@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-2

package/src/kernels/js/permission-slots.mjs

@@ -0,0 +1,133 @@
+const COUNT = 4;
+const REGION = 16 * 1024;
+const STRIDE = 12 + REGION * 2;
+const FREE = 0, REQUESTED = 1, WRITING = 2, ANSWERED = 3, ABANDONED = 4, INTERRUPTED = 5;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+
+export function createPermissionSlots() {
+	return new SharedArrayBuffer(COUNT * STRIDE);
+}
+
+function slotViews(buffer, index) {
+	if (buffer.byteLength !== COUNT * STRIDE || !Number.isInteger(index) || index < 0 || index >= COUNT) {
+		throw new Error("Invalid permission slot");
+	}
+	const offset = index * STRIDE;
+	return {
+		control: new Int32Array(buffer, offset, 3),
+		request: new Uint8Array(buffer, offset + 12, REGION),
+		response: new Uint8Array(buffer, offset + 12 + REGION, REGION),
+	};
+}
+
+export function permissionControl(buffer, index) {
+	return Atomics.load(slotViews(buffer, index).control, 0);
+}
+
+export function interruptPermissionSlot(buffer, index, observed) {
+	if ((observed & 7) !== REQUESTED) return false;
+	const { control } = slotViews(buffer, index);
+	const won = Atomics.compareExchange(control, 0, observed, (observed & ~7) | INTERRUPTED) === observed;
+	if (won) Atomics.notify(control, 0);
+	return won;
+}
+
+export function interruptPermissionSlots(buffer) {
+	for (let index = 0; index < COUNT; index++) interruptPermissionSlot(buffer, index, permissionControl(buffer, index));
+}
+
+function encode(region, value) {
+	const bytes = encoder.encode(JSON.stringify(value));
+	if (bytes.length > region.length) throw new Error("Permission message exceeds slot capacity");
+	region.set(bytes);
+	return bytes.length;
+}
+
+function decode(region, length) {
+	if (!Number.isInteger(length) || length < 1 || length > region.length) throw new Error("Invalid permission message size");
+	return JSON.parse(decoder.decode(region.subarray(0, length)));
+}
+
+export function createPermissionRequester(buffer, hooks) {
+	let generation = 0;
+	let retired = false;
+	return {
+		check(request) {
+			if (retired || generation >= (hooks.generationLimit ?? 2 ** 28)) {
+				if (!retired) { retired = true; hooks.retire?.(); }
+				throw new Error("Permission worker generation exhausted");
+			}
+			generation++;
+			for (let index = 0; index < COUNT; index++) {
+				const { control, request: region, response } = slotViews(buffer, index);
+				const old = Atomics.load(control, 0);
+				if (![FREE, ANSWERED, ABANDONED].includes(old & 7)) continue;
+				control[1] = encode(region, request);
+				const requested = (generation << 3) | REQUESTED;
+				if (Atomics.compareExchange(control, 0, old, requested) !== old) throw new Error("Permission slot ownership changed");
+				try {
+					hooks.wake(index, generation);
+					const wait = hooks.wait ?? Atomics.wait;
+					const deadline = Date.now() + (hooks.deadlineMs ?? 2000);
+					// The host claims the slot before it answers, and that claim does not notify, so a park can
+					// end on the claim rather than on the answer. Keep waiting while the slot is still ours or
+					// held by the host; only the deadline or a foreign state ends the wait.
+					let current = Atomics.load(control, 0);
+					while (current === requested || current === ((generation << 3) | WRITING)) {
+						const remaining = deadline - Date.now();
+						if (remaining <= 0 || wait(control, 0, current, remaining) === "timed-out") break;
+						current = Atomics.load(control, 0);
+					}
+					if (current === ((generation << 3) | ANSWERED)) {
+						const result = decode(response, control[2]);
+						if (result?.action === "pass") return result;
+						if (result?.action === "deny" && validRule(result.rule)) return result;
+						throw new Error("Invalid permission answer");
+					}
+					throw new Error("Permission check interrupted or timed out");
+				} finally {
+					// A WRITING slot belongs to the host even when the worker's deadline has expired.
+					Atomics.compareExchange(control, 0, requested, (generation << 3) | ABANDONED);
+					Atomics.compareExchange(control, 0, (generation << 3) | INTERRUPTED, (generation << 3) | ABANDONED);
+				}
+			}
+			throw new Error("No permission slot available");
+		},
+	};
+}
+
+function validRule(rule) {
+	return rule !== null && typeof rule === "object" &&
+		typeof rule.permission === "string" && typeof rule.pattern === "string" && typeof rule.layer === "string";
+}
+
+export function servePermissionSlot(buffer, index, generation, decide, hooks = {}) {
+	const { control, request, response } = slotViews(buffer, index);
+	const requested = (generation << 3) | REQUESTED;
+	// Own the request bytes before reading them; an abandoned slot may otherwise be rewritten mid-decode.
+	if (Atomics.compareExchange(control, 0, requested, (generation << 3) | WRITING) !== requested) return Promise.resolve();
+	const finish = async (answer) => {
+		try {
+			control[2] = encode(response, answer);
+		} catch {
+			control[2] = encode(response, { action: "error" });
+		}
+		Atomics.compareExchange(control, 0, (generation << 3) | WRITING, (generation << 3) | ANSWERED);
+		Atomics.notify(control, 0);
+	};
+	const evaluate = () => {
+		try {
+			const result = decide(decode(request, control[1]));
+			return result instanceof Promise
+				? result.then(finish, () => finish({ action: "error" }))
+				: finish(result);
+		} catch {
+			return finish({ action: "error" });
+		}
+	};
+	try {
+		const pending = hooks.claimed?.();
+		return pending ? pending.then(evaluate, () => finish({ action: "error" })) : evaluate();
+	} catch { return finish({ action: "error" }); }
+}

package/src/kernels/js/permission-worker-entry.js

@@ -0,0 +1 @@
+import "./interpose.js";

package/src/kernels/js/permission-worker-frames.ts

@@ -0,0 +1,55 @@
+import { MessagePort, type Transferable } from "node:worker_threads";
+
+// Frames a host-observed cell Worker sends to its MessagePort proxy in the cell (permission-runtime.js).
+
+/**
+ * Runs inside a host-process listener, so it must not throw. A raw `parentPort` frame carries no transfer
+ * list; its received MessagePorts are the only values that cannot be re-cloned, so they are transferred
+ * onward as a native Worker would deliver them. A frame that still cannot be forwarded becomes the
+ * cell Worker's `messageerror` event.
+ */
+export function forwardWorkerMessage(port: MessagePort, value: unknown, transfer: Transferable[]): void {
+	const frame = { type: "message", value };
+	try {
+		port.postMessage(frame, transfer);
+	} catch {
+		try {
+			port.postMessage(frame, [...new Set([...transfer, ...receivedPorts(value)])]);
+		} catch (error) {
+			const reason = error instanceof Error ? error : new Error(String(error));
+			const failure = new Error(`Worker message could not be forwarded (${reason.name}): ${reason.message}`);
+			port.postMessage({ type: "messageerror", error: failure });
+		}
+	}
+}
+
+/** Structured clone yields only plain containers, so ports can sit in arrays, objects, Maps and Sets. */
+function receivedPorts(value: unknown): MessagePort[] {
+	const ports: MessagePort[] = [];
+	const seen = new Set<object>();
+	const pending = [value];
+	while (pending.length > 0) {
+		const next = pending.pop();
+		if (next === null || typeof next !== "object" || seen.has(next)) continue;
+		seen.add(next);
+		if (next instanceof MessagePort) ports.push(next);
+		// Push one value at a time: spreading a collection past the engine's argument limit throws RangeError.
+		else if (next instanceof Map) for (const [key, entry] of next) pending.push(key, entry);
+		else if (next instanceof Set || Array.isArray(next)) for (const entry of next) pending.push(entry);
+		else if (Object.getPrototypeOf(next) === Object.prototype)
+			for (const entry of Object.values(next)) pending.push(entry);
+	}
+	return ports;
+}
+
+export function workerErrorFrame(value: unknown) {
+	const error = value instanceof Error ? value : new Error(String(value));
+	return {
+		type: "error",
+		error,
+		message: error.message,
+		filename: "fileName" in error ? error.fileName : "sourceURL" in error ? error.sourceURL : "",
+		lineno: "lineNumber" in error ? error.lineNumber : "line" in error ? error.line : 0,
+		colno: "columnNumber" in error ? error.columnNumber : "column" in error ? error.column : 0,
+	};
+}

package/src/kernels/js/process-tree.js

@@ -10,6 +10,14 @@ const EXIT_POLL_MS = 25;
 // A hung `ps` must not hold a cell's retirement; empty output then means nothing is signalled.
 const PS_LOOKUP_TIMEOUT_MS = 2_000;
 const ZOMBIE_CHECK_INTERVAL_MS = 250;
+let cleanupExecFile = execFile;
+let initializedCleanup = false;
+
+export function initializeProcessCleanup(original) {
+	if (initializedCleanup) throw new Error("Process cleanup already initialized");
+	initializedCleanup = true;
+	cleanupExecFile = original;
+}
 
 export function isProcessAlive(pid) {
 	if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -184,7 +192,7 @@ async function withoutZombies(pids) {
 // `ps -p` exits non-zero when any listed pid is gone but still prints the rest.
 function ps(args, options = {}) {
 	return new Promise((resolve) => {
-		execFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true, ...options }, (_error, output) =>
+		cleanupExecFile("ps", args, { maxBuffer: PS_MAX_BUFFER, windowsHide: true, ...options }, (_error, output) =>
 			resolve(typeof output === "string" ? output : String(output ?? "")),
 		);
 	});

package/src/kernels/js/rewrite-imports.ts

@@ -177,3 +177,47 @@ export function rewriteImports(code: string): string {
 	}
 	return applyEdits(code, edits);
 }
+
+/** Host-side preflight: worker assets stay dependency-free, and direct eval keeps native lexical scope. */
+export function hasDynamicCodeCapability(code: string): boolean {
+	if (!/\b(?:eval|Function|plugin)\b/u.test(code)) return false;
+	const ast = parseProgram(code);
+	if (!ast) return false;
+	let unsupported = false;
+	walkNodes(ast.program, (node) => {
+		if (node.type === "MemberExpression" && !node.value.computed) {
+			const owner = nodeFrom(node.value.object);
+			const member = nodeFrom(node.value.property);
+			const outer = owner && nodeFrom(owner.value.object);
+			const inner = owner && nodeFrom(owner.value.property);
+			if (
+				member?.value.name === "plugin" &&
+				(owner?.value.name === "Bun" || (outer?.value.name === "globalThis" && inner?.value.name === "Bun"))
+			) {
+				unsupported = true;
+			}
+		}
+		if (node.type !== "CallExpression" && node.type !== "NewExpression") return;
+		const callee = nodeFrom(node.value.callee);
+		const object = callee && nodeFrom(callee.value.object);
+		const property = callee && nodeFrom(callee.value.property);
+		const name =
+			callee?.type === "Identifier"
+				? callee.value.name
+				: callee?.type === "MemberExpression" && !callee.value.computed && object?.value.name === "globalThis"
+					? property?.value.name
+					: undefined;
+		if (name !== "eval" && name !== "Function") return;
+		const args = node.value.arguments;
+		if (!Array.isArray(args)) return;
+		for (const argument of args) {
+			const value = nodeFrom(argument);
+			if (value?.type !== "StringLiteral") unsupported = true;
+		}
+		const body = nodeFrom(args.at(-1));
+		if (body?.type === "StringLiteral" && typeof body.value.value === "string") {
+			unsupported ||= hasDynamicCodeCapability(body.value.value);
+		}
+	});
+	return unsupported;
+}

package/src/kernels/js/windows-tree-kill.js

@@ -7,6 +7,14 @@ import { execFile } from "node:child_process";
 
 const LISTING_TIMEOUT_MS = 5_000;
 const LISTING_MAX_BUFFER = 16 * 1024 * 1024;
+let cleanupExecFile = execFile;
+let initializedCleanup = false;
+
+export function initializeWindowsCleanup(original) {
+	if (initializedCleanup) throw new Error("Windows cleanup already initialized");
+	initializedCleanup = true;
+	cleanupExecFile = original;
+}
 
 const ROWS_SCRIPT = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID } | ForEach-Object {
 $created = if ($_.CreationDate) { $_.CreationDate.ToFileTimeUtc() } else { 0 }
@@ -75,7 +83,7 @@ export function windowsTreeKillArgs(rootPid, rows, selfPid = process.pid) {
 
 export function listWindowsRows() {
 	return new Promise((resolve) => {
-		execFile(
+		cleanupExecFile(
 			"powershell.exe",
 			["-NoProfile", "-NonInteractive", "-Command", ROWS_SCRIPT],
 			{ timeout: LISTING_TIMEOUT_MS, maxBuffer: LISTING_MAX_BUFFER, windowsHide: true },
@@ -95,6 +103,6 @@ export async function killWindowsTree(pid, listing = listWindowsRows()) {
 	const args = windowsTreeKillArgs(pid, await listing);
 	if (args.length === 0) return;
 	await new Promise((resolve) => {
-		execFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
+		cleanupExecFile("taskkill", args, { timeout: LISTING_TIMEOUT_MS, windowsHide: true }, () => resolve());
 	});
 }

package/src/kernels/js/worker-core.d.ts

@@ -1,4 +1,5 @@
 import type { HostToKernelMessage, KernelToHostMessage } from "../../bridge/protocol.ts";
+import type { WireAuthority } from "./permission-authority.mjs";
 
 export interface WorkerCoreTransport {
 	send(message: KernelToHostMessage): void;
@@ -9,6 +10,7 @@ export interface WorkerCoreTransport {
 export interface WorkerCoreOptions {
 	cwd: string;
 	parallelPoolWidth: number;
+	runAuthority?<T>(token: WireAuthority | undefined, run: () => T | Promise<T>): Promise<T>;
 }
 
 export interface WorkerCoreHandle {

package/src/kernels/js/worker-core.js

@@ -50,6 +50,7 @@ export function createWorkerCore(transport, options) {
 		getRuntime: () => runtime,
 		emit: (message) => transport.send(message),
 		nestedInvokes,
+		runAuthority: options.runAuthority,
 	});
 
 	function emit(message) {
@@ -72,7 +73,7 @@ export function createWorkerCore(transport, options) {
 		activeCell = cell;
 		rejections.startCell(cell);
 		try {
-			const run = runInCell(cell, () =>
+			const execute = () => runInCell(cell, () =>
 				runtime.run(message.code, message.cellId, {
 					emit: (event) => {
 						if (releasedCellError() === undefined) emit(event);
@@ -80,6 +81,7 @@ export function createWorkerCore(transport, options) {
 					callTool: async (toolName, args) => await callTool(toolName, args),
 				}),
 			);
+			const run = options.runAuthority ? options.runAuthority(message.authority, execute, message.code) : execute();
 			const value = await Promise.race([run, release.promise]);
 			rejections.finishCell(cell);
 			emit({ type: "result", cellId: message.cellId, ok: true, valueRepr: valueRepr(value), durationMs: durationMs(startedAtMs), ...memoryReport() });
@@ -174,6 +176,7 @@ export function createWorkerCore(transport, options) {
 				parallelPoolWidth: options.parallelPoolWidth,
 				localRoots: message.connection.localRoots,
 				artifactsDir: message.connection.artifactsDir,
+				permissionIO: options.permissionIO,
 				kernelGeneration: message.kernelGeneration ?? 1,
 				hostToolNames: message.hostToolNames ?? [],
 				foreignLanguageNames: message.foreignLanguageNames ?? [],
@@ -265,7 +268,7 @@ function cellInterruptedError(reason) {
 
 function bridgeError(error) {
 	if (error instanceof Error) {
-		return { name: error.name, message: error.message, stack: error.stack, ...(typeof error.code === "string" ? { code: error.code } : {}) };
+		return { name: error.name, message: error.message, stack: error.stack, ...(typeof error.code === "string" ? { code: error.code } : {}), ...(error.code === "cell_permission_denied" && error.rule ? { permissionRule: error.rule } : {}) };
 	}
 	return { message: String(error) };
 }

package/src/kernels/js/worker-cwd.js

@@ -2,6 +2,7 @@ import { Buffer } from "node:buffer";
 import { syncBuiltinESMExports } from "node:module";
 import { isAbsolute, resolve, sep } from "node:path";
 import { isMainThread } from "node:worker_threads";
+import { FS_PERMISSION_PATHS } from "./interpose-fs.js";
 
 // A worker thread cannot chdir (process.chdir throws ERR_WORKER_UNSUPPORTED_OPERATION under Node
 // and Bun), so every relative path a cell used resolved against the host process directory: in a
@@ -73,19 +74,22 @@ export function installSessionCwd(cwd, options) {
 	const path = process.getBuiltinModule("node:path");
 	const resolveFromProcess = path.resolve;
 	path.resolve = (...segments) => resolveFromProcess(root, ...segments);
-	patchFs(process.getBuiltinModule("node:fs"), process.getBuiltinModule("node:fs/promises"), at, root);
+	patchFs(process.getBuiltinModule("node:fs"), process.getBuiltinModule("node:fs/promises"), at, root, options?.permissionInterposed);
 	patchChildProcess(process.getBuiltinModule("node:child_process"), at, root);
-	patchBun(globalThis.Bun, at, root);
+	patchBun(globalThis.Bun, at, root, options?.permissionInterposed);
 	syncBuiltinESMExports();
 }
 
-function patchFs(fs, promises, at, root) {
+function patchFs(fs, promises, at, root, permissionInterposed) {
 	const promiseModules = [...new Set([fs.promises, promises])];
 	for (const [name, indexes] of Object.entries(FS_PATH_ARGS)) {
+		if (permissionInterposed && FS_PERMISSION_PATHS.has(name)) continue;
 		replace(fs, name, (fn) => resolvingArgs(fn, indexes, at));
-		replace(fs, `${name}Sync`, (fn) => resolvingArgs(fn, indexes, at));
+		// The early wrapper must see the requested spelling before cwd resolution (#4309).
+		if (!(permissionInterposed && name === "writeFile")) replace(fs, `${name}Sync`, (fn) => resolvingArgs(fn, indexes, at));
 		for (const target of promiseModules) replace(target, name, (fn) => resolvingArgs(fn, indexes, at));
 	}
+	if (permissionInterposed) return;
 	replace(fs.realpath, "native", (fn) => resolvingArgs(fn, [0], at));
 	replace(fs.realpathSync, "native", (fn) => resolvingArgs(fn, [0], at));
 	for (const target of [fs, ...promiseModules]) {
@@ -105,15 +109,17 @@ function patchChildProcess(childProcess, at, root) {
 	for (const name of CHILD_PROCESS_COMMAND_ARGS) replace(childProcess, name, (fn) => withOptionsCwd(fn, () => 1, root));
 }
 
-function patchBun(bun, at, root) {
+function patchBun(bun, at, root, permissionInterposed) {
 	if (bun === null || typeof bun !== "object") return;
-	replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
-	replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
+	if (!permissionInterposed) {
+		replace(bun, "file", (fn) => resolvingArgs(fn, [0], at));
+		replace(bun, "write", (fn) => resolvingArgs(fn, [0], at));
+	}
 	replace(bun, "spawn", (fn) => withBunSpawnCwd(fn, root));
 	replace(bun, "spawnSync", (fn) => withBunSpawnCwd(fn, root, false));
 	if (typeof bun.$?.cwd === "function") bun.$.cwd(root);
 	const glob = bun.Glob?.prototype;
-	if (glob) {
+	if (glob && !permissionInterposed) {
 		for (const name of ["scan", "scanSync"]) {
 			replace(glob, name, (fn) =>
 				function scan(options) {

package/src/kernels/js/worker-entry.js

@@ -1,23 +1 @@
-import { parentPort, workerData } from "node:worker_threads";
-import { createWorkerCore } from "./worker-core.js";
-
-if (!parentPort) throw new Error("JS kernel worker missing parentPort");
-
-const transport = {
-	send(message) {
-		parentPort.postMessage(message);
-	},
-	onMessage(handler) {
-		parentPort.on("message", handler);
-		return () => parentPort.off("message", handler);
-	},
-	close() {
-		parentPort.close();
-		setTimeout(() => process.exit(0), 0);
-	},
-};
-
-createWorkerCore(transport, {
-	cwd: workerData.cwd,
-	parallelPoolWidth: workerData.parallelPoolWidth,
-});
+import "./interpose.js";

package/src/kernels/js/worker-file-helpers.js

@@ -0,0 +1,58 @@
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
+
+export function createFileHelpers(options, emit) {
+	const roots = { ...options.localRoots };
+	if (options.artifactsDir && !roots.local) roots.local = join(options.artifactsDir, "local");
+	const resolvePath = (raw, operation) => {
+		const match = /^([a-z][a-z0-9+.-]*):\/\/(.*)$/iu.exec(raw);
+		if (!match) return isAbsolute(raw) ? normalize(raw) : resolve(options.cwd, raw);
+		const scheme = match[1].toLowerCase();
+		const root = roots[scheme];
+		if (!root) throw new Error(`Protocol paths are not supported by ${operation}(): ${raw}`);
+		let relative;
+		try { relative = decodeURIComponent(match[2].replaceAll("\\", "/")); }
+		catch (error) {
+			if (error instanceof URIError) throw new Error(`Invalid URL encoding in ${scheme}:// path: ${raw}`);
+			throw error;
+		}
+		if (isAbsolute(relative) || relative.split("/").includes("..")) throw new Error(`Path traversal is not allowed in ${scheme}:// URLs: ${raw}`);
+		const rootPath = resolve(root);
+		const path = resolve(rootPath, relative);
+		if (path !== rootPath && !path.startsWith(`${rootPath}${sep}`)) throw new Error(`${scheme}:// path escapes its root`);
+		return path;
+	};
+	return {
+		async read(rawPath, settings) {
+			const path = resolvePath(String(rawPath), "read");
+			const info = await stat(path);
+			if (info.isDirectory()) throw new Error(`Directory paths are not supported by read(): ${path}`);
+			let text = options.permissionIO
+				? await options.permissionIO.read(String(rawPath), path) : await readFile(path, "utf8");
+			const offset = typeof settings.offset === "number" ? settings.offset : 1;
+			const limit = typeof settings.limit === "number" ? settings.limit : undefined;
+			if (offset > 1 || limit !== undefined) {
+				const start = Math.max(0, offset - 1);
+				text = text.split(/\r?\n/u).slice(start, limit === undefined ? undefined : start + limit).join("\n");
+			}
+			emit({ op: "read", path, bytes: info.size, chars: text.length });
+			return text;
+		},
+		async write(rawPath, content) {
+			const path = resolvePath(String(rawPath), "write");
+			const data = await writeData(content);
+			if (options.permissionIO) await options.permissionIO.write(String(rawPath), path, data);
+			else { await mkdir(dirname(path), { recursive: true }); await writeFile(path, data); }
+			emit({ op: "write", path, bytes: typeof data === "string" ? Buffer.byteLength(data) : data.byteLength });
+			return path;
+		},
+	};
+}
+
+async function writeData(value) {
+	if (typeof value === "string" || value instanceof Uint8Array) return value;
+	if (value instanceof Blob) return new Uint8Array(await value.arrayBuffer());
+	if (value instanceof ArrayBuffer) return new Uint8Array(value);
+	if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+	throw new TypeError("write() expects string, Blob, ArrayBuffer, or TypedArray data");
+}

package/src/kernels/js/worker-host.ts

@@ -4,6 +4,7 @@ import type { KernelToHostMessage } from "../../bridge/protocol.ts";
 import { describeExit } from "../shared/kernel-death.ts";
 import type { WorkerLike } from "./inline-worker.ts";
 import type { JavaScriptKernelMode } from "./kernel-contract.ts";
+import type { KernelPermissionHost } from "./permission-host.ts";
 
 declare global {
 	// Inert outside the gate. Bun does not refresh named builtin constructor exports.
@@ -41,10 +42,16 @@ export function spawnNodeWorker(
 	cwd: string,
 	parallelPoolWidth: number,
 	mode: JavaScriptKernelMode = "worker",
+	permissions?: KernelPermissionHost,
 ): WorkerLike {
-	const worker = new Worker(url, { workerData: { cwd, parallelPoolWidth } });
+	const permission = permissions?.bootstrap();
+	const worker = new Worker(url, {
+		workerData: { cwd, parallelPoolWidth, permission },
+		transferList: permission ? [permission.port] : [],
+	});
+	const exited = new Promise<void>((resolve) => worker.once("exit", () => resolve()));
 	globalThis.__senpiCodemodeGateObserveResource?.("workers", worker, "exit");
-	return wrapNodeWorker(worker, mode);
+	return wrapNodeWorker(worker, mode, exited, permissions);
 }
 
 export function waitForReady(worker: WorkerLike, signal: AbortSignal): Promise<void> {
@@ -106,13 +113,21 @@ export function crashedResult(
 	return { type: "result", cellId, ok: false, error: bridgeError(error), durationMs };
 }
 
-function wrapNodeWorker(worker: Worker, mode: JavaScriptKernelMode): WorkerLike {
+function wrapNodeWorker(
+	worker: Worker,
+	mode: JavaScriptKernelMode,
+	exited: Promise<void>,
+	permissions?: KernelPermissionHost,
+): WorkerLike {
 	return {
 		mode,
 		postMessage: (message, transfer) =>
-			worker.postMessage(message, transfer === undefined ? undefined : [...transfer]),
+			worker.postMessage(permissions?.frame(message) ?? message, transfer === undefined ? undefined : [...transfer]),
 		onMessage(handler) {
-			const listener = (message: KernelToHostMessage): void => handler(message);
+			const listener = (message: KernelToHostMessage): void => {
+				permissions?.settle(message);
+				handler(message);
+			};
 			worker.on("message", listener);
 			return () => worker.off("message", listener);
 		},
@@ -133,7 +148,10 @@ function wrapNodeWorker(worker: Worker, mode: JavaScriptKernelMode): WorkerLike
 			};
 		},
 		async terminate() {
-			await worker.terminate();
+			permissions?.revoke();
+			const children = permissions?.terminateChildren();
+			void worker.terminate();
+			await Promise.all([exited, children]);
 		},
 	};
 }

package/src/kernels/js/worker-package-resolve.js

@@ -9,6 +9,14 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 // conditions), so ESM-only packages load and the first root that has the package wins.
 const RESOLVE_PACKAGE = Symbol.for("senpi.kernel.resolvePackage");
 const CONDITIONS = typeof globalThis.Bun === "object" ? ["bun", "node", "import", "default"] : ["node", "import", "default"];
+let resolverIO = { readFileSync, realpathSync };
+let initializedIO = false;
+
+export function initializeResolverIO(io) {
+	if (initializedIO) throw new Error("Resolver IO already initialized");
+	initializedIO = true;
+	resolverIO = { readFileSync: io.readFileSync, realpathSync: io.realpathSync };
+}
 
 function isFile(path) {
 	try {
@@ -93,7 +101,7 @@ function legacyFile(path) {
 function packageEntry(packageDir, subpath, specifier) {
 	let manifest;
 	try {
-		manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8"));
+		manifest = JSON.parse(resolverIO.readFileSync(join(packageDir, "package.json"), "utf8"));
 	} catch {
 		return legacyFile(join(packageDir, subpath === "." ? "index.js" : subpath));
 	}
@@ -139,7 +147,7 @@ export function resolvePackage(specifier, rootUrls) {
 		if (entry === undefined) continue;
 		let real = entry;
 		try {
-			real = realpathSync(entry);
+			real = resolverIO.realpathSync(entry);
 		} catch {
 			// A missing target fails in the import itself, with the runtime's own error.
 		}