@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-2

package/src/kernels/js/interpose-process.js

@@ -0,0 +1,97 @@
+import { replaceMethod, requestedPath } from "./interpose-paths.js";
+
+const { basename } = process.getBuiltinModule("node:path");
+// Bun gives an explicit stdio[i] priority over the matching named option, so both are decided rather
+// than one standing in for the other. The first three slots carry one direction each; a slot at
+// index 3 or above has no named option and is handed to the child as a descriptor it can both read
+// and write.
+const SLOT_MODES = [["read"], ["write"], ["write"]];
+const EXTRA_SLOT_MODES = ["read", "write"];
+const quote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
+const cwdOf = (value) => requestedPath(value) ?? process.cwd();
+
+export function installProcessPermissions(check, files) {
+	const cp = process.getBuiltinModule("node:child_process");
+	for (const name of ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync", "fork"]) {
+		replaceMethod(cp, name, (original) => function (...parameters) {
+			check(() => {
+				const [file, args, options] = parameters;
+				const shellText = name === "exec" || name === "execSync";
+				const argv = Array.isArray(args) ? args : [];
+				const opts = shellText ? args : Array.isArray(args) || args == null ? options : args;
+				const shell = opts?.shell;
+				const command = name === "fork"
+					? [opts?.execPath ?? process.execPath, ...(opts?.execArgv ?? process.execArgv), file, ...argv].map(quote).join(" ")
+					: shellText ? file : shell ? [file, ...argv].join(" ") : [file, ...argv].map(quote).join(" ");
+				return {
+					call: { tool: "bash", input: { command }, cwd: cwdOf(opts?.cwd) },
+					unsupported: typeof shell === "string" && !/^(?:sh|bash|zsh|dash)$/u.test(basename(shell)),
+				};
+			});
+			return original.apply(this, parameters);
+		});
+	}
+	const bun = globalThis.Bun;
+	if (!bun) return;
+	for (const name of ["spawn", "spawnSync"]) replaceMethod(bun, name, (original) => function (...parameters) {
+		const [first, second] = parameters;
+		const options = Array.isArray(first) ? second : first;
+		check(() => {
+			const argv = Array.isArray(first) ? first : first?.cmd;
+			return {
+				call: { tool: "bash", input: { command: Array.isArray(argv) ? argv.map(quote).join(" ") : "" }, cwd: cwdOf(options?.cwd) },
+				unsupported: !Array.isArray(argv),
+			};
+		});
+		const slots = Array.isArray(options?.stdio) ? options.stdio : [];
+		files.source(options?.stdin); // sink:spawn-stdin
+		files.handle(options?.stdout, "write"); // sink:spawn-stdout
+		files.handle(options?.stderr, "write"); // sink:spawn-stderr
+		for (const [index, slot] of slots.entries()) {
+			for (const mode of SLOT_MODES[index] ?? EXTRA_SLOT_MODES) {
+				if (mode === "read") files.source(slot); // sink:spawn-stdio-read
+				if (mode === "write") files.handle(slot, "write"); // sink:spawn-stdio-write
+			}
+		}
+		return original.apply(this, parameters);
+	});
+	const shell = bun.$;
+	if (typeof shell !== "function") return;
+	let shellCwd;
+	const render = (value) => {
+		if (Array.isArray(value)) return value.map(render).join(" ");
+		if (value && typeof value === "object") {
+			if (typeof value.raw === "string") return value.raw;
+			check(() => ({ unsupported: true }));
+		}
+		return shell.escape(String(value));
+	};
+	const guarded = function (strings, ...values) {
+		check(() => ({
+			call: {
+				tool: "bash",
+				input: { command: strings.map((part, index) => part + (index < values.length ? render(values[index]) : "")).join("") },
+				cwd: cwdOf(shellCwd),
+			},
+		}));
+		return shell(strings, ...values);
+	};
+	for (const key of Reflect.ownKeys(shell)) {
+		if (key !== "Shell" && !Object.hasOwn(guarded, key)) Object.defineProperty(guarded, key, Object.getOwnPropertyDescriptor(shell, key));
+	}
+	for (const name of ["cwd", "env", "nothrow", "throws"]) {
+		if (typeof shell[name] !== "function") continue;
+		guarded[name] = (...args) => {
+			if (name === "cwd") shellCwd = args[0];
+			shell[name](...args);
+			return guarded;
+		};
+	}
+	if (shell.Shell) guarded.Shell = new Proxy(shell.Shell, {
+		construct(target, args, newTarget) {
+			check(() => ({ unsupported: true }));
+			return Reflect.construct(target, args, newTarget);
+		},
+	});
+	bun.$ = guarded;
+}

package/src/kernels/js/interpose-resources.js

@@ -0,0 +1,59 @@
+import { checkPath, replaceMethod } from "./interpose-paths.js";
+
+const { constants } = process.getBuiltinModule("node:fs");
+
+function openModes(flags = "r") {
+	flags ??= "r";
+	if (typeof flags === "number") {
+		const access = flags & (constants.O_RDONLY | constants.O_WRONLY | constants.O_RDWR);
+		if (access === constants.O_WRONLY) return ["write"];
+		return access === constants.O_RDWR || (flags & (constants.O_CREAT | constants.O_TRUNC)) !== 0 ? ["read", "write"] : ["read"];
+	}
+	return flags.includes("+") ? ["read", "write"] : /^[wax]/u.test(flags) ? ["write"] : ["read"];
+}
+
+export function createResourceTable(check) {
+	const descriptors = new Map();
+	const objects = new WeakMap();
+	const table = (resource) => typeof resource === "number" ? descriptors : objects;
+	const record = (resource, path, modes) => {
+		if (typeof resource === "number" || (resource !== null && typeof resource === "object")) {
+			table(resource).set(resource, { path, modes });
+		}
+		return resource;
+	};
+	const forget = (resource) => table(resource).delete(resource);
+	const use = (resource, mode) => {
+		check(() => {
+			const grant = table(resource).get(resource);
+			return { granted: true, unsupported: !grant || (mode !== undefined && !grant.modes.includes(mode)) };
+		});
+	};
+	const path = (resource) => table(resource).get(resource)?.path;
+	const open = (file, flags) => {
+		const modes = openModes(flags);
+		for (const mode of modes) checkPath(check, mode === "read" ? "read" : "write", file);
+		return modes;
+	};
+	const handle = (value, file, modes) => {
+		record(value, file, modes);
+		record(value.fd, file, modes);
+		for (const [mode, names] of [
+			["read", ["read", "readv", "readFile", "readLines", "createReadStream", "readableWebStream"]],
+			["write", ["write", "writev", "writeFile", "appendFile", "truncate", "chmod", "chown", "utimes", "sync", "datasync", "createWriteStream"]],
+		]) {
+			for (const name of names) replaceMethod(value, name, (original) => function (...args) {
+				use(this, mode);
+				const result = original.apply(this, args);
+				if (/Stream$/u.test(name)) record(result, file, [mode]);
+				return result;
+			});
+		}
+		replaceMethod(value, "close", (original) => function (...args) {
+			const fd = this.fd;
+			return original.apply(this, args).then((result) => { forget(fd); forget(this); return result; });
+		});
+		return value;
+	};
+	return { record, forget, use, path, open, handle };
+}

package/src/kernels/js/interpose-sqlite.js

@@ -0,0 +1,104 @@
+import { checkPath, executionPath, replaceMethod } from "./interpose-paths.js";
+
+// Skip quoted data/identifiers and comments, retaining semicolons to examine every statement.
+function sqlWords(sql) {
+	return String(sql).replace(/--[^\n]*|\/\*[\s\S]*?\*\/|'(?:''|[^'])*'|"(?:""|[^"])*"|`(?:``|[^`])*`|\[[^\]]*\]/gu, " ")
+		.toUpperCase().match(/[A-Z_]+|;/gu) ?? [];
+}
+
+function reachesOtherFile(sql) {
+	let first;
+	for (const word of sqlWords(sql)) {
+		if (word === ";") { first = undefined; continue; }
+		first ??= word;
+		if (first === "ATTACH" || (first === "VACUUM" && word === "INTO")) return true;
+	}
+	return false;
+}
+
+export function installSqlitePermissions(check) {
+	const paths = new WeakMap();
+	const memory = (path) => path === ":memory:" || path === "";
+	const file = (path, mode) => { if (!memory(path)) checkPath(check, mode, path); };
+	const refuse = () => check(() => ({ unsupported: true }));
+	const guardSql = (sql) => check(() => ({ granted: true, unsupported: reachesOtherFile(sql) }));
+	const install = (sqlite, name, node) => {
+		const Original = sqlite[name];
+		if (!Original) return;
+		const readonly = (options) => node ? options?.readOnly === true
+			: typeof options === "number" ? (options & sqlite.constants.SQLITE_OPEN_READONLY) !== 0 : options?.readonly === true;
+		const opening = (path, options) => {
+			if (node && options?.allowExtension) refuse();
+			file(path, "read");
+			if (!readonly(options)) file(path, "write");
+		};
+		const proto = Original.prototype;
+		const statement = (node ? sqlite.StatementSync : sqlite.Statement)?.prototype;
+		for (const method of ["run", "get", "all", "iterate", "values"]) replaceMethod(statement, method, (original) => function (...args) {
+			check(() => ({ granted: true }));
+			const result = original.apply(this, args);
+			if (method === "iterate") replaceMethod(result, "next", (next) => function (...parameters) {
+				check(() => ({ granted: true }));
+				return next.apply(this, parameters);
+			});
+			return result;
+		});
+		if (node) {
+			const setAuthorizer = proto.setAuthorizer;
+			replaceMethod(proto, "setAuthorizer", () => function (callback) {
+				return setAuthorizer.call(this, (operation, ...args) => {
+					if (operation === sqlite.constants.SQLITE_ATTACH) refuse();
+					return callback?.(operation, ...args) ?? sqlite.constants.SQLITE_OK;
+				});
+			});
+		}
+		for (const method of ["exec", "run", "prepare", "query"]) replaceMethod(proto, method, (original) => function (sql, ...args) {
+			// Also guards runtimes which translate SQLite authorizer throws to SQLITE_AUTH.
+			guardSql(sql);
+			return original.call(this, sql, ...args);
+		});
+		replaceMethod(proto, "enableLoadExtension", (original) => function (enabled) {
+			if (enabled) refuse();
+			return original.call(this, enabled);
+		});
+		replaceMethod(proto, "loadExtension", (original) => function (...args) {
+			refuse();
+			return original.apply(this, args);
+		});
+		sqlite[name] = new Proxy(Original, {
+			construct(target, args, newTarget) {
+				const [path = ":memory:", options] = args;
+				opening(path, options);
+				const actual = memory(path) ? path : executionPath(path);
+				const db = Reflect.construct(target, [actual, ...args.slice(1)], newTarget);
+				paths.set(db, path);
+				if (node && typeof db.setAuthorizer === "function") db.setAuthorizer(null);
+				return db;
+			},
+		});
+		if (sqlite.default === Original) sqlite.default = sqlite[name];
+		if (!node) {
+			replaceMethod(Original, "open", (original) => function (path, options) {
+				opening(path, options);
+				const db = original.call(this, memory(path) ? path : executionPath(path), options);
+				paths.set(db, path);
+				return db;
+			});
+			replaceMethod(Original, "setCustomSQLite", (original) => function (...args) {
+				refuse();
+				return original.apply(this, args);
+			});
+		}
+		if (node) replaceMethod(sqlite, "backup", (original) => function (db, dest, ...args) {
+			file(paths.get(db), "read");
+			file(dest, "write");
+			return original.call(this, db, executionPath(dest), ...args);
+		});
+	};
+	const nodeSqlite = process.getBuiltinModule("node:sqlite");
+	install(nodeSqlite, "DatabaseSync", true);
+	if (globalThis.Bun) {
+		const require = process.getBuiltinModule("node:module").createRequire(import.meta.url);
+		install(require("bun:sqlite"), "Database", false);
+	}
+}

package/src/kernels/js/interpose.js

@@ -0,0 +1,86 @@
+// This module must be the first import in every worker. No builtin ESM namespace exists yet.
+import { installFilesystemPermissions } from "./interpose-fs.js";
+import { installProcessPermissions } from "./interpose-process.js";
+import { installBunPermissions } from "./interpose-bun.js";
+import { installSqlitePermissions } from "./interpose-sqlite.js";
+import { installModulePermissions } from "./interpose-modules.js";
+import { installCapabilityPermissions } from "./interpose-capabilities.js";
+import { checkPath } from "./interpose-paths.js";
+
+// Bootstrap is engine-owned; there is no user statement until this one-time handoff finishes.
+let check = () => {};
+let engineDepth = 0;
+const authorize = (operation) => { if (engineDepth === 0) return check(operation); };
+const fs = process.getBuiltinModule("node:fs");
+const workerThreads = process.getBuiltinModule("node:worker_threads");
+const bootstrap = workerThreads.workerData;
+// Restore the public value before any builtin namespace or user preload observes it.
+if (bootstrap.script) workerThreads.workerData = bootstrap.userWorkerData;
+// Bun gives each worker one ESM namespace per builtin, copied from the module object at its first
+// import and never refreshed, so the guarded constructor must be in place before that import. Only a
+// user worker started under an active token is enforced against for its whole life, so only it gets
+// the forwarder; every other context keeps the engine's own Worker on the module.
+let guardedWorker;
+let forwarder;
+if (bootstrap.script && bootstrap.enforced) {
+	// A function, not a class: it hands back the instance the guarded class builds for new.target.
+	forwarder = function Worker(...args) {
+		if (!new.target) throw new TypeError("Class constructor Worker cannot be invoked without 'new'");
+		if (!guardedWorker) throw new Error("Worker is unavailable until the permission runtime starts");
+		return Reflect.construct(guardedWorker, args, new.target);
+	};
+	Object.setPrototypeOf(forwarder.prototype, EventTarget.prototype);
+	Object.defineProperty(workerThreads, "Worker", { value: forwarder, writable: false, configurable: false, enumerable: true });
+}
+const installGuardedWorker = (Guarded) => {
+	if (!forwarder) {
+		globalThis.Worker = Guarded;
+		return;
+	}
+	guardedWorker = Guarded;
+	Object.setPrototypeOf(forwarder.prototype, Guarded.prototype);
+	globalThis.Worker = forwarder;
+};
+const originals = { ...fs.promises, readFileSync: fs.readFileSync, realpathSync: fs.realpathSync };
+const execFile = process.getBuiltinModule("node:child_process").execFile;
+const cleanupExecFile = (...args) => {
+	engineDepth++;
+	try { return execFile(...args); }
+	finally { engineDepth--; }
+};
+const { dirname } = process.getBuiltinModule("node:path");
+const permissionIO = {
+	read(raw, actual) { checkPath(authorize, "read", raw, { executed: actual }); return originals.readFile(actual, "utf8"); },
+	async write(raw, actual, data) {
+		checkPath(authorize, "write", raw, { executed: actual });
+		await originals.mkdir(dirname(actual), { recursive: true });
+		await originals.writeFile(actual, data);
+	},
+};
+const resources = installFilesystemPermissions(authorize);
+installProcessPermissions(authorize, installBunPermissions(authorize, resources));
+installSqlitePermissions(authorize);
+const sealModules = installModulePermissions(authorize, Boolean(bootstrap.script));
+
+// The sole bootstrap handoff is consumed before user code. Neither module exports the originals.
+const { initializePermissionRuntime } = await import("./permission-runtime.js");
+let runtimeAuthorize;
+let activated = false;
+const activate = () => {
+	if (activated) return;
+	activated = true;
+	check = runtimeAuthorize;
+	sealModules();
+	installCapabilityPermissions(authorize);
+};
+// The worker bootstrap and the engine hooks are separate inputs: the bootstrap carries the
+// permission transport this worker must consume and delete, the engine carries the authorized IO
+// the runtime hands to the cell prelude. Collapsing them into one argument drops one of the two.
+await initializePermissionRuntime((authorize) => { runtimeAuthorize = authorize; }, bootstrap, {
+	permissionIO,
+	resolverIO: originals,
+	cleanupExecFile,
+	activate,
+	installGuardedWorker,
+});
+activate();

package/src/kernels/js/kernel-contract.ts

@@ -2,7 +2,31 @@ import type { KernelMemoryThresholds } from "../../bridge/memory-protocol.ts";
 import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import type { EvalKernelRunInput } from "../../tool/types.ts";
 import type { SessionEnvironment } from "../session-env.ts";
+import type { InvocationPermissions } from "../shared/invocation-authority.ts";
 import type { JavaScriptInterruptBounds } from "./interrupt-bounds.ts";
+import type { CellDecision, CellOperation, CellRule } from "./permission-slots.mjs";
+
+export interface CellAuthorityToken {
+	readonly id: string;
+	readonly sessionId: string;
+	readonly cwd: string;
+	readonly authority: SharedArrayBuffer;
+	readonly rules: readonly CellRule[];
+	readonly signal?: AbortSignal;
+}
+
+export type CellDecider = (token: CellAuthorityToken, call: CellOperation) => CellDecision | Promise<CellDecision>;
+
+export interface CellPermissionState {
+	readonly epoch: number;
+	readonly active: boolean;
+	readonly rules: readonly CellRule[];
+}
+
+export interface RevocationFailedEvent {
+	readonly sessionId: string;
+	readonly kernelId: string;
+}
 
 export type ResultMessage = Extract<KernelToHostMessage, { type: "result" }>;
 export type ToolCallMessage = Extract<KernelToHostMessage, { type: "tool-call" }>;
@@ -20,6 +44,13 @@ export function resolveKernelToolNameSource(names?: KernelToolNameSource): strin
 export interface JavaScriptKernelOptions {
 	readonly sessionId: string;
 	readonly cwd: string;
+	readonly permissions?: InvocationPermissions & {
+		readonly decide: CellDecider;
+		/** Slot wait deadline in ms; production keeps the 2s default. Integration suites raise it above host load. */
+		readonly checkDeadlineMs?: number;
+	};
+	/** Integration marks direct tool admission DEAD too; the kernel host fences cells itself. */
+	readonly onRevocationFailed?: (event: RevocationFailedEvent) => void;
 	/**
 	 * Collects the exit status of a retired worker's children once they are killed (#1962): no thread is left to
 	 * wait on them. Absent, they stay zombies until the host's child reaper or process exit collects them.

package/src/kernels/js/kernel-tools-pump.js

@@ -1,7 +1,7 @@
 import { kernelToolCallContext } from "./kernel-tools-context.js";
 import { kernelToolError } from "./kernel-tools-errors.js";
 
-export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
+export function createKernelToolPump({ getRuntime, emit, nestedInvokes, runAuthority }) {
 	async function describe(message) {
 		try {
 			const runtime = getRuntime();
@@ -20,7 +20,7 @@ export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
 		try {
 			const runtime = getRuntime();
 			if (!runtime?.kernelTools) throw kernelToolError("tools_unavailable", "JS runtime not initialized");
-			const value = await kernelToolCallContext.run(
+			const execute = () => kernelToolCallContext.run(
 				// The scope lives only in this store: it is gone once the call settles, and it never
 				// reaches the top-level cell context or the next invocation (#1731).
 				{
@@ -42,6 +42,7 @@ export function createKernelToolPump({ getRuntime, emit, nestedInvokes }) {
 						controller.signal,
 					),
 			);
+			const value = await (runAuthority ? runAuthority(message.authority, execute) : execute());
 			emit({ type: "kernel-tool-invoke-reply", requestId: message.requestId, ok: true, value });
 		} catch (error) {
 			emit({ type: "kernel-tool-invoke-reply", requestId: message.requestId, ok: false, error: pumpError(error) });
@@ -100,6 +101,7 @@ function pumpError(error) {
 			stack: error.stack,
 			...(typeof error.code === "string" ? { code: error.code } : {}),
 			...(isPlainRecord(error.details) ? { details: error.details } : {}),
+			...(error.code === "cell_permission_denied" && error.rule ? { details: { permissionRule: error.rule } } : {}),
 		};
 	}
 	return { message: String(error) };

package/src/kernels/js/local-module-loader.ts

@@ -11,7 +11,7 @@ import {
 } from "../../bridge/reserved.ts";
 import { type KernelPreludePlan, KernelPreludeTracker } from "../shared/kernel-prelude-plan.ts";
 import type { JavaScriptKernelOptions as BaseJavaScriptKernelOptions } from "./kernel-contract.ts";
-import { rewriteImports } from "./rewrite-imports.ts";
+import { hasDynamicCodeCapability, rewriteImports } from "./rewrite-imports.ts";
 
 const PREPARED_CELL_PREFIX = "/*senpi:prepared-cell*/";
 
@@ -77,8 +77,10 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"globalThis.__senpi_import__ = async (source, options) => {",
 		"  const context = globalThis.__senpi_module_context__;",
 		"  const specifier = String(source);",
+		"  const permissionImport = globalThis[Symbol.for('senpi.kernel.permissionImport')];",
+		"  permissionImport?.(specifier, new URL('__cell__.js', context.cwdUrl).href);",
 		"  const kernelBun = globalThis[Symbol.for('senpi.kernel.bun')];",
-		"  if (specifier === 'bun' && kernelBun) return { ...(await import('bun')), WebView: kernelBun.WebView, default: kernelBun };",
+		"  if (specifier === 'bun' && kernelBun) return { ...kernelBun, default: kernelBun };",
 		// Under Bun a cell's named import (`import { spawn } from 'node:child_process'`) binds the builtin's original
 		// export even after the worker patched the module object (worker-cwd.js), so the session cwd and the cell
 		// children's own process group (senpi#2995) were skipped. The patched module objects are served instead.
@@ -106,7 +108,10 @@ function loaderPrelude(context: RuntimeModuleContext): string {
 		"    const urlModule = await import('node:url');",
 		"    target = urlModule.pathToFileURL(specifier).href;",
 		"  }",
-		"  const load = (resolved) => (options === undefined ? import(resolved) : import(resolved, options));",
+		// The import and everything it loads (resolution hooks, module bodies) run under the cell's loading window.
+		"  const permissionLoad = globalThis[Symbol.for('senpi.kernel.permissionLoad')];",
+		"  const run = (resolved) => (options === undefined ? import(resolved) : import(resolved, options));",
+		"  const load = (resolved) => (permissionLoad ? permissionLoad(() => run(resolved)) : run(resolved));",
 		"  const resolvePackage = globalThis[Symbol.for('senpi.kernel.resolvePackage')];",
 		"  if (target === specifier && typeof resolvePackage === 'function') {",
 		"    const resolved = resolvePackage(specifier, [context.cwdUrl, context.packageRootUrl]);",
@@ -147,6 +152,6 @@ export class LocalModuleLoader {
 		const cwdUrl = sourceFile === undefined ? this.#cwdUrl : directoryUrl(dirname(sourceFile));
 		const base = `\nglobalThis.__senpi_module_context__ = { ...globalThis.__senpi_module_context__, cwdUrl: ${JSON.stringify(cwdUrl)}, packageRootUrl: ${JSON.stringify(packageRoot === undefined ? null : directoryUrl(packageRoot))} };`;
 		const prelude = `${this.#prelude}${base}\n${contributionPrelude(this.#contributions.plan(contributions))}`;
-		return `${PREPARED_CELL_PREFIX}${JSON.stringify({ prelude, code: rewriteImports(code), ...(sourceFile === undefined ? {} : { sourceFile }) })}`;
+		return `${PREPARED_CELL_PREFIX}${JSON.stringify({ prelude, code: rewriteImports(code), dynamicCodeCapability: hasDynamicCodeCapability(code), ...(sourceFile === undefined ? {} : { sourceFile }) })}`;
 	}
 }

package/src/kernels/js/permission-authority.d.mts

@@ -0,0 +1,10 @@
+export interface WireAuthority {
+	readonly id: string;
+	readonly authority: SharedArrayBuffer;
+	readonly rules: readonly import("./permission-slots.mjs").CellRule[];
+}
+export function authorityDecision(
+	current: WireAuthority | undefined,
+	bound: readonly WireAuthority[],
+	kernel: WireAuthority,
+): "pass" | "check" | "refuse";

package/src/kernels/js/permission-authority.mjs

@@ -0,0 +1,11 @@
+export function authorityDecision(current, bound, kernel) {
+	if (!(Atomics.load(new Int32Array(kernel.authority), 0) & 2)) return "refuse";
+	if (current) {
+		const word = Atomics.load(new Int32Array(current.authority), 0);
+		if (!(word & 2)) return "refuse";
+		return word & 1 ? "check" : "pass";
+	}
+	const authorities = bound.length ? bound : [kernel];
+	return authorities.every((token) => (Atomics.load(new Int32Array(token.authority), 0) & 3) === 2)
+		? "pass" : "refuse";
+}

package/src/kernels/js/permission-core.md

@@ -0,0 +1,114 @@
+# JS kernel permission core
+
+This is the core portion of senpi#4309. It provides the transport and lifetime
+contract for a host `CellDecider`; it does not connect the permission extension.
+
+## Host integration
+
+`JavaScriptKernelOptions.permissions` supplies a current epoch snapshot and
+`decide(token, call)`. Tokens identify the invoking session and execution cwd.
+The decision is either `pass` or `deny` with a rule's permission, pattern and
+layer. The core does not interpret rule syntax or implement allow/ask precedence.
+
+The host calls `revokeSessionKernels(sessionId)` when effective enforcement
+changes. The call kills every authority word synchronously, interrupts parked
+checks and waits for retirement. New cells wait for this completion. An
+abandoned retirement permanently fences cell admission for the session and
+emits `onRevocationFailed({ sessionId, kernelId })`.
+
+The integration PR must connect that event to direct-tool admission. Direct
+tools are not fenced by this core alone.
+
+The coding-agent dispatcher stamps `options.invoker.sessionId` from its own
+SessionManager. Neither cell data nor tool arguments can override that identity.
+Registered extension event handlers also bind their own host context, rather
+than inheriting a parent task tool's identity when a child emits an event.
+The shared host pump forwards these options to `resolveInvocationToken` before
+posting an invocation frame. Absent or owner identity mints an owner token;
+another session is refused before the body runs if either session enforces,
+with `reason: "cross_session_authority"` and the enforcing session identified.
+The attached `rule` names a deny rule activating that session's enforcement;
+it does not claim that this rule matched an operation inside the unexecuted
+tool body. Otherwise the token identifies the invoker.
+Python applies the same cross-session check before posting to the interpreter.
+
+Live kernel owners publish their current permission snapshots to the host-only
+invocation registry. The permission integration supplies `permissions.resolveSession`
+for sessions without a kernel, returning that session's current state and cwd.
+Without integration or a registered kernel, a session has no enforcing state in
+this core and retains the existing inactive behavior. No invoker identity or
+session resolver is accepted by the worker protocol. An active JS invocation
+also binds its destination kernel to the invoker's revocation lifecycle. A
+settled inactive invocation keeps that binding until the worker retires, so
+the invoker's revocation still reaches the continuations it left behind.
+
+## Runtime invariants
+
+Both worker entries load `interpose.js` first. It captures and patches builtins
+before importing the runtime, including before a package can obtain a static
+builtin binding. Originals stay in module-local closures. The one-time runtime
+initializer does not export a token store or original functions.
+
+Operation families are installed by `interpose-fs.js`, `interpose-process.js`,
+`interpose-bun.js` and `interpose-sqlite.js` through the same check closure.
+Arguments are analyzed only on the active path. Direct
+argv becomes shell-quoted command text; a shell invocation uses the text the
+shell actually receives. Requested path spelling is preserved for policy;
+execution still resolves relative paths against the kernel cwd.
+
+Each worker owns four bounded shared-memory slots. A generation-tagged CAS
+claims each transition. The host claims WRITING before decoding the request or
+calling the decider, so the requester cannot rewrite bytes the host is reading.
+A timed-out WRITING slot remains host-owned, while unclaimed and interrupted
+requests become ABANDONED. A stale interrupt cannot affect a later generation.
+Checks have a 2000 ms worker-side deadline and fail closed on
+transport, sizing, decoding or authority errors.
+
+Authority follows `AsyncLocalStorage` rather than a mutable current-cell global.
+No-token operations pass only when every bound token is alive and inactive;
+idle code consults the kernel word. Settlement kills active tokens, but leaves
+inactive continuations alive without retaining them in the host registry.
+An interrupt or timeout releases tokens the same way. Cancellation still
+kills the invocation token. A dead kernel word overrides
+every token, including inactive tokens from settled runs. A token's death
+takes precedence over its inactive bit.
+
+Cell-created global Workers use a private MessagePort proxy. The host constructs
+the instrumented worker and observes its exit directly, including nested
+workers. The proxy forwards messages and transfer lists; each child gets its
+own slot pool and the parent's shared authority. Retirement waits for observed
+exit, not merely a termination request or a DEAD word. Inactive Workers use the
+kernel lifetime, so later cells can use them or create them from a continuation.
+User workerData is restored before user imports and preloads. User frames,
+including primitives and objects resembling transport frames, remain data;
+internal transfer envelopes carry a per-Worker key. MessagePorts transferred
+through a raw `parentPort` frame are transferred on to the cell; a frame the
+host cannot forward becomes a `messageerror` event and never throws in the
+host listener. Error events carry the error
+and its available source coordinates, and observed exit dispatches close.
+
+## Scope boundary
+
+PR 3 extends the operation table without changing authority or slot messages.
+Resource tables retain each open's path and access modes; locally granted
+operations still check authority liveness before using a resource. Engine
+package-resolution reads and process retirement use one-time, closure-private
+originals, rather than gaining an exemption for an installation path.
+
+The module plugin observes resolution only and lets the native loader handle
+attributes. Cell import and require routes also check relative and absolute
+paths. Dynamic-code preflight runs in the host AST preparer so workers remain
+dependency-free and direct eval retains lexical scope.
+
+Native capability residual: Bun 1.4.4 makes both the global `Bun` binding and `Bun.plugin`
+non-writable and non-configurable. The cell-local binding can guard plugin calls;
+native libraries' plugin calls and non-literal dynamic evaluation remain available.
+The native-loader regression matrix verifies that code reached through these routes
+still encounters the enforced synchronous/asynchronous spawn and write checks.
+The engine adds no onLoad transform. Final acceptance of this named residual
+remains with the lead.
+This core is not a sandbox and does not claim read completeness.
+
+Known limitation: in natively loaded dependencies, Bun.plugin registration and non-literal eval are not refused (Bun 1.4.4 makes Bun.plugin immutable); code loaded that way still runs under the enforced spawn and write checks; tracked in #4380.
+
+Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.