@code-yeongyu/senpi-codemode 2026.10.27-1 → 2026.10.30-1

package/src/kernels/py/permission-host.ts

@@ -0,0 +1,198 @@
+import { closeSync, ftruncateSync, mkdtempSync, openSync, rmSync, writeSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { registerPermissionCheck } from "../../bridge/permission-check.ts";
+import type { HostToKernelMessage } from "../../bridge/protocol.ts";
+import type { CellAuthorityToken } from "../js/kernel-contract.ts";
+import type { CellDecision, CellOperation } from "../js/permission-slots.mjs";
+import type { KernelToolsInvokeOptions, KernelToolsInvokeRequest } from "../js/kernel-tools-types.ts";
+import { registerPermissionKernel, unregisterPermissionKernel } from "../js/permission-sessions.ts";
+import { invocationSession } from "../shared/invocation-authority.ts";
+import type { PythonKernelStartOptions } from "./kernel-contract.ts";
+
+const size = 1024 * 1024;
+type BoundToken = { token: CellAuthorityToken; offset: number; release: () => void; abort: AbortController };
+
+/** Python maps this host-owned file read-only. Words are published with one aligned eight-byte pwrite. */
+export class PythonPermissionHost {
+	readonly kernelId = crypto.randomUUID();
+	readonly #root = mkdtempSync(join(tmpdir(), "senpi-py-authority-"));
+	readonly #path = join(this.#root, "words");
+	readonly #fd = openSync(this.#path, "wx+", 0o600);
+	readonly #options: PythonKernelStartOptions;
+	readonly #session;
+	readonly #retire: () => Promise<void>;
+	readonly #tokens = new Map<string, BoundToken>();
+	readonly #runs = new Map<string, string>();
+	readonly #invocations = new Map<string, string>();
+	readonly #invokerBindings = new Map<string, number>();
+	#offset = 8;
+	#revoked = false;
+	#disposed = false;
+
+	constructor(options: PythonKernelStartOptions, retire: () => Promise<void>) {
+		this.#options = options;
+		this.#retire = retire;
+		ftruncateSync(this.#fd, size);
+		this.#session = registerPermissionKernel(options.sessionId, this);
+		this.#publishKernel();
+	}
+
+	#state() {
+		const state = this.#options.permissions?.state() ?? { epoch: 0, active: false, rules: [] };
+		if (!Number.isInteger(state.epoch) || state.epoch < 0 || state.epoch >= 2 ** 29)
+			throw new Error("Invalid permission epoch");
+		return state;
+	}
+	#store(offset: number, word: number): void {
+		const bytes = Buffer.alloc(8);
+		bytes.writeBigUInt64LE(BigInt(word));
+		if (writeSync(this.#fd, bytes, 0, 8, offset) !== 8) throw new Error("Permission authority publication failed");
+	}
+	#publishKernel(): void {
+		const state = this.#state();
+		this.#store(0, state.epoch * 4 + (this.#revoked ? 0 : 2) + Number(state.active));
+	}
+	async admit(): Promise<void> {
+		await this.#session.pending;
+		if (this.#session.dead || this.#disposed)
+			throw new Error("Permission authority unavailable; restart the session");
+	}
+	bootstrap() {
+		// A replacement is started only after the prior interpreter's exit was observed.
+		this.interrupt();
+		this.#offset = 8;
+		this.#revoked = false;
+		this.#publishKernel();
+		return { path: this.#path, size, rules: this.#state().rules, runtime: process.versions.bun ? "bun" : "node" };
+	}
+	#mint(options?: AbortSignal | KernelToolsInvokeOptions): BoundToken {
+		if (this.#revoked || this.#session.dead || this.#disposed) throw new Error("Permission authority unavailable");
+		const session = invocationSession(
+			this.#options.sessionId,
+			{ cwd: this.#options.cwd, state: this.#state() },
+			options,
+			this.#options.permissions?.resolveSession,
+		);
+		if (this.#offset >= size) throw new Error("Python permission token capacity exhausted; reset the kernel");
+		const authority = new SharedArrayBuffer(4);
+		const word = session.state.epoch * 4 + 2 + Number(session.state.active);
+		Atomics.store(new Int32Array(authority), 0, word);
+		const abort = new AbortController();
+		const token: CellAuthorityToken = {
+			id: crypto.randomUUID(),
+			sessionId: session.sessionId,
+			cwd: session.cwd,
+			authority,
+			rules: session.state.rules,
+			signal: abort.signal,
+		};
+		const offset = this.#offset;
+		this.#offset += 8;
+		this.#store(offset, word);
+		const release = registerPermissionCheck(token.id, (call) => this.#decide(token, call));
+		const bound = { token, offset, release, abort };
+		if (session.sessionId !== this.#options.sessionId) {
+			const binding = registerPermissionKernel(session.sessionId, this);
+			if (binding.dead || binding.pending) {
+				release();
+				if (!this.#invokerBindings.has(session.sessionId)) unregisterPermissionKernel(session.sessionId, this);
+				throw new Error("Permission authority unavailable");
+			}
+			this.#invokerBindings.set(session.sessionId, (this.#invokerBindings.get(session.sessionId) ?? 0) + 1);
+		}
+		this.#tokens.set(token.id, bound);
+		return bound;
+	}
+	async #decide(token: CellAuthorityToken, call: CellOperation): Promise<CellDecision> {
+		if (this.#revoked || this.#session.dead || !this.#tokens.has(token.id) || token.signal?.aborted)
+			throw new Error("Permission authority unavailable");
+		const decide = this.#options.permissions?.decide;
+		if (!decide) throw new Error("Cell decider unavailable");
+		const cancellation = Promise.withResolvers<never>();
+		const cancel = () => cancellation.reject(new Error("Permission authority revoked"));
+		token.signal?.addEventListener("abort", cancel, { once: true });
+		try {
+			const answer = await Promise.race([decide(token, call), cancellation.promise]);
+			if (!this.#tokens.has(token.id) || token.signal?.aborted) throw new Error("Permission authority revoked");
+			return answer;
+		} finally {
+			token.signal?.removeEventListener("abort", cancel);
+		}
+	}
+	frame(message: HostToKernelMessage): HostToKernelMessage {
+		let id: string | undefined;
+		if (message.type === "run") {
+			id = this.#mint().token.id;
+			this.#runs.set(message.cellId, id);
+		} else if (message.type === "kernel-tool-invoke") id = this.#invocations.get(message.call_id);
+		else if (message.type === "interrupt" || message.type === "close") this.interrupt();
+		const bound = id === undefined ? undefined : this.#tokens.get(id);
+		return bound
+			? Object.assign({}, message, {
+					authority: {
+						id,
+						offset: bound.offset,
+						rules: bound.token.rules,
+						active: Boolean(Atomics.load(new Int32Array(bound.token.authority), 0) & 1),
+					},
+				})
+			: message;
+	}
+	invocation(request: KernelToolsInvokeRequest, options?: AbortSignal | KernelToolsInvokeOptions): () => void {
+		const bound = this.#mint(options);
+		this.#invocations.set(request.call_id, bound.token.id);
+		const signal = options && ("aborted" in options ? options : options.signal);
+		const cancel = () => this.#release(bound.token.id);
+		signal?.addEventListener("abort", cancel, { once: true });
+		if (signal?.aborted) cancel();
+		return () => {
+			signal?.removeEventListener("abort", cancel);
+			this.#invocations.delete(request.call_id);
+			cancel();
+		};
+	}
+	settle(cellId: string): void {
+		const id = this.#runs.get(cellId);
+		this.#runs.delete(cellId);
+		if (id) this.#release(id);
+	}
+	#release(id: string): void {
+		const bound = this.#tokens.get(id);
+		if (!bound) return;
+		const word = Atomics.and(new Int32Array(bound.token.authority), 0, ~2) & ~2;
+		this.#store(bound.offset, word);
+		bound.abort.abort();
+		bound.release();
+		this.#tokens.delete(id);
+		const count = this.#invokerBindings.get(bound.token.sessionId);
+		if (count === 1) {
+			this.#invokerBindings.delete(bound.token.sessionId);
+			unregisterPermissionKernel(bound.token.sessionId, this);
+		} else if (count !== undefined) this.#invokerBindings.set(bound.token.sessionId, count - 1);
+	}
+	interrupt(): void {
+		for (const id of this.#tokens.keys()) this.#release(id);
+	}
+	revoke(): void {
+		this.#revoked = true;
+		this.#publishKernel();
+		this.interrupt();
+	}
+	async retire(): Promise<void> {
+		try {
+			await this.#retire();
+		} catch {
+			this.#session.dead = true;
+			this.#options.onRevocationFailed?.({ sessionId: this.#options.sessionId, kernelId: this.kernelId });
+		}
+	}
+	dispose(): void {
+		if (this.#disposed) return;
+		this.revoke();
+		this.#disposed = true;
+		unregisterPermissionKernel(this.#options.sessionId, this);
+		closeSync(this.#fd);
+		rmSync(this.#root, { recursive: true, force: true });
+	}
+}

package/src/kernels/py/permission_bridge.py

@@ -0,0 +1,145 @@
+"""Synchronous, invocation-scoped permission checks over the existing loopback bridge."""
+import contextvars
+import builtins
+import json
+import mmap
+import os
+import socket
+import _socket
+import struct
+import time
+import importlib
+import importlib.util
+from typing import NoReturn
+
+__builtins__ = vars(builtins).copy()
+
+_interpose_path = os.path.join(os.path.dirname(__file__), "interpose.py")
+_spec = importlib.util.spec_from_file_location("_senpi_interpose", _interpose_path)
+if _spec is None or _spec.loader is None:
+    raise RuntimeError("Python permission interposition asset is unavailable")
+_module = importlib.util.module_from_spec(_spec)
+# Engine assets are source-only; loading them must never populate the checkout.
+with open(_interpose_path, "rb") as _source:
+    exec(compile(_source.read(), _interpose_path, "exec"), _module.__dict__)
+install = _module.install
+
+
+class CellPermissionError(RuntimeError):
+    code = "cell_permission_denied"
+
+    def __init__(self, reason, rule=None):
+        self.permissionRule = rule
+        identity = (f"{rule['permission']} {rule['pattern']} ({rule['layer']})"
+                    if rule else "permission authority unavailable")
+        super().__init__(f"Cell operation refused: {identity}: {reason}")
+
+
+def initialize(config, port):
+    # The mapping and captured I/O never enter the user namespace.
+    with open(config["path"], "rb") as file:
+        words = mmap.mmap(file.fileno(), config["size"], access=mmap.ACCESS_READ)
+    context = contextvars.ContextVar("senpi_permission", default=None)
+    getcwd = os.getcwd
+    unpack_from = struct.unpack_from
+    random_bytes = os.urandom
+    # The C scanner/encoder retain their dependencies too: merely capturing
+    # json.loads/dumps still leaves mutable decoder/encoder method lookups.
+    encode = getattr(json.encoder, "c_make_encoder")({}, None, json.encoder.encode_basestring_ascii,
+                                                   None, ": ", ", ", False, False, True)
+    decode = getattr(json.JSONDecoder(), "scan_once")
+    monotonic = time.monotonic
+    socket_type = _socket.socket
+    family, stream = socket.AF_INET, socket.SOCK_STREAM
+    connect, sendall, recv = socket_type.connect, socket_type.sendall, socket_type.recv
+    settimeout, close = socket_type.settimeout, socket_type.close
+
+    def rule():
+        token = context.get()
+        rules = token.get("rules", []) if token else config.get("rules", [])
+        return rules[0] if rules else None
+
+    def refuse(reason, deciding_rule=None) -> NoReturn:
+        raise CellPermissionError(reason, deciding_rule or rule())
+
+    def enforcing():
+        token = context.get()
+        offset = token["offset"] if token else 0
+        word = unpack_from("<Q", words, offset)[0]
+        if not word & 2:
+            # Settled inactive contexts retain ordinary background I/O, but a
+            # dead/enforcing kernel can never be revived by that expired token.
+            kernel_word = unpack_from("<Q", words, 0)[0]
+            if word & 1 or kernel_word & 3 != 2:
+                refuse("authority revoked")
+            return False
+        if token is None and word & 1:
+            refuse("operation has no invocation authority")
+        return bool(word & 1)
+
+    def check(tool, input, cwd=None):
+        if not enforcing():
+            return
+        token = context.get()
+        if token is None:
+            refuse("operation has no invocation authority")
+        nonce = random_bytes(16).hex()
+        payload = "".join(encode({"token": token["id"], "nonce": nonce,
+                                 "call": {"tool": tool, "input": input, "cwd": cwd or getcwd()}}, 0)).encode()
+        deadline = monotonic() + 2.0
+        sock = None
+        try:
+            sock = socket_type(family, stream)
+            if sock is not None:
+                def remaining():
+                    seconds = deadline - monotonic()
+                    if seconds <= 0:
+                        raise TimeoutError("permission deadline")
+                    settimeout(sock, seconds)
+                remaining()
+                connect(sock, ("127.0.0.1", port))
+                remaining()
+                sendall(sock, b"POST /permission_check HTTP/1.1\r\nHost: 127.0.0.1\r\n"
+                             b"Connection: close\r\nContent-Type: application/json\r\nContent-Length: " +
+                             str(len(payload)).encode() + b"\r\n\r\n" + payload)
+                response = bytearray()
+                while True:
+                    remaining()
+                    chunk = recv(sock, 16384)
+                    if not chunk:
+                        break
+                    response.extend(chunk)
+                    if len(response) > 32768:
+                        raise ValueError("oversized permission response")
+                header, body = bytes(response).split(b"\r\n\r\n", 1)
+                if not header.startswith(b"HTTP/1.1 200 "):
+                    raise ValueError("permission HTTP failure")
+                # Node sends chunked responses unless Content-Length is set by the bridge.
+                text = body.decode().strip()
+                reply, end = decode(text, 0)
+                if end != len(text):
+                    raise ValueError("trailing permission response")
+                value = reply["value"]
+                if reply.get("ok") is not True or value.get("nonce") != nonce:
+                    raise ValueError("permission nonce mismatch")
+                decision = value["decision"]
+                enforcing()  # A late allow cannot cross revocation.
+                if decision.get("action") == "pass":
+                    return
+                deciding_rule = decision.get("rule")
+                if decision.get("action") == "deny" and isinstance(deciding_rule, dict) and all(
+                    isinstance(deciding_rule.get(key), str) for key in ("permission", "pattern", "layer")
+                ):
+                    refuse(str(input), deciding_rule)
+                raise ValueError("invalid permission decision")
+        except CellPermissionError:
+            raise
+        except BaseException as exc:
+            # KeyboardInterrupt must leave the parked check immediately, never wait for the host.
+            refuse(f"permission check failed ({type(exc).__name__})")
+        finally:
+            if sock is not None:
+                close(sock)
+
+    install(check, enforcing, refuse, config["runtime"])
+    return context

package/src/kernels/py/prelude.py

@@ -14,6 +14,7 @@ import base64
 import codecs
 import contextlib
 import importlib
+import importlib.util
 import gc
 import inspect
 import io
@@ -42,6 +43,17 @@ from typing import Iterator
 from threading import Lock, Thread
 from typing import Any, Callable, Union
 from urllib.parse import unquote
+# Resolve the loopback bridge's lazy codec before user authority exists.
+codecs.lookup("idna")
+_permission_path = Path(__file__).with_name("permission_bridge.py")
+_permission_spec = importlib.util.spec_from_file_location(
+    "_senpi_permission_bridge", _permission_path
+)
+if _permission_spec is None or _permission_spec.loader is None:
+    raise RuntimeError("Python permission bridge asset is unavailable")
+_permission_module = importlib.util.module_from_spec(_permission_spec)
+exec(compile(_permission_path.read_bytes(), str(_permission_path), "exec"), _permission_module.__dict__)
+initialize_permissions = _permission_module.initialize
 
 sys.__stdout__.write('{"type":"status","event":{"op":"kernel-startup","stage":"runtime-init"}}\n')
 sys.__stdout__.flush()
@@ -51,6 +63,7 @@ USER_NS: dict[str, Any] = {"__name__": "__main__", "__doc__": None, "__builtins_
 LOOP = asyncio.new_event_loop()
 asyncio.set_event_loop(LOOP)
 EMIT_LOCK = Lock()
+permission_context = contextvars.ContextVar("senpi_unconfigured_permission", default=None)
 
 # Mirrors src/bridge/reserved.ts; this standalone subprocess asset cannot import TypeScript.
 RESERVED_AGENT_TOOL = "__agent__"
@@ -103,10 +116,21 @@ def emit(frame: dict[str, Any]) -> None:
 
 
 def bridge_error(exc: BaseException) -> dict[str, str]:
+    authority = permission_context.get()
+    if (authority and authority.get("active")) or isinstance(exc, KeyboardInterrupt) or getattr(exc, "code", None) == "cell_permission_denied":
+        # Formatting an exception must not issue a second cell-requested read
+        # (linecache opens source files). Keep the real frames without source I/O.
+        frames = [f'  File "{frame.f_code.co_filename}", line {line}, in {frame.f_code.co_name}\n'
+                  for frame, line in traceback.walk_tb(exc.__traceback__)]
+        stack = "Traceback (most recent call last):\n" + "".join(frames) + f"{type(exc).__name__}: {exc}\n"
+    else:
+        stack = "".join(traceback.format_exception(type(exc), exc, exc.__traceback__))
     return {
         "name": type(exc).__name__,
         "message": str(exc),
-        "stack": "".join(traceback.format_exception(type(exc), exc, exc.__traceback__)),
+        "stack": stack,
+        **({"code": getattr(exc, "code")} if getattr(exc, "code", None) else {}),
+        **({"permissionRule": getattr(exc, "permissionRule")} if getattr(exc, "permissionRule", None) else {}),
     }
 
 
@@ -910,6 +934,7 @@ class KernelToolRunner:
 
     def _run(self, invocation: Invocation, message: dict[str, Any]) -> None:
         output = io.StringIO()
+        permission_scope = permission_context.set(message.get("authority"))
         try:
             entry = self._registry.resolve(message)
             args = validate_args(entry.input_schema, message.get("args"))
@@ -935,8 +960,9 @@ class KernelToolRunner:
             self._reply_error(invocation, exc.code, str(exc), output, exc.details)
         except BaseException as exc:  # noqa: BROAD_EXCEPT_OK — the invocation boundary serializes the tool's own failure.
             self._reply_error(invocation, "kernel_tool_failed", f"{type(exc).__name__}: {exc}", output,
-                              stack="".join(traceback.format_exception(type(exc), exc, exc.__traceback__)))
+                              stack=bridge_error(exc)["stack"])
         finally:
+            permission_context.reset(permission_scope)
             with self._lock:
                 self._invocations.pop(invocation.request_id, None)
 
@@ -1964,9 +1990,10 @@ def _footprint_reader() -> Callable[[], tuple[int, bool]] | None:
             if darwin() is not None:
                 return darwin
     if sys.platform.startswith("linux") and os.path.exists("/proc/self/status"):
+        open_status = open
 
         def linux() -> tuple[int, bool] | None:
-            with open("/proc/self/status", encoding="ascii", errors="replace") as status:
+            with open_status("/proc/self/status", encoding="ascii", errors="replace") as status:
                 for line in status:
                     if line.startswith("RssAnon:"):
                         return int(line.split()[1]) * 1024, False
@@ -2234,7 +2261,8 @@ def _enter_source_file(source_file: str | None) -> Callable[[], None]:
 
 
 def run_cell(
-    cell_id: str, code: str, preludes: Any = None, source_file: str | None = None, cell_token: str | None = None
+    cell_id: str, code: str, preludes: Any = None, source_file: str | None = None, cell_token: str | None = None,
+    authority: Any = None,
 ) -> None:
     start = time.monotonic()
     stdout = io.StringIO()
@@ -2245,6 +2273,7 @@ def run_cell(
     result: dict[str, Any]
     leave_source_file: Callable[[], None] = lambda: None
     cell_scope = CURRENT_CELL_TOKEN.set(cell_token)
+    permission_scope = permission_context.set(authority)
     try:
         KERNEL_TOOL_TOKEN.acquire()
         with capture_streams(KERNEL_TOOL_STREAMS, (stdout, stderr), cell=True):
@@ -2277,6 +2306,7 @@ def run_cell(
         # Liveness and revocation first: nothing the cell installed (an import finder, a path hook) can skip them.
         KERNEL_TOOL_TOKEN.release()
         CURRENT_CELL_TOKEN.reset(cell_scope)
+        permission_context.reset(permission_scope)
         try:
             leave_source_file()
         except BaseException as exc:  # noqa: BROAD_EXCEPT_OK — user code can break the restore; it must not wedge the kernel.
@@ -2300,7 +2330,7 @@ def elapsed(start: float) -> int:
 
 
 def _handle_message(message: dict[str, Any]) -> bool:
-    global CONNECTION
+    global CONNECTION, permission_context
     message_type = message.get("type")
     if message_type == "init":
         connection = message.get("connection")
@@ -2312,6 +2342,10 @@ def _handle_message(message: dict[str, Any]) -> bool:
         if isinstance(generation, int) and not isinstance(generation, bool):
             KERNEL_TOOL_REGISTRY.generation = generation
         KERNEL_MEMORY.configure(message.get("memory"))
+        if KERNEL_MEMORY.thresholds is not None:
+            KERNEL_MEMORY._footprint()
+        if message.get("permission") is not None:
+            permission_context = initialize_permissions(message["permission"], connection["port"])
         emit({"type": "ready"})
         return True
     if message_type == "run":
@@ -2326,6 +2360,7 @@ def _handle_message(message: dict[str, Any]) -> bool:
             message.get("preludes"),
             source_file if isinstance(source_file, str) and source_file else None,
             token if isinstance(token, str) else None,
+            message.get("authority"),
         )
         return True
     if message_type == "close":

package/src/kernels/py/transport.ts

@@ -27,6 +27,7 @@ import {
 	waitForExit,
 } from "./process.ts";
 import { PythonStartup, type PythonStartupStage } from "./startup.ts";
+import type { PythonPermissionHost } from "./permission-host.ts";
 
 export type PythonTransportResult = Extract<KernelToHostMessage, { type: "result" }>;
 
@@ -41,6 +42,7 @@ export interface PythonTransportRunInput {
 }
 
 export interface PythonTransportOptions {
+	readonly permission?: PythonPermissionHost;
 	readonly interpreterPath: string;
 	readonly sessionId: string;
 	readonly cwd: string;
@@ -256,18 +258,23 @@ export class PythonKernelTransport {
 			this.#onPipeError(error instanceof Error ? error : new Error(String(error))),
 		);
 		const { sessionId, connection, memory, kernelGeneration } = this.#options;
-		this.#write({
-			type: "init",
-			sessionId,
-			connection,
-			...(memory === undefined ? {} : { memory }),
-			...(kernelGeneration === undefined ? {} : { kernelGeneration }),
-		});
+		this.#write(
+			Object.assign(
+				{
+					type: "init",
+					sessionId,
+					connection,
+					...(memory === undefined ? {} : { memory }),
+					...(kernelGeneration === undefined ? {} : { kernelGeneration }),
+				} as const,
+				this.#options.permission ? { permission: this.#options.permission.bootstrap() } : {},
+			),
+		);
 		await startup.ready;
 	}
 
 	#write(message: HostToKernelMessage): void {
-		this.#child.stdin.write(encodeBridgeFrame(message));
+		this.#child.stdin.write(encodeBridgeFrame(this.#options.permission?.frame(message) ?? message));
 	}
 
 	#onStdout(chunk: string): void {

package/src/kernels/rb/kernel.ts

@@ -2,11 +2,13 @@ import { join } from "node:path";
 import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { SessionEnvironment } from "../session-env.ts";
 import type { KernelLifecycle } from "../shared/kernel-death.ts";
+import type { InvocationPermissions } from "../shared/invocation-authority.ts";
 import { readProcessGroupCpuTime } from "../shared/process-group-cpu.ts";
 import { type CodemodeRuntimeAssetEnvironment, requireCodemodeRuntimeAsset } from "../shared/runtime-asset.ts";
 import { SubprocessKernel, type SubprocessKernelMemory, type SubprocessSpawn } from "../shared/subprocess-kernel.ts";
 
 export interface RubyKernelStartOptions extends KernelLifecycle {
+	readonly permissions?: InvocationPermissions;
 	readonly cwd: string;
 	readonly sessionId: string;
 	readonly connection: BridgeConnectionConfig;
@@ -44,6 +46,7 @@ export class RubyKernel extends SubprocessKernel {
 			onMessage: options.onMessage,
 			memory: options.memory && { language: "rb", ...options.memory },
 			onDeath: options.onDeath,
+			permissions: options.permissions,
 			startup: { label: "Ruby", readGroupCpuTime: readProcessGroupCpuTime },
 		});
 	}

package/src/kernels/shared/invocation-authority.ts

@@ -0,0 +1,59 @@
+import type { CellPermissionState } from "../js/kernel-contract.ts";
+import type { KernelToolsInvokeOptions } from "../js/kernel-tools-types.ts";
+
+export interface InvocationSession {
+	readonly cwd: string;
+	readonly state: CellPermissionState;
+}
+
+export interface InvocationPermissions {
+	readonly state: () => CellPermissionState;
+	/** Integration resolves live permission state even for an invoker that has never opened a kernel. */
+	readonly resolveSession?: (sessionId: string) => InvocationSession;
+}
+
+const sessions = new Map<string, Set<() => InvocationSession>>();
+
+export function registerInvocationSession(sessionId: string, read: () => InvocationSession): () => void {
+	let entries = sessions.get(sessionId);
+	if (!entries) {
+		entries = new Set();
+		sessions.set(sessionId, entries);
+	}
+	entries.add(read);
+	return () => {
+		entries.delete(read);
+		if (entries.size === 0) sessions.delete(sessionId);
+	};
+}
+
+export function invocationSession(
+	ownerId: string,
+	owner: InvocationSession,
+	options?: AbortSignal | KernelToolsInvokeOptions,
+	resolveSession?: InvocationPermissions["resolveSession"],
+): InvocationSession & { readonly sessionId: string } {
+	const invokerId = options && !("aborted" in options) ? options.invoker?.sessionId : undefined;
+	if (invokerId === undefined || invokerId === ownerId) return { sessionId: ownerId, ...owner };
+	const registered = [...(sessions.get(invokerId) ?? [])].map((read) => read());
+	const invoker = resolveSession?.(invokerId) ?? registered.find((session) => session.state.active) ?? registered[0];
+	for (const [enforcingSessionId, state] of [
+		[ownerId, owner.state],
+		[invokerId, invoker?.state],
+	] as const) {
+		if (!state?.active) continue;
+		const rule = state.rules[0];
+		throw Object.assign(
+			new Error(
+				rule
+					? `Cross-session kernel tool refused while session ${enforcingSessionId} enforces deny rules, including ${rule.permission} ${rule.pattern} (${rule.layer})`
+					: "Cross-session kernel tool refused: permission authority unavailable",
+			),
+			{ code: "cell_permission_denied", reason: "cross_session_authority", enforcingSessionId, rule },
+		);
+	}
+	return {
+		sessionId: invokerId,
+		...(invoker ?? { cwd: owner.cwd, state: { epoch: 0, active: false, rules: [] } }),
+	};
+}

package/src/kernels/shared/kernel-tools-pump.ts

@@ -24,10 +24,19 @@ export class KernelToolHostPump {
 	readonly #waiters = new Map<string, Waiter>();
 	readonly #post: (message: HostToKernelMessage) => void;
 	readonly #isOpen: () => boolean;
+	readonly #invocation?: (
+		request: KernelToolsInvokeRequest,
+		options?: AbortSignal | KernelToolsInvokeOptions,
+	) => () => void;
 
-	constructor(post: (message: HostToKernelMessage) => void, isOpen: () => boolean) {
+	constructor(
+		post: (message: HostToKernelMessage) => void,
+		isOpen: () => boolean,
+		invocation?: (request: KernelToolsInvokeRequest, options?: AbortSignal | KernelToolsInvokeOptions) => () => void,
+	) {
 		this.#post = post;
 		this.#isOpen = isOpen;
+		this.#invocation = invocation;
 	}
 
 	consume(message: KernelToHostMessage): boolean {
@@ -70,6 +79,18 @@ export class KernelToolHostPump {
 	 * the message it always did (#1731).
 	 */
 	async invoke(request: KernelToolsInvokeRequest, options?: AbortSignal | KernelToolsInvokeOptions): Promise<unknown> {
+		const release = this.#invocation?.(request, options);
+		try {
+			return await this.#invoke(request, options);
+		} finally {
+			release?.();
+		}
+	}
+
+	async #invoke(
+		request: KernelToolsInvokeRequest,
+		options?: AbortSignal | KernelToolsInvokeOptions,
+	): Promise<unknown> {
 		const { signal, scope } = normalizeInvokeOptions(options);
 		this.events.dispatchEvent(new Event("nestedInvoke"));
 		const reply = await this.#request(