCancelledError` once the generation is stale. */
 	publish(worker: WorkerLike): void;
 	isCurrent(worker: WorkerLike): boolean;
@@ -43,7 +45,7 @@ export interface WorkerStartupHooks {
 }
 
 export async function startWorkerWithInlineFallback(hooks: WorkerStartupHooks, signal: AbortSignal): Promise<void> {
-	let worker = spawnWorker(hooks.options);
+	let worker = spawnWorker(hooks.options, hooks.permissions);
 	hooks.publish(worker);
 	try {
 		await initializeWorker(worker, hooks, signal);
@@ -65,12 +67,12 @@ export async function startWorkerWithInlineFallback(hooks: WorkerStartupHooks, s
 		await worker.terminate();
 	}
 	if (!hooks.canFallBackInline()) throw new WorkerStartupCancelledError();
-	worker = createInlineWorker(hooks.options.cwd, hooks.options.parallelPoolWidth);
+	worker = createInlineWorker(hooks.options.cwd, hooks.options.parallelPoolWidth, hooks.permissions);
 	hooks.publish(worker);
 	await initializeWorker(worker, hooks, signal);
 }
 
-function spawnWorker(options: JavaScriptKernelOptions): WorkerLike {
+function spawnWorker(options: JavaScriptKernelOptions, permissions?: KernelPermissionHost): WorkerLike {
 	if (options.isolation === "process") {
 		const url = resolveJsProcessEntryUrl();
 		return spawnProcessWorker(url, {
@@ -82,10 +84,10 @@ function spawnWorker(options: JavaScriptKernelOptions): WorkerLike {
 	}
 	try {
 		const url = options.workerEntryUrl ?? resolveJsWorkerEntryUrl();
-		return spawnNodeWorker(url, options.cwd, options.parallelPoolWidth);
+		return spawnNodeWorker(url, options.cwd, options.parallelPoolWidth, "worker", permissions);
 	} catch (error) {
 		if (!(error instanceof Error)) throw error;
-		return createInlineWorker(options.cwd, options.parallelPoolWidth);
+		return createInlineWorker(options.cwd, options.parallelPoolWidth, permissions);
 	}
 }
 

package/src/kernels/js/worker-webview.js

@@ -1,10 +1,11 @@
 import { onCellRelease } from "./cell-run-context.js";
 import { DELIVER_EVENT, WebViewPortClient, webViewError } from "./worker-webview-client.js";
 
-// Bun constructs "chrome"-backend WebViews only on the process main thread, and this kernel runs in
-// a worker where `globalThis.Bun` and `Bun.WebView` are non-writable. Cells therefore run with a
-// `Bun` parameter bound to a stand-in whose `WebView` forwards Chrome-backed views to the
-// main-thread service over a private port; every other `Bun.*` member is the real one.
+// Bun's WebViews are only safe on the process main thread (Chrome is constructed nowhere else, and
+// the WebKit host client is bound to one thread), and this kernel runs in a worker where
+// `globalThis.Bun` and `Bun.WebView` are non-writable. Cells therefore run with a `Bun` parameter
+// bound to a stand-in whose `WebView` forwards every view to the main-thread service over a private
+// port; every other `Bun.*` member is the real one.
 const KERNEL_BUN = Symbol.for("senpi.kernel.bun");
 const KERNEL_PROCESS_MODE = Symbol.for("senpi.kernel.processMode");
 
@@ -27,7 +28,8 @@ function shadowBun(real, WebView) {
 	return new Proxy(
 		{},
 		{
-			get: (_target, key) => (key === "WebView" ? WebView : Reflect.get(real, key)),
+			get: (_target, key) => key === "WebView" ? WebView
+				: key === "plugin" ? globalThis[Symbol.for("senpi.kernel.permissionBunPlugin")] ?? real.plugin : Reflect.get(real, key),
 			set: (_target, key, value) => Reflect.set(real, key, value),
 			has: (_target, key) => key === "WebView" || Reflect.has(real, key),
 			ownKeys: () => Reflect.ownKeys(real),
@@ -40,14 +42,13 @@ function shadowBun(real, WebView) {
 	);
 }
 
-// The macOS default (WebKit) stays a native worker view: its host process serves any thread.
-// A process-mode kernel already runs its cells on the child's main thread, so the native
-// WebView constructs there directly and no MessagePort proxy is ever needed.
-function needsMainThread(options) {
-	if (globalThis[KERNEL_PROCESS_MODE]) return false;
-	const backend = options?.backend;
-	if (backend === undefined) return process.platform !== "darwin";
-	return backend === "chrome" || (typeof backend === "object" && backend !== null && backend.type === "chrome");
+// Every backend goes to the main thread, WebKit included (senpi#4794): Bun's WebKit host client is
+// one per process, bound to the thread that first spawned it, and it settles every view's replies
+// in that thread's heap. A second kernel worker's views then corrupt the process heap, and once the
+// binding worker exits no later view can spawn the host. A process-mode kernel already runs its
+// cells on the child's main thread, so the native WebView constructs there directly.
+function needsMainThread() {
+	return !globalThis[KERNEL_PROCESS_MODE];
 }
 
 function closedError(method) {
@@ -96,7 +97,7 @@ function createKernelWebView(NativeWebView, requestPort) {
 		onNavigationFailed = null;
 
 		constructor(options = {}) {
-			if (!needsMainThread(options)) {
+			if (!needsMainThread()) {
 				const view = new NativeWebView(options);
 				const ref = new WeakRef(view);
 				natives.add(ref);
@@ -141,8 +142,8 @@ function createKernelWebView(NativeWebView, requestPort) {
 		scroll(dx, dy) { return this.#call("scroll", [dx, dy]); }
 		scrollTo(...args) { return this.#call("scrollTo", args); }
 		resize(width, height) { return this.#call("resize", [width, height]); }
-		back() { return this.#call("back", []); }
-		forward() { return this.#call("forward", []); }
+		goBack() { return this.#call("goBack", []); }
+		goForward() { return this.#call("goForward", []); }
 		reload() { return this.#call("reload", []); }
 		cdp(...args) { return this.#call("cdp", args); }