@ai-ecoverse/slicc-kernel 1.108.5 → 1.110.0

package/dist/kernel-worker.js

@@ -2645,14 +2645,14 @@ var WsReader = class {
   }
 };
 function switchingHead(accept2, protocol = "") {
-  const chosen = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+  const chosen2 = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
 ` : "";
   return latin1Bytes(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
 Connection: Upgrade\r
 Sec-WebSocket-Accept: ${accept2}\r
-${chosen}\r
+${chosen2}\r
 `
   );
 }
@@ -6108,7 +6108,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.108.5" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.110.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -6156,6 +6156,37 @@ function argsOf(pkg, raw) {
   if (!raw.every((arg) => typeof arg === "string")) return void 0;
   return raw.map((arg) => arg.replace(PACKAGE, pkg));
 }
+var warnedVariants = /* @__PURE__ */ new Set();
+function variantOf(pkg, raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const { env, wasm } = raw;
+  const path = inside(pkg, wasm);
+  if (!path || !env || typeof env !== "object" || Array.isArray(env)) return void 0;
+  const pairs = Object.entries(env);
+  if (pairs.length === 0) return void 0;
+  if (!pairs.every(([key, value2]) => ENV_KEY.test(key) && typeof value2 === "string")) {
+    return void 0;
+  }
+  return { env: Object.fromEntries(pairs), wasm: path };
+}
+function variantsOf(pkg, name2, raw) {
+  if (raw === void 0) return void 0;
+  const variants = Array.isArray(raw) ? raw.map((one) => variantOf(pkg, one)) : [void 0];
+  if (variants.every((one) => one !== void 0)) {
+    return variants.length > 0 ? variants : void 0;
+  }
+  const key = `${pkg}:${name2}:${JSON.stringify(raw)}`;
+  if (!warnedVariants.has(key)) {
+    warnedVariants.add(key);
+    console.warn(`slicc-kernel: ${pkg}: ${name2}: ignoring malformed "variants", running its wasm`);
+  }
+  return void 0;
+}
+function variantFor(variants, env) {
+  return variants?.find(
+    (one) => Object.entries(one.env).every(([key, value2]) => env[key] === value2)
+  )?.wasm;
+}
 function abiOf(raw, fallback) {
   const abi = raw ?? fallback;
   return abi === "emscripten" || abi === "wasi" || abi === "js" ? abi : void 0;
@@ -6189,6 +6220,7 @@ function commandOf(pkg, name2, raw, packageAbi, shared) {
   const glue = abi === "wasi" ? wasm : inside(pkg, raw.glue);
   if (!abi || !glue || !wasm) return void 0;
   const imports = abi === "wasi" ? inside(pkg, raw.imports) : void 0;
+  const variants = variantsOf(pkg, name2, raw.variants);
   return {
     name: name2,
     abi,
@@ -6200,7 +6232,8 @@ function commandOf(pkg, name2, raw, packageAbi, shared) {
     ...abi === "wasi" && raw.preopenRoot === true ? { preopenRoot: true } : {},
     ...args ? { args } : {},
     ...withEnv,
-    ...imports ? { imports } : {}
+    ...imports ? { imports } : {},
+    ...variants ? { variants } : {}
   };
 }
 function commandsOf(pkg, manifest) {
@@ -6467,245 +6500,116 @@ function binfmtOf(binfmts, path) {
   return best === void 0 ? void 0 : binfmts.get(best);
 }
 
-// src/fs/unlinked.ts
-var UNLINKED_DIR = ".slicc-unlinked";
-function webLocks() {
-  return globalThis.navigator?.locks;
-}
-var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
-var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
-var lockName = (instance) => `slicc-unlinked:${instance}`;
-var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
-var PathGate = class {
-  tails = /* @__PURE__ */ new Map();
-  async acquire(path) {
-    const prev = this.tails.get(path) ?? Promise.resolve();
-    const { promise, resolve: resolve2 } = Promise.withResolvers();
-    const tail2 = prev.then(() => promise);
-    this.tails.set(path, tail2);
-    await prev;
-    return () => {
-      resolve2();
-      if (this.tails.get(path) === tail2) this.tails.delete(path);
-    };
-  }
-  async run(path, op) {
-    const release = await this.acquire(path);
-    try {
-      return await op();
-    } finally {
-      release();
-    }
-  }
+// src/cron/command.ts
+var CRONTAB_PATH = "/usr/bin/crontab";
+var CRONTAB_COMMAND = {
+  name: "crontab",
+  abi: "js",
+  glue: CRONTAB_PATH,
+  wasm: CRONTAB_PATH,
+  argv0: "crontab"
 };
-var UnlinkedKeeper = class {
-  fs;
-  holders;
-  rootOf;
-  locks;
-  busy;
-  waiting = /* @__PURE__ */ new Set();
-  owner;
-  instance;
-  gate = new PathGate();
-  queue = Promise.resolve();
-  count = 0;
-  links = /* @__PURE__ */ new Map();
-  linked = /* @__PURE__ */ new Map();
-  dirOwner;
-  constructor(fs, holders, rootOf, options = {}) {
-    const { locks, owner } = options;
-    this.dirOwner = options.dirOwner;
-    this.fs = fs;
-    this.holders = holders;
-    this.rootOf = rootOf;
-    this.locks = locks;
-    this.busy = options.busy ?? (() => false);
-    this.owner = owner;
-    this.instance = owner ? `${owner.id}~${crypto.randomUUID()}` : crypto.randomUUID();
-    void locks?.request(lockName(this.instance), () => new Promise(() => void 0));
-  }
-  serial(op) {
-    const next3 = this.queue.then(op);
-    this.queue = next3.catch(() => void 0);
-    return next3;
-  }
-  wrap(fs = this.fs) {
-    const keeper = this;
-    const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
-    const counted2 = (st) => {
-      const hidden = keeper.links.get(`${st.dev ?? 0}:${st.ino}`) ?? 0;
-      return hidden === 0 || st.nlink === void 0 ? st : { ...st, nlink: Math.max(0, st.nlink - hidden) };
-    };
-    return {
-      ...fs,
-      links: (path) => mayLink(fs, path),
-      stat: async (path) => counted2(await fs.stat(path)),
-      lstat: async (path) => counted2(await fs.lstat(path)),
-      async rm(path, options) {
-        const target = fs.resolvePath("/", path);
-        const pinned = await keeper.pin(target);
-        if (pinned.moved.has(target)) pinned.commit();
-        else await keeper.settle(pinned, () => fs.rm(path, options));
-      },
-      async rename(from, to) {
-        const target = fs.resolvePath("/", to);
-        if (target === fs.resolvePath("/", from)) return fs.rename(from, to);
-        const pinned = await keeper.pin(target);
-        await keeper.settle(pinned, () => fs.rename(from, to));
-      },
-      readdir: async (path) => visible(await fs.readdir(path)),
-      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR).map(([name2, st]) => [name2, st && counted2(st)])
-    };
+var CRONTAB_SOURCE = `export default async function crontab(ctx) {
+  const say = (fd, text) => ctx.write(fd, text).catch(() => undefined);
+  const usage = async () => {
+    await say(2, "usage: crontab [-u user] { -l | -r | -e | file | - }\\n");
+    return 1;
+  };
+  const args = ctx.argv.slice(1);
+  let user;
+  let action;
+  let file;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "-u") {
+      user = args[++i];
+      if (user === undefined) return usage();
+    } else if (arg === "-l" || arg === "-r" || arg === "-e") {
+      if (action !== undefined) return usage();
+      action = arg.slice(1);
+    } else if (arg === "-" || !arg.startsWith("-")) {
+      if (file !== undefined) return usage();
+      file = arg;
+    } else return usage();
+  }
+  if ((action === undefined) === (file === undefined)) return usage();
+  const call = (c) => ctx.crontab(user === undefined ? c : { ...c, user });
+  const failed = async (answer) => {
+    await say(2, answer.error + "\\n");
+    return 1;
+  };
+  const decode = (bytes) => new TextDecoder().decode(bytes);
+  if (action === "l") {
+    const answer = await call({ action: "list" });
+    if (answer.error !== undefined) return failed(answer);
+    await say(1, answer.text);
+    return 0;
+  }
+  if (action === "r") {
+    const answer = await call({ action: "remove" });
+    return answer.error !== undefined ? failed(answer) : 0;
+  }
+  if (action === "e") return edit();
+  let text;
+  try {
+    if (file === "-") {
+      const stream = new TextDecoder();
+      const parts = [];
+      for (;;) {
+        const chunk = await ctx.read(0);
+        if (chunk.length === 0) break;
+        parts.push(stream.decode(chunk, { stream: true }));
+      }
+      text = parts.join("") + stream.decode();
+    } else text = decode(await ctx.fs.readFile(ctx.resolve(file)));
+  } catch (err) {
+    await say(2, "crontab: " + file + ": " + (err && err.code ? err.code : String(err)) + "\\n");
+    return 1;
   }
-  async settle(pinned, op) {
+  const answer = await call({ action: "install", text });
+  return answer.error !== undefined ? failed(answer) : 0;
+
+  async function edit() {
+    const editor = ctx.env.VISUAL || ctx.env.EDITOR;
+    if (!editor) {
+      await say(2, "crontab: set VISUAL or EDITOR to edit, or install a file with crontab <file>\\n");
+      return 1;
+    }
+    const current = await call({ action: "list" });
+    const before = current.error === undefined ? current.text : "";
+    if (current.error !== undefined && !current.error.startsWith("no crontab for ")) return failed(current);
+    const tmp = "/tmp/crontab." + ctx.pid + "." + crypto.randomUUID();
     try {
-      await op();
+      const file = await ctx.open(tmp, { write: true, create: true, exclusive: true, mode: 0o600 });
+      await file.write(0, new TextEncoder().encode(before));
+      await file.close();
     } catch (err) {
-      await pinned.rollback();
-      throw err;
+      await say(2, "crontab: " + tmp + ": " + (err && err.code ? err.code : String(err)) + "\\n");
+      return 1;
     }
-    pinned.commit();
-  }
-  async pin(target) {
-    const held = /* @__PURE__ */ new Map();
-    for (const holder of this.holders) {
-      if (holder.owns(target)) continue;
-      for (const path of holder.held()) {
-        if (!within4(path, target) || holder.isKept(path)) continue;
-        held.set(path, [...held.get(path) ?? [], holder]);
-      }
+    const child = await ctx.spawn({ argv: ["/bin/bash", "-c", editor + ' "$1"', "crontab", tmp] });
+    const ended = await ctx.wait(child.pid);
+    if (ended.status !== 0) {
+      await say(2, "crontab: the editor exited with status " + ended.status + ", crontab not changed\\n");
+      await ctx.fs.rm(tmp).catch(() => undefined);
+      return 1;
     }
-    const paths = [...held.keys()].sort();
-    const releases = [];
-    for (const path of paths) releases.push(await this.gate.acquire(path));
-    const hidden = /* @__PURE__ */ new Map();
-    for (const path of paths) {
-      const at = await this.hide(path);
-      if (at !== void 0) hidden.set(path, at);
-    }
-    const done4 = () => {
-      for (const release of releases) release();
-    };
-    const files = /* @__PURE__ */ new Map();
-    for (const [path, at] of hidden) {
-      const holders = held.get(path);
-      const file = this.keptFile(at, { refs: holders.length + 1 });
-      files.set(path, file);
-      for (const holder of holders) holder.keep(path, file);
+    const after = decode(await ctx.fs.readFile(tmp));
+    if (after === before) {
+      await say(2, "crontab: no changes made to crontab\\n");
+      await ctx.fs.rm(tmp).catch(() => undefined);
+      return 0;
     }
-    return {
-      moved: new Set(hidden.keys()),
-      commit: () => {
-        for (const file of files.values()) file.release();
-        done4();
-      },
-      rollback: async () => {
-        for (const [path, file] of files) {
-          for (const holder of held.get(path)) holder.unkeep(path, file);
-          await this.serial(async () => {
-            await Promise.allSettled([this.fs.rename(file.hidden, path)]);
-            this.unlinkedName(file.hidden);
-            await this.tidy(parentOf5(file.hidden));
-          });
-        }
-        done4();
-      }
-    };
-  }
-  keptFile(hidden, entry) {
-    return {
-      hidden,
-      release: () => {
-        if (--entry.refs === 0) void this.serial(() => this.drop(hidden));
-      }
-    };
-  }
-  hide(path) {
-    return this.serial(async () => {
-      const dir = dirOf(this.rootOf(path));
-      const hidden = `${dir}/${this.instance}.${++this.count}`;
-      try {
-        const owner = this.dirOwner;
-        await this.fs.mkdir(dir, { recursive: true, ...owner ? { owner } : {} });
-        await this.fs.rename(path, hidden);
-        await this.linkedName(hidden);
-        return hidden;
-      } catch {
-        await this.tidy(dir);
-        return void 0;
-      }
-    });
-  }
-  closed(path) {
-    if (this.waiting.delete(path)) void this.serial(() => this.drop(path));
-  }
-  async drop(hidden) {
-    if (this.busy(hidden)) {
-      this.waiting.add(hidden);
-      return;
+    const answer = await call({ action: "install", text: after });
+    if (answer.error !== undefined) {
+      await say(2, answer.error + "\\ncrontab: your edit is kept in " + tmp + "\\n");
+      return 1;
     }
-    await this.fs.rm(hidden).catch(() => void 0);
-    this.unlinkedName(hidden);
-    await this.tidy(parentOf5(hidden));
-  }
-  async linkedName(hidden) {
-    if (!mayLink(this.fs, hidden)) return;
-    const st = await this.fs.lstat(hidden).catch(() => void 0);
-    if (st?.nlink === void 0) return;
-    const id2 = `${st.dev ?? 0}:${st.ino}`;
-    this.linked.set(hidden, id2);
-    this.links.set(id2, (this.links.get(id2) ?? 0) + 1);
+    await ctx.fs.rm(tmp).catch(() => undefined);
+    return 0;
   }
-  unlinkedName(hidden) {
-    const id2 = this.linked.get(hidden);
-    if (id2 === void 0) return;
-    this.linked.delete(hidden);
-    const left = (this.links.get(id2) ?? 1) - 1;
-    if (left > 0) this.links.set(id2, left);
-    else this.links.delete(id2);
-  }
-  async tidy(dir) {
-    const left = await this.fs.readdir(dir).catch(() => [UNLINKED_DIR]);
-    if (left.length === 0) await this.fs.rm(dir, { recursive: true }).catch(() => void 0);
-  }
-  sweep(root) {
-    const query = this.locks?.query?.bind(this.locks);
-    const owner = this.owner;
-    if (!query && !owner) return Promise.resolve();
-    return this.serial(async () => {
-      const dir = dirOf(root);
-      const names = await this.fs.readdir(dir).catch(() => void 0);
-      if (!names) return;
-      const held = query && new Set(((await query()).held ?? []).map((lock) => lock.name));
-      for (const name2 of names) {
-        const id2 = name2.slice(0, name2.lastIndexOf("."));
-        const at = id2.indexOf("~");
-        const dead = id2 !== this.instance && (at < 0 ? held !== void 0 && !held.has(lockName(id2)) : owner?.alive(id2.slice(0, at)) === false);
-        if (dead) await this.fs.rm(`${dir}/${name2}`, { recursive: true }).catch(() => void 0);
-      }
-      await this.tidy(dir);
-    });
-  }
-};
-
-// src/cron/clock.ts
-var systemCronClock = {
-  now: () => Date.now(),
-  sleep(until, signal) {
-    if (signal.aborted) return Promise.resolve();
-    return new Promise((resolve2) => {
-      const done4 = () => {
-        clearTimeout(timer);
-        signal.removeEventListener("abort", done4);
-        resolve2();
-      };
-      const timer = setTimeout(done4, Math.max(0, until - Date.now()));
-      timer.unref?.();
-      signal.addEventListener("abort", done4, { once: true });
-    });
-  }
-};
+}
+`;
 
 // src/cron/schedule.ts
 var MISSED_CAP = 1e5;
@@ -6877,79 +6781,378 @@ function hashId(text) {
     a = Math.imul(a ^ c, 16777619);
     b = Math.imul(b ^ c, 1540483477);
   }
-  const hex3 = (n) => (n >>> 0).toString(16).padStart(8, "0");
-  return hex3(a) + hex3(b);
-}
-function split2(text, count2) {
-  const words2 = [];
-  let rest2 = text;
-  for (let i = 0; i < count2; i++) {
-    const match = /^(\S+)\s+/.exec(rest2);
-    if (!match) return void 0;
-    words2.push(match[1]);
-    rest2 = rest2.slice(match[0].length);
+  const hex3 = (n) => (n >>> 0).toString(16).padStart(8, "0");
+  return hex3(a) + hex3(b);
+}
+function split2(text, count2) {
+  const words2 = [];
+  let rest2 = text;
+  for (let i = 0; i < count2; i++) {
+    const match = /^(\S+)\s+/.exec(rest2);
+    if (!match) return void 0;
+    words2.push(match[1]);
+    rest2 = rest2.slice(match[0].length);
+  }
+  return [words2, rest2.trim()];
+}
+function jobOf(content, pending, ctx) {
+  const fields = content.startsWith("@") ? 1 : 5;
+  const parts2 = split2(content, fields + (ctx.system ? 1 : 0));
+  if (!parts2 || parts2[1] === "") throw new Error("no command");
+  const [words2, command] = parts2;
+  const schedule = words2.slice(0, fields).join(" ");
+  const when = parseWhen(schedule);
+  const user = ctx.system ? words2[fields] : void 0;
+  if (user !== void 0 && !USER_NAME.test(user)) throw new Error(`bad user name ${user}`);
+  if (pending !== void 0 && !JOB_NAME.test(pending))
+    throw new Error(`bad job name "${pending}"`);
+  if (pending !== void 0 && ctx.names.has(pending))
+    throw new Error(`job name ${pending} is taken`);
+  const hashed = hashId(`${ctx.path}
+${user ?? ""}
+${schedule}
+${command}`);
+  let id2 = pending ?? hashed;
+  for (let n = 2; pending === void 0 && ctx.names.has(id2); n++) id2 = `${hashed}.${n}`;
+  ctx.names.add(id2);
+  return {
+    id: id2,
+    ...pending !== void 0 ? { name: pending } : {},
+    schedule,
+    when,
+    ...user !== void 0 ? { user } : {},
+    command
+  };
+}
+function parseCrontab(text, path, system = false) {
+  const jobs = [];
+  const errors = [];
+  const env = {};
+  const ctx = { path, system, names: /* @__PURE__ */ new Set() };
+  let name2;
+  for (const [index, raw] of text.split("\n").entries()) {
+    const line = index + 1;
+    const content = raw.trim();
+    const named = NAME_LINE.exec(content);
+    if (named) {
+      name2 = named[1];
+      continue;
+    }
+    const pending = name2;
+    name2 = void 0;
+    if (content === "" || content.startsWith("#")) continue;
+    const assign = ENV_LINE.exec(content);
+    if (assign) {
+      env[assign[1]] = unquote(assign[2]);
+      continue;
+    }
+    try {
+      jobs.push({ line, ...jobOf(content, pending, ctx), env: { ...env } });
+    } catch (err) {
+      errors.push({ line, message: err.message });
+    }
+  }
+  return { jobs, errors };
+}
+
+// src/cron/crontab.ts
+var CRONTAB_MAX = 256 * 1024;
+var ACTIONS = /* @__PURE__ */ new Set(["list", "remove", "install"]);
+function crontabCall(req) {
+  const { action, user, text } = req;
+  if (typeof action !== "string" || !ACTIONS.has(action)) return void 0;
+  if (user !== void 0 && typeof user !== "string") return void 0;
+  if (action === "install" && typeof text !== "string") return void 0;
+  return {
+    op: "proc-crontab",
+    action,
+    ...user !== void 0 ? { user } : {},
+    ...action === "install" ? { text } : {}
+  };
+}
+var Crontabs = class {
+  o;
+  constructor(options) {
+    this.o = options;
+  }
+  async request(cred, call) {
+    const caller = await this.o.lookup(cred.ruid);
+    if (!caller) return { error: `crontab: your uid ${cred.ruid} is not in /etc/passwd` };
+    let target = caller;
+    if (call.user !== void 0 && call.user !== caller.name) {
+      if (cred.euid !== 0) return { error: "crontab: must be privileged to use -u" };
+      const found = await this.o.lookup(call.user);
+      if (!found) return { error: `crontab: user ${call.user} unknown` };
+      target = found;
+    }
+    const path = `${SPOOL_DIR}/${target.name}`;
+    const none = { error: `no crontab for ${target.name}` };
+    const { fs } = this.o;
+    if (call.action === "install") return this.install(path, target, call.text);
+    if (!await fs.exists(path)) return none;
+    if (call.action === "list") return { text: await fs.readFile(path) };
+    await fs.rm(path);
+    return { text: "" };
+  }
+  async install(path, target, text) {
+    if (text.length > CRONTAB_MAX) return { error: "crontab: the table is too long" };
+    const { errors } = parseCrontab(text, path);
+    if (errors.length > 0) {
+      const lines2 = errors.map(({ line, message: message3 }) => `"-":${line}: ${message3}`);
+      return { error: ["crontab: errors in crontab file, cannot install", ...lines2].join("\n") };
+    }
+    const { fs, owners } = this.o;
+    if (!await fs.exists(SPOOL_DIR)) {
+      await fs.mkdir(SPOOL_DIR, { recursive: true });
+      if (owners) await fs.chown?.(SPOOL_DIR, { uid: 0, gid: 0, mode: 448, follow: false });
+    }
+    const fresh2 = `${SPOOL_DIR}/.${target.name}.${crypto.randomUUID()}.new`;
+    const owner = owners ? { uid: target.uid, gid: target.gid, mode: 384 } : void 0;
+    await fs.writeFile(fresh2, text, owner);
+    await fs.rename(fresh2, path);
+    return { text: "" };
+  }
+};
+
+// src/fs/unlinked.ts
+var UNLINKED_DIR = ".slicc-unlinked";
+function webLocks() {
+  return globalThis.navigator?.locks;
+}
+var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var lockName = (instance) => `slicc-unlinked:${instance}`;
+var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
+var PathGate = class {
+  tails = /* @__PURE__ */ new Map();
+  async acquire(path) {
+    const prev = this.tails.get(path) ?? Promise.resolve();
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
+    const tail2 = prev.then(() => promise);
+    this.tails.set(path, tail2);
+    await prev;
+    return () => {
+      resolve2();
+      if (this.tails.get(path) === tail2) this.tails.delete(path);
+    };
+  }
+  async run(path, op) {
+    const release = await this.acquire(path);
+    try {
+      return await op();
+    } finally {
+      release();
+    }
+  }
+};
+var UnlinkedKeeper = class {
+  fs;
+  holders;
+  rootOf;
+  locks;
+  busy;
+  waiting = /* @__PURE__ */ new Set();
+  owner;
+  instance;
+  gate = new PathGate();
+  queue = Promise.resolve();
+  count = 0;
+  links = /* @__PURE__ */ new Map();
+  linked = /* @__PURE__ */ new Map();
+  dirOwner;
+  constructor(fs, holders, rootOf, options = {}) {
+    const { locks, owner } = options;
+    this.dirOwner = options.dirOwner;
+    this.fs = fs;
+    this.holders = holders;
+    this.rootOf = rootOf;
+    this.locks = locks;
+    this.busy = options.busy ?? (() => false);
+    this.owner = owner;
+    this.instance = owner ? `${owner.id}~${crypto.randomUUID()}` : crypto.randomUUID();
+    void locks?.request(lockName(this.instance), () => new Promise(() => void 0));
+  }
+  serial(op) {
+    const next3 = this.queue.then(op);
+    this.queue = next3.catch(() => void 0);
+    return next3;
+  }
+  wrap(fs = this.fs) {
+    const keeper = this;
+    const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
+    const counted2 = (st) => {
+      const hidden = keeper.links.get(`${st.dev ?? 0}:${st.ino}`) ?? 0;
+      return hidden === 0 || st.nlink === void 0 ? st : { ...st, nlink: Math.max(0, st.nlink - hidden) };
+    };
+    return {
+      ...fs,
+      links: (path) => mayLink(fs, path),
+      stat: async (path) => counted2(await fs.stat(path)),
+      lstat: async (path) => counted2(await fs.lstat(path)),
+      async rm(path, options) {
+        const target = fs.resolvePath("/", path);
+        const pinned = await keeper.pin(target);
+        if (pinned.moved.has(target)) pinned.commit();
+        else await keeper.settle(pinned, () => fs.rm(path, options));
+      },
+      async rename(from, to) {
+        const target = fs.resolvePath("/", to);
+        if (target === fs.resolvePath("/", from)) return fs.rename(from, to);
+        const pinned = await keeper.pin(target);
+        await keeper.settle(pinned, () => fs.rename(from, to));
+      },
+      readdir: async (path) => visible(await fs.readdir(path)),
+      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR).map(([name2, st]) => [name2, st && counted2(st)])
+    };
   }
-  return [words2, rest2.trim()];
-}
-function jobOf(content, pending, ctx) {
-  const fields = content.startsWith("@") ? 1 : 5;
-  const parts2 = split2(content, fields + (ctx.system ? 1 : 0));
-  if (!parts2 || parts2[1] === "") throw new Error("no command");
-  const [words2, command] = parts2;
-  const schedule = words2.slice(0, fields).join(" ");
-  const when = parseWhen(schedule);
-  const user = ctx.system ? words2[fields] : void 0;
-  if (user !== void 0 && !USER_NAME.test(user)) throw new Error(`bad user name ${user}`);
-  if (pending !== void 0 && !JOB_NAME.test(pending))
-    throw new Error(`bad job name "${pending}"`);
-  if (pending !== void 0 && ctx.names.has(pending))
-    throw new Error(`job name ${pending} is taken`);
-  const hashed = hashId(`${ctx.path}
-${user ?? ""}
-${schedule}
-${command}`);
-  let id2 = pending ?? hashed;
-  for (let n = 2; pending === void 0 && ctx.names.has(id2); n++) id2 = `${hashed}.${n}`;
-  ctx.names.add(id2);
-  return {
-    id: id2,
-    ...pending !== void 0 ? { name: pending } : {},
-    schedule,
-    when,
-    ...user !== void 0 ? { user } : {},
-    command
-  };
-}
-function parseCrontab(text, path, system = false) {
-  const jobs = [];
-  const errors = [];
-  const env = {};
-  const ctx = { path, system, names: /* @__PURE__ */ new Set() };
-  let name2;
-  for (const [index, raw] of text.split("\n").entries()) {
-    const line = index + 1;
-    const content = raw.trim();
-    const named = NAME_LINE.exec(content);
-    if (named) {
-      name2 = named[1];
-      continue;
-    }
-    const pending = name2;
-    name2 = void 0;
-    if (content === "" || content.startsWith("#")) continue;
-    const assign = ENV_LINE.exec(content);
-    if (assign) {
-      env[assign[1]] = unquote(assign[2]);
-      continue;
-    }
+  async settle(pinned, op) {
     try {
-      jobs.push({ line, ...jobOf(content, pending, ctx), env: { ...env } });
+      await op();
     } catch (err) {
-      errors.push({ line, message: err.message });
+      await pinned.rollback();
+      throw err;
     }
+    pinned.commit();
   }
-  return { jobs, errors };
-}
+  async pin(target) {
+    const held = /* @__PURE__ */ new Map();
+    for (const holder of this.holders) {
+      if (holder.owns(target)) continue;
+      for (const path of holder.held()) {
+        if (!within4(path, target) || holder.isKept(path)) continue;
+        held.set(path, [...held.get(path) ?? [], holder]);
+      }
+    }
+    const paths = [...held.keys()].sort();
+    const releases = [];
+    for (const path of paths) releases.push(await this.gate.acquire(path));
+    const hidden = /* @__PURE__ */ new Map();
+    for (const path of paths) {
+      const at = await this.hide(path);
+      if (at !== void 0) hidden.set(path, at);
+    }
+    const done4 = () => {
+      for (const release of releases) release();
+    };
+    const files = /* @__PURE__ */ new Map();
+    for (const [path, at] of hidden) {
+      const holders = held.get(path);
+      const file = this.keptFile(at, { refs: holders.length + 1 });
+      files.set(path, file);
+      for (const holder of holders) holder.keep(path, file);
+    }
+    return {
+      moved: new Set(hidden.keys()),
+      commit: () => {
+        for (const file of files.values()) file.release();
+        done4();
+      },
+      rollback: async () => {
+        for (const [path, file] of files) {
+          for (const holder of held.get(path)) holder.unkeep(path, file);
+          await this.serial(async () => {
+            await Promise.allSettled([this.fs.rename(file.hidden, path)]);
+            this.unlinkedName(file.hidden);
+            await this.tidy(parentOf5(file.hidden));
+          });
+        }
+        done4();
+      }
+    };
+  }
+  keptFile(hidden, entry) {
+    return {
+      hidden,
+      release: () => {
+        if (--entry.refs === 0) void this.serial(() => this.drop(hidden));
+      }
+    };
+  }
+  hide(path) {
+    return this.serial(async () => {
+      const dir = dirOf(this.rootOf(path));
+      const hidden = `${dir}/${this.instance}.${++this.count}`;
+      try {
+        const owner = this.dirOwner;
+        await this.fs.mkdir(dir, { recursive: true, ...owner ? { owner } : {} });
+        await this.fs.rename(path, hidden);
+        await this.linkedName(hidden);
+        return hidden;
+      } catch {
+        await this.tidy(dir);
+        return void 0;
+      }
+    });
+  }
+  closed(path) {
+    if (this.waiting.delete(path)) void this.serial(() => this.drop(path));
+  }
+  async drop(hidden) {
+    if (this.busy(hidden)) {
+      this.waiting.add(hidden);
+      return;
+    }
+    await this.fs.rm(hidden).catch(() => void 0);
+    this.unlinkedName(hidden);
+    await this.tidy(parentOf5(hidden));
+  }
+  async linkedName(hidden) {
+    if (!mayLink(this.fs, hidden)) return;
+    const st = await this.fs.lstat(hidden).catch(() => void 0);
+    if (st?.nlink === void 0) return;
+    const id2 = `${st.dev ?? 0}:${st.ino}`;
+    this.linked.set(hidden, id2);
+    this.links.set(id2, (this.links.get(id2) ?? 0) + 1);
+  }
+  unlinkedName(hidden) {
+    const id2 = this.linked.get(hidden);
+    if (id2 === void 0) return;
+    this.linked.delete(hidden);
+    const left = (this.links.get(id2) ?? 1) - 1;
+    if (left > 0) this.links.set(id2, left);
+    else this.links.delete(id2);
+  }
+  async tidy(dir) {
+    const left = await this.fs.readdir(dir).catch(() => [UNLINKED_DIR]);
+    if (left.length === 0) await this.fs.rm(dir, { recursive: true }).catch(() => void 0);
+  }
+  sweep(root) {
+    const query = this.locks?.query?.bind(this.locks);
+    const owner = this.owner;
+    if (!query && !owner) return Promise.resolve();
+    return this.serial(async () => {
+      const dir = dirOf(root);
+      const names = await this.fs.readdir(dir).catch(() => void 0);
+      if (!names) return;
+      const held = query && new Set(((await query()).held ?? []).map((lock) => lock.name));
+      for (const name2 of names) {
+        const id2 = name2.slice(0, name2.lastIndexOf("."));
+        const at = id2.indexOf("~");
+        const dead = id2 !== this.instance && (at < 0 ? held !== void 0 && !held.has(lockName(id2)) : owner?.alive(id2.slice(0, at)) === false);
+        if (dead) await this.fs.rm(`${dir}/${name2}`, { recursive: true }).catch(() => void 0);
+      }
+      await this.tidy(dir);
+    });
+  }
+};
+
+// src/cron/clock.ts
+var systemCronClock = {
+  now: () => Date.now(),
+  sleep(until, signal) {
+    if (signal.aborted) return Promise.resolve();
+    return new Promise((resolve2) => {
+      const done4 = () => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", done4);
+        resolve2();
+      };
+      const timer = setTimeout(done4, Math.max(0, until - Date.now()));
+      timer.unref?.();
+      signal.addEventListener("abort", done4, { once: true });
+    });
+  }
+};
 
 // src/cron/service.ts
 var CRON_DIR = "/var/spool/cron";
@@ -7125,9 +7328,12 @@ var CronService = class {
       const account = await this.host.lookup(job.user);
       if (account) out.push({ source: "system", account, job });
     }
-    const names = await fs.readdir(SPOOL_DIR).catch(() => []);
+    const names = await fs.readdir(SPOOL_DIR).catch((err) => {
+      if (err?.code === "ENOENT") return [];
+      throw err;
+    });
     for (const name2 of names.sort()) {
-      if (name2.startsWith(".") || name2.endsWith("~") || name2.endsWith(".new")) continue;
+      if (name2.startsWith(".") || name2.endsWith("~")) continue;
       const path = `${SPOOL_DIR}/${name2}`;
       const account = await this.host.lookup(name2);
       if (!account) {
@@ -16637,6 +16843,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "proc-wait",
   "proc-captured",
   "proc-sudo",
+  "proc-crontab",
   "proc-run",
   "proc-exit",
   "proc-kill-self",
@@ -17826,8 +18033,17 @@ var WasmProcess = class {
         return { ok: true, kind: "bytes", bytes: this.children.captured(req.pid, req.slot) };
       case "proc-sudo":
         return { ok: true, kind: "json", json: await this.sudo(req, cancelled) };
+      case "proc-crontab":
+        return { ok: true, kind: "json", json: await this.crontab(req) };
     }
   }
+  async crontab(req) {
+    const { crontab } = this.options;
+    if (!crontab) throw new KernelError("ENOSYS");
+    const call = crontabCall(req);
+    if (!call) throw new KernelError("EINVAL");
+    return crontab(call);
+  }
   signalSyscall(req) {
     if (req.op === "sig-inherited") {
       return { ok: true, kind: "json", json: this.inherited & ~this.caught };
@@ -18230,6 +18446,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...opts.writesBack ? { writesBack: opts.writesBack } : {},
     processes: opts.processes,
     ...opts.sudo ? { sudo: opts.sudo } : {},
+    ...opts.crontab ? { crontab: opts.crontab } : {},
     openFiles: opts.openFiles,
     ...opts.nodes ? { nodes: opts.nodes } : {},
     mounts: opts.mounts,
@@ -21697,6 +21914,7 @@ var LAYOUT = [
   ["/usr", 493],
   ["/usr/local", 493]
 ];
+var IN_TREE = /* @__PURE__ */ new Set([SUDO_PATH, CRONTAB_PATH]);
 var LOAD_SAMPLE_MS = 5e3;
 var LOAD_WINDOWS_MS = [6e4, 3e5, 9e5];
 var encoder8 = new TextEncoder();
@@ -21795,9 +22013,18 @@ function targetOf(command) {
     ...command.env ? { env: command.env } : {},
     ...command.unset ? { unset: command.unset } : {},
     ...command.imports ? { imports: command.imports } : {},
-    ...command.preopenRoot ? { preopenRoot: true } : {}
+    ...command.preopenRoot ? { preopenRoot: true } : {},
+    ...command.variants ? { variants: command.variants } : {}
   };
 }
+function chosen(planned, env) {
+  const { target } = planned;
+  const wasm = variantFor(target.variants, env);
+  if (wasm === void 0) return planned;
+  const { asked: _asked, ...rest2 } = target;
+  const glue = target.abi === "wasi" ? wasm : target.glue;
+  return { ...planned, target: { ...rest2, wasm, glue } };
+}
 function withScriptEnv(target, command) {
   if (!command) return target;
   return {
@@ -21927,6 +22154,7 @@ var Launcher = class {
   boot = Date.now();
   bootId = crypto.randomUUID();
   cron;
+  crontabs;
   terminals = 0;
   constructor(options) {
     this.usersMode = usersMode(options.users);
@@ -22127,7 +22355,9 @@ var Launcher = class {
       found = this.trustedAppended().then(async (appended2) => {
         const tiers = await this.tiers(scope, appended2);
         return scanCommands(this.scanned, tiers, tiers.length - appended2.length);
-      }).then((commands) => this.refusals(commands).set(SUDO_COMMAND.name, SUDO_COMMAND));
+      }).then(
+        (commands) => this.refusals(commands).set(SUDO_COMMAND.name, SUDO_COMMAND).set(CRONTAB_COMMAND.name, CRONTAB_COMMAND)
+      );
       this.catalogs.set(scope, found);
     }
     return found;
@@ -22532,7 +22762,7 @@ var Launcher = class {
       const root = packageRootOf(at, roots) ?? PACKAGE_ROOT.exec(at)?.[1];
       if (root !== void 0) files.push(`${root}/package.json`);
     }
-    return [...new Set(files)].filter((path) => path !== "" && path !== SUDO_PATH);
+    return [...new Set(files)].filter((path) => path !== "" && !IN_TREE.has(path));
   }
   async unrunnable(file, cwd, scope) {
     const path = this.fs.resolvePath(cwd, file);
@@ -22672,6 +22902,9 @@ var Launcher = class {
     if (target.abi === "js" && target.wasm === SUDO_PATH) {
       return { abi: "js", glue: SUDO_SOURCE, path: SUDO_PATH };
     }
+    if (target.abi === "js" && target.wasm === CRONTAB_PATH) {
+      return { abi: "js", glue: CRONTAB_SOURCE, path: CRONTAB_PATH };
+    }
     if (target.abi === "js" && target.wasm === REFUSED_PATH) {
       return { abi: "js", glue: REFUSED_SOURCE, path: REFUSED_PATH };
     }
@@ -22702,14 +22935,15 @@ var Launcher = class {
       ...target.preopenRoot ? { preopenRoot: true } : {}
     };
   }
-  async launch(planned, req) {
-    const { target, args } = planned;
+  async launch(asked, req) {
     const cwd = await physicalPathAsync(this.base, req.cwd);
     const seen = { ...req.env, HOSTNAME: this.hostname, cwd };
-    const env = { ...expandDefaults(target.env, seen), ...req.env };
-    for (const key of target.unset ?? []) delete env[key];
+    const env = { ...expandDefaults(asked.target.env, seen), ...req.env };
+    for (const key of asked.target.unset ?? []) delete env[key];
     delete env[TICKET_ENV];
     env.HOSTNAME = this.hostname;
+    const planned = chosen(asked, env);
+    const { target, args } = planned;
     let program;
     await this.pnpmReady();
     try {
@@ -22827,6 +23061,7 @@ var Launcher = class {
         cpu: this.cpuTotal()
       }),
       sudo: (call, signal) => this.sudo(pid, call, signal),
+      crontab: (call) => this.crontab(pid, call),
       openFiles: this.openFiles,
       nodes: stack.nodes,
       held: this.held,
@@ -23045,6 +23280,14 @@ var Launcher = class {
     const threads = this.stateOf(pid) === "S" ? this.processes.get(pid)?.threads?.() : void 0;
     return threads ? { threads } : {};
   }
+  crontab(pid, call) {
+    this.crontabs ??= new Crontabs({
+      fs: this.fs,
+      owners: this.owners,
+      lookup: (user) => this.users.lookup(user)
+    });
+    return this.crontabs.request(this.credOf(pid), call);
+  }
   sudo(pid, call, signal) {
     const caller = {
       cred: this.credOf(pid),