@ai-ecoverse/slicc-kernel 1.103.4 → 1.106.3

package/dist/kernel-worker.js

@@ -58,9 +58,9 @@ var PathMap = class {
   }
   link(path) {
     for (let child = path, parent = parentOf(path); parent !== void 0; ) {
-      const set2 = this.children.get(parent);
-      if (set2?.has(child)) return;
-      if (set2) set2.add(child);
+      const set3 = this.children.get(parent);
+      if (set3?.has(child)) return;
+      if (set3) set3.add(child);
       else this.children.set(parent, /* @__PURE__ */ new Set([child]));
       child = parent;
       parent = parentOf(parent);
@@ -69,9 +69,9 @@ var PathMap = class {
   prune(path) {
     for (let child = path, parent = parentOf(path); parent !== void 0; ) {
       if (this.values.has(child) || this.children.has(child)) return;
-      const set2 = this.children.get(parent);
-      set2?.delete(child);
-      if (set2 && set2.size > 0) return;
+      const set3 = this.children.get(parent);
+      set3?.delete(child);
+      if (set3 && set3.size > 0) return;
       this.children.delete(parent);
       child = parent;
       parent = parentOf(parent);
@@ -208,15 +208,15 @@ var IndexedDbMeta = class {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
     const request2 = store.get(path);
-    let next2;
+    let next3;
     request2.onsuccess = () => {
-      next2 = change(request2.result);
-      if (next2) store.put(next2);
+      next3 = change(request2.result);
+      if (next3) store.put(next3);
       else store.delete(path);
     };
     await settle(transaction, () => void 0);
     this.changed({ paths: [path] });
-    this.cache.set(path, next2 ?? null);
+    this.cache.set(path, next3 ?? null);
   }
   async updateMany(changes) {
     const [transaction, store] = this.transaction("readwrite");
@@ -530,14 +530,14 @@ var Integrity = class {
     if (!this.root.version) return void 0;
     return `${real}\0${await this.root.version(real)}`;
   }
-  async read(path, caller, plain, asked) {
-    return (await this.readKeyed(path, caller, plain, asked)).bytes;
+  async read(path, caller, plain2, asked) {
+    return (await this.readKeyed(path, caller, plain2, asked)).bytes;
   }
-  async readKeyed(path, caller, plain, asked) {
+  async readKeyed(path, caller, plain2, asked) {
     const found = await this.real(path, asked);
-    if (found === void 0) return { bytes: await plain() };
+    if (found === void 0) return { bytes: await plain2() };
     const { real, name: name2 } = found;
-    const read = name2 !== real ? { bytes: await plain(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const read = name2 !== real ? { bytes: await plain2(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
     const { bytes } = read;
     const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
     await this.verify(name2, bytes, caller, EXEC_OPS);
@@ -546,9 +546,9 @@ var Integrity = class {
   get readsChecked() {
     return this.sources.length > 0;
   }
-  async readSource(path, caller, plain) {
+  async readSource(path, caller, plain2) {
     const found = await this.source(path);
-    return found === void 0 ? plain() : this.checked(found, caller, plain);
+    return found === void 0 ? plain2() : this.checked(found, caller, plain2);
   }
   async openSource(path, caller, real) {
     const found = await this.source(path, real);
@@ -558,10 +558,10 @@ var Integrity = class {
     }
     await this.checked(found, caller, () => this.root.readFileBuffer(found.real));
   }
-  async checked(found, caller, plain) {
+  async checked(found, caller, plain2) {
     const { real, name: name2 } = found;
     if (name2 !== real || !this.root.readVersioned) {
-      const bytes2 = await plain();
+      const bytes2 = await plain2();
       await this.verify(name2, bytes2, caller, READ_OPS);
       return bytes2;
     }
@@ -1287,8 +1287,8 @@ var OpfsFs = class {
     this.refuse(found.path);
     const [stored] = found.link ? [found.link] : await this.meta.get([found.path]);
     const current = await this.ownerAt(found.path, stored);
-    const next2 = { uid: change.uid ?? current.uid, gid: change.gid ?? current.gid };
-    const handing = found.handle?.kind === "directory" && !sameOwner(next2, current);
+    const next3 = { uid: change.uid ?? current.uid, gid: change.gid ?? current.gid };
+    const handing = found.handle?.kind === "directory" && !sameOwner(next3, current);
     const heir = change.kind === "adopt" ? void 0 : stored?.heir ?? (handing ? [current.uid, current.gid] : void 0);
     const ctimeMs = Date.now();
     await this.meta.update(found.path, (entry) => {
@@ -1296,7 +1296,7 @@ var OpfsFs = class {
       return {
         ...rest2,
         path: found.path,
-        ...next2,
+        ...next3,
         ...heir ? { heir } : {},
         ...change.mode !== void 0 ? { mode: change.mode & PERM_MASK } : {},
         ctimeMs
@@ -2342,11 +2342,11 @@ async function realDir(fs, dir, budget = { hops: 0 }) {
       at = parentOf4(at);
       continue;
     }
-    const next2 = at === "/" ? `/${part}` : `${at}/${part}`;
-    const link2 = await linkOf(fs, next2);
+    const next3 = at === "/" ? `/${part}` : `${at}/${part}`;
+    const link2 = await linkOf(fs, next3);
     if (link2 === void 0) {
-      if (queue.find((p) => p !== ".") === "..") await mustBeDir(fs, next2);
-      at = next2;
+      if (queue.find((p) => p !== ".") === "..") await mustBeDir(fs, next3);
+      at = next3;
       continue;
     }
     if (budget.hops >= MAX_LINKS3) throw fsError("ELOOP", dir);
@@ -2449,18 +2449,18 @@ async function walk(fs, cred, path, follow2, links) {
       at = parentOf4(at);
       continue;
     }
-    const next2 = joinName(at, part);
-    const perm = await perms.at(next2);
+    const next3 = joinName(at, part);
+    const perm = await perms.at(next3);
     const last = queue.length === 0;
     if (perm?.link !== void 0 && (!last || follow2)) {
-      if (!trustedLink(perm, links)) return { path, perm: void 0, denied: next2, link: true };
-      if (++hops > MAX_LINKS4) return { path: next2, perm: void 0 };
+      if (!trustedLink(perm, links)) return { path, perm: void 0, denied: next3, link: true };
+      if (++hops > MAX_LINKS4) return { path: next3, perm: void 0 };
       queue.unshift(...parts(perm.link));
       if (perm.link.startsWith("/")) at = "/";
       continue;
     }
-    if (last) return { path: next2, perm };
-    at = next2;
+    if (last) return { path: next3, perm };
+    at = next3;
   }
   return { path: at, perm: await perms.at(at) };
 }
@@ -2565,8 +2565,13 @@ function ttyOpenable(g, tty) {
 async function need(g, op, path, want, options = {}, shown = path) {
   const walked = await access(g.fs, g.cred, path, want, linked(g, options));
   if (walked.denied !== void 0) deny(g, op, walked.link ? walked.denied : shown);
+  else if (want & R_OK && g.fs.commandTarget) await readsAs(g, op, walked.path, shown);
   return walked;
 }
+async function readsAs(g, op, path, shown) {
+  const target = await g.fs.commandTarget?.(path);
+  if (target !== void 0) await need(g, op, target, R_OK, { directory: false }, shown);
+}
 function entryIn(dir, path) {
   return joinName(dir.path, path.slice(path.lastIndexOf("/") + 1));
 }
@@ -2725,14 +2730,14 @@ function changeCred(cur, change) {
     throw fsError("EINVAL", "not a change");
   }
   const privileged = cur.euid === 0;
-  const next2 = copyCred(cur);
+  const next3 = copyCred(cur);
   for (const keys of [UIDS, GIDS]) {
     const own = keys.map((key) => cur[key]);
     for (const key of keys) {
       const value = id(change[key]);
       if (value === void 0) continue;
       if (!privileged && !own.includes(value)) throw fsError("EPERM", `${key} ${value}`);
-      next2[key] = value;
+      next3[key] = value;
     }
   }
   if (change.groups !== void 0) {
@@ -2742,9 +2747,9 @@ function changeCred(cur, change) {
     const groups = change.groups.map((g) => id(g) ?? Number.NaN);
     if (groups.some(Number.isNaN)) throw fsError("EINVAL", "not a group list");
     if (!privileged) throw fsError("EPERM", "setgroups");
-    next2.groups = groups;
+    next3.groups = groups;
   }
-  return next2;
+  return next3;
 }
 function maySignal(sender, target) {
   if (sender.euid === 0) return true;
@@ -3657,10 +3662,10 @@ var KernelSocket = class _KernelSocket {
   async accept(signal, nonblock = false) {
     for (; ; ) {
       if (this.state !== "listening") throw new KernelError("EINVAL");
-      const next2 = this.queue.shift();
-      if (next2) {
+      const next3 = this.queue.shift();
+      if (next3) {
         this.room.wake();
-        return next2;
+        return next3;
       }
       if (nonblock) throw new KernelError("EAGAIN");
       await this.changes.wait(signal);
@@ -4179,12 +4184,12 @@ var MessageQueue = class {
   }
   async *[Symbol.asyncIterator]() {
     for (; ; ) {
-      const next2 = this.items.shift();
-      if (next2 !== void 0) {
-        const n = payloadSize(next2);
+      const next3 = this.items.shift();
+      if (next3 !== void 0) {
+        const n = payloadSize(next3);
         this.size -= n;
         this.taken?.(n);
-        yield next2;
+        yield next3;
         continue;
       }
       if (this.ended) return;
@@ -4200,6 +4205,29 @@ var SEND_BUFFER = 1024 * 1024;
 var CLOSE_WAIT_MS = 5e3;
 var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
+function uploadsFor(peer) {
+  const pulls = /* @__PURE__ */ new Map();
+  const of = (nid, signal) => ({
+    async *[Symbol.asyncIterator]() {
+      for (; ; ) {
+        signal.throwIfAborted();
+        const got = await new Promise((resolve2, reject) => {
+          const stop = () => reject(signal.reason);
+          signal.addEventListener("abort", stop, { once: true });
+          pulls.set(nid, (call) => {
+            signal.removeEventListener("abort", stop);
+            resolve2(call);
+          });
+          peer.postMessage({ net: "body-pull", nid });
+        }).finally(() => pulls.delete(nid));
+        if (got.net === "body-end") return;
+        if (got.net === "body-error") throw new Error(got.message);
+        if (got.net === "body-chunk") yield got.bytes;
+      }
+    }
+  });
+  return { of, answer: (call) => pulls.get(call.nid)?.(call) };
+}
 function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const open = /* @__PURE__ */ new Map();
   const fail2 = (nid, e) => {
@@ -4213,6 +4241,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
       ...typeof code === "string" ? { code } : {}
     });
   };
+  const uploads = uploadsFor(peer);
   const start2 = async (call) => {
     const abort = new AbortController();
     const entry = { abort };
@@ -4222,7 +4251,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         url: call.url,
         method: call.method,
         headers: call.headers,
-        ...call.body ? { body: call.body } : {},
+        ...call.streamed ? { bodyStream: uploads.of(call.nid, abort.signal) } : call.body ? { body: call.body } : {},
         signal: abort.signal
       });
       if (!open.has(call.nid)) {
@@ -4294,9 +4323,9 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
     try {
       const messages = socket.messages[Symbol.asyncIterator]();
       for (; ; ) {
-        const next2 = await Promise.race([messages.next(), unanswered]);
-        if (next2 === "late" || next2.done) break;
-        const data = next2.value;
+        const next3 = await Promise.race([messages.next(), unanswered]);
+        if (next3 === "late" || next3.done) break;
+        const data = next3.value;
         if (flow.closing) continue;
         if (payloadSize(data) > MESSAGE_LIMIT) {
           oversize = true;
@@ -4337,12 +4366,12 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
     const body = open.get(nid)?.body;
     if (!body) return;
     try {
-      const next2 = await body.next();
-      if (next2.done) {
+      const next3 = await body.next();
+      if (next3.done) {
         open.delete(nid);
         peer.postMessage({ net: "end", nid });
       } else {
-        const bytes = fresh(next2.value);
+        const bytes = fresh(next3.value);
         peer.postMessage({ net: "chunk", nid, bytes }, [bytes.buffer]);
       }
     } catch (e) {
@@ -4360,7 +4389,9 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   return {
     answer(call) {
       if (call.net === "fetch") void start2(call);
-      else if (call.net === "read") void read(call.nid);
+      else if (call.net === "body-chunk" || call.net === "body-end" || call.net === "body-error") {
+        uploads.answer(call);
+      } else if (call.net === "read") void read(call.nid);
       else if (call.net === "ws-open") void openSocket(call);
       else if (call.net === "ws-send") void sendOn(call);
       else if (call.net === "ws-close") {
@@ -4570,9 +4601,9 @@ var UserDb = class {
     }
   }
   serial(work) {
-    const next2 = this.writing.then(work);
-    this.writing = next2.catch(() => void 0);
-    return next2;
+    const next3 = this.writing.then(work);
+    this.writing = next3.catch(() => void 0);
+    return next3;
   }
   async ensure() {
     await this.fs.mkdir("/etc", { recursive: true });
@@ -4744,14 +4775,14 @@ async function realpath(fs, path) {
   let resolved2 = "";
   for (let hops = 0; parts2.length > 0; ) {
     const [name2, ...rest2] = parts2;
-    const next2 = `${resolved2}/${name2}`;
-    if (!(await fs.lstat(next2)).isSymbolicLink) {
-      resolved2 = next2;
+    const next3 = `${resolved2}/${name2}`;
+    if (!(await fs.lstat(next3)).isSymbolicLink) {
+      resolved2 = next3;
       parts2 = rest2;
       continue;
     }
     if (++hops > MAX_LINKS5) throw fsError("ELOOP", path);
-    const target = await fs.readlink(next2);
+    const target = await fs.readlink(next3);
     const base = target.startsWith("/") ? "/" : resolved2 || "/";
     parts2 = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest2];
     resolved2 = "";
@@ -5344,9 +5375,9 @@ var ClipboardBroker = class {
 // src/clipboard-relay.ts
 function clipboardAsker(port) {
   const asks = /* @__PURE__ */ new Map();
-  let next2 = 0;
+  let next3 = 0;
   const ask = (op, stamp, text) => {
-    const id2 = ++next2;
+    const id2 = ++next3;
     const waiting = Promise.withResolvers();
     asks.set(id2, waiting);
     const timer = setTimeout(() => {
@@ -5374,9 +5405,9 @@ function clipboardAsker(port) {
 // src/integrity-relay.ts
 function integrityAsker(port) {
   const asks = /* @__PURE__ */ new Map();
-  let next2 = 0;
+  let next3 = 0;
   const lookup2 = (path) => {
-    const id2 = ++next2;
+    const id2 = ++next3;
     const waiting = Promise.withResolvers();
     asks.set(id2, waiting);
     port.postMessage({ integrityAsk: { id: id2, path } });
@@ -5440,10 +5471,10 @@ var Incoming = class {
       this.eof = true;
       return false;
     }
-    const next2 = new Uint8Array(this.buf.length + chunk2.length);
-    next2.set(this.buf);
-    next2.set(chunk2, this.buf.length);
-    this.buf = next2;
+    const next3 = new Uint8Array(this.buf.length + chunk2.length);
+    next3.set(this.buf);
+    next3.set(chunk2, this.buf.length);
+    this.buf = next3;
     return true;
   }
   take(n) {
@@ -5583,23 +5614,50 @@ async function readBody(incoming, framing, cap, signal) {
   const chunks = [];
   let total = 0;
   for (; ; ) {
-    const sizeLine = await incoming.line(MAX_CHUNK_LINE, signal);
-    const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(sizeLine);
-    if (!size) throw new HttpError(400, "malformed chunk size");
-    const n = Number.parseInt(size[1], 16);
+    const n = await chunkSize(incoming, signal);
     if (n === 0) break;
     total += n;
     if (total > cap) throw new HttpError(413, `request body over ${cap} bytes`);
     chunks.push(await incoming.exactly(n, signal));
     if (await incoming.line(2, signal) !== "") throw new HttpError(400, "malformed chunk");
   }
+  await skipTrailers(incoming, signal);
+  return concat(chunks, total);
+}
+async function chunkSize(incoming, signal) {
+  const sizeLine = await incoming.line(MAX_CHUNK_LINE, signal);
+  const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(sizeLine);
+  if (!size) throw new HttpError(400, "malformed chunk size");
+  return Number.parseInt(size[1], 16);
+}
+async function skipTrailers(incoming, signal) {
   let trailers = 0;
   for (let line = await incoming.line(MAX_TRAILERS, signal); line !== ""; ) {
     trailers += line.length;
     if (trailers > MAX_TRAILERS) throw new HttpError(431, "trailers too large");
     line = await incoming.line(MAX_TRAILERS, signal);
   }
-  return concat(chunks, total);
+}
+var STREAM_PIECE = 64 * 1024;
+async function* pieces(incoming, n, signal) {
+  for (let left = n; left > 0; ) {
+    const piece = await incoming.some(Math.min(left, STREAM_PIECE), signal);
+    if (piece.length === 0) throw new HttpError(400, "connection closed inside a body");
+    left -= piece.length;
+    yield piece;
+  }
+}
+async function* streamBody(incoming, framing, signal) {
+  if (framing.kind === "none") return;
+  if (framing.kind === "length") {
+    yield* pieces(incoming, framing.length, signal);
+    return;
+  }
+  for (let n = await chunkSize(incoming, signal); n !== 0; n = await chunkSize(incoming, signal)) {
+    yield* pieces(incoming, n, signal);
+    if (await incoming.line(2, signal) !== "") throw new HttpError(400, "malformed chunk");
+  }
+  await skipTrailers(incoming, signal);
 }
 function concat(chunks, total = chunks.reduce((n, c) => n + c.length, 0)) {
   const out = new Uint8Array(total);
@@ -5708,11 +5766,11 @@ function frame(opcode, payload) {
   return out;
 }
 function clientFrame(opcode, payload) {
-  const plain = frame(opcode, payload);
-  const head = plain.length - payload.length;
+  const plain2 = frame(opcode, payload);
+  const head = plain2.length - payload.length;
   const mask = crypto.getRandomValues(new Uint8Array(4));
-  const out = new Uint8Array(plain.length + 4);
-  out.set(plain.subarray(0, head));
+  const out = new Uint8Array(plain2.length + 4);
+  out.set(plain2.subarray(0, head));
   out[1] = out[1] | 128;
   out.set(mask, head);
   for (let i = 0; i < payload.length; i++) {
@@ -6045,6 +6103,11 @@ async function watchHangup(conn, abort, until) {
     }
   }
 }
+var BODILESS_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+async function* drain(body, done4) {
+  yield* body;
+  done4();
+}
 function untilAborted(response, signal) {
   return new Promise((resolve2, reject) => {
     const onAbort = () => {
@@ -6187,7 +6250,8 @@ var RealmProxy = class {
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
     const keep2 = keepsAlive(req);
     const framing = requestFraming(req.headers);
-    const reserve = framing.kind === "length" ? framing.length : framing.kind === "chunked" ? this.cap() : 0;
+    const streaming = this.options.transport.traits.streamingBodies === true && framing.kind !== "none" && !BODILESS_METHODS.has(req.method);
+    const reserve = streaming ? 0 : framing.kind === "length" ? framing.length : framing.kind === "chunked" ? this.cap() : 0;
     if (reserve > this.cap()) throw new HttpError(413, `request body over ${this.cap()} bytes`);
     await this.expectContinue(conn, req, framing.kind !== "none");
     await this.bodies.acquire(reserve, this.stop.signal);
@@ -6195,9 +6259,12 @@ var RealmProxy = class {
     const abort = new AbortController();
     const stopExchange = () => abort.abort();
     this.stop.signal.addEventListener("abort", stopExchange, { once: true });
+    let drained = !streaming;
     try {
       try {
-        const body = await readBody(incoming, framing, this.cap());
+        const body = streaming ? drain(streamBody(incoming, framing, abort.signal), () => {
+          drained = true;
+        }) : await readBody(incoming, framing, this.cap());
         const waiting = new AbortController();
         void watchHangup(ctx.socket, abort, waiting.signal);
         try {
@@ -6208,7 +6275,8 @@ var RealmProxy = class {
       } finally {
         this.bodies.release(reserve);
       }
-      return await this.relay(conn, req.method, req.minor, response, keep2);
+      const kept = await this.relay(conn, req.method, req.minor, response, keep2 && drained);
+      return kept && drained;
     } finally {
       this.stop.signal.removeEventListener("abort", stopExchange);
       abort.abort();
@@ -6228,13 +6296,14 @@ var RealmProxy = class {
     }
   }
   async upstream(req, url, body, signal, owner) {
+    const sent = BODILESS_METHODS.has(req.method) ? void 0 : body;
     try {
       const fetching = this.options.transport.fetch(
         {
           url: toHostLoopback(url),
           method: req.method.toUpperCase(),
           headers: forwardRequestHeaders(req.headers),
-          body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
+          ...sent instanceof Uint8Array ? { body: sent } : sent ? { bodyStream: sent } : {},
           signal
         },
         owner
@@ -7152,12 +7221,17 @@ var RemoteTransport = class {
   waiting = /* @__PURE__ */ new Map();
   nextId = 0;
   sockets = /* @__PURE__ */ new Map();
+  uploads = /* @__PURE__ */ new Map();
   failure;
   constructor(port, traits) {
     this.port = port;
     this.traits = traits;
   }
   receive(reply) {
+    if (reply.net === "body-pull") {
+      void this.pull(reply.nid);
+      return;
+    }
     const socket = this.sockets.get(reply.nid);
     if (socket && this.toSocket(reply, socket)) return;
     const waiter = this.waiting.get(reply.nid);
@@ -7176,8 +7250,35 @@ var RemoteTransport = class {
     } else return false;
     return true;
   }
+  async pull(nid) {
+    const upload = this.uploads.get(nid);
+    if (!upload) {
+      this.port.postMessage({ net: "body-error", nid, message: "the request body is gone" });
+      return;
+    }
+    try {
+      const next3 = await upload.next();
+      if (next3.done) {
+        this.uploads.delete(nid);
+        this.port.postMessage({ net: "body-end", nid });
+      } else this.port.postMessage({ net: "body-chunk", nid, bytes: next3.value });
+    } catch (e) {
+      this.uploads.delete(nid);
+      this.port.postMessage({
+        net: "body-error",
+        nid,
+        message: e instanceof Error ? e.message : String(e)
+      });
+    }
+  }
+  dropUpload(nid) {
+    const upload = this.uploads.get(nid);
+    this.uploads.delete(nid);
+    void upload?.return?.().catch(() => void 0);
+  }
   fail(error) {
     this.failure = error;
+    for (const nid of [...this.uploads.keys()]) this.dropUpload(nid);
     for (const waiter of this.waiting.values()) waiter.reject(error);
     this.waiting.clear();
     for (const socket of this.sockets.values())
@@ -7204,14 +7305,17 @@ var RemoteTransport = class {
     let finished = false;
     const abort = () => {
       finished = true;
+      this.dropUpload(nid);
       this.cancel(nid);
     };
     signal.addEventListener("abort", abort, { once: true });
     const finish = () => {
+      this.dropUpload(nid);
       if (finished) return;
       finished = true;
       signal.removeEventListener("abort", abort);
     };
+    if (request2.bodyStream) this.uploads.set(nid, request2.bodyStream[Symbol.asyncIterator]());
     let head;
     try {
       head = await this.ask({
@@ -7220,7 +7324,7 @@ var RemoteTransport = class {
         url: request2.url,
         method: request2.method,
         headers: request2.headers,
-        ...request2.body ? { body: request2.body } : {}
+        ...request2.bodyStream ? { streamed: true } : request2.body ? { body: request2.body } : {}
       });
     } catch (e) {
       finish();
@@ -7730,6 +7834,164 @@ function closeAll(entry) {
   }
 }
 
+// src/fs/engines.ts
+var NUMBER = /^(0|[1-9]\d*)$/;
+var PART = /^(?:0|[1-9]\d*|[xX*])$/;
+var IDENTIFIER = /^(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)$/;
+function identifiers(pre) {
+  if (pre === void 0) return [];
+  const ids = pre.split(".");
+  return ids.every((id2) => IDENTIFIER.test(id2)) ? ids : void 0;
+}
+function parseVersion(text) {
+  const m = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(text.trim());
+  const pre = identifiers(m?.[4]);
+  if (!m || !pre || ![m[1], m[2], m[3]].every((n) => NUMBER.test(n))) return void 0;
+  return [Number(m[1]), Number(m[2]), Number(m[3]), pre];
+}
+function comparePre(a, b) {
+  if (a.length === 0 || b.length === 0) return b.length - a.length;
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const [x, y] = [a[i], b[i]];
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    if (x === y) continue;
+    const [nx, ny] = [NUMBER.test(x), NUMBER.test(y)];
+    if (nx && ny) return Number(x) - Number(y);
+    if (nx !== ny) return nx ? -1 : 1;
+    return x < y ? -1 : 1;
+  }
+  return 0;
+}
+function compare(a, b) {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2] || comparePre(a[3], b[3]);
+}
+function partial(text) {
+  const m = /^v?([^.+-]+)(?:\.([^.+-]+))?(?:\.([^.+-]+))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(
+    text
+  );
+  if (!m) return void 0;
+  const raw = [m[1], m[2], m[3]];
+  if (!raw.every((p) => p === void 0 || PART.test(p))) return void 0;
+  const parts2 = [];
+  for (const p of raw) {
+    if (p === void 0 || /^[xX*]$/.test(p) || parts2.includes(void 0)) parts2.push(void 0);
+    else parts2.push(Number(p));
+  }
+  const pre = identifiers(m[4]);
+  return pre && { parts: parts2, pre };
+}
+function floor(p) {
+  const [a = 0, b = 0, c = 0] = p.parts;
+  return [a, b, c, p.parts.includes(void 0) ? [] : p.pre];
+}
+function next(p) {
+  const [a, b] = p.parts;
+  if (a === void 0) return void 0;
+  if (b === void 0) return [a + 1, 0, 0, ["0"]];
+  return [a, b + 1, 0, ["0"]];
+}
+var ANY = [[">=", [0, 0, 0, []]]];
+var NOTHING = [["<", [0, 0, 0, ["0"]]]];
+function plain(op, p) {
+  const exact = !p.parts.includes(void 0);
+  const low = floor(p);
+  const high = next(p);
+  if (op === ">=") return [[">=", low]];
+  if (op === "<") return [["<", exact ? low : [low[0], low[1], low[2], ["0"]]]];
+  if (exact) return [[op === "" ? "=" : op, low]];
+  if (op === ">") return high ? [[">=", high]] : NOTHING;
+  if (op === "<=") return high ? [["<", high]] : ANY;
+  return high ? [
+    [">=", low],
+    ["<", high]
+  ] : ANY;
+}
+function caret(p) {
+  const [a = 0, b, c] = p.parts;
+  const low = floor(p);
+  if (b === void 0)
+    return [
+      [">=", low],
+      ["<", [a + 1, 0, 0, ["0"]]]
+    ];
+  if (a > 0)
+    return [
+      [">=", low],
+      ["<", [a + 1, 0, 0, ["0"]]]
+    ];
+  if (c === void 0 || b > 0)
+    return [
+      [">=", low],
+      ["<", [0, b + 1, 0, ["0"]]]
+    ];
+  return [
+    [">=", low],
+    ["<", [0, b, c + 1, ["0"]]]
+  ];
+}
+function tilde(p) {
+  const [a = 0, b] = p.parts;
+  const low = floor(p);
+  return [
+    [">=", low],
+    ["<", b === void 0 ? [a + 1, 0, 0, ["0"]] : [a, b + 1, 0, ["0"]]]
+  ];
+}
+function hyphen(from, to) {
+  const high = to.parts.includes(void 0) ? next(to) : void 0;
+  const upper = to.parts.includes(void 0) ? high ? [["<", high]] : [] : [["<=", floor(to)]];
+  return [[">=", floor(from)], ...upper];
+}
+function comparator(token) {
+  const m = /^(<=|>=|<|>|=|\^|~>?)?\s*(.*)$/.exec(token);
+  const op = m?.[1] ?? "";
+  const p = partial(m?.[2] ?? "");
+  if (!p) return void 0;
+  const wild = p.parts[0] === void 0;
+  if (op === "^") return wild ? ANY : caret(p);
+  if (op.startsWith("~")) return wild ? ANY : tilde(p);
+  return plain(op, p);
+}
+function set2(text) {
+  const trimmed = text.trim().replace(/(<=|>=|<|>|=|\^|~>?)\s+/g, "$1");
+  if (trimmed === "") return ANY;
+  const range = /^(\S+)\s+-\s+(\S+)$/.exec(trimmed);
+  if (range) {
+    const [from, to] = [partial(range[1]), partial(range[2])];
+    return from && to ? hyphen(from, to) : void 0;
+  }
+  const out = [];
+  for (const token of trimmed.split(/\s+/)) {
+    const found = comparator(token);
+    if (!found) return void 0;
+    out.push(...found);
+  }
+  return out;
+}
+function holds(v, [op, w]) {
+  const c = compare(v, w);
+  if (op === "<") return c < 0;
+  if (op === "<=") return c <= 0;
+  if (op === ">") return c > 0;
+  if (op === ">=") return c >= 0;
+  return c === 0;
+}
+function satisfies(version, range) {
+  const v = parseVersion(version);
+  if (!v) return void 0;
+  const sets = range.split("||").map(set2);
+  if (sets.some((s) => s === void 0)) return void 0;
+  return sets.some((s) => s.every((c) => holds(v, c)));
+}
+
+// src/version.ts
+var KERNEL_VERSION = true ? "1.106.3" : "0.0.0-dev";
+var OS_RELEASE = "6.0.0-slicc";
+function procVersion() {
+  return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
+`;
+}
+
 // src/commands.ts
 var NAME2 = /^[A-Za-z0-9._+-]+$/;
 var COMMAND_NAME = /^[^/\s\p{Cc}]+$/u;
@@ -7941,13 +8203,25 @@ async function binCommandsOf(physical, pkg, manifest, taken) {
   }
   return out;
 }
+function engineRefusal(manifest, kernel) {
+  const engines = manifest.engines;
+  const range = engines && typeof engines === "object" ? engines["slicc-kernel"] : void 0;
+  const running = parseVersion(kernel);
+  if (typeof range !== "string" || !running || running.slice(0, 3).every((n) => n === 0)) {
+    return void 0;
+  }
+  const fits = satisfies(kernel, range);
+  if (fits) return void 0;
+  const who = `${String(manifest.name ?? "?")}@${String(manifest.version ?? "?")}`;
+  return fits === false ? `${who} needs slicc-kernel ${range}; this kernel is ${kernel}` : `${who} has an engines.slicc-kernel range this kernel can't read: ${JSON.stringify(range)}`;
+}
 var PACKAGE_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
 function replacesOf(manifest) {
   const replaces = manifest.slicc?.replaces;
   if (!Array.isArray(replaces)) return [];
   return replaces.every((name2) => typeof name2 === "string" && PACKAGE_NAME.test(name2)) ? replaces : [];
 }
-async function tierPackages(fs, physical, roots, bins) {
+async function tierPackages(fs, physical, roots, bins, kernel) {
   const out = [];
   for (const root of roots) {
     for (const pkg of await packages(fs, root)) {
@@ -7960,11 +8234,13 @@ async function tierPackages(fs, physical, roots, bins) {
       const own = commandsOf(pkg, manifest);
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
+      const refused2 = engineRefusal(manifest, kernel);
+      const commands = [...own, ...extra];
       out.push({
         name: pkg.slice(root.length + 1),
         pkg,
         replaces: replacesOf(manifest),
-        commands: [...own, ...extra]
+        commands: refused2 ? commands.map((command) => ({ ...command, refused: refused2 })) : commands
       });
     }
   }
@@ -7990,14 +8266,14 @@ function winners(tier) {
   }
   return out;
 }
-async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY) {
+async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION) {
   const found = /* @__PURE__ */ new Map();
   const physical = physicalResolver(fs);
   const tiers = (typeof modules === "string" ? [modules] : modules).map(
     (tier) => typeof tier === "string" ? [tier] : tier
   );
   for (const [index, roots] of tiers.entries()) {
-    const tier = await tierPackages(fs, physical, roots, index >= binsFrom);
+    const tier = await tierPackages(fs, physical, roots, index >= binsFrom, kernel);
     for (const [name2, { pkg, command }] of winners(tier)) {
       if (!found.has(name2)) found.set(name2, await withPackagePaths(fs, pkg, command));
     }
@@ -8374,6 +8650,7 @@ var S_IFDIR2 = 16384;
 var S_IFREG2 = 32768;
 var COMMAND = /^\/(?:usr\/)?bin\/([^/]+)$/;
 var MAX_LINKS6 = 40;
+var BIN_ENTRY = /\/bin\/[^/]+$/;
 function missing3(err) {
   return err?.code === "ENOENT";
 }
@@ -8401,7 +8678,20 @@ async function followLinks(fs, path) {
   }
   return current;
 }
-function withCommandDirs(fs, names, userDir = async () => void 0, owners = false) {
+var NOBODY = { ruid: -1, euid: -1, suid: -1, rgid: -1, egid: -1, sgid: -1, groups: [] };
+var EMPTY = new Uint8Array(0);
+function quiet(promise) {
+  return promise.catch(() => void 0);
+}
+async function readsAs2(fs, cred, target) {
+  const walked = await quiet(access(fs, cred, target, R_OK, { directory: false }));
+  return walked !== void 0 && walked.denied === void 0 && !walked.missing;
+}
+async function shownTarget(fs, target) {
+  const st = await quiet(fs.stat(target));
+  return st?.isFile && await readsAs2(fs, NOBODY, target) ? st : void 0;
+}
+function withCommandDirs(fs, names, userDir = async () => void 0, owners = false, targetOf2 = async () => void 0) {
   async function nearest(path) {
     const st = await fs.stat(path).catch(() => void 0);
     if (st || path === "/") return st ?? {};
@@ -8433,9 +8723,54 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     const own = await userDir(dir);
     return own?.has(path.slice(slash + 1)) ? owned4(synthetic(false, path), dir) : void 0;
   }
+  let generation;
+  const targets = /* @__PURE__ */ new Map();
+  async function targetStat(target) {
+    const now = await names();
+    if (now !== generation) {
+      generation = now;
+      targets.clear();
+    }
+    let found = targets.get(target);
+    if (!found) {
+      found = shownTarget(fs, target);
+      targets.set(target, found);
+    }
+    return found;
+  }
+  async function shown(path) {
+    const st = await virtual(path);
+    if (!st?.isFile) return st;
+    const target = await targetOf2(path);
+    const real = target === void 0 ? void 0 : await targetStat(target.path);
+    return real ? { ...st, size: real.size, mtime: real.mtime, ctime: real.mtime, atime: real.mtime } : st;
+  }
   async function linked2(path) {
-    return await virtual(path) ?? virtual(await followLinks(fs, path));
+    return await shown(path) ?? shown(await followLinks(fs, path));
+  }
+  async function entryTarget(path) {
+    if (!BIN_ENTRY.test(path) || !(await virtual(path))?.isFile) return void 0;
+    if (!await fs.lstat(path).then(() => false, missing3)) return void 0;
+    const target = await targetOf2(path);
+    return target?.path === path ? void 0 : target;
+  }
+  async function redirected2(path) {
+    const target = await entryTarget(path) ?? await entryTarget(await followLinks(fs, path));
+    if (owners && target?.owner && !await readsAs2(fs, target.owner, target.path)) {
+      throw fsError("EACCES", path);
+    }
+    return target?.path;
+  }
+  const absent2 = (err) => {
+    if (missing3(err)) return EMPTY;
+    throw err;
+  };
+  async function content(path, err) {
+    if (!missing3(err) || !(await linked2(path))?.isFile) throw err;
+    const target = await redirected2(path);
+    return target === void 0 ? EMPTY : fs.readFileBuffer(target).catch(absent2);
   }
+  const ranged2 = rangedOps(fs);
   async function stat(path, real) {
     try {
       return await real(path);
@@ -8447,16 +8782,13 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   }
   return {
     resolvePath: (base, path) => fs.resolvePath(base, path),
-    readFile: (path) => fs.readFile(path),
-    async readFileBuffer(path) {
-      try {
-        return await fs.readFileBuffer(path);
-      } catch (err) {
-        if (missing3(err) && (await linked2(path))?.isFile) return new Uint8Array(0);
-        throw err;
-      }
-    },
-    writeFile: (path, content, owner) => fs.writeFile(path, content, owner),
+    readFile: (path) => fs.readFile(path).catch(async (err) => {
+      if (!BIN_ENTRY.test(await followLinks(fs, path))) throw err;
+      return new TextDecoder().decode(await content(path, err));
+    }),
+    readFileBuffer: (path) => fs.readFileBuffer(path).catch((err) => content(path, err)),
+    commandTarget: async (path) => (await entryTarget(path))?.path,
+    writeFile: (path, content2, owner) => fs.writeFile(path, content2, owner),
     link: (from, to, follow2) => fs.link(from, to, follow2),
     links: (path) => mayLink(fs, path),
     async exists(path) {
@@ -8487,7 +8819,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
         added.map(
           async (name2) => [
             name2,
-            await virtual(`${base}/${name2}`)
+            await shown(`${base}/${name2}`)
           ]
         )
       );
@@ -8505,7 +8837,14 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     chmod: (path, mode) => fs.chmod(path, mode),
     utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime),
     lutimes: (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
-    ...rangedOps(fs) ?? {}
+    ...ranged2 ? {
+      ...ranged2,
+      pread: (path, offset, length2, version) => ranged2.pread(path, offset, length2, version).catch(async (err) => {
+        const target = missing3(err) ? await redirected2(path) : void 0;
+        if (target === void 0) throw err;
+        return ranged2.pread(target, offset, length2).catch(absent2);
+      })
+    } : {}
   };
 }
 
@@ -8650,7 +8989,7 @@ var MAX_HOPS2 = 40;
 function start(path) {
   return { done: [], todo: path.split("/").filter((p) => p !== ""), hops: 0 };
 }
-function next(walk2) {
+function next2(walk2) {
   while (walk2.todo.length > 0) {
     const part = walk2.todo.shift();
     if (part === ".") continue;
@@ -8664,7 +9003,7 @@ function next(walk2) {
 }
 function lexical(path) {
   const walk2 = start(path);
-  for (let part = next(walk2); part !== void 0; part = next(walk2)) walk2.done.push(part);
+  for (let part = next2(walk2); part !== void 0; part = next2(walk2)) walk2.done.push(part);
   return `/${walk2.done.join("/")}`;
 }
 function rest(walk2, part) {
@@ -8678,7 +9017,7 @@ function follow(walk2, target) {
 }
 async function physicalPathAsync(fs, path) {
   const walk2 = start(path);
-  for (let part = next(walk2); part !== void 0; part = next(walk2)) {
+  for (let part = next2(walk2); part !== void 0; part = next2(walk2)) {
     const at = `/${[...walk2.done, part].join("/")}`;
     let target;
     try {
@@ -8751,9 +9090,9 @@ var UnlinkedKeeper = class {
     void locks?.request(lockName(this.instance), () => new Promise(() => void 0));
   }
   serial(op) {
-    const next2 = this.queue.then(op);
-    this.queue = next2.catch(() => void 0);
-    return next2;
+    const next3 = this.queue.then(op);
+    this.queue = next3.catch(() => void 0);
+    return next3;
   }
   wrap(fs = this.fs) {
     const keeper = this;
@@ -9198,7 +9537,8 @@ var ChildTable = class {
     const child = this.children.get(pid);
     if (!child) return;
     this.watchers.set(pid, listener);
-    if (child.stoppedBy !== void 0) listener("stopped", child.stoppedBy);
+    if (child.stoppedBy !== void 0 && child.code === void 0)
+      listener("stopped", child.stoppedBy);
   }
   openSlot(slot2, n, captured) {
     if ("fd" in slot2) return this.parentFds.get(slot2.fd).retain();
@@ -9496,14 +9836,14 @@ var HeldSet = class extends Set {
     super();
     this.idle = idle;
   }
-  add(holds) {
-    holds.onIdle = this.idle;
-    return super.add(holds);
+  add(holds2) {
+    holds2.onIdle = this.idle;
+    return super.add(holds2);
   }
-  delete(holds) {
-    const removed = super.delete(holds);
-    for (const path of /* @__PURE__ */ new Set([...holds.keys(), ...holds.opens.keys()])) this.idle(path);
-    holds.releaseAll();
+  delete(holds2) {
+    const removed = super.delete(holds2);
+    for (const path of /* @__PURE__ */ new Set([...holds2.keys(), ...holds2.opens.keys()])) this.idle(path);
+    holds2.releaseAll();
     return removed;
   }
 };
@@ -10690,9 +11030,9 @@ var MountFs = class _MountFs {
     this.writable(mount, real);
     const { uid, gid, mode } = change;
     const fresh2 = change.kind === "new" && { uid, gid, mode };
-    const set2 = fresh2 ? await this.driverOwner(found, real, fresh2, false) : change;
+    const set3 = fresh2 ? await this.driverOwner(found, real, fresh2, false) : change;
     this.table.forget(mount, real);
-    const attrs = Object.entries({ uid: set2.uid, gid: set2.gid, mode: set2.mode });
+    const attrs = Object.entries({ uid: set3.uid, gid: set3.gid, mode: set3.mode });
     await mount.conn.call({
       op: "setattr",
       path: rel2,
@@ -10719,11 +11059,11 @@ var MountFs = class _MountFs {
     const real = await this.follow(path);
     const found = this.at(real);
     if (!found) {
-      const set2 = () => this.base.utimes(real, atime, mtime);
+      const set3 = () => this.base.utimes(real, atime, mtime);
       return this.based(
         [real],
         redirects,
-        set2,
+        set3,
         ([to], n) => this.utimes(to, atime, mtime, n)
       );
     }
@@ -10732,11 +11072,11 @@ var MountFs = class _MountFs {
   async lutimes(path, atime, mtime, redirects = 0) {
     const found = this.at(path);
     if (!found) {
-      const set2 = () => lutimesOf(this.base, path, atime, mtime);
+      const set3 = () => lutimesOf(this.base, path, atime, mtime);
       return this.based(
         [path],
         redirects,
-        set2,
+        set3,
         ([to], n) => this.lutimes(to, atime, mtime, n)
       );
     }
@@ -10758,6 +11098,20 @@ var MountFs = class _MountFs {
   }
 };
 
+// src/fs/command-stat.ts
+async function callerStat(g, path, st) {
+  if (!g?.fs.commandTarget || !st.isFile || st.size > 0) return st;
+  const target = await g.fs.commandTarget(path);
+  if (target === void 0) return st;
+  const options = { directory: false, ...g.links === void 0 ? {} : { links: g.links } };
+  const walked = await access(g.fs, g.cred, target, R_OK, options).catch(() => void 0);
+  if (!walked || walked.denied !== void 0 || walked.missing) return st;
+  const real = await g.fs.stat(target).catch(() => void 0);
+  if (!real?.isFile) return st;
+  const { size, mtime } = real;
+  return { ...st, size, mtime, atime: mtime, ctime: mtime };
+}
+
 // src/realm/sync-fs-token-registry.ts
 var registry = /* @__PURE__ */ new Map();
 function mintSyncFsToken(entry) {
@@ -10844,8 +11198,10 @@ function statJson(s) {
     ...s.gid !== void 0 ? { gid: s.gid } : {}
   };
 }
-async function readdirStat(fs, dir) {
-  return (await fs.readdirStat(dir)).map(([name2, stat]) => [name2, stat && statJson(stat)]);
+async function readdirStat(fs, dir, g) {
+  const listed = await fs.readdirStat(dir);
+  const shown = async (name2, stat) => stat && statJson(await callerStat(g, joinName(dir, name2), stat));
+  return Promise.all(listed.map(async ([name2, stat]) => [name2, await shown(name2, stat)]));
 }
 async function usageAt(entry, path) {
   if (!entry.statfs) return void 0;
@@ -10914,18 +11270,22 @@ async function chown(entry, path, req) {
 }
 async function runMkdir(entry, path, req) {
   const { fs } = entry;
-  const plain = plainDirMode(entry, req.mode);
+  const plain2 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh2 = plain !== void 0 && !await fs.exists(path);
+  const fresh2 = plain2 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh2) await fs.chmod(path, plain);
+  if (fresh2) await fs.chmod(path, plain2);
   return done;
 }
+async function shownAs(entry, path, st) {
+  const real = st.isFile && st.size === 0 ? entry.fs.realpath?.(path, true) : void 0;
+  return callerStat(guardOf(entry), await real?.catch(() => path) ?? path, st);
+}
 function readSource(entry, path) {
-  const plain = () => entry.fs.readFileBuffer(path);
-  return entry.source ? entry.source.read(path, plain) : plain();
+  const plain2 = () => entry.fs.readFileBuffer(path);
+  return entry.source ? entry.source.read(path, plain2) : plain2();
 }
 async function run(entry, path, req) {
   const { fs, cwd } = entry;
@@ -10938,13 +11298,13 @@ async function run(entry, path, req) {
     case "exists":
       return json2(await fs.exists(path));
     case "stat":
-      return json2(statJson(await fs.stat(path)));
+      return json2(statJson(await shownAs(entry, path, await fs.stat(path))));
     case "lstat":
-      return json2(statJson(await fs.lstat(path)));
+      return json2(statJson(await shownAs(entry, path, await fs.lstat(path))));
     case "readdir":
       return json2(await fs.readdir(path));
     case "readdir-stat":
-      return json2(await readdirStat(fs, path));
+      return json2(await readdirStat(fs, path, guardOf(entry)));
     case "mkdir":
       return runMkdir(entry, path, req);
     case "rm":
@@ -11866,18 +12226,18 @@ var KernelDgram = class {
       const pending = this.takeError();
       if (pending) throw new KernelError(pending);
       if (this.closed) throw new KernelError("EBADF");
-      const next2 = this.queue[0];
-      if (next2) {
+      const next3 = this.queue[0];
+      if (next3) {
         if (!peek) {
           this.queue.shift();
-          this.queued -= next2.bytes.length;
+          this.queued -= next3.bytes.length;
           this.changes.wake();
         }
         const size = Math.max(0, max);
         return {
-          bytes: next2.bytes.slice(0, size),
-          from: next2.from,
-          truncated: next2.bytes.length > size
+          bytes: next3.bytes.slice(0, size),
+          from: next3.from,
+          truncated: next3.bytes.length > size
         };
       }
       await this.changes.wait(signal);
@@ -12196,14 +12556,6 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 // src/realm/live-vfs-fs.ts
 var EARLY_WHOLE_FILE = 64 * 1024;
 
-// src/version.ts
-var KERNEL_VERSION = true ? "1.103.4" : "0.0.0-dev";
-var OS_RELEASE = "6.0.0-slicc";
-function procVersion() {
-  return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
-`;
-}
-
 // src/process/process-fds.ts
 var field2 = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
 var pinnedRoot;
@@ -12595,7 +12947,7 @@ function* procWalk(path, follow2) {
     const whole = normalize(`/${[...done4, part, ...todo].join("/")}`);
     if (inProc(at) && inProc(whole)) return broken ?? whole;
     if (!follow2 && todo.length === 0) return void 0;
-    const target = yield { at, check: todo.find((next2) => next2 !== ".") === ".." };
+    const target = yield { at, check: todo.find((next3) => next3 !== ".") === ".." };
     if (typeof target === "string") {
       if (++hops > MAX_HOPS3) return void 0;
       [done4, todo] = throughLink(target, done4, todo);
@@ -12731,18 +13083,18 @@ function timerAfter(ms, fire) {
   return timerAt(performance.now() + ms, fire);
 }
 function repeating(first, every, fire) {
-  let next2 = performance.now() + first;
+  let next3 = performance.now() + first;
   let cancel = () => {
   };
   const tick = () => {
     fire();
     if (every <= 0) return;
-    next2 += every;
+    next3 += every;
     const now = performance.now();
-    if (next2 <= now) next2 += (Math.floor((now - next2) / every) + 1) * every;
-    cancel = timerAt(next2, tick);
+    if (next3 <= now) next3 += (Math.floor((now - next3) / every) + 1) * every;
+    cancel = timerAt(next3, tick);
   };
-  cancel = timerAt(next2, tick);
+  cancel = timerAt(next3, tick);
   return () => cancel();
 }
 
@@ -13033,11 +13385,11 @@ var LockTable = class {
   }
   changed(key, signal) {
     return new Promise((resolve2, reject) => {
-      const set2 = this.wakers.get(key) ?? /* @__PURE__ */ new Set();
-      this.wakers.set(key, set2);
+      const set3 = this.wakers.get(key) ?? /* @__PURE__ */ new Set();
+      this.wakers.set(key, set3);
       const done4 = () => {
-        set2.delete(wake);
-        if (set2.size === 0 && this.wakers.get(key) === set2) this.wakers.delete(key);
+        set3.delete(wake);
+        if (set3.size === 0 && this.wakers.get(key) === set3) this.wakers.delete(key);
         signal.removeEventListener("abort", abort);
       };
       const wake = () => {
@@ -13048,7 +13400,7 @@ var LockTable = class {
         done4();
         reject(new KernelError("EINTR"));
       };
-      set2.add(wake);
+      set3.add(wake);
       signal.addEventListener("abort", abort, { once: true });
     });
   }
@@ -13349,9 +13701,10 @@ var MAX_UNREAD = 16 * 1024 * 1024;
 function errno(code, message3) {
   return Object.assign(new Error(`${code}: ${message3}`), { code });
 }
-function requestHead(method, url, headers, extra) {
+function requestHead(method, url, headers, extra, first = []) {
   if (!TOKEN3.test(method)) throw errno("EINVAL", `method ${method}`);
-  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `Host: ${url.host}`];
+  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
+  for (const [name2, value] of first) lines2.push(`${name2}: ${value}`);
   for (const [name2, value] of headers) {
     if (OWN_HEADERS.has(name2.toLowerCase())) continue;
     if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value)) throw errno("EINVAL", `header ${name2}`);
@@ -13466,8 +13819,8 @@ var KernelLoopback = class {
   async fetch(req, port) {
     const url = new URL(req.url);
     const body = req.body ?? (/^(POST|PUT|PATCH)$/i.test(req.method) ? new Uint8Array(0) : void 0);
-    const length2 = body ? [["Content-Length", String(body.length)]] : [];
-    const head = requestHead(req.method, url, req.headers, [...length2, ["Connection", "close"]]);
+    const length2 = body ? [["content-length", String(body.length)]] : [];
+    const head = requestHead(req.method, url, req.headers, length2, [["connection", "close"]]);
     const socket = await this.connect(url, port, req.signal);
     try {
       await writeAll2(socket, body ? concat([head, body]) : head, req.signal);
@@ -13560,7 +13913,7 @@ var LoopbackWebSocket = class {
     const queue = [];
     let wake;
     let ended = false;
-    void this.pump(new WsReader(incoming, void 0, true, true), (message3) => {
+    void this.pump(incoming, (message3) => {
       queue.push(message3);
       this.unread += message3.length;
       wake?.();
@@ -13577,10 +13930,10 @@ var LoopbackWebSocket = class {
     this.messages = {
       [Symbol.asyncIterator]: async function* () {
         for (; ; ) {
-          const next2 = queue.shift();
-          if (next2 !== void 0) {
-            taken(next2);
-            yield next2;
+          const next3 = queue.shift();
+          if (next3 !== void 0) {
+            taken(next3);
+            yield next3;
             continue;
           }
           if (ended) return;
@@ -13615,7 +13968,8 @@ var LoopbackWebSocket = class {
       this.pending -= bytes.length;
     })();
   }
-  async pump(reader, deliver) {
+  async pump(incoming, deliver) {
+    const reader = new WsReader(incoming, void 0, true, true);
     let close = { code: 1006, reason: "", wasClean: false };
     try {
       for (; ; ) {
@@ -13637,11 +13991,18 @@ var LoopbackWebSocket = class {
     } finally {
       const late = setTimeout(() => this.stop.abort(), CLOSE_WAIT_MS3);
       await this.writes;
+      if (close.wasClean) await this.serverEnd(incoming);
       clearTimeout(late);
       this.socket.close();
       this.settle(close);
     }
   }
+  async serverEnd(incoming) {
+    try {
+      while ((await incoming.some(64 * 1024, this.stop.signal)).length > 0) ;
+    } catch {
+    }
+  }
   sendClose(code, reason) {
     if (this.sentClose) return;
     this.sentClose = true;
@@ -13690,9 +14051,9 @@ var WsHandles = class {
   open = /* @__PURE__ */ new Map();
   next;
   local;
-  constructor(transport, next2, local) {
+  constructor(transport, next3, local) {
     this.transport = transport;
-    this.next = next2;
+    this.next = next3;
     this.local = local;
   }
   owns(handle) {
@@ -13754,9 +14115,9 @@ var WsHandles = class {
   }
   async recv(socket, entry) {
     try {
-      const next2 = await entry.messages.next();
-      if (!next2.done) {
-        return typeof next2.value === "string" ? { ok: true, kind: "json", json: { text: next2.value } } : { ok: true, kind: "bytes", bytes: next2.value };
+      const next3 = await entry.messages.next();
+      if (!next3.done) {
+        return typeof next3.value === "string" ? { ok: true, kind: "json", json: { text: next3.value } } : { ok: true, kind: "bytes", bytes: next3.value };
       }
       const closed = await socket.closed;
       return {
@@ -13804,11 +14165,49 @@ var HTTP_OPS = [
   "net-open",
   "net-head",
   "net-read",
+  "net-write",
+  "net-end",
   "net-close",
   "net-traits",
   ...WS_OPS
 ];
-var EMPTY = new Uint8Array(0);
+var Upload = class {
+  queue = [];
+  ended = false;
+  wake;
+  write(bytes) {
+    if (this.ended) return Promise.resolve(false);
+    return new Promise((taken) => {
+      this.queue.push({ bytes, taken });
+      this.wake?.();
+    });
+  }
+  end() {
+    this.ended = true;
+    this.wake?.();
+  }
+  cancel() {
+    this.ended = true;
+    for (const { taken } of this.queue.splice(0)) taken(false);
+    this.wake?.();
+  }
+  async *[Symbol.asyncIterator]() {
+    for (; ; ) {
+      const next3 = this.queue.shift();
+      if (next3) {
+        next3.taken(true);
+        yield next3.bytes;
+        continue;
+      }
+      if (this.ended) return;
+      await new Promise((resolve2) => {
+        this.wake = resolve2;
+      });
+      this.wake = void 0;
+    }
+  }
+};
+var EMPTY2 = new Uint8Array(0);
 function message2(e) {
   return e instanceof Error ? e.message : String(e);
 }
@@ -13838,6 +14237,8 @@ var HttpHandles = class {
     if (req.op === "net-open") return Promise.resolve(this.opened(req));
     if (req.op === "net-head") return this.head(req.handle);
     if (req.op === "net-read") return this.read(req.handle, req.max);
+    if (req.op === "net-write") return this.write(req.handle, req.bytes);
+    if (req.op === "net-end") return Promise.resolve(this.end(req.handle));
     if (req.op === "net-traits") return Promise.resolve(this.traits(req.url));
     return this.close(req.handle);
   }
@@ -13856,19 +14257,37 @@ var HttpHandles = class {
     return result;
   }
   opened(req) {
+    if (req.stream && (this.local?.port(req.url) !== void 0 || !this.transport.traits.streamingBodies)) {
+      return { ok: false, errno: "ENOTSUP", message: "this transport takes whole request bodies" };
+    }
     return { ok: true, kind: "json", json: this.start(req).handle };
   }
+  async write(handle, bytes) {
+    const upload = this.open.get(handle)?.upload;
+    if (!upload) return { ok: false, errno: "EBADF", message: `no upload ${handle}` };
+    if (!await upload.write(bytes)) {
+      return { ok: false, errno: "EPIPE", message: "the request no longer takes a body" };
+    }
+    return { ok: true, kind: "void" };
+  }
+  end(handle) {
+    const upload = this.open.get(handle)?.upload;
+    if (!upload) return { ok: false, errno: "EBADF", message: `no upload ${handle}` };
+    upload.end();
+    return { ok: true, kind: "void" };
+  }
   start(req) {
     const handle = ++this.nextHandle;
     const abort = new AbortController();
     const entry = {
       abort,
       head: Promise.resolve({ ok: true, kind: "void" }),
-      body: once(EMPTY),
-      left: EMPTY,
+      body: once(EMPTY2),
+      left: EMPTY2,
       done: false,
       reading: Promise.resolve(),
-      cancel: async () => void 0
+      cancel: async () => void 0,
+      ...req.stream ? { upload: new Upload() } : {}
     };
     this.open.set(handle, entry);
     entry.head = this.respond(handle, req, entry);
@@ -13882,7 +14301,7 @@ var HttpHandles = class {
         url: target,
         method: req.method,
         headers: req.headers,
-        ...req.body ? { body: req.body } : {},
+        ...entry.upload ? { bodyStream: entry.upload } : req.body ? { body: req.body } : {},
         signal: entry.abort.signal
       };
       const response = port === void 0 ? await this.transport.fetch(request2, this.owner) : await this.local.fetch(request2, port);
@@ -13893,6 +14312,7 @@ var HttpHandles = class {
       const head = this.headOf(handle, shown, response);
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
+      entry.upload?.cancel();
       const text = message2(e);
       if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
       const status = e.status;
@@ -13929,9 +14349,9 @@ var HttpHandles = class {
   async take(entry, max) {
     if (entry.left.length === 0 && !entry.done) {
       try {
-        const next2 = await entry.body.next();
-        if (next2.done) entry.done = true;
-        else entry.left = next2.value;
+        const next3 = await entry.body.next();
+        if (next3.done) entry.done = true;
+        else entry.left = next3.value;
       } catch (e) {
         entry.done = true;
         const timedOut = e?.code === "ETIMEDOUT";
@@ -13950,6 +14370,7 @@ var HttpHandles = class {
     const entry = this.open.get(handle);
     if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
     this.open.delete(handle);
+    entry.upload?.cancel();
     entry.abort.abort();
     await entry.cancel().catch(() => void 0);
     return { ok: true, kind: "void" };
@@ -14304,12 +14725,12 @@ var KernelTty = class {
     const chunks = [];
     let n = 0;
     while (this.readable.length > 0 && n < max) {
-      const next2 = this.readable[0];
-      if (next2 === null || next2 === void 0) break;
-      const take = next2.subarray(0, max - n);
+      const next3 = this.readable[0];
+      if (next3 === null || next3 === void 0) break;
+      const take = next3.subarray(0, max - n);
       chunks.push(take);
       n += take.length;
-      if (take.length < next2.length) this.readable[0] = next2.subarray(take.length);
+      if (take.length < next3.length) this.readable[0] = next3.subarray(take.length);
       else this.readable.shift();
       if (this.canonical) break;
     }
@@ -14406,11 +14827,11 @@ var PtyPair = class {
     const chunks = [];
     let n = 0;
     while (this.queue.length > 0 && n < max - status) {
-      const next2 = this.queue[0];
-      const take = next2.subarray(0, max - status - n);
+      const next3 = this.queue[0];
+      const take = next3.subarray(0, max - status - n);
       chunks.push(take);
       n += take.length;
-      if (take.length < next2.length) this.queue[0] = next2.subarray(take.length);
+      if (take.length < next3.length) this.queue[0] = next3.subarray(take.length);
       else this.queue.shift();
     }
     const out = new Uint8Array(status + n);
@@ -14730,8 +15151,8 @@ var Semaphore = class {
     this.mode = mode;
   }
   post() {
-    const next2 = this.waiters.shift();
-    if (next2) next2.grant();
+    const next3 = this.waiters.shift();
+    if (next3) next3.grant();
     else if (this.value >= SEM_VALUE_MAX) throw new KernelError("EOVERFLOW");
     else this.value++;
   }
@@ -15159,9 +15580,9 @@ var VfsNode = class {
     if (dirty && contents2 !== void 0) this.markDirty();
   }
   serial(op) {
-    const next2 = this.queue.then(op);
-    this.queue = next2.catch(() => void 0);
-    return next2;
+    const next3 = this.queue.then(op);
+    this.queue = next3.catch(() => void 0);
+    return next3;
   }
   revoke() {
     this.revoked = true;
@@ -15583,9 +16004,9 @@ var VfsNodes = class {
     }
     for (const [p] of moved2) this.byPath.delete(p);
     for (const [p, node] of moved2) {
-      const next2 = to + p.slice(from.length);
-      if (node.path === p) node.renamedTo(next2);
-      this.byPath.set(next2, node);
+      const next3 = to + p.slice(from.length);
+      if (node.path === p) node.renamedTo(next3);
+      this.byPath.set(next3, node);
     }
   }
 };
@@ -15960,6 +16381,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "tty-pgrp-get",
   "tty-pgrp-set",
   "sig-mask",
+  "sig-waiting",
   "sig-pause",
   ...SOCKET_OPS,
   ...EPOLL_OPS,
@@ -16073,16 +16495,8 @@ var WasmProcess = class {
     if (sig === SIG.STOP) return this.stop(sig);
     const bit = sigbit(sig);
     if (this.ignores(bit)) return "ignore";
-    if (((this.options.blockedBits?.() ?? 0) & bit) !== 0) {
-      const tid = this.options.unblockedThread?.(sig);
-      if (tid === void 0) {
-        this.options.onPending?.(sig);
-        return "deliver";
-      }
-      if (this.caught & bit) {
-        this.options.threadKill?.(tid, sig);
-        return "deliver";
-      }
+    if (((this.options.blockedBits?.() ?? 0) & bit) !== 0 && this.routeBlocked(sig, bit)) {
+      return "deliver";
     }
     if (!(this.caught & bit)) {
       const action = defaultAction(sig);
@@ -16099,6 +16513,17 @@ var WasmProcess = class {
     blocked2.abort();
     return "deliver";
   }
+  routeBlocked(sig, bit) {
+    const waiter = this.waiterFor(bit);
+    const tid = waiter ?? this.options.unblockedThread?.(sig);
+    if (tid === void 0 || tid === 1) {
+      this.options.onPending?.(sig);
+      return true;
+    }
+    if (waiter === void 0 && !(this.caught & bit)) return false;
+    this.options.threadKill?.(tid, sig);
+    return true;
+  }
   async spawn(req) {
     const { file, argv, argv0, env, cwd, chdir, stdio, inherit: inherit2, exec, pgid, session, deathSignal } = req;
     if (deathSignal !== void 0 && (exec || !isSignal(deathSignal))) {
@@ -16179,6 +16604,16 @@ var WasmProcess = class {
   }
   blocks = /* @__PURE__ */ new WeakMap();
   sizesRead = /* @__PURE__ */ new WeakMap();
+  sigwaiters = /* @__PURE__ */ new Map();
+  setSigwaiter(tid, set3) {
+    if (set3 === 0) this.sigwaiters.delete(tid);
+    else this.sigwaiters.set(tid, set3);
+  }
+  waiterFor(bit) {
+    if (((this.sigwaiters.get(1) ?? 0) & bit) !== 0) return 1;
+    for (const [tid, set3] of this.sigwaiters) if (set3 & bit) return tid;
+    return void 0;
+  }
   async syscall(req, cancelled, block) {
     this.options.onSyscall?.(req);
     const started = performance.now();
@@ -16435,18 +16870,18 @@ var WasmProcess = class {
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open = { ...req, path };
-      const plain = this.plainMode(req.mode);
+      const plain2 = this.plainMode(req.mode);
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner(req.mode));
-        if (plain !== void 0) await fs.chmod?.(path, plain);
+        if (plain2 !== void 0) await fs.chmod?.(path, plain2);
         this.fds.installAt(fd, this.openVfsFile(open, void 0, fs));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const marks = this.options.owners || plain !== void 0;
+          const marks = this.options.owners || plain2 !== void 0;
           const fresh2 = marks && !await present2(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2 && plain !== void 0) await fs.chmod?.(path, plain);
+          if (fresh2 && plain2 !== void 0) await fs.chmod?.(path, plain2);
           else if (fresh2) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
@@ -17087,6 +17522,9 @@ var WasmProcess = class {
       case "dl-unlock":
         this.unlockDl(req.owner);
         return { ok: true, kind: "void" };
+      case "sig-waiting":
+        this.setSigwaiter(req.tid, req.set);
+        return { ok: true, kind: "void" };
       case "sig-mask":
         this.caught = req.caught;
         this.ignored = req.ignored;
@@ -17154,8 +17592,8 @@ var WasmProcess = class {
   };
   withDl(state) {
     if (this.dlLog.length === 0) return state;
-    const { next: next2, handle, free, live } = this.closures;
-    const dl = { log: [...this.dlLog], next: next2, handle, free: [...free], live: [...live] };
+    const { next: next3, handle, free, live } = this.closures;
+    const dl = { log: [...this.dlLog], next: next3, handle, free: [...free], live: [...live] };
     return { ...state, dl };
   }
   seedDl(dl) {
@@ -17166,8 +17604,8 @@ var WasmProcess = class {
     this.closures.free.push(...dl.free);
     for (const index of dl.live) this.closures.live.add(index);
   }
-  allocateClosure(floor) {
-    const index = this.closures.free.pop() ?? Math.max(floor, this.closures.next);
+  allocateClosure(floor2) {
+    const index = this.closures.free.pop() ?? Math.max(floor2, this.closures.next);
     this.closures.next = Math.max(this.closures.next, index + 1);
     this.closures.live.add(index);
     this.dlLog.push({ kind: "closure", index });
@@ -17219,8 +17657,8 @@ var WasmProcess = class {
   wakeDl() {
     for (const waiter of [...this.dlLock.waiters]) waiter.wake(false);
   }
-  reserveSlots(floor, size) {
-    const base = Math.max(floor, this.closures.next);
+  reserveSlots(floor2, size) {
+    const base = Math.max(floor2, this.closures.next);
     this.closures.next = base + size;
     return base;
   }
@@ -17277,6 +17715,7 @@ var WASM_MAX_THREADS = 256;
 // src/kernel/host.ts
 var CRASHED = 70;
 var KILL_GRACE_MS = 2e3;
+var KILL_HARD_MS = 5e3;
 var descIds = /* @__PURE__ */ new WeakMap();
 var nextDescId = 1;
 function descId(file) {
@@ -17303,16 +17742,21 @@ function inheritedFds(fds) {
 var Dying = class {
   ending;
   timer;
+  hard;
   busy = 0;
   finish;
   start(code, sig, header3, process, finish) {
     if (this.ending) return;
     this.ending = { code, sig };
     this.finish = finish;
+    this.hard = setTimeout(finish, KILL_HARD_MS);
     this.arm();
     Atomics.store(header3, SAB_I_KILLED, code);
     process.die();
   }
+  serve(req, work) {
+    return this.ending && isWasmSyscall(req) ? work() : this.serving(work);
+  }
   async serving(work) {
     this.busy++;
     clearTimeout(this.timer);
@@ -17329,6 +17773,7 @@ var Dying = class {
   }
   clear() {
     clearTimeout(this.timer);
+    clearTimeout(this.hard);
   }
   status(reported2) {
     if (this.ending) return [this.ending.code, this.ending.sig];
@@ -17340,8 +17785,8 @@ function killThread(thread, caught, sig) {
   const held = (Atomics.load(thread.header, SAB_I_BLOCKED) & sigbit(sig)) !== 0;
   if (!held && (caught & sigbit(sig)) === 0) return false;
   Atomics.or(thread.header, SAB_I_SIGNALS, sigbit(sig));
-  if (held) return true;
   Atomics.notify(thread.header, SAB_I_SIGNALS);
+  if (held) return true;
   const blocked2 = thread.interrupt;
   thread.interrupt = new AbortController();
   blocked2.abort();
@@ -17437,7 +17882,7 @@ function inherited(opts) {
     ...opts.cred ? { cred: opts.cred } : {}
   };
 }
-function holdingToken(opts, holds, caller) {
+function holdingToken(opts, holds2, caller) {
   return mintSyncFsToken({
     ...opts.owners ? caller : { umask: caller.umask },
     ...opts.dac ? { dac: opts.dac, pid: opts.pid, created: caller.created } : {},
@@ -17448,13 +17893,13 @@ function holdingToken(opts, holds, caller) {
     noLinks: opts.noLinks,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
-    hold: (path, on, open, real, handle) => holds.hold(path, on, open, real, handle),
-    keptFor: (handle) => holds.keptFor(handle),
-    unlinked: (path) => holds.keptAt(path),
-    gate: (path, op) => opts.unlinkGate && holds.holding(path) ? opts.unlinkGate.run(holds.keyOf(path), op) : op(),
-    own: (path, op) => holds.own(path, op),
-    revoked: (path) => holds.isRevoked(path),
-    renamed: (from, to) => holds.renamed(from, to)
+    hold: (path, on, open, real, handle) => holds2.hold(path, on, open, real, handle),
+    keptFor: (handle) => holds2.keptFor(handle),
+    unlinked: (path) => holds2.keptAt(path),
+    gate: (path, op) => opts.unlinkGate && holds2.holding(path) ? opts.unlinkGate.run(holds2.keyOf(path), op) : op(),
+    own: (path, op) => holds2.own(path, op),
+    revoked: (path) => holds2.isRevoked(path),
+    renamed: (from, to) => holds2.renamed(from, to)
   });
 }
 function linksOf(opts) {
@@ -17528,6 +17973,9 @@ function threadInit(opts, program, sab, cred, thread, main) {
     signals: main
   };
 }
+function settleExit(exit, settle3, code) {
+  void exit.catch(() => void 0).then(() => settle3(code & 255));
+}
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
@@ -17554,19 +18002,20 @@ function spawnWasmProcess(opts) {
     )
   );
   publishStops(process, header3);
-  const holds = new HeldPaths();
-  opts.held?.add(holds);
-  const token = holdingToken(opts, holds, {
+  const holds2 = new HeldPaths();
+  opts.held?.add(holds2);
+  const token = holdingToken(opts, holds2, {
     cred: () => process.cred,
     umask: () => process.umask,
     created: created3,
-    holdsKept: async (path) => path.includes(`/${UNLINKED_DIR}/`) && (holds.keeps(path) || await process.holds(path))
+    holdsKept: async (path) => path.includes(`/${UNLINKED_DIR}/`) && (holds2.keeps(path) || await process.holds(path))
   });
-  process.keptPath = (path) => holds.keptAt(path)?.hidden;
-  process.keptHandle = (handle2) => holds.keptFor(handle2)?.hidden;
+  process.keptPath = (path) => holds2.keptAt(path)?.hidden;
+  process.keptHandle = (handle2) => holds2.keptFor(handle2)?.hidden;
   const worker = opts.createWorker();
   const dying = new Dying();
-  const dispatch2 = (req, block) => dying.serving(
+  const dispatch2 = (req, block) => dying.serve(
+    req,
     () => isWasmSyscall(req) ? process.syscall(req, void 0, block) : dispatchSyncFs(req)
   );
   const clocks = new ProcessClocks(sab, opts.program.abi !== "js", process);
@@ -17589,12 +18038,9 @@ function spawnWasmProcess(opts) {
     responder.dispose();
     lane?.dispose();
     revokeSyncFsToken(token);
-    opts.held?.delete(holds);
+    opts.held?.delete(holds2);
     worker.terminate();
-    void process.exit().then(
-      () => settle3(code),
-      () => settle3(code)
-    );
+    settleExit(process.exit(), settle3, code);
   };
   const exitNow = (code) => {
     queueMicrotask(() => finish(...dying.status(code)));
@@ -17638,7 +18084,7 @@ function spawnWasmProcess(opts) {
     const tsignals = threadSignalsOf(tsab);
     if (thread.blocked) storeBlocked(tsignals.header, thread.blocked);
     threadSignals.set(thread.tid, tsignals);
-    const tdispatch = (req, block) => dying.serving(() => threadCall(process, req, threadCancel(tsignals), block));
+    const tdispatch = (req, block) => dying.serve(req, () => threadCall(process, req, threadCancel(tsignals), block));
     const tresponder = attachSyncSabResponder(tw, tsab, token, {
       dispatch: clocks.timed(clocks.thread(thread.tid, tsab), tdispatch)
     });
@@ -18108,10 +18554,10 @@ var Automaton = class {
     let node = 0;
     for (const byte of bytes) {
       const key = node * 256 + byte;
-      let next2 = this.edges.get(key);
-      if (next2 === void 0) {
-        next2 = this.depth.length;
-        this.edges.set(key, next2);
+      let next3 = this.edges.get(key);
+      if (next3 === void 0) {
+        next3 = this.depth.length;
+        this.edges.set(key, next3);
         this.fail.push(0);
         this.depth.push(this.depth[node] + 1);
         this.children.push(0);
@@ -18119,7 +18565,7 @@ var Automaton = class {
         this.out.push([]);
         this.dict.push(-1);
       }
-      node = next2;
+      node = next3;
     }
     const id2 = this.lengths.length;
     this.lengths.push(bytes.length);
@@ -18155,8 +18601,8 @@ var Automaton = class {
   step(state, byte) {
     let current = state;
     for (; ; ) {
-      const next2 = this.edges.get(current * 256 + byte);
-      if (next2 !== void 0) return next2;
+      const next3 = this.edges.get(current * 256 + byte);
+      if (next3 !== void 0) return next3;
       if (current === 0) return 0;
       current = this.fail[current];
     }
@@ -18184,7 +18630,7 @@ var RANK = {
 };
 var CR2 = 13;
 var LF2 = 10;
-var EMPTY2 = new Uint8Array(0);
+var EMPTY3 = new Uint8Array(0);
 function register(automaton, sources, ids, bytes, source) {
   const key = Array.from(bytes).join(",");
   let id2 = ids.get(key);
@@ -18310,7 +18756,7 @@ function pass(c, input, final) {
   const partials = [];
   scanMain(c, input, best, partials);
   scanWrapped(c, input, best, partials);
-  const holds = final ? [] : [...new Set(partials)].sort((a, b) => a - b);
+  const holds2 = final ? [] : [...new Set(partials)].sort((a, b) => a - b);
   const starts = [...best.keys()].sort((a, b) => a - b);
   const parts2 = [];
   const hits = /* @__PURE__ */ new Map();
@@ -18320,16 +18766,16 @@ function pass(c, input, final) {
   let h = 0;
   for (; ; ) {
     while (s < starts.length && starts[s] < pos) s++;
-    while (h < holds.length && holds[h] < pos) h++;
-    const hold = h < holds.length ? holds[h] : Infinity;
-    const next2 = s < starts.length ? starts[s] : Infinity;
-    if (hold <= next2) {
+    while (h < holds2.length && holds2[h] < pos) h++;
+    const hold = h < holds2.length ? holds2[h] : Infinity;
+    const next3 = s < starts.length ? starts[s] : Infinity;
+    if (hold <= next3) {
       cut = Math.min(hold, input.length);
       break;
     }
-    const candidate = best.get(next2);
+    const candidate = best.get(next3);
     parts2.push(
-      input.subarray(pos, next2),
+      input.subarray(pos, next3),
       c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
     );
     count(c, hits, candidate);
@@ -18364,12 +18810,12 @@ function compile(secrets, options = {}) {
       return { text: decoder4.decode(bytes), hits };
     },
     stream() {
-      let pending = EMPTY2;
+      let pending = EMPTY3;
       const hits = /* @__PURE__ */ new Map();
       const run2 = (final) => {
         if (c.secrets.length === 0 || pending.length === 0) {
           const out = pending;
-          pending = EMPTY2;
+          pending = EMPTY3;
           return out;
         }
         const result = pass(c, pending, final);
@@ -18383,7 +18829,7 @@ function compile(secrets, options = {}) {
           return run2(false);
         },
         idle() {
-          return pending.length < FRAGMENT ? run2(true) : EMPTY2;
+          return pending.length < FRAGMENT ? run2(true) : EMPTY3;
         },
         end() {
           return run2(true);
@@ -18425,7 +18871,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   let timer;
   let failed3;
   const waiters = /* @__PURE__ */ new Set();
-  const quiet = () => !busy && pending === 0;
+  const quiet2 = () => !busy && pending === 0;
   const wake = () => {
     for (const waiter of [...waiters]) waiter();
   };
@@ -18442,7 +18888,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
       if (failed3 === void 0) failed3 = err;
     }).finally(() => {
       pending -= 1;
-      if (quiet()) wake();
+      if (quiet2()) wake();
     });
   };
   const settling = (signal) => new Promise((resolve2, reject) => {
@@ -18460,7 +18906,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
     signal?.addEventListener("abort", stop, { once: true });
   });
   const settled = async () => {
-    while (!quiet()) await settling();
+    while (!quiet2()) await settling();
   };
   const changed = async (signal) => {
     const round = new AbortController();
@@ -18476,7 +18922,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   };
   const turn = async (signal) => {
     for (let waited = false; ; waited = true) {
-      if (quiet() && (pollFile(file).writable || !file.changed)) {
+      if (quiet2() && (pollFile(file).writable || !file.changed)) {
         busy = true;
         return;
       }
@@ -18505,7 +18951,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
     ...bound(file, "stat"),
     poll: () => {
       const state = pollFile(file);
-      return quiet() ? state : { ...state, writable: false };
+      return quiet2() ? state : { ...state, writable: false };
     },
     changed,
     ...file.tty ? { tty: file.tty } : {},
@@ -18521,7 +18967,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
           await send(stream.push(taken), signal);
         } finally {
           busy = false;
-          if (quiet()) wake();
+          if (quiet2()) wake();
         }
         timer = setTimeout(release, idleMs);
         return taken.length;
@@ -18622,15 +19068,15 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function serialized(reply) {
-  let plain;
+  let plain2;
   try {
     const text = JSON.stringify(reply);
-    plain = text === void 0 ? void 0 : JSON.parse(text);
+    plain2 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
     return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
-  if (!isRecord(plain)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
-  const { v: _, ...rest2 } = plain;
+  if (!isRecord(plain2)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
+  const { v: _, ...rest2 } = plain2;
   return JSON.stringify({ v: 1, ...rest2 });
 }
 function lineOf2(err) {
@@ -19649,22 +20095,22 @@ function keepWatching(loop, signal) {
     const stop = () => session2.abort();
     signal.addEventListener("abort", stop);
     let timer;
-    const quiet = () => {
+    const quiet2 = () => {
       clearTimeout(timer);
       timer = setTimeout(stop, silenceMs);
     };
     let opened2 = false;
     try {
       const client = await loop.connect();
-      quiet();
+      quiet2();
       await client.watch(
         session2.signal,
         (event) => {
-          quiet();
+          quiet2();
           if (!event.ping) loop.event(event);
         },
         () => {
-          quiet();
+          quiet2();
           opened2 = true;
           up = true;
           loop.up(client);
@@ -20106,9 +20552,9 @@ function tmpfs() {
     let node = root;
     for (const name2 of parts2(path)) {
       if (node.kind !== "directory") throw fsError2("ENOTDIR", path);
-      const next2 = node.children.get(name2);
-      if (!next2) throw fsError2("ENOENT", path);
-      node = next2;
+      const next3 = node.children.get(name2);
+      if (!next3) throw fsError2("ENOENT", path);
+      node = next3;
     }
     return node;
   }
@@ -20414,6 +20860,28 @@ function foreignImports(bytes) {
   return {};
 }
 
+// src/refused-command.ts
+var REFUSED_PATH = "/usr/lib/slicc/refused";
+var REFUSED_SOURCE = [
+  "export default async function refused(ctx) {",
+  "  await ctx.write(2, ctx.argv[1] + '\\n').catch(() => undefined);",
+  "  return 126;",
+  "}"
+].join("\n");
+function refusing(command) {
+  if (!command.refused) return command;
+  return {
+    name: command.name,
+    abi: "js",
+    glue: REFUSED_PATH,
+    wasm: REFUSED_PATH,
+    argv0: command.name,
+    args: [`${command.name}: ${command.refused}`],
+    refused: command.refused,
+    shows: command.script ?? command.wasm
+  };
+}
+
 // src/sudo.ts
 var SUDOERS = "/etc/sudoers";
 var SUDOERS_D = "/etc/sudoers.d";
@@ -20441,13 +20909,13 @@ function splitWords(text) {
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
-    const [, single, double, escaped, plain, space] = m;
+    const [, single, double, escaped, plain2, space] = m;
     if (space !== void 0) {
       if (word !== void 0) words2.push(word);
       word = void 0;
       continue;
     }
-    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain));
+    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain2));
   }
   if (word !== void 0) words2.push(word);
   return words2;
@@ -20479,7 +20947,7 @@ function parseRule(line) {
   if (!cmnd?.[0]?.startsWith("/")) return void 0;
   return { ...rule, cmnd };
 }
-function flags(parsed2, arg, next2) {
+function flags(parsed2, arg, next3) {
   for (let j = 1; j < arg.length; j++) {
     const flag = arg[j];
     if (flag === "n") parsed2.nonInteractive = true;
@@ -20487,7 +20955,7 @@ function flags(parsed2, arg, next2) {
     else if (flag !== "u") return `sudo: invalid option -- '${flag}'
 ${USAGE}`;
     else {
-      const user = arg.slice(j + 1) || next2;
+      const user = arg.slice(j + 1) || next3;
       if (!user) return `sudo: option requires an argument -- 'u'
 ${USAGE}`;
       parsed2.user = user;
@@ -20937,9 +21405,9 @@ function appendedRoots(given) {
   return [...roots];
 }
 function plainEnv(words2) {
-  const next2 = words2[1];
-  if (baseName2(words2[0] ?? "") !== "env" || next2 === void 0) return false;
-  return next2 === "-S" || !next2.startsWith("-") && !next2.includes("=");
+  const next3 = words2[1];
+  if (baseName2(words2[0] ?? "") !== "env" || next3 === void 0) return false;
+  return next3 === "-S" || !next3.startsWith("-") && !next3.includes("=");
 }
 function shebangCommand(words2) {
   if (!plainEnv(words2)) {
@@ -20963,9 +21431,9 @@ function expandDefaults(defaults, env) {
   for (const [key, value] of Object.entries(defaults ?? {})) {
     let missing4 = false;
     const expanded = value.replace(ENV_REFERENCE, (_, name2) => {
-      const set2 = Object.hasOwn(env, name2) ? env[name2] : void 0;
-      if (set2 === void 0) missing4 = true;
-      return set2 ?? "";
+      const set3 = Object.hasOwn(env, name2) ? env[name2] : void 0;
+      if (set3 === void 0) missing4 = true;
+      return set3 ?? "";
     });
     if (!missing4) out[key] = expanded;
   }
@@ -21190,7 +21658,7 @@ var Launcher = class {
     const holders = [this.held, this.openFiles];
     this.unlinked = new UnlinkedKeeper(
       fs,
-      { [Symbol.iterator]: () => holders.flatMap((set2) => [...set2]).values() },
+      { [Symbol.iterator]: () => holders.flatMap((set3) => [...set3]).values() },
       (path) => this.mountRoot(path),
       {
         locks: webLocks(),
@@ -21275,11 +21743,21 @@ var Launcher = class {
       found = this.trustedAppended().then(async (appended2) => {
         const tiers = await this.tiers(scope, appended2);
         return scanCommands(this.scanned, tiers, tiers.length - appended2.length);
-      }).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
+      }).then((commands) => this.refusals(commands).set(SUDO_COMMAND.name, SUDO_COMMAND));
       this.catalogs.set(scope, found);
     }
     return found;
   }
+  refusals(commands) {
+    for (const [name2, command] of commands) {
+      if (!command.refused) continue;
+      commands.set(name2, refusing(command));
+      if (this.warned.has(command.refused)) continue;
+      this.warned.add(command.refused);
+      console.warn(`slicc-kernel: refusing the commands of ${command.refused}`);
+    }
+    return commands;
+  }
   ownCommands(scope) {
     let found = this.ownCatalogs.get(scope);
     if (!found) {
@@ -21354,7 +21832,8 @@ var Launcher = class {
         );
         return {
           byUid: new Map(users.map((account, i) => [account.uid, homes[i]])),
-          byBin: new Map(homes.map((home) => [`${home}/bin`, home]))
+          byBin: new Map(homes.map((home) => [`${home}/bin`, home])),
+          owners: new Map(homes.map((home, i) => [home, credOf(users[i])]))
         };
       },
       () => ({ byUid: /* @__PURE__ */ new Map(), byBin: /* @__PURE__ */ new Map() })
@@ -21696,12 +22175,12 @@ var Launcher = class {
     return `${path}:${st.size}:${st.mtime.getTime()}`;
   }
   verified(path, caller, fs = this.base) {
-    const plain = () => fs.readFileBuffer(path);
-    return this.integrity ? this.integrity.read(path, caller, plain) : plain();
+    const plain2 = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain2) : plain2();
   }
   keyed(path, caller, asked) {
-    const plain = async () => this.base.readFileBuffer(path);
-    return this.integrity ? this.integrity.readKeyed(path, caller, plain, asked) : plain().then((bytes) => ({ bytes }));
+    const plain2 = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain2, asked) : plain2().then((bytes) => ({ bytes }));
   }
   cached(cache, key, load) {
     const hit = cache.get(key);
@@ -21772,6 +22251,9 @@ var Launcher = class {
     if (target.abi === "js" && target.wasm === SUDO_PATH) {
       return { abi: "js", glue: SUDO_SOURCE, path: SUDO_PATH };
     }
+    if (target.abi === "js" && target.wasm === REFUSED_PATH) {
+      return { abi: "js", glue: REFUSED_SOURCE, path: REFUSED_PATH };
+    }
     const { asked } = target;
     if (target.abi === "js") {
       return { abi: "js", glue: await this.text(target.wasm, caller, asked), path: target.wasm };
@@ -21841,7 +22323,7 @@ var Launcher = class {
     });
     return {
       source: {
-        read: (path, plain) => integrity.readSource(path, caller(), plain),
+        read: (path, plain2) => integrity.readSource(path, caller(), plain2),
         open: (path, real) => integrity.openSource(path, caller(), real)
       }
     };
@@ -22280,9 +22762,9 @@ var Launcher = class {
     const members = this.jobs.list();
     let image = pid;
     for (; ; ) {
-      const next2 = members.find((m) => m.execParent === image);
-      if (!next2) return image;
-      image = next2.pid;
+      const next3 = members.find((m) => m.execParent === image);
+      if (!next3) return image;
+      image = next3.pid;
     }
   }
   credOf(pid) {
@@ -22569,7 +23051,7 @@ var Launcher = class {
     this.pnpmStale();
     if (!detach) return;
     for (const nodes of this.openFiles) nodes.revoke(at);
-    for (const holds of this.held) holds.revoke(at);
+    for (const holds2 of this.held) holds2.revoke(at);
   }
   unmountAll() {
     this.booting.abort();
@@ -22715,7 +23197,7 @@ var Launcher = class {
     this.openFiles.add(nodes);
     const unlinked = new UnlinkedKeeper(
       fs,
-      { [Symbol.iterator]: () => [this.held, this.openFiles].flatMap((set2) => [...set2]).values() },
+      { [Symbol.iterator]: () => [this.held, this.openFiles].flatMap((set3) => [...set3]).values() },
       (path) => this.mountRoot(path),
       {
         locks: webLocks(),
@@ -22743,11 +23225,32 @@ var Launcher = class {
   commandFs(root) {
     return withCommandDirs(
       root,
-      async () => new Set((await this.commands()).keys()),
+      async () => this.commandNames(await this.commands()),
       (dir) => this.userCommandDir(dir),
-      this.owners
+      this.owners,
+      (path) => this.entryTarget(path)
     );
   }
+  named = /* @__PURE__ */ new WeakMap();
+  commandNames(commands) {
+    let names = this.named.get(commands);
+    if (!names) {
+      names = new Set(commands.keys());
+      this.named.set(commands, names);
+    }
+    return names;
+  }
+  async entryTarget(path) {
+    const system = COMMAND2.exec(path)?.[1];
+    const slash = path.lastIndexOf("/");
+    const scopes = await this.userScopes();
+    const scope = system === void 0 ? scopes.byBin.get(path.slice(0, slash)) : "";
+    const name2 = system ?? path.slice(slash + 1);
+    const command = scope === void 0 ? void 0 : (await this.commands(scope)).get(name2);
+    const owner = scope ? scopes.owners?.get(scope) : void 0;
+    const target = command && (command.shows ?? command.script ?? command.wasm);
+    return target === void 0 ? void 0 : { path: target, ...owner ? { owner } : {} };
+  }
   processChain(fs, nodes, unlinked) {
     nodes.changed = (path) => this.changes.publish(path);
     nodes.dirtied = (delta) => this.changes.dirtied(delta);
@@ -22862,9 +23365,9 @@ var Launcher = class {
 // src/sealed-relay.ts
 function sealedAsker(port) {
   const asks = /* @__PURE__ */ new Map();
-  let next2 = 0;
+  let next3 = 0;
   const hook = (req, { signal }) => {
-    const id2 = ++next2;
+    const id2 = ++next3;
     const waiting = Promise.withResolvers();
     asks.set(id2, waiting);
     const abort = () => {