@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-1

package/src/kernels/js/permission-runtime.js

@@ -0,0 +1,205 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { pathToFileURL } from "node:url";
+import { MessageChannel, parentPort } from "node:worker_threads";
+import { authorityDecision } from "./permission-authority.mjs";
+import { createPermissionRequester } from "./permission-slots.mjs";
+import { createCodePermissionGuard } from "./interpose-code.js";
+
+let initialized = false;
+
+export async function initializePermissionRuntime(install, workerData, engine) {
+	if (initialized) throw new Error("Permission runtime already initialized");
+	initialized = true;
+	const context = new AsyncLocalStorage();
+	const bound = new Map();
+	const data = workerData.permission;
+	// The bootstrap transport is host authority, not user-visible worker data.
+	delete workerData.permission;
+	const inactiveWord = new SharedArrayBuffer(4);
+	Atomics.store(new Int32Array(inactiveWord), 0, 2);
+	const kernel = data?.kernel ?? { id: "", authority: inactiveWord, rules: [] };
+	const requester = data && createPermissionRequester(data.slots, {
+		wake: (slot, generation) => data.port.postMessage({ type: "check", slot, generation }),
+		retire: () => data.port.postMessage({ type: "retire" }),
+		deadlineMs: data.deadlineMs,
+	});
+	const refusal = (reason, rule) => {
+		const error = new Error(`${reason}${rule ? ` (${rule.permission}: ${rule.pattern}, ${rule.layer})` : ""}`);
+		error.name = "CellPermissionDeniedError";
+		error.code = "cell_permission_denied";
+		error.rule = rule;
+		return error;
+	};
+	// Resolution hooks and module top-level bodies run outside the importing cell's async context. A
+	// token that is importing opens a LOADING WINDOW; an out-of-context operation is attributed to that
+	// token only while it is the sole loader, bound, active and alive, and no other bound token is active
+	// (design 6.4 / N4). Any other shape keeps today's refusal: never a pass that was a refusal before.
+	const loading = new Map();
+	const activeBit = (entry) => Atomics.load(new Int32Array(entry.authority), 0) & 1;
+	const aliveBit = (entry) => Atomics.load(new Int32Array(entry.authority), 0) & 2;
+	const load = async (thunk) => {
+		const token = context.getStore();
+		if (!token) return thunk();
+		const entry = loading.get(token.id);
+		if (entry) entry.depth += 1;
+		else loading.set(token.id, { token, depth: 1 });
+		try {
+			return await thunk();
+		} finally {
+			const current = loading.get(token.id);
+			if (current && (current.depth -= 1) === 0) loading.delete(token.id);
+		}
+	};
+	Object.defineProperty(load, "pending", { value: () => loading.size });
+	Object.defineProperty(globalThis, Symbol.for("senpi.kernel.permissionLoad"), { value: load });
+	const soleLoader = () => {
+		if (loading.size !== 1) return undefined;
+		const [{ token }] = loading.values();
+		if (!bound.has(token.id) || !activeBit(token) || !aliveBit(token)) return undefined;
+		for (const other of bound.values()) if (other.id !== token.id && activeBit(other)) return undefined;
+		return token;
+	};
+	const authorize = (operation) => {
+		const token = context.getStore() ?? soleLoader();
+		const disposition = authorityDecision(token, token ? [] : [...bound.values()], kernel);
+		if (disposition === "pass") return;
+		const rule = token?.rules[0] ?? [...bound.values()].find((entry) => entry.rules.length)?.rules[0] ?? kernel.rules[0];
+		if (disposition === "refuse" || !requester || !token) throw refusal("Permission authority unavailable", rule);
+		try {
+			const { call, unsupported, granted } = operation();
+			if (unsupported) throw refusal("Operation cannot be checked", rule);
+			if (granted) return;
+			const result = requester.check({ token: token.id, call });
+			// Revocation may have raced an already-published answer.
+			if (!(Atomics.load(new Int32Array(token.authority), 0) & 2)) throw new Error("Permission authority revoked");
+			if (result.action === "deny") throw refusal("Operation denied", result.rule);
+		} catch (error) {
+			if (error?.code === "cell_permission_denied") throw error;
+			throw refusal(error instanceof Error ? error.message : "Permission check failed", rule);
+		}
+	};
+	install(authorize);
+	const codeGuard = createCodePermissionGuard(authorize);
+	const runAuthority = async (token, run, source) => {
+		if (!token && authorityDecision(undefined, [...bound.values()], kernel) !== "pass") {
+			throw refusal("Permission authority unavailable", kernel.rules[0]);
+		}
+		if (token) bound.set(token.id, token);
+		try { return await context.run(token, () => { codeGuard.scan(source); return run(); }); }
+		finally { if (token) bound.delete(token.id); }
+	};
+
+	// Only a configured kernel replaces the constructor; the entry already put a forwarder on the module
+	// before its ESM namespace existed, and this class is what it constructs.
+	if (data && globalThis.Worker) {
+		engine.installGuardedWorker(class Worker extends EventTarget {
+			#port;
+			onmessage = null;
+			onerror = null;
+			onopen = null;
+			onclose = null;
+			onmessageerror = null;
+			constructor(script, options = {}) {
+				super();
+				const token = context.getStore();
+				if (authorityDecision(token, [...bound.values()], kernel) === "refuse") throw refusal("Permission authority unavailable", token?.rules[0] ?? kernel.rules[0]);
+				const { port1, port2 } = new MessageChannel();
+				this.#port = port1;
+				port1.on("message", (frame) => {
+					if (frame.type === "message") {
+						const event = new MessageEvent("message", { data: frame.value });
+						if (frame.value === undefined) Object.defineProperty(event, "data", { value: undefined });
+						this.onmessage?.(event);
+						this.dispatchEvent(event);
+					} else if (frame.type === "error") {
+						const event = new ErrorEvent("error", {
+							message: frame.message, error: frame.error,
+							filename: frame.filename, lineno: frame.lineno, colno: frame.colno,
+						});
+						this.onerror?.(event);
+						this.dispatchEvent(event);
+					} else if (frame.type === "messageerror") {
+						const event = new MessageEvent("messageerror", { data: frame.error });
+						this.onmessageerror?.(event);
+						this.dispatchEvent(event);
+					} else if (frame.type === "open") {
+						const event = new Event("open");
+						this.onopen?.(event);
+						this.dispatchEvent(event);
+					} else if (frame.type === "exit") {
+						port1.close();
+						const event = new Event("close");
+						this.onclose?.(event);
+						this.dispatchEvent(event);
+					}
+				});
+				port1.on("messageerror", (error) => {
+					const event = new MessageEvent("messageerror", { data: error });
+					this.onmessageerror?.(event);
+					this.dispatchEvent(event);
+				});
+				const href = new URL(String(script), pathToFileURL(`${process.cwd()}/`)).href;
+				// Inactive resources belong to the kernel lifetime, not the completed run's registry entry.
+				const activeToken = token && (Atomics.load(new Int32Array(token.authority), 0) & 1) ? token.id : undefined;
+				data.port.postMessage({ type: "spawn", script: href, token: activeToken, port: port2, options }, [port2]);
+			}
+			postMessage(value, options = []) {
+				const transfer = Array.isArray(options) ? options : options.transfer ?? [];
+				this.#port.postMessage({ type: "message", value, transfer }, transfer);
+			}
+			terminate() { this.#port.postMessage({ type: "terminate" }); }
+			ref() { this.#port.ref(); return this; }
+			unref() { this.#port.unref(); return this; }
+		});
+	}
+
+	if (workerData.script) {
+		const { installSessionCwd } = await import("./worker-cwd.js");
+		installSessionCwd(data.cwd, { permissionInterposed: true });
+		globalThis.postMessage = (value, options = []) => {
+			const transfer = Array.isArray(options) ? options : options.transfer ?? [];
+			parentPort.postMessage({ key: data.messageKey, value, transfer }, transfer);
+		};
+		globalThis.close = () => parentPort.close();
+		const events = new EventTarget();
+		globalThis.addEventListener = events.addEventListener.bind(events);
+		globalThis.removeEventListener = events.removeEventListener.bind(events);
+		parentPort.on("message", (value) => context.run(data.token, () => {
+			const event = new MessageEvent("message", { data: value });
+			if (value === undefined) Object.defineProperty(event, "data", { value: undefined });
+			globalThis.onmessage?.(event);
+			events.dispatchEvent(event);
+		}));
+		engine.activate();
+		await runAuthority(data.token, async () => {
+			// User preloads still precede the script, but never precede interposition.
+			const preloads = typeof workerData.preload === "string" ? [workerData.preload] : workerData.preload ?? [];
+			const require = process.getBuiltinModule("node:module").createRequire(pathToFileURL(`${data.cwd}/__preload__.js`));
+			const { isAbsolute } = process.getBuiltinModule("node:path");
+			for (const preload of preloads) {
+				const resolved = /^[a-z][a-z\d+.-]*:/iu.test(preload) && !isAbsolute(preload) ? preload : require.resolve(preload);
+				await load(() => import(isAbsolute(resolved) ? pathToFileURL(resolved).href : resolved));
+			}
+			await load(() => import(workerData.script));
+		});
+		return;
+	}
+	const { createWorkerCore } = await import("./worker-core.js");
+	const { initializeResolverIO } = await import("./worker-package-resolve.js");
+	initializeResolverIO(engine.resolverIO);
+	const { initializeProcessCleanup } = await import("./process-tree.js");
+	const { initializeWindowsCleanup } = await import("./windows-tree-kill.js");
+	initializeProcessCleanup(engine.cleanupExecFile);
+	initializeWindowsCleanup(engine.cleanupExecFile);
+	createWorkerCore({
+		send: (message) => parentPort.postMessage(message),
+		onMessage(handler) { parentPort.on("message", handler); return () => parentPort.off("message", handler); },
+		close() { parentPort.close(); setTimeout(() => process.exit(0), 0); },
+	}, {
+		cwd: workerData.cwd,
+		parallelPoolWidth: workerData.parallelPoolWidth,
+		cwdInstallOptions: { permissionInterposed: true },
+		runAuthority,
+		permissionIO: engine.permissionIO,
+	});
+}

package/src/kernels/js/permission-sessions.ts

@@ -0,0 +1,46 @@
+interface SessionKernel {
+	revoke(): void;
+	retire(): Promise<void>;
+}
+
+export interface PermissionSession {
+	dead: boolean;
+	pending?: Promise<void>;
+	readonly kernels: Set<SessionKernel>;
+}
+
+const sessions = new Map<string, PermissionSession>();
+
+export function registerPermissionKernel(sessionId: string, kernel: SessionKernel): PermissionSession {
+	let session = sessions.get(sessionId);
+	if (!session) {
+		session = { dead: false, kernels: new Set() };
+		sessions.set(sessionId, session);
+	}
+	session.kernels.add(kernel);
+	return session;
+}
+
+export function unregisterPermissionKernel(sessionId: string, kernel: SessionKernel): void {
+	const session = sessions.get(sessionId);
+	if (!session) return;
+	session.kernels.delete(kernel);
+	if (!session.dead && !session.pending && session.kernels.size === 0) sessions.delete(sessionId);
+}
+
+/** All words go DEAD synchronously, before retirement or another admission can run. */
+export function revokeSessionKernels(sessionId: string): Promise<void> {
+	const session = sessions.get(sessionId);
+	if (!session) return Promise.resolve();
+	if (session.pending) return session.pending;
+	const kernels = [...session.kernels];
+	for (const kernel of kernels) kernel.revoke();
+	const pending = Promise.all(kernels.map((kernel) => kernel.retire())).then(() => {});
+	session.pending = pending;
+	void pending
+		.finally(() => {
+			if (session.pending === pending) session.pending = undefined;
+		})
+		.catch(() => {});
+	return pending;
+}

package/src/kernels/js/permission-slots.d.mts

@@ -0,0 +1,51 @@
+export interface CellRule {
+	readonly permission: string;
+	readonly pattern: string;
+	readonly layer: string;
+}
+export interface CellCanonicalPath {
+	/** PATH_IDENTITY_VERSION of the kernel that computed it; the host ignores any other version. */
+	readonly v: number;
+	readonly path: string;
+	readonly foldCase: boolean;
+}
+export type CellOperation = {
+	readonly tool: "bash" | "read" | "write" | "ls";
+	readonly input: {
+		readonly command?: string;
+		/** The path as written by the cell, byte-for-byte. */
+		readonly path?: string;
+		/** The absolute string the operation hands to the runtime. */
+		readonly executedPath?: string;
+		readonly canonical?: CellCanonicalPath;
+		/** Error code when the kernel could not canonicalize the executed path. */
+		readonly unresolvable?: string;
+	};
+	readonly cwd?: string;
+};
+export type CellDecision = { readonly action: "pass" } | { readonly action: "deny"; readonly rule: CellRule };
+export interface PermissionRequest {
+	readonly token: string;
+	readonly call: CellOperation;
+}
+export function createPermissionSlots(): SharedArrayBuffer;
+export function permissionControl(buffer: SharedArrayBuffer, index: number): number;
+export function interruptPermissionSlot(buffer: SharedArrayBuffer, index: number, observed: number): boolean;
+export function interruptPermissionSlots(buffer: SharedArrayBuffer): void;
+export function createPermissionRequester(
+	buffer: SharedArrayBuffer,
+	hooks: {
+		wake(index: number, generation: number): void;
+		wait?: typeof Atomics.wait;
+		generationLimit?: number;
+		deadlineMs?: number;
+		retire?(): void;
+	},
+): { check(request: PermissionRequest): CellDecision };
+export function servePermissionSlot(
+	buffer: SharedArrayBuffer,
+	index: number,
+	generation: number,
+	decide: (request: PermissionRequest) => CellDecision | Promise<CellDecision>,
+	hooks?: { claimed?(): void | Promise<void> },
+): Promise<void>;

package/src/kernels/js/permission-slots.mjs

@@ -0,0 +1,133 @@
+const COUNT = 4;
+const REGION = 16 * 1024;
+const STRIDE = 12 + REGION * 2;
+const FREE = 0, REQUESTED = 1, WRITING = 2, ANSWERED = 3, ABANDONED = 4, INTERRUPTED = 5;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+
+export function createPermissionSlots() {
+	return new SharedArrayBuffer(COUNT * STRIDE);
+}
+
+function slotViews(buffer, index) {
+	if (buffer.byteLength !== COUNT * STRIDE || !Number.isInteger(index) || index < 0 || index >= COUNT) {
+		throw new Error("Invalid permission slot");
+	}
+	const offset = index * STRIDE;
+	return {
+		control: new Int32Array(buffer, offset, 3),
+		request: new Uint8Array(buffer, offset + 12, REGION),
+		response: new Uint8Array(buffer, offset + 12 + REGION, REGION),
+	};
+}
+
+export function permissionControl(buffer, index) {
+	return Atomics.load(slotViews(buffer, index).control, 0);
+}
+
+export function interruptPermissionSlot(buffer, index, observed) {
+	if ((observed & 7) !== REQUESTED) return false;
+	const { control } = slotViews(buffer, index);
+	const won = Atomics.compareExchange(control, 0, observed, (observed & ~7) | INTERRUPTED) === observed;
+	if (won) Atomics.notify(control, 0);
+	return won;
+}
+
+export function interruptPermissionSlots(buffer) {
+	for (let index = 0; index < COUNT; index++) interruptPermissionSlot(buffer, index, permissionControl(buffer, index));
+}
+
+function encode(region, value) {
+	const bytes = encoder.encode(JSON.stringify(value));
+	if (bytes.length > region.length) throw new Error("Permission message exceeds slot capacity");
+	region.set(bytes);
+	return bytes.length;
+}
+
+function decode(region, length) {
+	if (!Number.isInteger(length) || length < 1 || length > region.length) throw new Error("Invalid permission message size");
+	return JSON.parse(decoder.decode(region.subarray(0, length)));
+}
+
+export function createPermissionRequester(buffer, hooks) {
+	let generation = 0;
+	let retired = false;
+	return {
+		check(request) {
+			if (retired || generation >= (hooks.generationLimit ?? 2 ** 28)) {
+				if (!retired) { retired = true; hooks.retire?.(); }
+				throw new Error("Permission worker generation exhausted");
+			}
+			generation++;
+			for (let index = 0; index < COUNT; index++) {
+				const { control, request: region, response } = slotViews(buffer, index);
+				const old = Atomics.load(control, 0);
+				if (![FREE, ANSWERED, ABANDONED].includes(old & 7)) continue;
+				control[1] = encode(region, request);
+				const requested = (generation << 3) | REQUESTED;
+				if (Atomics.compareExchange(control, 0, old, requested) !== old) throw new Error("Permission slot ownership changed");
+				try {
+					hooks.wake(index, generation);
+					const wait = hooks.wait ?? Atomics.wait;
+					const deadline = Date.now() + (hooks.deadlineMs ?? 2000);
+					// The host claims the slot before it answers, and that claim does not notify, so a park can
+					// end on the claim rather than on the answer. Keep waiting while the slot is still ours or
+					// held by the host; only the deadline or a foreign state ends the wait.
+					let current = Atomics.load(control, 0);
+					while (current === requested || current === ((generation << 3) | WRITING)) {
+						const remaining = deadline - Date.now();
+						if (remaining <= 0 || wait(control, 0, current, remaining) === "timed-out") break;
+						current = Atomics.load(control, 0);
+					}
+					if (current === ((generation << 3) | ANSWERED)) {
+						const result = decode(response, control[2]);
+						if (result?.action === "pass") return result;
+						if (result?.action === "deny" && validRule(result.rule)) return result;
+						throw new Error("Invalid permission answer");
+					}
+					throw new Error("Permission check interrupted or timed out");
+				} finally {
+					// A WRITING slot belongs to the host even when the worker's deadline has expired.
+					Atomics.compareExchange(control, 0, requested, (generation << 3) | ABANDONED);
+					Atomics.compareExchange(control, 0, (generation << 3) | INTERRUPTED, (generation << 3) | ABANDONED);
+				}
+			}
+			throw new Error("No permission slot available");
+		},
+	};
+}
+
+function validRule(rule) {
+	return rule !== null && typeof rule === "object" &&
+		typeof rule.permission === "string" && typeof rule.pattern === "string" && typeof rule.layer === "string";
+}
+
+export function servePermissionSlot(buffer, index, generation, decide, hooks = {}) {
+	const { control, request, response } = slotViews(buffer, index);
+	const requested = (generation << 3) | REQUESTED;
+	// Own the request bytes before reading them; an abandoned slot may otherwise be rewritten mid-decode.
+	if (Atomics.compareExchange(control, 0, requested, (generation << 3) | WRITING) !== requested) return Promise.resolve();
+	const finish = async (answer) => {
+		try {
+			control[2] = encode(response, answer);
+		} catch {
+			control[2] = encode(response, { action: "error" });
+		}
+		Atomics.compareExchange(control, 0, (generation << 3) | WRITING, (generation << 3) | ANSWERED);
+		Atomics.notify(control, 0);
+	};
+	const evaluate = () => {
+		try {
+			const result = decide(decode(request, control[1]));
+			return result instanceof Promise
+				? result.then(finish, () => finish({ action: "error" }))
+				: finish(result);
+		} catch {
+			return finish({ action: "error" });
+		}
+	};
+	try {
+		const pending = hooks.claimed?.();
+		return pending ? pending.then(evaluate, () => finish({ action: "error" })) : evaluate();
+	} catch { return finish({ action: "error" }); }
+}

package/src/kernels/js/permission-worker-entry.js

@@ -0,0 +1 @@
+import "./interpose.js";

package/src/kernels/js/permission-worker-frames.ts

@@ -0,0 +1,55 @@
+import { MessagePort, type Transferable } from "node:worker_threads";
+
+// Frames a host-observed cell Worker sends to its MessagePort proxy in the cell (permission-runtime.js).
+
+/**
+ * Runs inside a host-process listener, so it must not throw. A raw `parentPort` frame carries no transfer
+ * list; its received MessagePorts are the only values that cannot be re-cloned, so they are transferred
+ * onward as a native Worker would deliver them. A frame that still cannot be forwarded becomes the
+ * cell Worker's `messageerror` event.
+ */
+export function forwardWorkerMessage(port: MessagePort, value: unknown, transfer: Transferable[]): void {
+	const frame = { type: "message", value };
+	try {
+		port.postMessage(frame, transfer);
+	} catch {
+		try {
+			port.postMessage(frame, [...new Set([...transfer, ...receivedPorts(value)])]);
+		} catch (error) {
+			const reason = error instanceof Error ? error : new Error(String(error));
+			const failure = new Error(`Worker message could not be forwarded (${reason.name}): ${reason.message}`);
+			port.postMessage({ type: "messageerror", error: failure });
+		}
+	}
+}
+
+/** Structured clone yields only plain containers, so ports can sit in arrays, objects, Maps and Sets. */
+function receivedPorts(value: unknown): MessagePort[] {
+	const ports: MessagePort[] = [];
+	const seen = new Set<object>();
+	const pending = [value];
+	while (pending.length > 0) {
+		const next = pending.pop();
+		if (next === null || typeof next !== "object" || seen.has(next)) continue;
+		seen.add(next);
+		if (next instanceof MessagePort) ports.push(next);
+		// Push one value at a time: spreading a collection past the engine's argument limit throws RangeError.
+		else if (next instanceof Map) for (const [key, entry] of next) pending.push(key, entry);
+		else if (next instanceof Set || Array.isArray(next)) for (const entry of next) pending.push(entry);
+		else if (Object.getPrototypeOf(next) === Object.prototype)
+			for (const entry of Object.values(next)) pending.push(entry);
+	}
+	return ports;
+}
+
+export function workerErrorFrame(value: unknown) {
+	const error = value instanceof Error ? value : new Error(String(value));
+	return {
+		type: "error",
+		error,
+		message: error.message,
+		filename: "fileName" in error ? error.fileName : "sourceURL" in error ? error.sourceURL : "",
+		lineno: "lineNumber" in error ? error.lineNumber : "line" in error ? error.line : 0,
+		colno: "columnNumber" in error ? error.columnNumber : "column" in error ? error.column : 0,
+	};
+}

package/src/kernels/js/process-tree.js

@@ -10,6 +10,14 @@ const EXIT_POLL_MS = 25;
 // A hung `ps` must not hold a cell's retirement; empty output then means nothing is signalled.
 const PS_LOOKUP_TIMEOUT_MS = 2_000;
 const ZOMBIE_CHECK_INTERVAL_MS = 250;
+let cleanupExecFile = execFile;
+let initializedCleanup = false;
+
+export function initializeProcessCleanup(original) {
+	if (initializedCleanup) throw new Error("Process cleanup already initialized");
+	initializedCleanup = true;
+	cleanupExecFile = original;
+}
 
 export function isProcessAlive(pid) {
 	if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -184,7 +192,7 @@ async function withoutZombies(pids) {
 // `ps -p` exits non-zero when any listed pid is gone but still prints the rest.
 function ps(args, options = {}) {
 	return new Promise((resolve) => {
-		execFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true, ...options }, (_error, output) =>
+		cleanupExecFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true, ...options }, (_error, output) =>
 			resolve(typeof output === "string" ? output : String(output ?? "")),
 		);
 	});

package/src/kernels/js/rewrite-imports.ts

@@ -177,3 +177,47 @@ export function rewriteImports(code: string): string {
 	}
 	return applyEdits(code, edits);
 }
+
+/** Host-side preflight: worker assets stay dependency-free, and direct eval keeps native lexical scope. */
+export function hasDynamicCodeCapability(code: string): boolean {
+	if (!/\b(?:eval|Function|plugin)\b/u.test(code)) return false;
+	const ast = parseProgram(code);
+	if (!ast) return false;
+	let unsupported = false;
+	walkNodes(ast.program, (node) => {
+		if (node.type === "MemberExpression" && !node.value.computed) {
+			const owner = nodeFrom(node.value.object);
+			const member = nodeFrom(node.value.property);
+			const outer = owner && nodeFrom(owner.value.object);
+			const inner = owner && nodeFrom(owner.value.property);
+			if (
+				member?.value.name === "plugin" &&
+				(owner?.value.name === "Bun" || (outer?.value.name === "globalThis" && inner?.value.name === "Bun"))
+			) {
+				unsupported = true;
+			}
+		}
+		if (node.type !== "CallExpression" && node.type !== "NewExpression") return;
+		const callee = nodeFrom(node.value.callee);
+		const object = callee && nodeFrom(callee.value.object);
+		const property = callee && nodeFrom(callee.value.property);
+		const name =
+			callee?.type === "Identifier"
+				? callee.value.name
+				: callee?.type === "MemberExpression" && !callee.value.computed && object?.value.name === "globalThis"
+					? property?.value.name
+					: undefined;
+		if (name !== "eval" && name !== "Function") return;
+		const args = node.value.arguments;
+		if (!Array.isArray(args)) return;
+		for (const argument of args) {
+			const value = nodeFrom(argument);
+			if (value?.type !== "StringLiteral") unsupported = true;
+		}
+		const body = nodeFrom(args.at(-1));
+		if (body?.type === "StringLiteral" && typeof body.value.value === "string") {
+			unsupported ||= hasDynamicCodeCapability(body.value.value);
+		}
+	});
+	return unsupported;
+}

package/src/kernels/js/windows-tree-kill.js

@@ -7,6 +7,14 @@ import { execFile } from "node:child_process";
 
 const LISTING_TIMEOUT_MS = 5_000;
 const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+let cleanupExecFile = execFile;
+let initializedCleanup = false;
+
+export function initializeWindowsCleanup(original) {
+	if (initializedCleanup) throw new Error("Windows cleanup already initialized");
+	initializedCleanup = true;
+	cleanupExecFile = original;
+}
 
 const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
 $created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
@@ -75,7 +83,7 @@ export function windowsTreeKillArgs(rootPid, rows, selfPid = process.pid) {
 
 export function listWindowsRows() {
 	return new Promise((resolve) => {
-		execFile(
+		cleanupExecFile(
 			"powershell.exe",
 			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
 			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
@@ -95,6 +103,6 @@ export async function killWindowsTree(pid, listing = listWindowsRows()) {
 	const args = windowsTreeKillArgs(pid, await listing);
 	if (args.length === 0) return;
 	await new Promise((resolve) => {
-		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+		cleanupExecFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
 	});
 }

package/src/kernels/js/worker-core.d.ts

@@ -1,4 +1,5 @@
 import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { WireAuthority } from "./permission-authority.mjs";
 
 export interface WorkerCoreTransport {
 	send(message: KernelToHostMessage): void;
@@ -9,6 +10,7 @@ export interface WorkerCoreTransport {
 export interface WorkerCoreOptions {
 	cwd: string;
 	parallelPoolWidth: number;
+	runAuthority?<T>(token: WireAuthority | undefined, run: () => T | Promise<T>): Promise<T>;
 }
 
 export interface WorkerCoreHandle {

package/src/kernels/js/worker-core.js

@@ -50,6 +50,7 @@ export function createWorkerCore(transport, options) {
 		getRuntime: () => runtime,
 		emit: (message) => transport.send(message),
 		nestedInvokes,
+		runAuthority: options.runAuthority,
 	});
 
 	function emit(message) {
@@ -72,7 +73,7 @@ export function createWorkerCore(transport, options) {
 		activeCell = cell;
 		rejections.startCell(cell);
 		try {
-			const run = runInCell(cell, () =>
+			const execute = () => runInCell(cell, () =>
 				runtime.run(message.code, message.cellId, {
 					emit: (event) => {
 						if (releasedCellError() === undefined) emit(event);
@@ -80,6 +81,7 @@ export function createWorkerCore(transport, options) {
 					callTool: async (toolName, args) => await callTool(toolName, args),
 				}),
 			);
+			const run = options.runAuthority ? options.runAuthority(message.authority, execute, message.code) : execute();
 			const value = await Promise.race([run, release.promise]);
 			rejections.finishCell(cell);
 			emit({ type: "result", cellId: message.cellId, ok: true, valueRepr: valueRepr(value), durationMs: durationMs(startedAtMs), ...memoryReport() });
@@ -174,6 +176,7 @@ export function createWorkerCore(transport, options) {
 				parallelPoolWidth: options.parallelPoolWidth,
 				localRoots: message.connection.localRoots,
 				artifactsDir: message.connection.artifactsDir,
+				permissionIO: options.permissionIO,
 				kernelGeneration: message.kernelGeneration ?? 1,
 				hostToolNames: message.hostToolNames ?? [],
 				foreignLanguageNames: message.foreignLanguageNames ?? [],
@@ -265,7 +268,7 @@ function cellInterruptedError(reason) {
 
 function bridgeError(error) {
 	if (error instanceof Error) {
-		return { name: error.name, message: error.message, stack: error.stack, ...(typeof error.code === "string" ? { code: error.code } : {}) };
+		return { name: error.name, message: error.message, stack: error.stack, ...(typeof error.code === "string" ? { code: error.code } : {}), ...(error.code === "cell_permission_denied" && error.rule ? { permissionRule: error.rule } : {}) };
 	}
 	return { message: String(error) };
 }