feat(eval): call-scoped host-tool policy for kernel-tool invoke (nested host calls run parent-permissioned)

[code-yeongyu]

Summary

kernelTools.invoke({name, kernel_generation, definition_revision, args, call_id}, signal?) (shipped in #1647 / #1728) runs the parent's registered JavaScript function inside the parent worker. Any tool.<host>() call the closure makes during that invocation executes on the parent's host bridge with the parent's full tool surface and permissions. A consumer that grants such a tool to a child session with a narrower tool policy therefore has only two options today: refuse the grant, or accept that nested host calls run with the parent's permissions.

Expected (ideal state)

invoke accepts an optional execution scope for nested host calls made by the closure during that call, e.g. { tools: { allow?: string[], deny?: string[] } } or an opaque scope token the consumer obtained from the child's effective tool policy. While the invocation is active, a nested tool.<name>() outside the scope fails closed with a typed error (kernel_tool_host_denied or similar) on the invoking call's channel, without affecting the parent's own top-level cells. The scope is per call (call-scoped bridge context already exists for the reentrant pump), never persisted, and absent scope keeps today's behavior.

Actual

No scope parameter exists. The consumer (omo's in-process child grant, oh-my-openagent#8226) refuses grants for children with explicit allow/deny narrower than the parent and for curated read-only agents, and documents that nested host calls otherwise run parent-permissioned.

Acceptance criteria

• Typed scope option on invoke, forwarded through the worker protocol to the call-scoped bridge context.
• Nested host call outside the scope: typed error on the invoking call, the closure sees a rejected promise, the parent's queue is unaffected.
• Scope is dropped when the call settles (including interrupt/reset); no persistence in transcripts or records.
• Real-transport tests: allowed nested call succeeds, denied nested call fails closed, interrupt during a scoped nested wait settles once.

Related

• feat(eval): fenced JS kernel tools and reentrant worker pump (S6) #1647 (producer), oh-my-openagent#8226 (consumer that needs this to enforce the child's effective policy instead of refusing the grant).

[code-yeongyu]

Working this now on feat/1731-invoke-scope → PR #1765.

RED first. Three new contracts were written and run before any production code, against a real JS worker:

 × kernel-tool invoke scope > refuses a denied nested host call on the invoking call's channel without touching the bridge
 × kernel-tool invoke scope > hands the closure a rejected promise it can observe, keeping the invoke successful
 × kernel-tool invoke scope > lets an allowed nested host call cross the bridge under the same scope
 × kernel-tool invoke scope > refuses a host tool outside the allow list with reason allow
 × kernel-tool invoke scope > lets deny win over allow when a tool appears in both lists
 ✓ kernel-tool invoke scope > keeps an invoke without scope on today's path
 × kernel-tool invoke scope > drops the scope when the call settles, so the next invoke runs unscoped
 × kernel-tool invoke scope > leaves the parent's own cell, queue and later cells unaffected by a refusal
 × kernel-tool invoke scope on the real worker tool-call path > runs an allowed nested host call and fails the denied one closed on the invoking call
 FAIL  test/kernel-tools-scope.test.js [ Cannot find module '../src/kernels/js/kernel-tools-scope.js' ]

 Test Files  3 failed (3)
      Tests  8 failed | 1 passed (9)

The one passing case is the unscoped path, which must keep behaving exactly as it does today.

GREEN after the implementation: 16/16 on those three files, and the whole packages/senpi-codemode suite at 132 files / 929 tests passed (1 file, 14 tests skipped), root tsc --noEmit clean. The real-worker QA driver prints the acceptance criteria directly:

DENIED={"settled":"rejected","code":"kernel_tool_host_denied","details":{"tool":"write","call_id":"qa-denied","reason":"deny"}}
ALLOWED="nested-body"
PARENT={"ok":true,"valueRepr":"\"parent-done\""}
HOST_TOOL_CALLS=["hold","read"]

Capability marker for consumers: kernelTools.capabilities.invokeScope === true.

[code-yeongyu]

Shipped in #1765 (merged as da9397e7ecf727afa383e9e719c569b8e111484e).

kernelTools.invoke(request, options?) now takes a per-call execution scope — { scope: { tools: { allow?, deny? } } } — forwarded through the worker protocol into the call-scoped bridge context. A nested tool.<name>() outside the scope is refused inside the worker before it reaches the host bridge, with kernel_tool_host_denied carrying { tool, call_id, reason: "allow" | "deny" } on the invoking call's channel; the closure sees a rejected promise and the parent's own cells and queue keep the parent's full tool surface. deny wins over allow, an allow list refuses everything it does not name, a malformed list fails closed, the scope dies with the call (interrupt and reset included) and is never persisted, and an unscoped invoke posts exactly the frame it always did.

Consumers gate on kernelTools.capabilities.invokeScope === true (KERNEL_TOOLS_CAPABILITIES), so oh-my-openagent#8226 can enforce a child's effective policy on a runtime that has this, and keep refusing the grant on one that does not.

All 23 CI checks green on the merge commit; the known test/experimental-remote-runtime.test.ts flake (#1676) did not fire on this run. Coverage: policy unit contracts, live-worker kernel-seam contracts (allow/deny/absent, deny-wins, scope dropped at settle, parent cell + queue unaffected, scoped nested wait settles once on interrupt), a real-worker e2e through the eval tool, and scripts/qa-kernel-tool-scope.ts as the real-surface driver.

One follow-up left deliberately out of scope: ExtensionContext.kernelTools in packages/coding-agent still declares invoke(request, signal?) with no capabilities, so a typed consumer needs a cast until that declaration is widened.