@ai-ecoverse/slicc-kernel 1.12.0 → 1.14.0

package/dist/node.js

@@ -252,7 +252,7 @@ function serveTransport(peer, transport) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 1];
+var PROTOCOL = [1, 2];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -341,6 +341,11 @@ async function fsCall(fs, method, args) {
       return { result: await fs.exists(path(0)) };
   }
 }
+function signalOf(host) {
+  return host.signal ?? ((name2) => {
+    throw fsError("EINVAL", `this kernel names no signal ${name2}`);
+  });
+}
 function serveClient(port, host) {
   let state = "new";
   const terminals = /* @__PURE__ */ new Map();
@@ -428,6 +433,9 @@ function serveClient(port, host) {
     return { result: result.status };
   }
   async function handle(req) {
+    if (host.scope === "transport" && req.op !== "detach") {
+      throw fsError("EPERM", `${req.op}: this client may only use the network transport`);
+    }
     const l = await host.launcher();
     switch (req.op) {
       case "spawn":
@@ -437,11 +445,11 @@ function serveClient(port, host) {
       case "terminal": {
         const session = terminals.get(req.terminal);
         if (!session) throw new Error(`no terminal ${req.terminal}`);
-        act(session, req, host.signal);
+        act(session, req, signalOf(host));
         return { result: true };
       }
       case "kill":
-        if (!l.kill(req.pid, host.signal(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
+        if (!l.kill(req.pid, signalOf(host)(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
         return { result: true };
       case "ps":
         return {
@@ -465,6 +473,13 @@ function serveClient(port, host) {
         watches.get(req.watch)?.();
         watches.delete(req.watch);
         return { result: true };
+      case "mount":
+        return { result: await l.mount(req.spec) };
+      case "umount":
+        l.umount(req.target);
+        return { result: true };
+      case "mounts":
+        return { result: l.mounts.list() };
       case "detach":
         return { result: true };
       default:
@@ -1153,9 +1168,28 @@ async function packages(fs, modules) {
   }
   return dirs;
 }
+async function pnpmGlobalRoots(fs, home) {
+  const roots = [];
+  const global = `${home}/global`;
+  for (const version of (await fs.readdir(global).catch(() => [])).sort()) {
+    for (const group of (await fs.readdir(`${global}/${version}`).catch(() => [])).sort()) {
+      const dir = `${global}/${version}/${group}`;
+      const st = await fs.lstat(dir).catch(() => void 0);
+      if (st?.isDirectory && await fs.exists(`${dir}/node_modules`))
+        roots.push(`${dir}/node_modules`);
+    }
+  }
+  return roots;
+}
+async function packagesIn(fs, roots) {
+  const dirs = [];
+  for (const root of typeof roots === "string" ? [roots] : roots)
+    dirs.push(...await packages(fs, root));
+  return dirs;
+}
 async function scanCommands(fs, modules) {
   const found = /* @__PURE__ */ new Map();
-  for (const pkg of await packages(fs, modules)) {
+  for (const pkg of await packagesIn(fs, modules)) {
     let manifest;
     try {
       manifest = JSON.parse(await fs.readFile(`${pkg}/package.json`));
@@ -1172,6 +1206,24 @@ async function scanCommands(fs, modules) {
   }
   return found;
 }
+async function scanFilesystems(fs, modules) {
+  const found = /* @__PURE__ */ new Map();
+  for (const pkg of await packagesIn(fs, modules)) {
+    let manifest;
+    try {
+      manifest = JSON.parse(await fs.readFile(`${pkg}/package.json`));
+    } catch {
+      continue;
+    }
+    const declared = manifest.slicc?.filesystems;
+    if (!declared || typeof declared !== "object") continue;
+    for (const [type, entry] of Object.entries(declared)) {
+      const module = inside(pkg, entry?.module);
+      if (NAME.test(type) && module && !found.has(type)) found.set(type, module);
+    }
+  }
+  return found;
+}
 
 // src/fs/commands.ts
 var S_IFDIR2 = 16384;
@@ -1934,7 +1986,8 @@ function statJson(s) {
     mtimeMs: s.mtime.getTime(),
     atimeMs: s.atime.getTime(),
     ctimeMs: s.ctime.getTime(),
-    ino: s.ino
+    ino: s.ino,
+    ...s.dev !== void 0 ? { dev: s.dev } : {}
   };
 }
 async function readdirStat(fs, dir) {
@@ -1995,8 +2048,6 @@ async function run(fs, path, req, cwd) {
     case "utimes":
       await fs.utimes(path, new Date(req.atimeMs ?? 0), new Date(req.mtimeMs ?? 0));
       return done;
-    case "statfs":
-      return json(await storageUsage());
     default:
       return { ok: false, errno: "EINVAL", message: `sync-fs: unknown op '${req.op}'` };
   }
@@ -2006,7 +2057,13 @@ async function dispatchSyncFs(req) {
   if (!entry) return { ok: false, errno: "EACCES", message: "sync-fs: unknown or revoked token" };
   const { fs, cwd } = entry;
   try {
-    return await run(fs, fs.resolvePath(cwd, req.path), req, cwd);
+    const path = fs.resolvePath(cwd, req.path);
+    if (req.op === "statfs") return json(await entry.statfs?.(path) ?? await storageUsage());
+    if (req.op === "hold") {
+      entry.hold?.(path, req.mode === 1);
+      return done;
+    }
+    return await run(fs, path, req, cwd);
   } catch (err) {
     return toErrno(err);
   }
@@ -2070,7 +2127,7 @@ function attachSyncSabResponder(port, sab, token, opts) {
   const { header: header2, window } = views;
   const pending = /* @__PURE__ */ new Map();
   let disposed = false;
-  const { dispatch } = opts;
+  const { dispatch: dispatch2 } = opts;
   function drop(id) {
     const entry = pending.get(id);
     if (!entry) return;
@@ -2125,7 +2182,7 @@ function attachSyncSabResponder(port, sab, token, opts) {
     const req = { ...body, token };
     let dispatched;
     try {
-      dispatched = dispatch(req);
+      dispatched = dispatch2(req);
     } catch (err) {
       settle(id, {
         ok: false,
@@ -4747,6 +4804,10 @@ var VfsNodes = class {
     node.opens++;
     return node;
   }
+  holds(prefix) {
+    for (const path of this.byPath.keys()) if (within2(path, prefix)) return true;
+    return false;
+  }
   closed(node) {
     node.opens--;
     if (node.opens === 0 && this.byPath.get(node.path) === node) this.byPath.delete(node.path);
@@ -4924,6 +4985,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "proc-fork",
   "proc-kill",
   "proc-list",
+  "mount-list",
   "proc-exec",
   "proc-setpgid",
   "proc-getpgid",
@@ -4967,6 +5029,7 @@ var WasmProcess = class {
     this.options = options;
     this.children = new ChildTable(fds, options.spawner, options.forker);
     this.nodes = new VfsNodes(options.fs);
+    options.openFiles?.add(this.nodes);
     this.children.onChildState = () => this.signal(SIG.CHLD);
     this.children.onReap = options.onReap;
   }
@@ -5378,6 +5441,8 @@ var WasmProcess = class {
           kind: "json",
           json: this.options.processes?.() ?? { boot: 0, processes: [] }
         };
+      case "mount-list":
+        return { ok: true, kind: "json", json: this.options.mounts?.() ?? [] };
       case "proc-alarm":
         this.setAlarm(req.sig, req.firstMs ?? req.ms, req.repeat ? req.ms : 0, req.timer);
         return { ok: true, kind: "void" };
@@ -5435,6 +5500,7 @@ var WasmProcess = class {
     this.asyncOps.close();
     for (const pid of this.children.pids()) this.options.onReap?.(pid);
     await this.fds.closeAll();
+    this.options.openFiles?.delete(this.nodes);
     await this.options.http?.closeAll();
   }
 };
@@ -5482,6 +5548,8 @@ function spawnWasmProcess(opts) {
     fs: opts.fs,
     kill: opts.kill,
     processes: opts.processes,
+    openFiles: opts.openFiles,
+    mounts: opts.mounts,
     jobs: opts.jobs,
     ptys: opts.ptys,
     net: opts.net,
@@ -5494,13 +5562,24 @@ function spawnWasmProcess(opts) {
     raise: (sig) => signal(sig),
     ...opts.program.abi === "wasi" ? { pendingBits: () => Atomics.load(header2, SAB_I_SIGNALS) } : {}
   });
-  const token = mintSyncFsToken({ fs: opts.fs, cwd: opts.cwd });
+  const holds = /* @__PURE__ */ new Map();
+  opts.held?.add(holds);
+  const token = mintSyncFsToken({
+    fs: opts.fs,
+    cwd: opts.cwd,
+    ...opts.statfs ? { statfs: opts.statfs } : {},
+    hold: (path, on) => {
+      const count = (holds.get(path) ?? 0) + (on ? 1 : -1);
+      if (count > 0) holds.set(path, count);
+      else holds.delete(path);
+    }
+  });
   const worker = opts.createWorker();
-  const dispatch = async (req) => {
+  const dispatch2 = async (req) => {
     if (isWasmSyscall(req)) return process.syscall(req);
     return dispatchSyncFs(req);
   };
-  const responder = attachSyncSabResponder(worker, sab, token, { dispatch });
+  const responder = attachSyncSabResponder(worker, sab, token, { dispatch: dispatch2 });
   let settle;
   const exited = new Promise((resolve) => settle = resolve);
   let done4 = false;
@@ -5514,6 +5593,7 @@ function spawnWasmProcess(opts) {
     for (const tid of [...threads.keys()]) endThread(tid);
     responder.dispose();
     revokeSyncFsToken(token);
+    opts.held?.delete(holds);
     worker.terminate();
     void process.exit().then(
       () => settle(code),
@@ -5553,7 +5633,7 @@ function spawnWasmProcess(opts) {
     }
     const tsab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
     const tw = opts.createWorker();
-    const tresponder = attachSyncSabResponder(tw, tsab, token, { dispatch });
+    const tresponder = attachSyncSabResponder(tw, tsab, token, { dispatch: dispatch2 });
     const onThreadMessage = (event) => {
       const data = event.data;
       if (data?.type === WASM_THREAD_EXIT) endThread(thread.tid);
@@ -5719,6 +5799,815 @@ var JobTable = class {
   }
 };
 
+// src/mount/protocol.ts
+var DRIVER_PROTOCOL = [1, 0];
+function driverVersionError(theirs) {
+  const major = Array.isArray(theirs) ? theirs[0] : void 0;
+  if (major === DRIVER_PROTOCOL[0]) return void 0;
+  const named = typeof major === "number" ? `${major}.x` : "without a version";
+  return `slicc-kernel driver protocol ${named} is not supported: this side speaks ${DRIVER_PROTOCOL.join(".")}`;
+}
+
+// src/mount/driver.ts
+function fsError2(code, message2 = code) {
+  return Object.assign(new Error(message2), { code });
+}
+async function dispatch(h, req) {
+  switch (req.op) {
+    case "getattr":
+      return h.getattr(req.path);
+    case "readdir":
+      return h.readdir(req.path);
+    case "open":
+      return h.open(req.path, {
+        write: req.write,
+        create: req.create,
+        truncate: req.truncate,
+        exclusive: req.exclusive
+      });
+    case "read":
+      return h.read(req.fh, req.offset, req.size);
+    case "write":
+      return h.write(req.fh, req.offset, req.bytes);
+    case "release":
+      return h.release(req.fh);
+    case "mkdir":
+      return h.mkdir(req.path);
+    case "rmdir":
+      return h.rmdir(req.path);
+    case "unlink":
+      return h.unlink(req.path);
+    case "rename":
+      return h.rename(req.from, req.to);
+    case "symlink":
+      if (!h.symlink) throw fsError2("EPERM", "this file system has no symlinks");
+      return h.symlink(req.target, req.path);
+    case "readlink":
+      if (!h.readlink) throw fsError2("EINVAL", `${req.path} is not a symlink`);
+      return h.readlink(req.path);
+    case "setattr":
+      return h.setattr?.(req.path, {
+        ...req.mode !== void 0 ? { mode: req.mode } : {},
+        ...req.mtime !== void 0 ? { mtime: req.mtime } : {}
+      });
+    case "statfs":
+      return h.statfs?.() ?? null;
+    default:
+      throw fsError2("ENOSYS", `unknown driver op ${req.op}`);
+  }
+}
+function serveFilesystem(port, handlers, capabilities = {}) {
+  let open = false;
+  const reply = (message2, transfer = []) => port.postMessage(message2, transfer);
+  async function hello(message2) {
+    const refused = driverVersionError(message2.protocol);
+    if (refused) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused, errno: "EPROTO" } });
+      return;
+    }
+    try {
+      const refined = await handlers.mount?.(message2.mount);
+      open = true;
+      reply({
+        hello: { protocol: DRIVER_PROTOCOL, capabilities: { ...capabilities, ...refined } }
+      });
+    } catch (err) {
+      const code = err?.code;
+      reply({
+        hello: {
+          protocol: DRIVER_PROTOCOL,
+          error: err instanceof Error ? err.message : String(err),
+          errno: typeof code === "string" ? code : "EIO"
+        }
+      });
+    }
+  }
+  port.addEventListener("message", (event) => {
+    const data = event.data;
+    if (data.hello) {
+      void hello(data.hello);
+      return;
+    }
+    if (!open) return;
+    dispatch(handlers, data).then(
+      (result) => {
+        if (result instanceof Uint8Array) {
+          const bytes = result.slice();
+          reply({ id: data.id, result: bytes }, [bytes.buffer]);
+        } else reply({ id: data.id, result: result ?? null });
+      },
+      (err) => {
+        const code = err?.code;
+        reply({
+          id: data.id,
+          errno: typeof code === "string" ? code : "EIO",
+          message: err instanceof Error ? err.message : String(err)
+        });
+      }
+    );
+  });
+  port.start?.();
+  return { invalidate: (paths) => reply({ invalidate: paths }) };
+}
+
+// src/mount/connection.ts
+var DRIVER_TIMEOUT_MS = 3e4;
+function unref(timer) {
+  timer.unref?.();
+  return timer;
+}
+function errnoError(code, message2) {
+  return Object.assign(new Error(`${code}: ${message2}`), { code });
+}
+var DriverConnection = class _DriverConnection {
+  capabilities;
+  failure;
+  port;
+  waiting;
+  timeoutMs;
+  nextId = 0;
+  onFail;
+  constructor(port, capabilities, waiting, timeoutMs, onFail) {
+    this.port = port;
+    this.capabilities = capabilities;
+    this.waiting = waiting;
+    this.timeoutMs = timeoutMs;
+    this.onFail = onFail;
+  }
+  static async open(port, mount, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DRIVER_TIMEOUT_MS;
+    const waiting = /* @__PURE__ */ new Map();
+    const greeted = Promise.withResolvers();
+    port.addEventListener("message", (event) => {
+      const data = event.data;
+      if (data.hello) return greeted.resolve(data.hello);
+      if (data.invalidate !== void 0) return options.onInvalidate?.(data.invalidate);
+      const call = waiting.get(data.id);
+      if (!call) return;
+      waiting.delete(data.id);
+      clearTimeout(call.timer);
+      if (data.errno) call.reject(errnoError(data.errno, data.message ?? data.errno));
+      else call.resolve(data.result);
+    });
+    port.start?.();
+    port.postMessage({ hello: { protocol: DRIVER_PROTOCOL, mount } });
+    const timer = unref(
+      setTimeout(
+        () => greeted.reject(errnoError("EIO", `the driver did not answer within ${timeoutMs} ms`)),
+        timeoutMs
+      )
+    );
+    let hello;
+    try {
+      hello = await greeted.promise;
+    } finally {
+      clearTimeout(timer);
+    }
+    const refused = driverVersionError(hello.protocol);
+    if (refused) throw errnoError("EPROTO", refused);
+    if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
+    return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options.onFail);
+  }
+  call(call, transfer = []) {
+    if (this.failure) return Promise.reject(this.failure);
+    const id = ++this.nextId;
+    return new Promise((resolve, reject) => {
+      const timer = unref(
+        setTimeout(() => {
+          this.waiting.delete(id);
+          const error = errnoError(
+            "EIO",
+            `the driver did not answer ${call.op} within ${this.timeoutMs} ms`
+          );
+          reject(error);
+          this.fail(error);
+          this.onFail?.(error);
+        }, this.timeoutMs)
+      );
+      this.waiting.set(id, { resolve, reject, timer });
+      this.port.postMessage({ ...call, id }, transfer);
+    });
+  }
+  fail(error) {
+    if (this.failure) return;
+    this.failure = error;
+    for (const call of this.waiting.values()) {
+      clearTimeout(call.timer);
+      call.reject(error);
+    }
+    this.waiting.clear();
+  }
+  close() {
+    this.fail(errnoError("EIO", "the file system is unmounted"));
+    this.port.close?.();
+  }
+};
+
+// src/mount/mount-fs.ts
+var MAX_LINKS4 = 40;
+var DEFAULT_IO = 8 * 1024 * 1024;
+var UNITS = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3, t: 1024 ** 4 };
+function parseSize(text) {
+  const match = /^(\d+(?:\.\d+)?)\s*([kmgt]?)i?b?$/i.exec(text.trim());
+  if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
+  return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
+}
+var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+function heldUnder(held, target) {
+  for (const paths of held) for (const path of paths.keys()) if (within3(path, target)) return true;
+  return false;
+}
+var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+function statOf(attr, path, dev) {
+  const mtime = new Date(attr.mtime);
+  const fallback = attr.kind === "directory" ? 16877 : attr.kind === "symlink" ? 41471 : 33188;
+  return {
+    isFile: attr.kind === "file",
+    isDirectory: attr.kind === "directory",
+    isSymbolicLink: attr.kind === "symlink",
+    size: attr.size,
+    mode: attr.mode ?? fallback,
+    mtime,
+    atime: mtime,
+    ctime: mtime,
+    ino: attr.ino ?? inodeOf(path),
+    dev
+  };
+}
+function concat4(chunks2, total) {
+  if (chunks2.length === 1 && chunks2[0]?.length === total) return chunks2[0];
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const chunk2 of chunks2) {
+    out.set(chunk2, at);
+    at += chunk2.length;
+  }
+  return out;
+}
+var MountTable = class {
+  mounts = /* @__PURE__ */ new Map();
+  devices = 0;
+  pending = /* @__PURE__ */ new Set();
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  list() {
+    return [...this.mounts.values()].map(({ type, source, target, options, state, error }) => ({
+      type,
+      source,
+      target,
+      options: { ...options },
+      state,
+      ...error ? { error } : {}
+    }));
+  }
+  locate(path) {
+    let best;
+    for (const mount of this.mounts.values()) {
+      if (within3(path, mount.target) && (!best || mount.target.length > best.target.length))
+        best = mount;
+    }
+    if (!best) return void 0;
+    const rel = best.target === "/" ? path : path.slice(best.target.length);
+    return { mount: best, rel: rel || "/" };
+  }
+  async mount(spec, fs) {
+    const target = normalizePath(spec.target);
+    if (this.mounts.has(target) || this.pending.has(target)) {
+      throw errnoError("EBUSY", `${target} is already mounted`);
+    }
+    this.pending.add(target);
+    try {
+      return await this.attach(spec, target, fs);
+    } finally {
+      this.pending.delete(target);
+    }
+  }
+  async attach(spec, target, fs) {
+    const st = await fs.stat(target);
+    if (!st.isDirectory) throw errnoError("ENOTDIR", target);
+    const options = { ...spec.options };
+    const opened2 = await this.deps.open(spec.type, { ...spec, target, options });
+    let mounted;
+    const started = Promise.withResolvers();
+    opened2.onCrash?.((error) => {
+      if (mounted) this.crashed(mounted, error);
+      else
+        started.reject(
+          errnoError("EIO", `the ${spec.type} driver failed to start: ${error.message}`)
+        );
+    });
+    let conn;
+    try {
+      conn = await Promise.race([
+        DriverConnection.open(
+          opened2.port,
+          { source: spec.source, options },
+          {
+            ...this.deps.timeoutMs ? { timeoutMs: this.deps.timeoutMs } : {},
+            onInvalidate: (paths) => this.invalidated(target, paths),
+            onFail: (error) => {
+              if (mounted) this.crashed(mounted, error);
+            }
+          }
+        ),
+        started.promise
+      ]);
+    } catch (err) {
+      opened2.dispose();
+      throw err;
+    }
+    const caps = conn.capabilities;
+    const mount = {
+      type: spec.type,
+      source: spec.source,
+      target,
+      options,
+      state: "ok",
+      dev: 256 + ++this.devices,
+      conn,
+      caps,
+      maxFile: options.maxfile !== void 0 ? parseSize(options.maxfile) : caps.maxFile ?? 0,
+      attrs: /* @__PURE__ */ new Map(),
+      lists: /* @__PURE__ */ new Map(),
+      dispose: () => opened2.dispose()
+    };
+    mounted = mount;
+    this.mounts.set(target, mount);
+    return this.list().find((m) => m.target === target);
+  }
+  umount(target) {
+    const at = normalizePath(target);
+    const mount = this.mounts.get(at);
+    if (!mount) throw errnoError("EINVAL", `${at} is not mounted`);
+    if (this.deps.busy(at)) throw errnoError("EBUSY", `${at} has open files`);
+    this.mounts.delete(at);
+    mount.conn.close();
+    mount.dispose();
+  }
+  crashed(mount, error) {
+    mount.state = "failed";
+    mount.attrs.clear();
+    mount.lists.clear();
+    mount.error = error.message;
+    mount.conn.fail(
+      errnoError("EIO", `the ${mount.type} driver for ${mount.target} failed: ${error.message}`)
+    );
+  }
+  invalidated(target, paths) {
+    const mount = this.mounts.get(target);
+    if (!mount) return;
+    if (paths === true) {
+      mount.attrs.clear();
+      mount.lists.clear();
+      this.deps.changed?.(target);
+      return;
+    }
+    const full = paths.map((p) => normalizePath(`${target}/${p}`));
+    for (const path of full) this.forget(mount, path);
+    this.deps.changed?.(...full);
+  }
+  forget(mount, path) {
+    for (const key of [...mount.attrs.keys()]) if (within3(key, path)) mount.attrs.delete(key);
+    mount.lists.delete(path);
+    mount.lists.delete(parentOf4(path));
+    for (const key of [...mount.lists.keys()]) if (within3(key, path)) mount.lists.delete(key);
+  }
+  async getattr(mount, path, rel) {
+    if (mount.conn.failure) throw mount.conn.failure;
+    const cached = mount.attrs.get(path);
+    if (cached && cached.expires > Date.now()) return cached.value;
+    const attr = await mount.conn.call({ op: "getattr", path: rel });
+    const ttl = mount.caps.attrTtl ?? 1e3;
+    if (ttl > 0) mount.attrs.set(path, { value: attr, expires: Date.now() + ttl });
+    return attr;
+  }
+  async readdir(mount, path, rel) {
+    if (mount.conn.failure) throw mount.conn.failure;
+    const cached = mount.lists.get(path);
+    if (cached && cached.expires > Date.now()) return cached.value;
+    const entries = await mount.conn.call({ op: "readdir", path: rel });
+    const ttl = mount.caps.entryTtl ?? mount.caps.attrTtl ?? 1e3;
+    if (ttl > 0) mount.lists.set(path, { value: entries, expires: Date.now() + ttl });
+    return entries;
+  }
+  async statfs(path) {
+    const found = this.locate(normalizePath(path));
+    if (!found) return void 0;
+    const st = await found.mount.conn.call({ op: "statfs" });
+    if (!st) return { quota: 0, usage: 0 };
+    return { quota: st.blocks * st.bsize, usage: (st.blocks - st.bfree) * st.bsize };
+  }
+  wrap(base) {
+    return new MountFs(this, base);
+  }
+};
+var MountFs = class {
+  table;
+  base;
+  constructor(table, base) {
+    this.table = table;
+    this.base = base;
+  }
+  at(path) {
+    return this.table.locate(normalizePath(path));
+  }
+  writable(mount, path) {
+    if (mount.caps.readonly) throw errnoError("EROFS", path);
+  }
+  async follow(path, hops = 0, create = false) {
+    const found = this.at(path);
+    if (!found) return path;
+    const real = normalizePath(path);
+    let attr;
+    try {
+      attr = await this.table.getattr(found.mount, real, found.rel);
+    } catch (err) {
+      if (create && err.code === "ENOENT") return real;
+      throw err;
+    }
+    if (attr.kind !== "symlink") return real;
+    if (hops >= MAX_LINKS4) throw errnoError("ELOOP", path);
+    const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
+    return this.follow(this.base.resolvePath(parentOf4(real), target), hops + 1, create);
+  }
+  async open(mount, rel, write) {
+    return await mount.conn.call({
+      op: "open",
+      path: rel,
+      write,
+      create: write,
+      truncate: write,
+      exclusive: false
+    });
+  }
+  resolvePath(base, path) {
+    return this.base.resolvePath(base, path);
+  }
+  async readFile(path) {
+    return new TextDecoder().decode(await this.readFileBuffer(path));
+  }
+  async readFileBuffer(path) {
+    const real = await this.follow(path);
+    const found = this.at(real);
+    if (!found) return this.base.readFileBuffer(real);
+    const { mount, rel } = found;
+    const attr = await this.table.getattr(mount, real, rel);
+    if (attr.kind === "directory") throw errnoError("EISDIR", real);
+    if (mount.maxFile > 0 && attr.size > mount.maxFile) {
+      throw errnoError("EFBIG", `${real} is larger than this mount's maxfile (${mount.maxFile})`);
+    }
+    const fh = await this.open(mount, rel, false);
+    const chunk2 = mount.caps.maxIo ?? DEFAULT_IO;
+    const chunks2 = [];
+    let total = 0;
+    try {
+      for (; ; ) {
+        const bytes = await mount.conn.call({
+          op: "read",
+          fh,
+          offset: total,
+          size: chunk2
+        });
+        if (bytes.length === 0) break;
+        chunks2.push(bytes);
+        total += bytes.length;
+        if (bytes.length < chunk2 && total >= attr.size) break;
+      }
+    } finally {
+      await mount.conn.call({ op: "release", fh });
+    }
+    return concat4(chunks2, total);
+  }
+  async writeFile(path, content) {
+    const real = await this.follow(path, 0, true);
+    const found = this.at(real);
+    if (!found) return this.base.writeFile(real, content);
+    const { mount, rel } = found;
+    this.writable(mount, real);
+    const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+    if (mount.maxFile > 0 && bytes.length > mount.maxFile) {
+      throw errnoError(
+        "EFBIG",
+        `${real} would be larger than this mount's maxfile (${mount.maxFile})`
+      );
+    }
+    this.table.forget(mount, real);
+    const fh = await this.open(mount, rel, true);
+    const chunk2 = mount.caps.maxIo ?? DEFAULT_IO;
+    try {
+      for (let offset = 0; offset < bytes.length; offset += chunk2) {
+        await mount.conn.call({
+          op: "write",
+          fh,
+          offset,
+          bytes: bytes.slice(offset, offset + chunk2)
+        });
+      }
+    } finally {
+      await mount.conn.call({ op: "release", fh });
+      this.table.forget(mount, real);
+    }
+  }
+  async exists(path) {
+    if (!this.at(path)) return this.base.exists(path);
+    try {
+      await this.stat(path);
+      return true;
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT" || code === "ENOTDIR") return false;
+      throw err;
+    }
+  }
+  async lstat(path) {
+    const found = this.at(path);
+    if (!found) return this.base.lstat(path);
+    const real = normalizePath(path);
+    return statOf(await this.table.getattr(found.mount, real, found.rel), real, found.mount.dev);
+  }
+  async stat(path) {
+    const real = await this.follow(path);
+    return this.at(real) ? this.lstat(real) : this.base.stat(real);
+  }
+  async entries(path) {
+    const real = await this.follow(path);
+    const found = this.at(real);
+    if (!found) throw errnoError("ENOTDIR", real);
+    return {
+      real,
+      mount: found.mount,
+      list: await this.table.readdir(found.mount, real, found.rel)
+    };
+  }
+  async readdir(path) {
+    if (!this.at(path)) return this.base.readdir(path);
+    return (await this.entries(path)).list.map((e) => e.name);
+  }
+  async readdirStat(path) {
+    if (!this.at(path)) return this.base.readdirStat(path);
+    const { real, mount, list } = await this.entries(path);
+    return Promise.all(
+      list.map(async (entry) => {
+        const child = normalizePath(`${real}/${entry.name}`);
+        if (entry.attr && mount.caps.listingStats) {
+          return [entry.name, statOf(entry.attr, child, mount.dev)];
+        }
+        return [entry.name, await this.lstat(child).catch(() => null)];
+      })
+    );
+  }
+  async mkdir(path, options = {}) {
+    const found = this.at(path);
+    if (!found) return this.base.mkdir(path, options);
+    const { mount, rel } = found;
+    const real = normalizePath(path);
+    this.writable(mount, real);
+    if (!options.recursive) {
+      if (rel === "/") throw errnoError("EEXIST", real);
+      this.table.forget(mount, real);
+      await mount.conn.call({ op: "mkdir", path: rel });
+      return;
+    }
+    const parts = rel.split("/").filter(Boolean);
+    for (let n = 1; n <= parts.length; n++) {
+      const sub = `/${parts.slice(0, n).join("/")}`;
+      const full = normalizePath(`${mount.target}${sub}`);
+      const exists = await this.table.getattr(mount, full, sub).catch(() => void 0);
+      if (exists?.kind === "directory") continue;
+      if (exists) throw errnoError("ENOTDIR", full);
+      this.table.forget(mount, full);
+      await mount.conn.call({ op: "mkdir", path: sub });
+    }
+  }
+  async rm(path, options = {}) {
+    const found = this.at(path);
+    if (!found) return this.base.rm(path, options);
+    const { mount, rel } = found;
+    const real = normalizePath(path);
+    if (rel === "/") throw errnoError("EBUSY", `${real} is a mount point`);
+    this.writable(mount, real);
+    let attr;
+    try {
+      attr = await this.table.getattr(mount, real, rel);
+    } catch (err) {
+      if (options.force && err.code === "ENOENT") return;
+      throw err;
+    }
+    this.table.forget(mount, real);
+    if (attr.kind === "directory" && options.recursive) {
+      for (const entry of await this.table.readdir(mount, real, rel)) {
+        await this.rm(`${real}/${entry.name}`, { recursive: true, force: options.force ?? false });
+      }
+      this.table.forget(mount, real);
+    }
+    await mount.conn.call({ op: attr.kind === "directory" ? "rmdir" : "unlink", path: rel });
+    this.table.forget(mount, real);
+  }
+  async rename(from, to) {
+    const a = this.at(from);
+    const b = this.at(to);
+    if (!a && !b) return this.base.rename(from, to);
+    if (!a || !b || a.mount !== b.mount) throw errnoError("EXDEV", `${from} -> ${to}`);
+    this.writable(a.mount, normalizePath(to));
+    this.table.forget(a.mount, normalizePath(from));
+    this.table.forget(a.mount, normalizePath(to));
+    try {
+      await a.mount.conn.call({ op: "rename", from: a.rel, to: b.rel });
+    } finally {
+      this.table.forget(a.mount, normalizePath(from));
+      this.table.forget(a.mount, normalizePath(to));
+    }
+  }
+  async symlink(target, path) {
+    const found = this.at(path);
+    if (!found) return this.base.symlink(target, path);
+    this.writable(found.mount, normalizePath(path));
+    if (!found.mount.caps.symlinks)
+      throw errnoError("EPERM", `${path}: this file system has no symlinks`);
+    this.table.forget(found.mount, normalizePath(path));
+    await found.mount.conn.call({ op: "symlink", target, path: found.rel });
+  }
+  async readlink(path) {
+    const found = this.at(path);
+    if (!found) return this.base.readlink(path);
+    return await found.mount.conn.call({ op: "readlink", path: found.rel });
+  }
+  async chmod(path, mode) {
+    const found = this.at(path);
+    if (!found) return this.base.chmod(path, mode);
+    this.writable(found.mount, normalizePath(path));
+    if (!found.mount.caps.chmod) return;
+    this.table.forget(found.mount, normalizePath(path));
+    await found.mount.conn.call({ op: "setattr", path: found.rel, mode });
+  }
+  async utimes(path, atime, mtime) {
+    const found = this.at(path);
+    if (!found) return this.base.utimes(path, atime, mtime);
+    this.writable(found.mount, normalizePath(path));
+    this.table.forget(found.mount, normalizePath(path));
+    await found.mount.conn.call({ op: "setattr", path: found.rel, mtime: mtime.getTime() });
+  }
+};
+
+// src/mount/tmpfs.ts
+function tmpfs() {
+  let inodes = 0;
+  const make = (kind, mode) => ({
+    kind,
+    ino: ++inodes,
+    mode,
+    mtime: Date.now(),
+    data: new Uint8Array(0),
+    target: "",
+    children: /* @__PURE__ */ new Map()
+  });
+  const root = make("directory", 16877);
+  const handles = /* @__PURE__ */ new Map();
+  let nextFh = 0;
+  const parts = (path) => path.split("/").filter(Boolean);
+  function find(path) {
+    let node = root;
+    for (const name2 of parts(path)) {
+      if (node.kind !== "directory") throw fsError2("ENOTDIR", path);
+      const next = node.children.get(name2);
+      if (!next) throw fsError2("ENOENT", path);
+      node = next;
+    }
+    return node;
+  }
+  function parent(path) {
+    const names = parts(path);
+    const name2 = names.pop();
+    if (name2 === void 0) throw fsError2("EBUSY", "the root of a mount");
+    const dir = find(`/${names.join("/")}`);
+    if (dir.kind !== "directory") throw fsError2("ENOTDIR", path);
+    return { dir, name: name2 };
+  }
+  const attr = (node) => ({
+    kind: node.kind,
+    size: node.kind === "file" ? node.data.length : node.kind === "symlink" ? node.target.length : 4096,
+    mtime: node.mtime,
+    mode: node.mode,
+    ino: node.ino
+  });
+  const handle = (fh) => {
+    const found = handles.get(fh);
+    if (!found) throw fsError2("EBADF", `handle ${fh}`);
+    return found;
+  };
+  function opened2(path, flags) {
+    const { dir, name: name2 } = parent(path);
+    const existing = dir.children.get(name2);
+    if (existing && flags.exclusive) throw fsError2("EEXIST", path);
+    if (existing?.kind === "directory" && flags.write) throw fsError2("EISDIR", path);
+    if (existing) return existing;
+    if (!flags.create) throw fsError2("ENOENT", path);
+    const node = make("file", 33188);
+    dir.children.set(name2, node);
+    dir.mtime = Date.now();
+    return node;
+  }
+  return {
+    async getattr(path) {
+      return attr(find(path));
+    },
+    async readdir(path) {
+      const dir = find(path);
+      if (dir.kind !== "directory") throw fsError2("ENOTDIR", path);
+      return [...dir.children].map(
+        ([name2, node]) => ({ name: name2, kind: node.kind, attr: attr(node) })
+      );
+    },
+    async open(path, flags) {
+      const node = opened2(path, flags);
+      const data = flags.truncate ? new Uint8Array(0) : node.data.slice();
+      handles.set(++nextFh, { node, data, length: data.length, dirty: flags.truncate });
+      return nextFh;
+    },
+    async read(fh, offset, size) {
+      const h = handle(fh);
+      return h.data.slice(offset, Math.min(h.length, offset + size));
+    },
+    async write(fh, offset, bytes) {
+      const h = handle(fh);
+      const end = offset + bytes.length;
+      if (end > h.data.length) {
+        const grown = new Uint8Array(Math.max(end, h.data.length * 2));
+        grown.set(h.data.subarray(0, h.length));
+        h.data = grown;
+      }
+      h.data.set(bytes, offset);
+      h.length = Math.max(h.length, end);
+      h.dirty = true;
+    },
+    async release(fh) {
+      const h = handle(fh);
+      handles.delete(fh);
+      if (!h.dirty) return;
+      h.node.data = h.data.slice(0, h.length);
+      h.node.mtime = Date.now();
+    },
+    async mkdir(path) {
+      const { dir, name: name2 } = parent(path);
+      if (dir.children.has(name2)) throw fsError2("EEXIST", path);
+      dir.children.set(name2, make("directory", 16877));
+    },
+    async rmdir(path) {
+      const { dir, name: name2 } = parent(path);
+      const node = dir.children.get(name2);
+      if (!node) throw fsError2("ENOENT", path);
+      if (node.kind !== "directory") throw fsError2("ENOTDIR", path);
+      if (node.children.size > 0) throw fsError2("ENOTEMPTY", path);
+      dir.children.delete(name2);
+    },
+    async unlink(path) {
+      const { dir, name: name2 } = parent(path);
+      const node = dir.children.get(name2);
+      if (!node) throw fsError2("ENOENT", path);
+      if (node.kind === "directory") throw fsError2("EISDIR", path);
+      dir.children.delete(name2);
+    },
+    async rename(from, to) {
+      const a = `/${parts(from).join("/")}`;
+      const b = `/${parts(to).join("/")}`;
+      if (b !== a && b.startsWith(`${a}/`)) throw fsError2("EINVAL", `${to} is inside ${from}`);
+      const source = parent(from);
+      const node = source.dir.children.get(source.name);
+      if (!node) throw fsError2("ENOENT", from);
+      const target = parent(to);
+      const replaced = target.dir.children.get(target.name);
+      if (replaced === node) return;
+      if (replaced?.kind === "directory" && (node.kind !== "directory" || replaced.children.size > 0)) {
+        throw fsError2(node.kind === "directory" ? "ENOTEMPTY" : "EISDIR", to);
+      }
+      source.dir.children.delete(source.name);
+      target.dir.children.set(target.name, node);
+    },
+    async symlink(target, path) {
+      const { dir, name: name2 } = parent(path);
+      if (dir.children.has(name2)) throw fsError2("EEXIST", path);
+      const node = make("symlink", 41471);
+      node.target = target;
+      dir.children.set(name2, node);
+    },
+    async readlink(path) {
+      const node = find(path);
+      if (node.kind !== "symlink") throw fsError2("EINVAL", path);
+      return node.target;
+    },
+    async setattr(path, change) {
+      const node = find(path);
+      if (change.mode !== void 0) node.mode = node.mode & ~4095 | change.mode & 4095;
+      if (change.mtime !== void 0) node.mtime = change.mtime;
+    },
+    async statfs() {
+      return { bsize: 4096, blocks: 262144, bfree: 262144 };
+    }
+  };
+}
+
 // src/process/wasi/wasi-module.ts
 function importedMemory(bytes) {
   let at = 8;
@@ -5879,6 +6768,7 @@ function foreignImports(bytes) {
 }
 
 // src/launcher.ts
+var PNPM_HOME = "/home/.local/share/pnpm";
 var COMMAND2 = /^\/(?:usr\/)?bin\/([^/]+)$/;
 var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
 var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
@@ -5940,7 +6830,7 @@ function childHandle(handle) {
     onState: (listener) => handle.onState(listener)
   };
 }
-function concat4(chunks2) {
+function concat5(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, chunk2) => n + chunk2.length, 0));
   let offset = 0;
   for (const chunk2 of chunks2) {
@@ -5968,12 +6858,24 @@ var Launcher = class {
   ca;
   transport;
   watchers = new FsWatchers();
+  pnpmHome;
+  mounts;
+  createDriverWorker;
+  openFiles = /* @__PURE__ */ new Set();
+  held = /* @__PURE__ */ new Set();
   nextPid = 1e3;
   boot = Date.now();
   terminals = 0;
   constructor(options) {
-    this.base = this.watchers.wrap(options.fs);
+    this.mounts = new MountTable({
+      open: (type, spec) => this.driver(type, spec),
+      busy: (target) => [...this.openFiles].some((nodes) => nodes.holds(target)) || heldUnder(this.held, target),
+      changed: this.watchers.changed.bind(this.watchers)
+    });
+    this.base = this.watchers.wrap(this.mounts.wrap(options.fs));
     this.createWorker = options.createWorker;
+    this.createDriverWorker = options.createDriverWorker;
+    this.pnpmHome = options.env?.PNPM_HOME ?? PNPM_HOME;
     this.modulesDir = options.modules ?? "/node_modules";
     this.env = { ...networkEnv(), ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
@@ -5984,11 +6886,17 @@ var Launcher = class {
       ca: this.ca
     });
     this.fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
+    this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
+      this.catalog = void 0;
+    });
   }
   commands() {
-    this.catalog ??= scanCommands(this.base, this.modulesDir);
+    this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
     return this.catalog;
   }
+  async roots() {
+    return [this.modulesDir, ...await pnpmGlobalRoots(this.base, this.pnpmHome)];
+  }
   async resolve(file, argv0, cwd) {
     const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
     if (name2 !== void 0) {
@@ -6142,6 +7050,10 @@ var Launcher = class {
       forker: this.forker(pid, req),
       kill: (target, sig) => this.kill(target, sig),
       processes: () => ({ boot: this.boot, processes: this.list() }),
+      openFiles: this.openFiles,
+      held: this.held,
+      statfs: (path) => this.mounts.statfs(path),
+      mounts: () => this.mounts.list(),
       jobs: this.jobs,
       ptys: this.ptys,
       net: this.net,
@@ -6226,12 +7138,66 @@ var Launcher = class {
     if (sig !== 0) handle.signal(sig);
     return true;
   }
+  async driver(type, _spec) {
+    if (type === "tmpfs") {
+      const { port1, port2 } = new MessageChannel();
+      serveFilesystem(port2, tmpfs(), { symlinks: true, chmod: true, attrTtl: 0 });
+      return {
+        port: port1,
+        dispose: () => {
+          port1.close();
+          port2.close();
+        }
+      };
+    }
+    const module = (await scanFilesystems(this.base, await this.roots())).get(type);
+    if (!module) throw fsError("ENODEV", `unknown file system type ${type}`);
+    if (!this.createDriverWorker)
+      throw fsError("ENODEV", `this kernel cannot start ${type} drivers`);
+    const code = await this.base.readFile(module);
+    const worker = this.createDriverWorker();
+    const driver = new MessageChannel();
+    const client = new MessageChannel();
+    const served = serveClient(client.port1, {
+      launcher: async () => this,
+      scope: "transport"
+    });
+    worker.postMessage({ code, driver: driver.port2, client: client.port2 }, [
+      driver.port2,
+      client.port2
+    ]);
+    return {
+      port: driver.port1,
+      dispose: () => {
+        worker.terminate();
+        served.detach();
+        driver.port1.close();
+      },
+      onCrash: (listener) => worker.addEventListener("error", (event) => {
+        event.preventDefault?.();
+        listener(new Error(String(event.message)));
+      })
+    };
+  }
+  mount(spec) {
+    return this.mounts.mount(spec, this.fs);
+  }
+  umount(target) {
+    this.mounts.umount(target);
+  }
   async prepare() {
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     await writeCaFile(this.base, this.ca).catch(() => void 0);
   }
   environment(cwd, extra) {
-    return { PATH: "/usr/bin:/bin", HOME: "/home", ...this.env, PWD: cwd, ...extra };
+    return {
+      PATH: `/usr/bin:/bin:${this.pnpmHome}/bin`,
+      HOME: "/home",
+      PNPM_HOME: this.pnpmHome,
+      ...this.env,
+      PWD: cwd,
+      ...extra
+    };
   }
   async starting(argv, dir) {
     this.catalog = void 0;
@@ -6293,7 +7259,7 @@ var Launcher = class {
 `));
     if (!planned) {
       report(`${file}: command not found`);
-      return { status: NOT_FOUND, stdout: concat4(out), stderr: concat4(err) };
+      return { status: NOT_FOUND, stdout: concat5(out), stderr: concat5(err) };
     }
     const fds = new FdTable();
     fds.installAt(0, options.stdin ? bytesSource(options.stdin) : nullFile());
@@ -6302,7 +7268,7 @@ var Launcher = class {
     const handle = await this.launch(planned, { env, cwd, fds, report });
     options.onStarted?.(handle.pid);
     const status = await handle.exited;
-    return { status, stdout: concat4(out), stderr: concat4(err) };
+    return { status, stdout: concat5(out), stderr: concat5(err) };
   }
 };
 
@@ -6598,7 +7564,7 @@ async function holdLock(locks) {
   await granted.promise;
   return { name: name2, release: () => held.resolve() };
 }
-function concat5(chunks2) {
+function concat6(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let at = 0;
   for (const chunk2 of chunks2) {
@@ -6720,7 +7686,7 @@ async function runOn(channel, argv, opts) {
     onStderr: tee(2, onStderr)
   });
   const status = await child.exited;
-  const text = (fd) => new TextDecoder().decode(concat5(chunks2[fd]));
+  const text = (fd) => new TextDecoder().decode(concat6(chunks2[fd]));
   return { pid: child.pid, status, stdout: text(1), stderr: text(2) };
 }
 async function terminalOn(channel, argv, opts) {
@@ -6799,6 +7765,17 @@ function fsOn(channel) {
     }
   };
 }
+function since(channel, minor, what, run2) {
+  if (channel.protocol[1] < minor) {
+    return Promise.reject(
+      new KernelCallError(
+        `this kernel speaks protocol ${channel.protocol.join(".")}, which has no ${what}`,
+        "ENOSYS"
+      )
+    );
+  }
+  return run2();
+}
 async function greet(channel, lock, timeoutMs) {
   channel.post({ hello: { protocol: PROTOCOL, ...lock ? { lock } : {} } });
   const timer = setTimeout(
@@ -6841,6 +7818,9 @@ async function attachKernel(port, options = {}) {
     run: (argv, opts = {}) => runOn(channel, argv, opts),
     openTerminal: (argv, opts = {}) => terminalOn(channel, argv, opts),
     ps: () => channel.call({ op: "ps" }),
+    mount: (spec) => since(channel, 2, "mount", () => channel.call({ op: "mount", spec })),
+    umount: async (target) => void await since(channel, 2, "umount", () => channel.call({ op: "umount", target })),
+    mounts: () => since(channel, 2, "mounts", () => channel.call({ op: "mounts" })),
     kill: async (pid, signal = "SIGTERM") => void await channel.call({ op: "kill", pid, signal }),
     fetch: (req) => {
       const { signal, ...rest } = req;
@@ -6919,6 +7899,11 @@ async function createNodeKernel(options = {}) {
   const launcher = new Launcher({
     fs,
     createWorker: () => nodeWorker(file, live, terminated),
+    createDriverWorker: () => nodeWorker(
+      options.driverWorker ?? new URL("./node-driver-worker.js", import.meta.url),
+      live,
+      terminated
+    ),
     ...options.modules ? { modules: options.modules } : {},
     ...options.env ? { env: options.env } : {},
     ...transport ? { transport } : {}
@@ -6982,6 +7967,9 @@ async function createNodeKernel(options = {}) {
       await fs.writeFile(path, data);
     },
     readFile: async (path) => fs.readFileBuffer(path),
+    mount: (spec) => guard(() => launcher.mount(spec)),
+    umount: (target) => guard(async () => launcher.umount(target)),
+    mounts: async () => launcher.mounts.list(),
     async connect() {
       if (terminated) throw new Error(TERMINATED);
       const { port1, port2 } = new MessageChannel2();