@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-1

package/src/kernels/js/interpose-fs.js

@@ -0,0 +1,124 @@
+import { checkPath, executionPath, replaceMethod } from "./interpose-paths.js";
+import { createResourceTable } from "./interpose-resources.js";
+
+export const FS_PERMISSION_PATHS = new Set([
+	"writeFile", "appendFile", "truncate", "mkdir", "mkdtemp", "rm", "rmdir", "unlink",
+	"symlink", "chmod", "chown", "lchmod", "lchown", "utimes", "lutimes", "rename", "link", "copyFile", "cp",
+	"readFile", "readlink", "realpath", "readdir", "opendir", "open", "openAsBlob",
+	"createReadStream", "createWriteStream",
+]);
+
+export function installFilesystemPermissions(check) {
+	const fs = process.getBuiltinModule("node:fs");
+	const resources = createResourceTable(check);
+	const promises = [...new Set([fs.promises, process.getBuiltinModule("node:fs/promises")])];
+	const decisions = {
+		writeFile: [[0, "write"]], appendFile: [[0, "write"]], truncate: [[0, "write"]],
+		mkdir: [[0, "write"]], mkdtemp: [[0, "write"]], rm: [[0, "write"]], rmdir: [[0, "write"]],
+		unlink: [[0, "write"]], symlink: [[1, "write"]], chmod: [[0, "write"]], chown: [[0, "write"]],
+		lchmod: [[0, "write"]], lchown: [[0, "write"]],
+		utimes: [[0, "write"]], lutimes: [[0, "write"]], rename: [[0, "write"], [1, "write"]],
+		link: [[0, "write"], [1, "write"]], copyFile: [[0, "read"], [1, "write"]], cp: [[0, "read"], [1, "write"]],
+		readFile: [[0, "read"]], readlink: [[0, "read"]], realpath: [[0, "read"]],
+		readdir: [[0, "ls"]], opendir: [[0, "ls"]], openAsBlob: [[0, "read"]],
+	};
+	const guard = (original, entries) => function (...args) {
+		const actual = [...args];
+		for (const [index, tool] of entries) {
+			const value = args[index];
+			if (typeof value === "number" || (value !== null && typeof value === "object" && typeof value.fd === "number")) {
+				resources.use(value, tool === "write" ? "write" : "read");
+			} else {
+				checkPath(check, tool, value);
+				actual[index] = executionPath(value);
+			}
+		}
+		return original.apply(this, actual);
+	};
+	for (const [name, entries] of Object.entries(decisions)) {
+		replaceMethod(fs, name, (original) => guard(original, entries));
+		replaceMethod(fs, `${name}Sync`, (original) => guard(original, entries));
+		for (const owner of promises) replaceMethod(owner, name, (original) => guard(original, entries));
+	}
+	replaceMethod(fs.realpath, "native", (original) => guard(original, [[0, "read"]]));
+	replaceMethod(fs.realpathSync, "native", (original) => guard(original, [[0, "read"]]));
+	for (const owner of [fs, ...promises]) {
+		for (const name of ["glob", "globSync"]) replaceMethod(owner, name, (original) => function (pattern, ...args) {
+			const options = args[0];
+			const cwd = options && typeof options === "object" ? options.cwd ?? process.cwd() : process.cwd();
+			checkPath(check, "ls", cwd);
+			const effective = options && typeof options === "object" ? { ...options, cwd: executionPath(cwd) } : { cwd: process.cwd() };
+			return typeof options === "function"
+				? original.call(this, pattern, effective, ...args)
+				: original.call(this, pattern, effective, ...args.slice(1));
+		});
+	}
+	replaceMethod(fs, "openSync", (original) => function (file, flags, ...args) {
+		const modes = resources.open(file, flags);
+		return resources.record(original.call(this, executionPath(file), flags, ...args), file, modes);
+	});
+	replaceMethod(fs, "open", (original) => function (file, flags, ...args) {
+		if (typeof flags === "function") { args = [flags]; flags = undefined; }
+		const modes = resources.open(file, flags);
+		const callback = args.at(-1);
+		if (typeof callback !== "function") return original.call(this, executionPath(file), flags, ...args);
+		return original.call(this, executionPath(file), flags, ...args.slice(0, -1), (error, fd) => {
+			if (!error) resources.record(fd, file, modes);
+			callback(error, fd);
+		});
+	});
+	for (const owner of promises) replaceMethod(owner, "open", (original) => function (file, flags, ...args) {
+		const modes = resources.open(file, flags);
+		return original.call(this, executionPath(file), flags, ...args).then((handle) => resources.handle(handle, file, modes));
+	});
+	for (const [mode, names] of [
+		["read", ["read", "readv"]],
+		["write", ["write", "writev", "ftruncate", "fchmod", "fchown", "futimes", "fsync", "fdatasync"]],
+	]) {
+		for (const name of names) {
+			for (const key of [name, `${name}Sync`]) replaceMethod(fs, key, (original) => function (fd, ...args) {
+				resources.use(fd, mode);
+				return original.call(this, fd, ...args);
+			});
+		}
+	}
+	replaceMethod(fs, "closeSync", (original) => function (fd, ...args) {
+		resources.use(fd);
+		const result = original.call(this, fd, ...args);
+		resources.forget(fd);
+		return result;
+	});
+	replaceMethod(fs, "close", (original) => function (fd, callback) {
+		resources.use(fd);
+		return original.call(this, fd, (error) => { if (!error) resources.forget(fd); callback(error); });
+	});
+	for (const [name, mode] of [["createReadStream", "read"], ["createWriteStream", "write"]]) {
+		replaceMethod(fs, name, (original) => function (file, options) {
+			const fd = options?.fd;
+			if (fd != null) resources.use(fd, mode);
+			else checkPath(check, mode, file);
+			const stream = original.call(this, executionPath(file), options);
+			resources.record(stream, file, [mode]);
+			stream.once("open", (descriptor) => resources.record(descriptor, file, [mode]));
+			const methods = mode === "write" ? ["write", "end"] : ["read"];
+			for (const method of methods) replaceMethod(stream, method, (fn) => function (...args) {
+				resources.use(stream, mode);
+				return fn.apply(this, args);
+			});
+			return stream;
+		});
+	}
+	const protectBlob = (blob, file) => {
+		resources.record(blob, file, ["read"]);
+		for (const name of ["text", "bytes", "arrayBuffer", "stream", "slice"]) replaceMethod(blob, name, (fn) => function (...params) {
+			resources.use(this, "read");
+			const value = fn.apply(this, params);
+			return name === "slice" ? protectBlob(value, file) : value;
+		});
+		return blob;
+	};
+	replaceMethod(fs, "openAsBlob", (original) => function (file, ...args) {
+		return original.call(this, file, ...args).then((blob) => protectBlob(blob, file));
+	});
+	return resources;
+}

package/src/kernels/js/interpose-modules.js

@@ -0,0 +1,107 @@
+import { checkPath, requestedPath } from "./interpose-paths.js";
+
+const { dirname, isAbsolute, resolve } = process.getBuiltinModule("node:path");
+const { fileURLToPath } = process.getBuiltinModule("node:url");
+
+export function installModulePermissions(check, userWorker = false) {
+	const module = process.getBuiltinModule("node:module");
+	const nativeRequire = module.createRequire(import.meta.url);
+	const resolveSync = globalThis.Bun?.resolveSync;
+	let sealed = false;
+	// Resolving a specifier re-enters this hook, because the engine resolver is itself observed. That
+	// re-entry is one import still being decided, not another import, so it must not ask again.
+	let resolving = false;
+	// A user worker's own script reaches its own workerData and parentPort through this module, which
+	// #4387 keeps transparent, so only the cell context treats the module itself as a capability.
+	const forbidden = userWorker
+		? /^(?:bun:ffi|(?:node:)?vm)$/u
+		: /^(?:bun:ffi|(?:node:)?(?:vm|worker_threads))$/u;
+	const workerThreads = /^(?:node:)?worker_threads$/u;
+	// A cell already owns these as globals, so handing them back over require grants nothing, while
+	// Worker, parentPort and workerData stay out of reach: the raw Worker would spawn an uninterposed
+	// one. Only require can substitute a namespace, so import and getBuiltinModule stay refused.
+	const portPrimitives = () =>
+		Object.freeze(
+			Object.fromEntries(
+				["MessageChannel", "MessagePort", "BroadcastChannel"]
+					.filter((name) => name in globalThis)
+					.map((name) => [name, globalThis[name]]),
+			),
+		);
+	const pathLike = (name) => name.startsWith(".") || isAbsolute(name) || name.startsWith("file:");
+	const guard = (source, importer) => {
+		const specifier = String(source);
+		if (!sealed || resolving) return;
+		if (forbidden.test(specifier) || specifier.endsWith(".node")) check(() => ({ unsupported: true }));
+		if (!pathLike(specifier)) return;
+		const parent = importer?.startsWith("file:") ? fileURLToPath(importer) : importer;
+		const base = parent ? dirname(parent) : process.cwd();
+		const candidate = specifier.startsWith("file:") ? fileURLToPath(specifier) : specifier;
+		let target;
+		resolving = true;
+		try {
+			target = resolveSync ? resolveSync(candidate, base) : nativeRequire.resolve(resolve(base, candidate));
+		} catch {
+			target = isAbsolute(candidate) ? candidate : resolve(base, candidate);
+		} finally {
+			resolving = false;
+		}
+		checkPath(check, "read", target);
+	};
+	// Only resolution is observed: Bun owns every loader and import attribute.
+	if (globalThis.Bun?.plugin) {
+		Bun.plugin({
+			name: "senpi-cell-permissions",
+			setup(build) {
+				build.onResolve({ filter: /.*/u }, (args) => { guard(args.path, args.importer); });
+			},
+		});
+	}
+	// The decision comes first. A cell nothing is enforced against sees the engine's own module, so
+	// no-rules behaviour is unchanged and matches what import() returns; only a refusal is answered
+	// with the port primitives the cell already owns as globals.
+	const requireGuard = (specifier, importer) => {
+		if (!sealed || !workerThreads.test(String(specifier))) {
+			guard(specifier, importer);
+			return undefined;
+		}
+		try {
+			guard(specifier, importer);
+		} catch (error) {
+			if (error?.code !== "cell_permission_denied") throw error;
+			return portPrimitives();
+		}
+		return undefined;
+	};
+	const originalRequire = module.prototype.require;
+	module.prototype.require = function (specifier) {
+		const substitute = requireGuard(specifier, this.filename);
+		if (substitute) return substitute;
+		if (specifier === "bun" && globalThis.Bun) return globalThis[Symbol.for("senpi.kernel.bun")] ?? globalThis.Bun;
+		return originalRequire.call(this, specifier);
+	};
+	const originalCreateRequire = module.createRequire;
+	module.createRequire = function (...args) {
+		const require = originalCreateRequire.apply(this, args);
+		const guarded = function (specifier) {
+			const substitute = requireGuard(specifier, requestedPath(args[0]) ?? String(args[0]));
+			if (substitute) return substitute;
+			if (specifier === "bun" && globalThis.Bun) return globalThis[Symbol.for("senpi.kernel.bun")] ?? globalThis.Bun;
+			return require(specifier);
+		};
+		Object.assign(guarded, require);
+		guarded.cache = new Proxy(require.cache, {
+			set(target, name, value) { check(() => ({ unsupported: true })); return Reflect.set(target, name, value); },
+			deleteProperty(target, name) { check(() => ({ unsupported: true })); return Reflect.deleteProperty(target, name); },
+			defineProperty(target, name, descriptor) { check(() => ({ unsupported: true })); return Reflect.defineProperty(target, name, descriptor); },
+		});
+		return guarded;
+	};
+	const getBuiltin = process.getBuiltinModule;
+	process.getBuiltinModule = function (name) {
+		if (sealed && forbidden.test(name)) check(() => ({ unsupported: true }));
+		return getBuiltin.call(this, name);
+	};
+	Object.defineProperty(globalThis, Symbol.for("senpi.kernel.permissionImport"), { value: guard });
+	return () => { sealed = true; };
+}

package/src/kernels/js/interpose-paths.js

@@ -0,0 +1,80 @@
+import { createPathIdentity, PATH_IDENTITY_VERSION } from "../shared/path-identity.mjs";
+
+const path = process.getBuiltinModule("node:path");
+const fs = process.getBuiltinModule("node:fs");
+const { fileURLToPath } = process.getBuiltinModule("node:url");
+
+// Captured at module evaluation, before any interposition or cwd patch replaces them: the identity
+// must resolve with the engine's own native realpath and must never reach the live `path.resolve`
+// that worker-cwd.js rebinds to the session root (design N11).
+const identity = createPathIdentity({
+	realpathNative: fs.realpathSync.native,
+	lstat: fs.lstatSync,
+	readlink: fs.readlinkSync,
+	pathApi: {
+		join: path.join,
+		dirname: path.dirname,
+		basename: path.basename,
+		isAbsolute: path.isAbsolute,
+		sep: path.sep,
+		win32Resolve: path.win32.resolve,
+	},
+	platform: process.platform,
+});
+
+export function requestedPath(value) {
+	if (value instanceof URL) return fileURLToPath(value);
+	if (value instanceof Uint8Array) {
+		const text = Buffer.from(value).toString();
+		return Buffer.from(text).equals(value) ? text : undefined;
+	}
+	return typeof value === "string" ? value : undefined;
+}
+
+export function executionPath(value) {
+	if (typeof value === "string") return path.resolve(process.cwd(), value);
+	if (value instanceof Uint8Array && !path.isAbsolute(Buffer.from(value).toString("latin1"))) {
+		return Buffer.concat([Buffer.from(process.cwd() + path.sep), value]);
+	}
+	return value;
+}
+
+/** The written spelling, the executed spelling, and the kernel-computed canonical form (or why there is none). */
+function pathIdentityInput(value, executed = requestedPath(executionPath(value))) {
+	const requested = requestedPath(value);
+	if (requested === undefined || executed === undefined) return { input: { path: requested }, unsupported: true };
+	const input = { path: requested, executedPath: executed };
+	try {
+		const { path: canonical, foldCase } = identity.canonical(executed);
+		input.canonical = { v: PATH_IDENTITY_VERSION, path: canonical, foldCase };
+	} catch (error) {
+		input.unresolvable = typeof error?.code === "string" ? error.code : "EUNKNOWN";
+	}
+	return { input, unsupported: false };
+}
+
+export function checkPath(check, tool, value, options = {}) {
+	try {
+		check(() => {
+			const { input, unsupported } = pathIdentityInput(value, options.executed);
+			return { call: { tool, input, cwd: options.cwd ?? process.cwd() }, unsupported };
+		});
+	} catch (error) {
+		if (error?.code === "cell_permission_denied" && typeof value === "string") error.message += `: ${value}`;
+		throw error;
+	}
+}
+
+export function replaceMethod(owner, name, wrap) {
+	const original = owner?.[name];
+	if (typeof original !== "function") return;
+	const wrapped = wrap(original);
+	for (const key of Reflect.ownKeys(original)) {
+		if (key === "length" || key === "name" || key === "prototype" || Object.hasOwn(wrapped, key)) continue;
+		Object.defineProperty(wrapped, key, Object.getOwnPropertyDescriptor(original, key));
+	}
+	Object.defineProperty(owner, name, {
+		...(Object.getOwnPropertyDescriptor(owner, name) ?? { configurable: true, writable: true, enumerable: false }),
+		value: wrapped,
+	});
+}

package/src/kernels/js/interpose-process.js

@@ -0,0 +1,97 @@
+import { replaceMethod, requestedPath } from "./interpose-paths.js";
+
+const { basename } = process.getBuiltinModule("node:path");
+// Bun gives an explicit stdio[i] priority over the matching named option, so both are decided rather
+// than one standing in for the other. The first three slots carry one direction each; a slot at
+// index 3 or above has no named option and is handed to the child as a descriptor it can both read
+// and write.
+const SLOT_MODES = [["read"], ["write"], ["write"]];
+const EXTRA_SLOT_MODES = ["read", "write"];
+const quote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
+const cwdOf = (value) => requestedPath(value) ?? process.cwd();
+
+export function installProcessPermissions(check, files) {
+	const cp = process.getBuiltinModule("node:child_process");
+	for (const name of ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync", "fork"]) {
+		replaceMethod(cp, name, (original) => function (...parameters) {
+			check(() => {
+				const [file, args, options] = parameters;
+				const shellText = name === "exec" || name === "execSync";
+				const argv = Array.isArray(args) ? args : [];
+				const opts = shellText ? args : Array.isArray(args) || args == null ? options : args;
+				const shell = opts?.shell;
+				const command = name === "fork"
+					? [opts?.execPath ?? process.execPath, ...(opts?.execArgv ?? process.execArgv), file, ...argv].map(quote).join(" ")
+					: shellText ? file : shell ? [file, ...argv].join(" ") : [file, ...argv].map(quote).join(" ");
+				return {
+					call: { tool: "bash", input: { command }, cwd: cwdOf(opts?.cwd) },
+					unsupported: typeof shell === "string" && !/^(?:sh|bash|zsh|dash)$/u.test(basename(shell)),
+				};
+			});
+			return original.apply(this, parameters);
+		});
+	}
+	const bun = globalThis.Bun;
+	if (!bun) return;
+	for (const name of ["spawn", "spawnSync"]) replaceMethod(bun, name, (original) => function (...parameters) {
+		const [first, second] = parameters;
+		const options = Array.isArray(first) ? second : first;
+		check(() => {
+			const argv = Array.isArray(first) ? first : first?.cmd;
+			return {
+				call: { tool: "bash", input: { command: Array.isArray(argv) ? argv.map(quote).join(" ") : "" }, cwd: cwdOf(options?.cwd) },
+				unsupported: !Array.isArray(argv),
+			};
+		});
+		const slots = Array.isArray(options?.stdio) ? options.stdio : [];
+		files.source(options?.stdin); // sink:spawn-stdin
+		files.handle(options?.stdout, "write"); // sink:spawn-stdout
+		files.handle(options?.stderr, "write"); // sink:spawn-stderr
+		for (const [index, slot] of slots.entries()) {
+			for (const mode of SLOT_MODES[index] ?? EXTRA_SLOT_MODES) {
+				if (mode === "read") files.source(slot); // sink:spawn-stdio-read
+				if (mode === "write") files.handle(slot, "write"); // sink:spawn-stdio-write
+			}
+		}
+		return original.apply(this, parameters);
+	});
+	const shell = bun.$;
+	if (typeof shell !== "function") return;
+	let shellCwd;
+	const render = (value) => {
+		if (Array.isArray(value)) return value.map(render).join(" ");
+		if (value && typeof value === "object") {
+			if (typeof value.raw === "string") return value.raw;
+			check(() => ({ unsupported: true }));
+		}
+		return shell.escape(String(value));
+	};
+	const guarded = function (strings, ...values) {
+		check(() => ({
+			call: {
+				tool: "bash",
+				input: { command: strings.map((part, index) => part + (index < values.length ? render(values[index]) : "")).join("") },
+				cwd: cwdOf(shellCwd),
+			},
+		}));
+		return shell(strings, ...values);
+	};
+	for (const key of Reflect.ownKeys(shell)) {
+		if (key !== "Shell" && !Object.hasOwn(guarded, key)) Object.defineProperty(guarded, key, Object.getOwnPropertyDescriptor(shell, key));
+	}
+	for (const name of ["cwd", "env", "nothrow", "throws"]) {
+		if (typeof shell[name] !== "function") continue;
+		guarded[name] = (...args) => {
+			if (name === "cwd") shellCwd = args[0];
+			shell[name](...args);
+			return guarded;
+		};
+	}
+	if (shell.Shell) guarded.Shell = new Proxy(shell.Shell, {
+		construct(target, args, newTarget) {
+			check(() => ({ unsupported: true }));
+			return Reflect.construct(target, args, newTarget);
+		},
+	});
+	bun.$ = guarded;
+}

package/src/kernels/js/interpose-resources.js

@@ -0,0 +1,59 @@
+import { checkPath, replaceMethod } from "./interpose-paths.js";
+
+const { constants } = process.getBuiltinModule("node:fs");
+
+function openModes(flags = "r") {
+	flags ??= "r";
+	if (typeof flags === "number") {
+		const access = flags & (constants.O_RDONLY | constants.O_WRONLY | constants.O_RDWR);
+		if (access === constants.O_WRONLY) return ["write"];
+		return access === constants.O_RDWR || (flags & (constants.O_CREAT | constants.O_TRUNC)) !== 0 ? ["read", "write"] : ["read"];
+	}
+	return flags.includes("+") ? ["read", "write"] : /^[wax]/u.test(flags) ? ["write"] : ["read"];
+}
+
+export function createResourceTable(check) {
+	const descriptors = new Map();
+	const objects = new WeakMap();
+	const table = (resource) => typeof resource === "number" ? descriptors : objects;
+	const record = (resource, path, modes) => {
+		if (typeof resource === "number" || (resource !== null && typeof resource === "object")) {
+			table(resource).set(resource, { path, modes });
+		}
+		return resource;
+	};
+	const forget = (resource) => table(resource).delete(resource);
+	const use = (resource, mode) => {
+		check(() => {
+			const grant = table(resource).get(resource);
+			return { granted: true, unsupported: !grant || (mode !== undefined && !grant.modes.includes(mode)) };
+		});
+	};
+	const path = (resource) => table(resource).get(resource)?.path;
+	const open = (file, flags) => {
+		const modes = openModes(flags);
+		for (const mode of modes) checkPath(check, mode === "read" ? "read" : "write", file);
+		return modes;
+	};
+	const handle = (value, file, modes) => {
+		record(value, file, modes);
+		record(value.fd, file, modes);
+		for (const [mode, names] of [
+			["read", ["read", "readv", "readFile", "readLines", "createReadStream", "readableWebStream"]],
+			["write", ["write", "writev", "writeFile", "appendFile", "truncate", "chmod", "chown", "utimes", "sync", "datasync", "createWriteStream"]],
+		]) {
+			for (const name of names) replaceMethod(value, name, (original) => function (...args) {
+				use(this, mode);
+				const result = original.apply(this, args);
+				if (/Stream$/u.test(name)) record(result, file, [mode]);
+				return result;
+			});
+		}
+		replaceMethod(value, "close", (original) => function (...args) {
+			const fd = this.fd;
+			return original.apply(this, args).then((result) => { forget(fd); forget(this); return result; });
+		});
+		return value;
+	};
+	return { record, forget, use, path, open, handle };
+}

package/src/kernels/js/interpose-sqlite.js

@@ -0,0 +1,104 @@
+import { checkPath, executionPath, replaceMethod } from "./interpose-paths.js";
+
+// Skip quoted data/identifiers and comments, retaining semicolons to examine every statement.
+function sqlWords(sql) {
+	return String(sql).replace(/--[^\n]*|\/\*[\s\S]*?\*\/|'(?:''|[^'])*'|"(?:""|[^"])*"|`(?:``|[^`])*`|\[[^\]]*\]/gu, " ")
+		.toUpperCase().match(/[A-Z_]+|;/gu) ?? [];
+}
+
+function reachesOtherFile(sql) {
+	let first;
+	for (const word of sqlWords(sql)) {
+		if (word === ";") { first = undefined; continue; }
+		first ??= word;
+		if (first === "ATTACH" || (first === "VACUUM" && word === "INTO")) return true;
+	}
+	return false;
+}
+
+export function installSqlitePermissions(check) {
+	const paths = new WeakMap();
+	const memory = (path) => path === ":memory:" || path === "";
+	const file = (path, mode) => { if (!memory(path)) checkPath(check, mode, path); };
+	const refuse = () => check(() => ({ unsupported: true }));
+	const guardSql = (sql) => check(() => ({ granted: true, unsupported: reachesOtherFile(sql) }));
+	const install = (sqlite, name, node) => {
+		const Original = sqlite[name];
+		if (!Original) return;
+		const readonly = (options) => node ? options?.readOnly === true
+			: typeof options === "number" ? (options & sqlite.constants.SQLITE_OPEN_READONLY) !== 0 : options?.readonly === true;
+		const opening = (path, options) => {
+			if (node && options?.allowExtension) refuse();
+			file(path, "read");
+			if (!readonly(options)) file(path, "write");
+		};
+		const proto = Original.prototype;
+		const statement = (node ? sqlite.StatementSync : sqlite.Statement)?.prototype;
+		for (const method of ["run", "get", "all", "iterate", "values"]) replaceMethod(statement, method, (original) => function (...args) {
+			check(() => ({ granted: true }));
+			const result = original.apply(this, args);
+			if (method === "iterate") replaceMethod(result, "next", (next) => function (...parameters) {
+				check(() => ({ granted: true }));
+				return next.apply(this, parameters);
+			});
+			return result;
+		});
+		if (node) {
+			const setAuthorizer = proto.setAuthorizer;
+			replaceMethod(proto, "setAuthorizer", () => function (callback) {
+				return setAuthorizer.call(this, (operation, ...args) => {
+					if (operation === sqlite.constants.SQLITE_ATTACH) refuse();
+					return callback?.(operation, ...args) ?? sqlite.constants.SQLITE_OK;
+				});
+			});
+		}
+		for (const method of ["exec", "run", "prepare", "query"]) replaceMethod(proto, method, (original) => function (sql, ...args) {
+			// Also guards runtimes which translate SQLite authorizer throws to SQLITE_AUTH.
+			guardSql(sql);
+			return original.call(this, sql, ...args);
+		});
+		replaceMethod(proto, "enableLoadExtension", (original) => function (enabled) {
+			if (enabled) refuse();
+			return original.call(this, enabled);
+		});
+		replaceMethod(proto, "loadExtension", (original) => function (...args) {
+			refuse();
+			return original.apply(this, args);
+		});
+		sqlite[name] = new Proxy(Original, {
+			construct(target, args, newTarget) {
+				const [path = ":memory:", options] = args;
+				opening(path, options);
+				const actual = memory(path) ? path : executionPath(path);
+				const db = Reflect.construct(target, [actual, ...args.slice(1)], newTarget);
+				paths.set(db, path);
+				if (node && typeof db.setAuthorizer === "function") db.setAuthorizer(null);
+				return db;
+			},
+		});
+		if (sqlite.default === Original) sqlite.default = sqlite[name];
+		if (!node) {
+			replaceMethod(Original, "open", (original) => function (path, options) {
+				opening(path, options);
+				const db = original.call(this, memory(path) ? path : executionPath(path), options);
+				paths.set(db, path);
+				return db;
+			});
+			replaceMethod(Original, "setCustomSQLite", (original) => function (...args) {
+				refuse();
+				return original.apply(this, args);
+			});
+		}
+		if (node) replaceMethod(sqlite, "backup", (original) => function (db, dest, ...args) {
+			file(paths.get(db), "read");
+			file(dest, "write");
+			return original.call(this, db, executionPath(dest), ...args);
+		});
+	};
+	const nodeSqlite = process.getBuiltinModule("node:sqlite");
+	install(nodeSqlite, "DatabaseSync", true);
+	if (globalThis.Bun) {
+		const require = process.getBuiltinModule("node:module").createRequire(import.meta.url);
+		install(require("bun:sqlite"), "Database", false);
+	}
+}

package/src/kernels/js/interpose.js

@@ -0,0 +1,86 @@
+// This module must be the first import in every worker. No builtin ESM namespace exists yet.
+import { installFilesystemPermissions } from "./interpose-fs.js";
+import { installProcessPermissions } from "./interpose-process.js";
+import { installBunPermissions } from "./interpose-bun.js";
+import { installSqlitePermissions } from "./interpose-sqlite.js";
+import { installModulePermissions } from "./interpose-modules.js";
+import { installCapabilityPermissions } from "./interpose-capabilities.js";
+import { checkPath } from "./interpose-paths.js";
+
+// Bootstrap is engine-owned; there is no user statement until this one-time handoff finishes.
+let check = () => {};
+let engineDepth = 0;
+const authorize = (operation) => { if (engineDepth === 0) return check(operation); };
+const fs = process.getBuiltinModule("node:fs");
+const workerThreads = process.getBuiltinModule("node:worker_threads");
+const bootstrap = workerThreads.workerData;
+// Restore the public value before any builtin namespace or user preload observes it.
+if (bootstrap.script) workerThreads.workerData = bootstrap.userWorkerData;
+// Bun gives each worker one ESM namespace per builtin, copied from the module object at its first
+// import and never refreshed, so the guarded constructor must be in place before that import. Only a
+// user worker started under an active token is enforced against for its whole life, so only it gets
+// the forwarder; every other context keeps the engine's own Worker on the module.
+let guardedWorker;
+let forwarder;
+if (bootstrap.script && bootstrap.enforced) {
+	// A function, not a class: it hands back the instance the guarded class builds for new.target.
+	forwarder = function Worker(...args) {
+		if (!new.target) throw new TypeError("Class constructor Worker cannot be invoked without 'new'");
+		if (!guardedWorker) throw new Error("Worker is unavailable until the permission runtime starts");
+		return Reflect.construct(guardedWorker, args, new.target);
+	};
+	Object.setPrototypeOf(forwarder.prototype, EventTarget.prototype);
+	Object.defineProperty(workerThreads, "Worker", { value: forwarder, writable: false, configurable: false, enumerable: true });
+}
+const installGuardedWorker = (Guarded) => {
+	if (!forwarder) {
+		globalThis.Worker = Guarded;
+		return;
+	}
+	guardedWorker = Guarded;
+	Object.setPrototypeOf(forwarder.prototype, Guarded.prototype);
+	globalThis.Worker = forwarder;
+};
+const originals = { ...fs.promises, readFileSync: fs.readFileSync, realpathSync: fs.realpathSync };
+const execFile = process.getBuiltinModule("node:child_process").execFile;
+const cleanupExecFile = (...args) => {
+	engineDepth++;
+	try { return execFile(...args); }
+	finally { engineDepth--; }
+};
+const { dirname } = process.getBuiltinModule("node:path");
+const permissionIO = {
+	read(raw, actual) { checkPath(authorize, "read", raw, { executed: actual }); return originals.readFile(actual, "utf8"); },
+	async write(raw, actual, data) {
+		checkPath(authorize, "write", raw, { executed: actual });
+		await originals.mkdir(dirname(actual), { recursive: true });
+		await originals.writeFile(actual, data);
+	},
+};
+const resources = installFilesystemPermissions(authorize);
+installProcessPermissions(authorize, installBunPermissions(authorize, resources));
+installSqlitePermissions(authorize);
+const sealModules = installModulePermissions(authorize, Boolean(bootstrap.script));
+
+// The sole bootstrap handoff is consumed before user code. Neither module exports the originals.
+const { initializePermissionRuntime } = await import("./permission-runtime.js");
+let runtimeAuthorize;
+let activated = false;
+const activate = () => {
+	if (activated) return;
+	activated = true;
+	check = runtimeAuthorize;
+	sealModules();
+	installCapabilityPermissions(authorize);
+};
+// The worker bootstrap and the engine hooks are separate inputs: the bootstrap carries the
+// permission transport this worker must consume and delete, the engine carries the authorized IO
+// the runtime hands to the cell prelude. Collapsing them into one argument drops one of the two.
+await initializePermissionRuntime((authorize) => { runtimeAuthorize = authorize; }, bootstrap, {
+	permissionIO,
+	resolverIO: originals,
+	cleanupExecFile,
+	activate,
+	installGuardedWorker,
+});
+activate();