@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-1

package/src/kernels/js/kernel-contract.ts

@@ -2,7 +2,31 @@ import type { KernelMemoryThresholds } from "../../bridge/memory-protocol.ts";
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { EvalKernelRunInput } from "../../tool/types.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { InvocationPermissions } from "../shared/invocation-authority.ts";
 import type { JavaScriptInterruptBounds } from "./interrupt-bounds.ts";
+import type { CellDecision, CellOperation, CellRule } from "./permission-slots.mjs";
+
+export interface CellAuthorityToken {
+	readonly id: string;
+	readonly sessionId: string;
+	readonly cwd: string;
+	readonly authority: SharedArrayBuffer;
+	readonly rules: readonly CellRule[];
+	readonly signal?: AbortSignal;
+}
+
+export type CellDecider = (token: CellAuthorityToken, call: CellOperation) => CellDecision | Promise<CellDecision>;
+
+export interface CellPermissionState {
+	readonly epoch: number;
+	readonly active: boolean;
+	readonly rules: readonly CellRule[];
+}
+
+export interface RevocationFailedEvent {
+	readonly sessionId: string;
+	readonly kernelId: string;
+}
 
 export type ResultMessage = Extract<KernelToHostMessage, { type: "result" }>;
 export type ToolCallMessage = Extract<KernelToHostMessage, { type: "tool-call" }>;
@@ -20,6 +44,13 @@ export function resolveKernelToolNameSource(names?: KernelToolNameSource): strin
 export interface JavaScriptKernelOptions {
 	readonly sessionId: string;
 	readonly cwd: string;
+	readonly permissions?: InvocationPermissions & {
+		readonly decide: CellDecider;
+		/** Slot wait deadline in ms; production keeps the 2s default. Integration suites raise it above host load. */
+		readonly checkDeadlineMs?: number;
+	};
+	/** Integration marks direct tool admission DEAD too; the kernel host fences cells itself. */
+	readonly onRevocationFailed?: (event: RevocationFailedEvent) => void;
 	/**
 	 * Collects the exit status of a retired worker's children once they are killed (#1962): no thread is left to
 	 * wait on them. Absent, they stay zombies until the host's child reaper or process exit collects them.

package/src/kernels/js/kernel-tools-pump.js

@@ -1,7 +1,7 @@
 import { kernelToolCallContext } from "./kernel-tools-context.js";
 import { kernelToolError } from "./kernel-tools-errors.js";
 
-export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
+export function createKernelToolPump({ getRuntime, emit, nestedInvokes, runAuthority }) {
 	async function describe(message) {
 		try {
 			const runtime = getRuntime();
@@ -20,7 +20,7 @@ export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
 		try {
 			const runtime = getRuntime();
 			if (!runtime?.kernelTools) throw kernelToolError("tools_unavailable", "JS runtime not initialized");
-			const value = await kernelToolCallContext.run(
+			const execute = () => kernelToolCallContext.run(
 				// The scope lives only in this store: it is gone once the call settles, and it never
 				// reaches the top-level cell context or the next invocation (#1731).
 				{
@@ -42,6 +42,7 @@ export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
 						controller.signal,
 					),
 			);
+			const value = await (runAuthority ? runAuthority(message.authority, execute) : execute());
 			emit({ type: "kernel-tool-invoke-reply", requestId: message.requestId, ok: true, value });
 		} catch (error) {
 			emit({ type: "kernel-tool-invoke-reply", requestId: message.requestId, ok: false, error: pumpError(error) });
@@ -100,6 +101,7 @@ function pumpError(error) {
 			stack: error.stack,
 			...(typeof error.code === "string" ? { code: error.code } : {}),
 			...(isPlainRecord(error.details) ? { details: error.details } : {}),
+			...(error.code === "cell_permission_denied" && error.rule ? { details: { permissionRule: error.rule } } : {}),
 		};
 	}
 	return { message: String(error) };

package/src/kernels/js/local-module-loader.ts

@@ -11,7 +11,7 @@ import {
 } from "../../bridge/reserved.ts";
 import { type KernelPreludePlan, KernelPreludeTracker } from "../shared/kernel-prelude-plan.ts";
 import type { JavaScriptKernelOptions as BaseJavaScriptKernelOptions } from "./kernel-contract.ts";
-import { rewriteImports } from "./rewrite-imports.ts";
+import { hasDynamicCodeCapability, rewriteImports } from "./rewrite-imports.ts";
 
 const PREPARED_CELL_PREFIX = "/*senpi:prepared-cell*/";
 
@@ -77,8 +77,10 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"globalThis.__senpi_import__ = async (source, options) => {",
 		"  const context = globalThis.__senpi_module_context__;",
 		"  const specifier = String(source);",
+		"  const permissionImport = globalThis[Symbol.for('senpi.kernel.permissionImport')];",
+		"  permissionImport?.(specifier, new URL('__cell__.js', context.cwdUrl).href);",
 		"  const kernelBun = globalThis[Symbol.for('senpi.kernel.bun')];",
-		"  if (specifier === 'bun' && kernelBun) return { ...(await import('bun')), WebView: kernelBun.WebView, default: kernelBun };",
+		"  if (specifier === 'bun' && kernelBun) return { ...kernelBun, default: kernelBun };",
 		// Under Bun a cell's named import (`import { spawn } from 'node:child_process'`) binds the builtin's original
 		// export even after the worker patched the module object (worker-cwd.js), so the session cwd and the cell
 		// children's own process group (senpi#2995) were skipped. The patched module objects are served instead.
@@ -106,7 +108,10 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"    const urlModule = await import('node:url');",
 		"    target = urlModule.pathToFileURL(specifier).href;",
 		"  }",
-		"  const load = (resolved) => (options === undefined ? import(resolved) : import(resolved, options));",
+		// The import and everything it loads (resolution hooks, module bodies) run under the cell's loading window.
+		"  const permissionLoad = globalThis[Symbol.for('senpi.kernel.permissionLoad')];",
+		"  const run = (resolved) => (options === undefined ? import(resolved) : import(resolved, options));",
+		"  const load = (resolved) => (permissionLoad ? permissionLoad(() => run(resolved)) : run(resolved));",
 		"  const resolvePackage = globalThis[Symbol.for('senpi.kernel.resolvePackage')];",
 		"  if (target === specifier && typeof resolvePackage === 'function') {",
 		"    const resolved = resolvePackage(specifier, [context.cwdUrl, context.packageRootUrl]);",
@@ -147,6 +152,6 @@ export class LocalModuleLoader {
 		const cwdUrl = sourceFile === undefined ? this.#cwdUrl : directoryUrl(dirname(sourceFile));
 		const base = `\nglobalThis.__senpi_module_context__ = { ...globalThis.__senpi_module_context__, cwdUrl: ${JSON.stringify(cwdUrl)}, packageRootUrl: ${JSON.stringify(packageRoot === undefined ? null : directoryUrl(packageRoot))} };`;
 		const prelude = `${this.#prelude}${base}\n${contributionPrelude(this.#contributions.plan(contributions))}`;
-		return `${PREPARED_CELL_PREFIX}${JSON.stringify({ prelude, code: rewriteImports(code), ...(sourceFile === undefined ? {} : { sourceFile }) })}`;
+		return `${PREPARED_CELL_PREFIX}${JSON.stringify({ prelude, code: rewriteImports(code), dynamicCodeCapability: hasDynamicCodeCapability(code), ...(sourceFile === undefined ? {} : { sourceFile }) })}`;
 	}
 }

package/src/kernels/js/permission-authority.d.mts

@@ -0,0 +1,10 @@
+export interface WireAuthority {
+	readonly id: string;
+	readonly authority: SharedArrayBuffer;
+	readonly rules: readonly import("./permission-slots.mjs").CellRule[];
+}
+export function authorityDecision(
+	current: WireAuthority | undefined,
+	bound: readonly WireAuthority[],
+	kernel: WireAuthority,
+): "pass" | "check" | "refuse";

package/src/kernels/js/permission-authority.mjs

@@ -0,0 +1,11 @@
+export function authorityDecision(current, bound, kernel) {
+	if (!(Atomics.load(new Int32Array(kernel.authority), 0) & 2)) return "refuse";
+	if (current) {
+		const word = Atomics.load(new Int32Array(current.authority), 0);
+		if (!(word & 2)) return "refuse";
+		return word & 1 ? "check" : "pass";
+	}
+	const authorities = bound.length ? bound : [kernel];
+	return authorities.every((token) => (Atomics.load(new Int32Array(token.authority), 0) & 3) === 2)
+		? "pass" : "refuse";
+}

package/src/kernels/js/permission-core.md

@@ -0,0 +1,114 @@
+# JS kernel permission core
+
+This is the core portion of senpi#4309. It provides the transport and lifetime
+contract for a host `CellDecider`; it does not connect the permission extension.
+
+## Host integration
+
+`JavaScriptKernelOptions.permissions` supplies a current epoch snapshot and
+`decide(token, call)`. Tokens identify the invoking session and execution cwd.
+The decision is either `pass` or `deny` with a rule's permission, pattern and
+layer. The core does not interpret rule syntax or implement allow/ask precedence.
+
+The host calls `revokeSessionKernels(sessionId)` when effective enforcement
+changes. The call kills every authority word synchronously, interrupts parked
+checks and waits for retirement. New cells wait for this completion. An
+abandoned retirement permanently fences cell admission for the session and
+emits `onRevocationFailed({ sessionId, kernelId })`.
+
+The integration PR must connect that event to direct-tool admission. Direct
+tools are not fenced by this core alone.
+
+The coding-agent dispatcher stamps `options.invoker.sessionId` from its own
+SessionManager. Neither cell data nor tool arguments can override that identity.
+Registered extension event handlers also bind their own host context, rather
+than inheriting a parent task tool's identity when a child emits an event.
+The shared host pump forwards these options to `resolveInvocationToken` before
+posting an invocation frame. Absent or owner identity mints an owner token;
+another session is refused before the body runs if either session enforces,
+with `reason: "cross_session_authority"` and the enforcing session identified.
+The attached `rule` names a deny rule activating that session's enforcement;
+it does not claim that this rule matched an operation inside the unexecuted
+tool body. Otherwise the token identifies the invoker.
+Python applies the same cross-session check before posting to the interpreter.
+
+Live kernel owners publish their current permission snapshots to the host-only
+invocation registry. The permission integration supplies `permissions.resolveSession`
+for sessions without a kernel, returning that session's current state and cwd.
+Without integration or a registered kernel, a session has no enforcing state in
+this core and retains the existing inactive behavior. No invoker identity or
+session resolver is accepted by the worker protocol. An active JS invocation
+also binds its destination kernel to the invoker's revocation lifecycle. A
+settled inactive invocation keeps that binding until the worker retires, so
+the invoker's revocation still reaches the continuations it left behind.
+
+## Runtime invariants
+
+Both worker entries load `interpose.js` first. It captures and patches builtins
+before importing the runtime, including before a package can obtain a static
+builtin binding. Originals stay in module-local closures. The one-time runtime
+initializer does not export a token store or original functions.
+
+Operation families are installed by `interpose-fs.js`, `interpose-process.js`,
+`interpose-bun.js` and `interpose-sqlite.js` through the same check closure.
+Arguments are analyzed only on the active path. Direct
+argv becomes shell-quoted command text; a shell invocation uses the text the
+shell actually receives. Requested path spelling is preserved for policy;
+execution still resolves relative paths against the kernel cwd.
+
+Each worker owns four bounded shared-memory slots. A generation-tagged CAS
+claims each transition. The host claims WRITING before decoding the request or
+calling the decider, so the requester cannot rewrite bytes the host is reading.
+A timed-out WRITING slot remains host-owned, while unclaimed and interrupted
+requests become ABANDONED. A stale interrupt cannot affect a later generation.
+Checks have a 2000 ms worker-side deadline and fail closed on
+transport, sizing, decoding or authority errors.
+
+Authority follows `AsyncLocalStorage` rather than a mutable current-cell global.
+No-token operations pass only when every bound token is alive and inactive;
+idle code consults the kernel word. Settlement kills active tokens, but leaves
+inactive continuations alive without retaining them in the host registry.
+An interrupt or timeout releases tokens the same way. Cancellation still
+kills the invocation token. A dead kernel word overrides
+every token, including inactive tokens from settled runs. A token's death
+takes precedence over its inactive bit.
+
+Cell-created global Workers use a private MessagePort proxy. The host constructs
+the instrumented worker and observes its exit directly, including nested
+workers. The proxy forwards messages and transfer lists; each child gets its
+own slot pool and the parent's shared authority. Retirement waits for observed
+exit, not merely a termination request or a DEAD word. Inactive Workers use the
+kernel lifetime, so later cells can use them or create them from a continuation.
+User workerData is restored before user imports and preloads. User frames,
+including primitives and objects resembling transport frames, remain data;
+internal transfer envelopes carry a per-Worker key. MessagePorts transferred
+through a raw `parentPort` frame are transferred on to the cell; a frame the
+host cannot forward becomes a `messageerror` event and never throws in the
+host listener. Error events carry the error
+and its available source coordinates, and observed exit dispatches close.
+
+## Scope boundary
+
+PR 3 extends the operation table without changing authority or slot messages.
+Resource tables retain each open's path and access modes; locally granted
+operations still check authority liveness before using a resource. Engine
+package-resolution reads and process retirement use one-time, closure-private
+originals, rather than gaining an exemption for an installation path.
+
+The module plugin observes resolution only and lets the native loader handle
+attributes. Cell import and require routes also check relative and absolute
+paths. Dynamic-code preflight runs in the host AST preparer so workers remain
+dependency-free and direct eval retains lexical scope.
+
+Native capability residual: Bun 1.4.4 makes both the global `Bun` binding and `Bun.plugin`
+non-writable and non-configurable. The cell-local binding can guard plugin calls;
+native libraries' plugin calls and non-literal dynamic evaluation remain available.
+The native-loader regression matrix verifies that code reached through these routes
+still encounters the enforced synchronous/asynchronous spawn and write checks.
+The engine adds no onLoad transform. Final acceptance of this named residual
+remains with the lead.
+This core is not a sandbox and does not claim read completeness.
+
+Known limitation: in natively loaded dependencies, Bun.plugin registration and non-literal eval are not refused (Bun 1.4.4 makes Bun.plugin immutable); code loaded that way still runs under the enforced spawn and write checks; tracked in #4380.
+
+Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.

package/src/kernels/js/permission-host.ts

@@ -0,0 +1,388 @@
+import { MessageChannel, type MessagePort, type Transferable, Worker, type WorkerOptions } from "node:worker_threads";
+import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
+import {
+	invocationSession,
+	type InvocationSession,
+	registerInvocationSession,
+} from "../shared/invocation-authority.ts";
+import type { WorkerRetirement } from "./interrupt-bounds.ts";
+import type { CellAuthorityToken, JavaScriptKernelOptions } from "./kernel-contract.ts";
+import type { KernelToolsInvokeOptions, KernelToolsInvokeRequest } from "./kernel-tools-types.ts";
+import { type PermissionSession, registerPermissionKernel, unregisterPermissionKernel } from "./permission-sessions.ts";
+import { forwardWorkerMessage, workerErrorFrame } from "./permission-worker-frames.ts";
+import {
+	createPermissionSlots,
+	interruptPermissionSlots,
+	type PermissionRequest,
+	servePermissionSlot,
+} from "./permission-slots.mjs";
+
+export { revokeSessionKernels } from "./permission-sessions.ts";
+
+type WorkerCommand =
+	| { type: "check"; slot: number; generation: number }
+	| { type: "retire" }
+	| {
+			type: "spawn";
+			script: string;
+			token?: string;
+			port: MessagePort;
+			options: WorkerOptions & { preload?: string | string[] };
+	  };
+
+export class KernelPermissionHost {
+	readonly kernelId = crypto.randomUUID();
+	readonly #options: JavaScriptKernelOptions;
+	readonly #session: PermissionSession;
+	readonly #retire: () => Promise<WorkerRetirement>;
+	readonly #tokens = new Map<string, CellAuthorityToken>();
+	readonly #runs = new Map<string, CellAuthorityToken>();
+	readonly #invocations = new Map<string, CellAuthorityToken>();
+	readonly #invokerBindings = new Map<string, number>();
+	readonly #retained = new Map<string, Set<CellAuthorityToken>>();
+	readonly #pools = new Set<SharedArrayBuffer>();
+	readonly #ports = new Set<MessagePort>();
+	readonly #children = new Map<Worker, Promise<void>>();
+	readonly #releaseSession: () => void;
+	#kernel: CellAuthorityToken;
+	#revoked = false;
+	#retiring?: Promise<void>;
+
+	constructor(options: JavaScriptKernelOptions, retire: () => Promise<WorkerRetirement>) {
+		this.#options = options;
+		this.#retire = retire;
+		this.#kernel = this.#mint();
+		this.#session = registerPermissionKernel(options.sessionId, this);
+		this.#releaseSession = registerInvocationSession(options.sessionId, () => this.#snapshot());
+	}
+
+	get blocked(): boolean {
+		return this.#revoked || this.#session.dead || this.#session.pending !== undefined || this.#retiring !== undefined;
+	}
+
+	async admit(): Promise<void> {
+		await this.#session.pending;
+		await this.#retiring;
+		this.assertSessionLive();
+	}
+
+	assertSessionLive(): void {
+		if (this.#session.dead) throw new Error("Permission authority unavailable; restart the session");
+	}
+
+	#snapshot(): InvocationSession {
+		return {
+			cwd: this.#options.cwd,
+			state: this.#options.permissions?.state() ?? { epoch: 0, active: false, rules: [] },
+		};
+	}
+
+	#mint(
+		signal?: AbortSignal,
+		session = { sessionId: this.#options.sessionId, ...this.#snapshot() },
+	): CellAuthorityToken {
+		const { state } = session;
+		if (!Number.isInteger(state.epoch) || state.epoch < 0 || state.epoch >= 2 ** 29)
+			throw new Error("Invalid permission epoch");
+		const authority = new SharedArrayBuffer(4);
+		Atomics.store(new Int32Array(authority), 0, (state.epoch << 2) | 2 | Number(state.active));
+		return {
+			id: crypto.randomUUID(),
+			sessionId: session.sessionId,
+			cwd: session.cwd,
+			authority,
+			rules: state.rules,
+			signal,
+		};
+	}
+
+	/** Resolve host-only caller identity before admitting any invocation frame to the worker. */
+	resolveInvocationToken(
+		_request: KernelToolsInvokeRequest,
+		options?: AbortSignal | KernelToolsInvokeOptions,
+	): CellAuthorityToken {
+		const signal = options && ("aborted" in options ? options : options.signal);
+		const session = invocationSession(
+			this.#options.sessionId,
+			this.#snapshot(),
+			options,
+			this.#options.permissions?.resolveSession,
+		);
+		const token = this.#mint(signal, session);
+		if (session.sessionId !== this.#options.sessionId) {
+			const binding = registerPermissionKernel(session.sessionId, this);
+			if (binding.dead || binding.pending) {
+				if (!this.#invokerBindings.has(session.sessionId)) unregisterPermissionKernel(session.sessionId, this);
+				throw new Error("Permission authority unavailable");
+			}
+			this.#invokerBindings.set(session.sessionId, (this.#invokerBindings.get(session.sessionId) ?? 0) + 1);
+		}
+		this.#tokens.set(token.id, token);
+		return token;
+	}
+
+	invocation(request: KernelToolsInvokeRequest, options?: AbortSignal | KernelToolsInvokeOptions): () => void {
+		const token = this.resolveInvocationToken(request, options);
+		this.#invocations.set(request.call_id, token);
+		const cancel = () => this.#kill(token);
+		token.signal?.addEventListener("abort", cancel, { once: true });
+		if (token.signal?.aborted) cancel();
+		return () => {
+			token.signal?.removeEventListener("abort", cancel);
+			this.#invocations.delete(request.call_id);
+			this.#release(token);
+		};
+	}
+
+	frame(
+		message: HostToKernelMessage,
+	): HostToKernelMessage & { authority?: ReturnType<KernelPermissionHost["wireToken"]> } {
+		let token: CellAuthorityToken | undefined;
+		if (message.type === "run") {
+			token = this.#mint();
+			this.#tokens.set(token.id, token);
+			this.#runs.set(message.cellId, token);
+		} else if (message.type === "kernel-tool-invoke") {
+			token = this.#invocations.get(message.call_id);
+		} else if (message.type === "interrupt" || message.type === "close") {
+			// An interrupt (including a timeout) ends work like settlement: inactive continuations survive.
+			for (const token of this.#tokens.values()) {
+				if (message.type === "interrupt") this.#release(token);
+				else this.#kill(token);
+			}
+			if (message.type === "close") this.#endRetained();
+			for (const pool of this.#pools) interruptPermissionSlots(pool);
+		}
+		return token ? { ...message, authority: this.wireToken(token) } : message;
+	}
+
+	settle(message: KernelToHostMessage): void {
+		if (message.type !== "result") return;
+		const token = this.#runs.get(message.cellId);
+		this.#runs.delete(message.cellId);
+		if (token) this.#release(token);
+	}
+
+	#release(token: CellAuthorityToken): void {
+		if (!this.#tokens.delete(token.id)) return;
+		// Settled no-deny work keeps its async resources; the kernel word still revokes them. A live
+		// inactive token is retained rather than forgotten, and keeps its invoker binding for as long as it
+		// is alive, so that session's revocation still reaches the continuation it left behind. Nothing
+		// reports when that continuation actually finishes, so the binding ends with the token, which is
+		// what closing the kernel does; it does not end earlier.
+		const word = Atomics.load(new Int32Array(token.authority), 0);
+		if (word & 2 && !(word & 1)) {
+			if (this.#invokerBindings.has(token.sessionId)) {
+				const held = this.#retained.get(token.sessionId) ?? new Set<CellAuthorityToken>();
+				held.add(token);
+				this.#retained.set(token.sessionId, held);
+			}
+			this.#sweepRetained(token.sessionId);
+			return;
+		}
+		this.#kill(token);
+		this.#unbind(token.sessionId);
+	}
+
+	/** A retained token holds its own binding and gives it back once that token is dead, not before. */
+	#sweepRetained(sessionId: string): void {
+		const held = this.#retained.get(sessionId);
+		if (!held) return;
+		for (const token of held) {
+			if (Atomics.load(new Int32Array(token.authority), 0) & 2) continue;
+			held.delete(token);
+			this.#unbind(sessionId);
+		}
+		if (held.size === 0) this.#retained.delete(sessionId);
+	}
+
+	/** Closing the kernel ends every continuation it was still holding open for an invoker. */
+	#endRetained(): void {
+		for (const [sessionId, held] of this.#retained) {
+			for (const token of held) this.#kill(token);
+			this.#sweepRetained(sessionId);
+		}
+	}
+
+	#unbind(sessionId: string): void {
+		const count = this.#invokerBindings.get(sessionId);
+		if (count === undefined) return;
+		if (count > 1) this.#invokerBindings.set(sessionId, count - 1);
+		else {
+			this.#invokerBindings.delete(sessionId);
+			unregisterPermissionKernel(sessionId, this);
+		}
+	}
+
+	/** Worker retirement ends every continuation, so no invoker revocation needs to reach this kernel. */
+	#unbindInvokers(): void {
+		for (const sessionId of this.#invokerBindings.keys()) unregisterPermissionKernel(sessionId, this);
+		this.#invokerBindings.clear();
+		this.#retained.clear();
+	}
+
+	#kill(token: CellAuthorityToken): void {
+		Atomics.and(new Int32Array(token.authority), 0, ~2);
+	}
+
+	wireToken(token: CellAuthorityToken) {
+		return { id: token.id, authority: token.authority, rules: token.rules };
+	}
+
+	bootstrap() {
+		if (this.#revoked) {
+			this.#kernel = this.#mint();
+			this.#revoked = false;
+		}
+		return this.#channel();
+	}
+
+	#channel(token?: CellAuthorityToken) {
+		const slots = createPermissionSlots();
+		const { port1, port2 } = new MessageChannel();
+		this.#pools.add(slots);
+		this.#ports.add(port1);
+		port1.on("message", (message: WorkerCommand) => {
+			if (message.type === "check") {
+				void servePermissionSlot(slots, message.slot, message.generation, (request) => this.#decide(request));
+			} else if (message.type === "retire") {
+				this.revoke();
+				void this.retire();
+			} else if (message.type === "spawn") {
+				this.#spawnChild(message);
+			}
+		});
+		port1.on("close", () => {
+			this.#pools.delete(slots);
+			this.#ports.delete(port1);
+		});
+		return {
+			port: port2,
+			slots,
+			kernel: this.wireToken(this.#kernel),
+			deadlineMs: this.#options.permissions?.checkDeadlineMs,
+			token: token && this.wireToken(token),
+			cwd: this.#options.cwd,
+		};
+	}
+
+	async #decide(request: PermissionRequest) {
+		const token = this.#tokens.get(request.token);
+		if (!token || this.#revoked || this.#session.dead || !(Atomics.load(new Int32Array(token.authority), 0) & 2)) {
+			throw new Error("Permission authority unavailable");
+		}
+		const decide = this.#options.permissions?.decide;
+		if (!decide) throw new Error("Cell decider unavailable");
+		const answer = await decide(token, request.call);
+		if (!(Atomics.load(new Int32Array(token.authority), 0) & 2)) throw new Error("Permission authority revoked");
+		return answer;
+	}
+
+	#spawnChild(message: Extract<WorkerCommand, { type: "spawn" }>): void {
+		const token = message.token ? this.#tokens.get(message.token) : undefined;
+		if (this.blocked || (message.token && !token)) {
+			message.port.close();
+			return;
+		}
+		const permission = this.#channel(token);
+		const messageKey = crypto.randomUUID();
+		const { preload, ...workerOptions } = message.options;
+		let worker: Worker;
+		try {
+			worker = new Worker(new URL("./permission-worker-entry.js", import.meta.url), {
+				...workerOptions,
+				workerData: {
+					permission: { ...permission, messageKey },
+					enforced: token !== undefined,
+					script: message.script,
+					preload,
+					userWorkerData: workerOptions.workerData,
+				},
+				transferList: [permission.port],
+			});
+		} catch (error) {
+			permission.port.close();
+			message.port.postMessage(workerErrorFrame(error));
+			message.port.postMessage({ type: "exit" });
+			message.port.close();
+			return;
+		}
+		const exited = new Promise<void>((resolve) =>
+			worker.once("exit", () => {
+				message.port.postMessage({ type: "exit" });
+				message.port.close();
+				this.#children.delete(worker);
+				resolve();
+			}),
+		);
+		this.#children.set(worker, exited);
+		worker.on("error", (error: Error) => message.port.postMessage(workerErrorFrame(error)));
+		worker.on("online", () => message.port.postMessage({ type: "open" }));
+		worker.on("message", (frame: unknown) => {
+			if (
+				frame !== null &&
+				typeof frame === "object" &&
+				"key" in frame &&
+				frame.key === messageKey &&
+				"value" in frame &&
+				"transfer" in frame &&
+				Array.isArray(frame.transfer)
+			) {
+				forwardWorkerMessage(message.port, frame.value, frame.transfer);
+			} else forwardWorkerMessage(message.port, frame, []);
+		});
+		message.port.on("message", (frame: { type: string; value?: unknown; transfer?: Transferable[] }) => {
+			if (frame.type === "terminate") void worker.terminate();
+			else if (frame.type === "message") worker.postMessage(frame.value, frame.transfer);
+		});
+	}
+
+	revoke(): void {
+		this.#revoked = true;
+		this.#kill(this.#kernel);
+		for (const token of this.#tokens.values()) this.#kill(token);
+		for (const pool of this.#pools) interruptPermissionSlots(pool);
+	}
+
+	retire(): Promise<void> {
+		if (this.#retiring) return this.#retiring;
+		const retirement = (async () => {
+			let outcome: WorkerRetirement;
+			try {
+				outcome = await this.#retire();
+			} catch {
+				outcome = "abandoned";
+			}
+			if (outcome === "abandoned") this.#failed();
+		})();
+		this.#retiring = retirement;
+		void retirement
+			.finally(() => {
+				if (this.#retiring === retirement) this.#retiring = undefined;
+			})
+			.catch(() => {});
+		return retirement;
+	}
+
+	#failed(): void {
+		this.#session.dead = true;
+		this.#options.onRevocationFailed?.({ sessionId: this.#options.sessionId, kernelId: this.kernelId });
+	}
+
+	async terminateChildren(): Promise<void> {
+		const children = [...this.#children];
+		for (const [worker] of children) void worker.terminate();
+		await Promise.all(children.map(([, exited]) => exited));
+		for (const port of this.#ports) port.close();
+		for (const token of this.#tokens.values()) this.#release(token);
+		this.#unbindInvokers();
+		this.#runs.clear();
+	}
+
+	dispose(): void {
+		this.revoke();
+		this.#releaseSession();
+		this.#unbindInvokers();
+		unregisterPermissionKernel(this.#options.sessionId, this);
+	}
+}