feat(kernel): dispatch host requests as capabilities

[sethkarten]

Summary

• replace advisory host request handler registration with factory-minted capabilities and opaque dispatcher contexts
• revoke in-flight authority on comm close, settlement, cleanup, disposal, and restart paths
• migrate kernel host registrations and focused fixtures to explicit context-aware handlers

Validation

• biome check on all changed paths
• tsgo --noEmit
• explicit kernel/host-request Vitest suite (167 passed, 7 skipped)

Note

Dispatch host requests as revocable, provenance-checked capabilities in KernelManager

• Introduces HostRequestContext — a dispatcher-minted, revocable authority object passed alongside the payload to every host request handler. Only contexts created by KernelManager are accepted; fabricated or copied objects are rejected via a WeakSet provenance check.
• Adds createHostRequestHandler factory that requires an explicit contextAwareHostRequestHandler marker; unary or unmarked handler registrations are rejected at registration time.
• KernelManager now tracks active host-request controllers, closes admission on shutdown/dispose, and aborts in-flight requests before teardown. Stale or revoked requests are silently dropped rather than sending replies.
• Adds enterTerminal / shutdownInternal split so disposal and kill mark terminal state immediately while restart can reopen host-request admission without forcing terminal.
• All existing host handler factories (mcp, agent-messages, agent-observe, rlm-runtime, agent-session) are updated to use the new createHostRequestHandler wrapper.
• Risk: host request handlers now receive a second context argument and must be registered with the contextAwareHostRequestHandler marker; any unregistered or legacy unary handler will throw at call time.

^{Macroscope summarized d56f609.}

---

Note

High Risk
Touches kernel security boundaries (handler registration, context forgery, lifecycle revocation) across many host entry points; incorrect migration or admission logic could break Python skills or admit stale work after shutdown.

Overview
Host requests from the IPython kernel are no longer plain (payload) => … callbacks. Handlers must be registered through createHostRequestHandler with the explicit contextAwareHostRequestHandler marker; dispatch proves handler provenance and passes a dispatcher-minted HostRequestContext (identity in a WeakSet, not structural checks on the payload).

KernelManager tracks per-comm **AbortController**s, a hostRequestsClosed gate, and a one-way terminal state. Authority is revoked on comm close, handler settlement, cleanup, and shutdown/dispose/kill; restart uses non-terminal shutdownInternal and can reopen admission. Revoked or superseded requests skip stale comm replies.

Session registrations (agent messages, observe, goals, compact/refine, RLM, MCP, model.info, etc.) and tests are migrated to the factory; test helpers route through the real dispatcher or createTestHostHandlers. Startup/dispose edge cases and terminal snapshot flush are covered by added tests.

^{Reviewed by Cursor Bugbot for commit d56f609. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3c3b0d2. Configure here.}