@ai-ecoverse/slicc-kernel 1.123.2 → 1.124.1

package/dist/node.js

@@ -1404,6 +1404,111 @@ var Routes = class {
   }
 };
 
+// src/kernel/net/switch-conn.ts
+var SwitchConn = class {
+  raw;
+  box = [];
+  pulling = false;
+  waiters = [];
+  switching = false;
+  secure;
+  failed;
+  constructor(raw) {
+    this.raw = raw;
+  }
+  get localAddr() {
+    return this.raw.localAddr;
+  }
+  get remoteAddr() {
+    return this.raw.remoteAddr;
+  }
+  get upgraded() {
+    return this.switching || this.secure !== void 0;
+  }
+  wake() {
+    for (const wake of this.waiters.splice(0)) wake();
+  }
+  changed() {
+    return new Promise((resolve2) => this.waiters.push(resolve2));
+  }
+  pull() {
+    if (this.pulling || this.box.length > 0) return;
+    this.pulling = true;
+    this.raw.read().then(
+      (bytes) => this.box.push(bytes),
+      (err) => this.box.push(err instanceof Error ? err : new Error(String(err)))
+    ).finally(() => {
+      this.pulling = false;
+      this.wake();
+    });
+  }
+  take() {
+    const next3 = this.box.shift();
+    if (next3 instanceof Error) throw next3;
+    return next3;
+  }
+  async rawRead() {
+    while (this.box.length === 0) {
+      this.pull();
+      await this.changed();
+    }
+    return this.take();
+  }
+  async read() {
+    for (; ; ) {
+      if (this.failed) throw this.failed;
+      if (this.secure) return this.secure.read();
+      if (!this.switching && this.box.length > 0) return this.take();
+      if (!this.switching) this.pull();
+      await this.changed();
+    }
+  }
+  async settled() {
+    while (this.switching) await this.changed();
+    if (this.failed) throw this.failed;
+    return this.secure ?? this.raw;
+  }
+  async write(bytes) {
+    return (await this.settled()).write(bytes);
+  }
+  closeWrite() {
+    void this.settled().then(
+      (conn) => conn.closeWrite(),
+      () => void 0
+    );
+  }
+  close() {
+    this.failed ??= new Error("closed");
+    this.secure?.close();
+    this.raw.close();
+    this.wake();
+  }
+  async upgrade(make) {
+    if (this.upgraded) throw new Error("already upgraded");
+    this.switching = true;
+    this.wake();
+    const view2 = {
+      localAddr: this.raw.localAddr,
+      remoteAddr: this.raw.remoteAddr,
+      read: () => this.rawRead(),
+      write: (bytes) => this.raw.write(bytes),
+      closeWrite: () => this.raw.closeWrite(),
+      close: () => this.raw.close()
+    };
+    try {
+      const { conn, info } = await make(view2);
+      this.secure = conn;
+      return info;
+    } catch (err) {
+      this.failed = err instanceof Error ? err : new Error(String(err));
+      throw err;
+    } finally {
+      this.switching = false;
+      this.wake();
+    }
+  }
+};
+
 // src/kernel/net/uplink-socket.ts
 var CHUNK = 64 * 1024;
 function hostPort(text) {
@@ -1728,7 +1833,18 @@ var KernelSocket = class _KernelSocket {
       clearTimeout(timer);
     }
   }
-  dial(addr, route) {
+  switch;
+  connectSecure(addr, route, secure2) {
+    if (this.state !== "open") throw new KernelError("EISCONN");
+    return this.dial(addr, route, secure2);
+  }
+  upgradeSecure(make) {
+    if (this.state !== "connected") throw new KernelError("ENOTCONN");
+    if (!this.switch) throw new KernelError("EOPNOTSUPP");
+    if (this.switch.upgraded || this.writeShut || this.readShut) throw new KernelError("EINVAL");
+    return this.switch.upgrade(make);
+  }
+  dial(addr, route, secure2) {
     this.state = "connecting";
     const abort = new AbortController();
     this.dialing = abort;
@@ -1749,11 +1865,25 @@ var KernelSocket = class _KernelSocket {
       () => void 0
     );
     return Promise.race([dialled, abandoned]).then(
-      (conn) => {
+      async (raw) => {
         if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
+        const conn = new SwitchConn(raw);
+        if (secure2) {
+          clearTimeout(timer);
+          try {
+            await Promise.race([secure2(conn), abandoned]);
+          } catch (e) {
+            conn.close();
+            throw this.dialFailed(
+              abort,
+              e instanceof KernelError ? e : new KernelError("ENOTSUP", e instanceof Error ? e.message : String(e))
+            );
+          }
+        }
         this.local = { family: "inet", host: "0.0.0.0", port: 0, ...hostPort(conn.localAddr) };
         this.peer = { ...addr, ...hostPort(conn.remoteAddr) };
         this.dialing = void 0;
+        this.switch = conn;
         this.attach(
           uplinkLink(conn, () => {
             this.reset = true;
@@ -1762,17 +1892,19 @@ var KernelSocket = class _KernelSocket {
         );
       },
       (e) => {
-        const error = dialError(e, timedOut, abort.signal.aborted);
-        if (this.dialing === abort) {
-          this.dialing = void 0;
-          this.failed = error.code;
-          this.state = "open";
-          this.changes.wake();
-        }
-        throw error;
+        throw this.dialFailed(abort, dialError(e, timedOut, abort.signal.aborted));
       }
     ).finally(() => clearTimeout(timer));
   }
+  dialFailed(abort, error) {
+    if (this.dialing === abort) {
+      this.dialing = void 0;
+      this.failed = error.code;
+      this.state = "open";
+      this.changes.wake();
+    }
+    return error;
+  }
   unlink() {
     const link2 = this.link;
     if (link2) {
@@ -1878,6 +2010,7 @@ var LoopbackNet = class {
   useUplink(route) {
     this.route = route;
   }
+  tlsClient;
   uplinkFor(host) {
     const route = this.route;
     if (!route) return void 0;
@@ -2019,12 +2152,12 @@ function serveSocket(socket, port, onClose) {
   let writes = Promise.resolve();
   let credit = 0;
   let granted2;
-  const send = (message3, transfer) => {
+  const send2 = (message3, transfer) => {
     if (!closed) port.postMessage(message3, transfer);
   };
   const close = (reset = false) => {
     if (closed) return;
-    if (reset) send({ error: "ECONNRESET" });
+    if (reset) send2({ error: "ECONNRESET" });
     closed = true;
     granted2?.();
     socket.close();
@@ -2036,9 +2169,9 @@ function serveSocket(socket, port, onClose) {
       if (closed) return;
       try {
         await socket.write(data);
-        send({ ack: true });
+        send2({ ack: true });
       } catch (err) {
-        send({ error: codeOf(err) });
+        send2({ error: codeOf(err) });
       }
     });
   };
@@ -2063,11 +2196,11 @@ function serveSocket(socket, port, onClose) {
         const chunk2 = await socket.read(CHUNK2);
         if (chunk2.length === 0) break;
         credit--;
-        send(chunk2, [chunk2.buffer]);
+        send2(chunk2, [chunk2.buffer]);
       }
-      send({ end: true });
+      send2({ end: true });
     } catch (err) {
-      send({ error: codeOf(err) });
+      send2({ error: codeOf(err) });
     }
   })();
   return () => close(true);
@@ -2382,7 +2515,7 @@ function requestBody(request) {
   return request.body ? { body: request.body } : {};
 }
 function fetchTransport(options = {}) {
-  const send = options.fetch ?? globalThis.fetch.bind(globalThis);
+  const send2 = options.fetch ?? globalThis.fetch.bind(globalThis);
   const Socket = options.webSocket === true ? globalThis.WebSocket : options.webSocket || void 0;
   const headers = options.webSocketHeaders === true;
   const redirect = options.redirect ?? "follow";
@@ -2399,7 +2532,7 @@ function fetchTransport(options = {}) {
     async fetch(request) {
       let response;
       try {
-        response = await send(request.url, {
+        response = await send2(request.url, {
           method: request.method,
           headers: joinHeaders(request.headers),
           ...requestBody(request),
@@ -3199,7 +3332,7 @@ function joinable(l, pgid, ours) {
   if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
   if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
 }
-function cdpRegistry(send, gone) {
+function cdpRegistry(send2, gone) {
   const registered = /* @__PURE__ */ new Map();
   const drop = (id2) => {
     registered.get(id2)?.();
@@ -3208,7 +3341,7 @@ function cdpRegistry(send, gone) {
   return {
     serve(l, req) {
       const hook = portCdpHook(
-        (request, cdp) => send({ cdpOpen: { ...request, registration: req.id }, port: cdp }, [
+        (request, cdp) => send2({ cdpOpen: { ...request, registration: req.id }, port: cdp }, [
           cdp
         ]),
         gone
@@ -3222,7 +3355,7 @@ function cdpRegistry(send, gone) {
     }
   };
 }
-function facadeRegistry(send, gone) {
+function facadeRegistry(send2, gone) {
   const registered = /* @__PURE__ */ new Map();
   const drop = (id2) => {
     registered.get(id2)?.();
@@ -3231,7 +3364,7 @@ function facadeRegistry(send, gone) {
   return {
     serve(l, req) {
       const hook = portFacadeHook(
-        (request, facade) => send({ facadeOpen: { ...request, registration: req.id }, port: facade }, [
+        (request, facade) => send2({ facadeOpen: { ...request, registration: req.id }, port: facade }, [
           facade
         ]),
         gone
@@ -3245,9 +3378,9 @@ function facadeRegistry(send, gone) {
     }
   };
 }
-function hostRegistries(send, gone) {
-  const cdps = cdpRegistry(send, gone);
-  const facades = facadeRegistry(send, gone);
+function hostRegistries(send2, gone) {
+  const cdps = cdpRegistry(send2, gone);
+  const facades = facadeRegistry(send2, gone);
   return {
     answer(l, req) {
       if (req.op === "serve-cdp") return cdps.serve(l, req);
@@ -3274,21 +3407,21 @@ function visibleTo(g, notify) {
     });
   };
 }
-async function watchOp(l, req, watches, send, g) {
+async function watchOp(l, req, watches, send2, g) {
   if (req.op === "unwatch") {
     watches.get(req.watch)?.();
     watches.delete(req.watch);
     return { result: true };
   }
   if (g) for (const path of req.paths) await readable(g, "watch", l.fs.resolvePath("/", path));
-  const notify = visibleTo(g, (change) => send({ watch: req.id, change }));
+  const notify = visibleTo(g, (change) => send2({ watch: req.id, change }));
   const unwatch = l.watchers.watch(req.paths, { recursive: req.recursive }, notify);
   watches.set(req.id, unwatch);
   return { result: req.id };
 }
 var TRAITS_WATCH = -1;
-function traitsWatch(launcher, transport, send) {
-  return launcher.onTraits(() => send({ traits: transport.traits }));
+function traitsWatch(launcher, transport, send2) {
+  return launcher.onTraits(() => send2({ traits: transport.traits }));
 }
 function serveClient(port, host) {
   let state = "new";
@@ -3300,14 +3433,14 @@ function serveClient(port, host) {
   const watches = /* @__PURE__ */ new Map();
   let net;
   const ended = Promise.withResolvers();
-  const send = (message3, transfer = []) => {
+  const send2 = (message3, transfer = []) => {
     if (state !== "closed") port.postMessage(message3, transfer);
   };
-  const reply = (id2, body, transfer) => send({ id: id2, ...body }, transfer);
-  const hosts = hostRegistries(send, ended.promise);
+  const reply = (id2, body, transfer) => send2({ id: id2, ...body }, transfer);
+  const hosts = hostRegistries(send2, ended.promise);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
-    send({ bye });
+    send2({ bye });
     state = "closed";
     net?.close();
     for (const unwatch of watches.values()) unwatch();
@@ -3321,19 +3454,19 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused2 = versionError(message3.protocol);
-    if (refused2) {
-      send({ hello: { protocol: PROTOCOL, error: refused2 } });
+    const refused3 = versionError(message3.protocol);
+    if (refused3) {
+      send2({ hello: { protocol: PROTOCOL, error: refused3 } });
       detach();
       return;
     }
     const launcher = await host.launcher();
     if (host.scope !== "transport") self = await accountOf(launcher, host.user ?? 0);
     const transport = host.transport?.() ?? launcher.transport;
-    net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
+    net = serveTransport({ postMessage: (m, t) => send2(m, t) }, transport);
     state = "open";
     if (message3.lock && host.locks) void host.locks.request(message3.lock, () => detach());
-    send({
+    send2({
       hello: {
         protocol: PROTOCOL,
         traits: transport.traits,
@@ -3341,7 +3474,7 @@ function serveClient(port, host) {
         ...host.lock ? { lock: host.lock } : {}
       }
     });
-    watches.set(TRAITS_WATCH, traitsWatch(launcher, transport, send));
+    watches.set(TRAITS_WATCH, traitsWatch(launcher, transport, send2));
   }
   async function terminal(req, l) {
     const session = await l.openTerminal(req.argv, {
@@ -3405,7 +3538,7 @@ function serveClient(port, host) {
         return clientFs(l, host.tag, self, req);
       case "watch":
       case "unwatch":
-        return watchOp(l, req, watches, send, guard2(l));
+        return watchOp(l, req, watches, send2, guard2(l));
       case "mount":
         return { result: await l.mountAs(clientCred(self), req.spec) };
       case "umount":
@@ -3431,7 +3564,7 @@ function serveClient(port, host) {
     if (data.hello) {
       if (state === "new") {
         hello(data.hello).catch((err) => {
-          send({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
+          send2({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
           detach();
         });
       }
@@ -5646,18 +5779,19 @@ var UnlinkedKeeper = class {
     const keeper = this;
     const { replacing } = this;
     const replace = async (target, op) => {
-      const before = replacing.get(target);
       const { promise, resolve: resolve2 } = Promise.withResolvers();
-      const mine = {
-        done: Promise.all([before?.done, promise]).then(() => void 0)
+      let mine;
+      const gated = () => {
+        const before = replacing.get(target);
+        mine = { done: Promise.all([before?.done, promise]).then(() => void 0) };
+        replacing.set(target, mine);
       };
-      replacing.set(target, mine);
       try {
-        await op();
+        await op(gated);
       } finally {
         keeper.replaced += 1;
         resolve2();
-        if (replacing.get(target) === mine) replacing.delete(target);
+        if (mine && replacing.get(target) === mine) replacing.delete(target);
       }
     };
     const unreplaced = async (path, op) => {
@@ -5702,8 +5836,8 @@ var UnlinkedKeeper = class {
       async rename(from, to) {
         const target = fs.resolvePath("/", to);
         if (target === fs.resolvePath("/", from)) return fs.rename(from, to);
-        await replace(target, async () => {
-          const pinned = await keeper.pin(target);
+        await replace(target, async (gated) => {
+          const pinned = await keeper.pin(target, gated);
           await keeper.settle(pinned, () => fs.rename(from, to));
         });
       },
@@ -5720,7 +5854,7 @@ var UnlinkedKeeper = class {
     }
     pinned.commit();
   }
-  async pin(target) {
+  heldWithin(target) {
     const held = /* @__PURE__ */ new Map();
     for (const holder of this.holders) {
       if (holder.owns(target)) continue;
@@ -5729,11 +5863,19 @@ var UnlinkedKeeper = class {
         held.set(path, [...held.get(path) ?? [], holder]);
       }
     }
-    const paths = [...held.keys()].sort();
+    return held;
+  }
+  async pin(target, gated = () => void 0) {
+    const paths = [...this.heldWithin(target).keys()].sort();
     const releases = [];
     for (const path of paths) releases.push(await this.gate.acquire(path));
+    gated();
+    const now = this.heldWithin(target);
+    const held = new Map(
+      paths.flatMap((path) => now.has(path) ? [[path, now.get(path)]] : [])
+    );
     const hidden = /* @__PURE__ */ new Map();
-    for (const path of paths) {
+    for (const path of held.keys()) {
       const at = await this.hide(path);
       if (at !== void 0) hidden.set(path, at);
     }
@@ -6802,7 +6944,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.123.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.124.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -7084,13 +7226,13 @@ async function tierPackages(fs, physical, roots, bins, kernel) {
       const own = commandsOf(pkg, manifest);
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
-      const refused2 = engineRefusal(manifest, kernel);
+      const refused3 = engineRefusal(manifest, kernel);
       const commands = [...own, ...extra];
       out.push({
         name: pkg.slice(root.length + 1),
         pkg,
         replaces: replacesOf(manifest),
-        commands: refused2 ? commands.map((command) => ({ ...command, refused: refused2 })) : commands
+        commands: refused3 ? commands.map((command) => ({ ...command, refused: refused3 })) : commands
       });
     }
   }
@@ -8400,8 +8542,8 @@ var RealmProxy = class {
   }
   async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const refused2 = target.port === 443 ? await this.tunnelReady(target) : void 0;
-    if (refused2) throw refused2;
+    const refused3 = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused3) throw refused3;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
       const first = await incoming.peek(this.stop.signal);
@@ -10055,8 +10197,8 @@ var DriverConnection = class _DriverConnection {
     } finally {
       clearTimeout(timer);
     }
-    const refused2 = driverVersionError(hello.protocol);
-    if (refused2) throw errnoError("EPROTO", refused2);
+    const refused3 = driverVersionError(hello.protocol);
+    if (refused3) throw errnoError("EPROTO", refused3);
     if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
     return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options);
   }
@@ -11878,8 +12020,8 @@ async function guarded(entry, path, req) {
     return { paths };
   } catch (err) {
     const refusal2 = err.code === "EACCES";
-    const refused2 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
-    return { refused: refused2 };
+    const refused3 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
+    return { refused: refused3 };
   }
 }
 async function createExclusive(fs, path, owner) {
@@ -11990,13 +12132,13 @@ async function dispatchSyncFs(req) {
   }
 }
 var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
-async function rmPermitted(entry, path, req, refused2) {
+async function rmPermitted(entry, path, req, refused3) {
   const st = await entry.fs.lstat(path).catch(() => void 0);
-  if (!st?.isDirectory) return refused2;
+  if (!st?.isDirectory) return refused3;
   const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
   if ("refused" in unlisted) return unlisted.refused;
   const names = await entry.fs.readdir(path).catch(() => void 0);
-  if (!names) return refused2;
+  if (!names) return refused3;
   let first;
   for (const name2 of names) {
     const child = await dispatchOne(entry, {
@@ -12047,14 +12189,14 @@ async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
   if (!named && !CREATIONS.has(req.op)) return void 0;
   const target = named ? entry.fs.resolvePath(entry.cwd, req.arg2 ?? "") : path;
-  const refused2 = devCreation(target, entry.cred?.());
-  if (!refused2) return void 0;
+  const refused3 = devCreation(target, entry.cred?.());
+  if (!refused3) return void 0;
   const there = await entry.fs.lstat(target).then(
     () => true,
     () => false
   );
   if (there) return void 0;
-  return { ok: false, errno: refused2, message: `${target}: no new names in /dev or /proc` };
+  return { ok: false, errno: refused3, message: `${target}: no new names in /dev or /proc` };
 }
 async function dispatchOne(entry, req) {
   const { fs, cwd } = entry;
@@ -13457,6 +13599,9 @@ var FlockTable = class {
   held = /* @__PURE__ */ new Map();
   keys = /* @__PURE__ */ new WeakMap();
   wakers = /* @__PURE__ */ new Map();
+  isFree(key, owner, kind) {
+    return this.free(key, owner, kind);
+  }
   free(key, owner, kind) {
     for (const [other, has] of this.held.get(key) ?? [])
       if (other !== owner && (kind === "exclusive" || has === "exclusive")) return false;
@@ -13583,9 +13728,18 @@ var LockTable = class {
     );
     this.wake(key);
   }
+  wholeFree(pid, path, exclusive) {
+    for (const [other, h] of this.held.get(path) ?? []) {
+      if (other !== pid && (exclusive || h.exclusive)) return false;
+    }
+    return true;
+  }
+  flockFree(key, owner, kind) {
+    return this.flocks.isFree(key, owner, kind);
+  }
   lock(pid, path, exclusive, fd) {
+    if (!this.wholeFree(pid, path, exclusive)) return false;
     const holders = this.held.get(path) ?? /* @__PURE__ */ new Map();
-    for (const [other, h] of holders) if (other !== pid && (exclusive || h.exclusive)) return false;
     const mine = holders.get(pid) ?? { exclusive, fds: /* @__PURE__ */ new Set() };
     mine.exclusive = exclusive;
     mine.fds.add(fd);
@@ -13770,12 +13924,12 @@ var AsyncOps = class {
 async function hostSyscall(req, ctx) {
   switch (req.op) {
     case "lock":
-      if (!ctx.locks) throw new KernelError("ENOSYS");
-      if (!ctx.locks.lock(ctx.pid, req.path, req.exclusive, req.fd))
-        throw new KernelError("EAGAIN");
-      return done2;
+      return wholeLock(req, ctx);
     case "unlock":
       ctx.locks?.unlock(ctx.pid, req.path);
+      if (req.fd !== void 0 && ctx.locks?.shared?.() && ctx.flockOf) {
+        return flock({ op: "flock", fd: req.fd, kind: "unlock" }, ctx);
+      }
       return done2;
     case "lk-set":
     case "lk-get":
@@ -13805,6 +13959,23 @@ async function hostSyscall(req, ctx) {
       return done2;
   }
 }
+async function wholeLock(req, ctx) {
+  const { locks, flockOf } = ctx;
+  if (!locks) throw new KernelError("ENOSYS");
+  const kind = req.exclusive ? "exclusive" : "shared";
+  if (locks.shared?.() && flockOf) {
+    if (locks.wholeFree?.(ctx.pid, req.path, req.exclusive) === false) {
+      throw new KernelError("EAGAIN");
+    }
+    return flock({ op: "flock", fd: req.fd, kind }, ctx);
+  }
+  if (flockOf && locks.flockFree) {
+    const { key, owner } = await flockOf(req.fd);
+    if (!locks.flockFree(key, owner, kind)) throw new KernelError("EAGAIN");
+  }
+  if (!locks.lock(ctx.pid, req.path, req.exclusive, req.fd)) throw new KernelError("EAGAIN");
+  return done2;
+}
 var FLOCK_KINDS = /* @__PURE__ */ new Set(["shared", "exclusive", "unlock"]);
 async function flock(req, ctx) {
   const { locks, flockOf } = ctx;
@@ -13991,8 +14162,8 @@ var KernelLoopback = class {
       );
     } catch (err) {
       socket.close();
-      const refused2 = err instanceof KernelError && err.code === "ECONNREFUSED";
-      throw refused2 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+      const refused3 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused3 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
     }
     signal.addEventListener("abort", () => socket.close(), { once: true });
     return socket;
@@ -14484,6 +14655,7 @@ function realmCa(owner, store) {
 }
 
 // src/kernel/net/tls-engine.ts
+var TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -14544,6 +14716,76 @@ var TlsEngine = class {
     const n = fn(this.scratch, SCRATCH);
     return n > 0 ? this.taken(n) : n;
   }
+  get client() {
+    return typeof this.m._tls_client_new === "function" ? this.m : void 0;
+  }
+  clientModule() {
+    const m = this.client;
+    if (!m) throw new TlsError(0, "tls client: the installed tls engine has no client sessions");
+    return m;
+  }
+  store() {
+    const m = this.clientModule();
+    const ptr = m._tls_ca_new();
+    if (!ptr) throw this.error(m._tls_last_error(), "trust store");
+    return new TlsStore(this, m, ptr);
+  }
+  clientSession(store, servername, alpn, flags2) {
+    const m = this.clientModule();
+    const wire = alpnWire(alpn);
+    const name2 = this.put(new TextEncoder().encode(servername));
+    try {
+      const at = store?.ptr ?? 0;
+      const ptr = this.withBytes(wire, (p) => m._tls_client_new(at, name2, p, wire.length, flags2));
+      if (!ptr) throw this.error(m._tls_last_error(), "tls client");
+      return new TlsSession(this, m, ptr);
+    } finally {
+      this.m._free(name2);
+    }
+  }
+  verifyInfo(flags2) {
+    const m = this.clientModule();
+    const n = m._tls_verify_info(flags2, this.scratch, SCRATCH);
+    const end = this.m.HEAPU8.indexOf(0, this.scratch);
+    const text = new TextDecoder().decode(this.m.HEAPU8.subarray(this.scratch, end));
+    return n < 0 ? `${text}\u2026` : text;
+  }
+};
+function alpnWire(names) {
+  const parts2 = names.map((name2) => new TextEncoder().encode(name2));
+  const out = new Uint8Array(parts2.reduce((n, p) => n + p.length + 1, 0));
+  let at = 0;
+  for (const part of parts2) {
+    out[at++] = part.length;
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+var TlsStore = class {
+  engine;
+  m;
+  ptr;
+  constructor(engine, m, ptr) {
+    this.engine = engine;
+    this.m = m;
+    this.ptr = ptr;
+  }
+  add(der) {
+    const ret = this.engine.withBytes(der, (p) => this.m._tls_ca_add_der(this.ptr, p, der.length));
+    if (ret !== 0) throw this.engine.error(ret, "trust store certificate");
+  }
+  addBundle(bytes) {
+    const n = this.engine.withBytes(
+      bytes,
+      (p) => this.m._tls_ca_add_bundle(this.ptr, p, bytes.length)
+    );
+    if (n < 0) throw this.engine.error(n, "trust store bundle");
+    return n;
+  }
+  release() {
+    this.m._tls_ca_free(this.ptr);
+  }
 };
 var TlsLeaf = class {
   engine;
@@ -14608,6 +14850,33 @@ var TlsSession = class {
   free() {
     this.m._tls_session_free(this.ptr);
   }
+  get c() {
+    return this.m;
+  }
+  handshake() {
+    const ret = this.c._tls_handshake(this.ptr);
+    if (ret < 0) throw this.engine.error(ret, "tls handshake");
+    return ret === 1;
+  }
+  get verifyResult() {
+    return this.c._tls_verify_result(this.ptr);
+  }
+  get version() {
+    return this.c._tls_version(this.ptr);
+  }
+  get alpn() {
+    const out = this.engine.intoScratch((p, max) => this.c._tls_alpn(this.ptr, p, max));
+    return out instanceof Uint8Array ? new TextDecoder().decode(out) : void 0;
+  }
+  peerChain() {
+    const chain2 = [];
+    const count2 = this.c._tls_peer_count(this.ptr);
+    for (let i = 0; i < count2; i++) {
+      const der = this.engine.intoScratch((p, max) => this.c._tls_peer_der(this.ptr, i, p, max));
+      if (der instanceof Uint8Array) chain2.push(der);
+    }
+    return chain2;
+  }
 };
 var loading = /* @__PURE__ */ new WeakMap();
 function loadTlsEngine(load) {
@@ -14816,6 +15085,16 @@ function packageTlsEngine(fs, modules) {
     return factory.default({ wasmBinary, locateFile: (path) => path });
   };
 }
+function packageTlsRoots(fs, modules) {
+  const file = `${modules.replace(/\/+$/, "")}/${TLS_ENGINE_PACKAGE}/dist/roots.der`;
+  return async () => {
+    try {
+      return await fs.readFileBuffer(file);
+    } catch {
+      throw new Error(`TLS client sessions need ${TLS_ENGINE_PACKAGE}'s roots.der in ${modules}`);
+    }
+  };
+}
 function kernelCa(store) {
   return () => realmCa(CA_OWNER, store);
 }
@@ -14847,6 +15126,7 @@ async function writeCaFile(fs, ca, locks = globalThis.navigator?.locks) {
 function enableNetwork(net, options) {
   let proxy;
   const transport = options.transport ?? missingTransport();
+  if (options.roots) net.tlsClient = { engine: options.engine, roots: options.roots };
   const start2 = () => {
     const tls2 = new TlsTerminator({
       ca: options.ca,
@@ -16516,6 +16796,285 @@ function encodeReceived(got) {
   return out;
 }
 
+// src/kernel/net/tls-client.ts
+var WRITE_CHUNK = 16 * 1024;
+var BADCERT = [
+  [8, "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"],
+  [1, "CERT_HAS_EXPIRED"],
+  [512, "CERT_NOT_YET_VALID"],
+  [2, "CERT_REVOKED"],
+  [4, "ERR_TLS_CERT_ALTNAME_INVALID"],
+  [2048, "INVALID_PURPOSE"],
+  [4096, "INVALID_PURPOSE"]
+];
+function verifyCode(flags2) {
+  if (flags2 === 0) return void 0;
+  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+  return BADCERT.find(([bit]) => (flags2 & bit) !== 0)?.[1] ?? "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+}
+var Ciphertext = class {
+  queue = [];
+  ended = false;
+  conn;
+  session;
+  constructor(conn, session) {
+    this.conn = conn;
+    this.session = session;
+  }
+  hand(bytes) {
+    if (bytes.length > 0) this.queue.push(bytes);
+  }
+  async more() {
+    if (this.queue.length === 0 && !this.ended) {
+      const bytes = await this.conn.read();
+      if (bytes) this.queue.push(bytes);
+      else this.ended = true;
+    }
+    if (this.queue.length === 0) {
+      this.session.feedEnd();
+      return false;
+    }
+    while (this.queue.length > 0) {
+      const head = this.queue[0];
+      const n = this.session.feed(head);
+      if (n < head.length) {
+        this.queue[0] = head.subarray(n);
+        break;
+      }
+      this.queue.shift();
+    }
+    return true;
+  }
+};
+async function send(conn, session) {
+  for (; ; ) {
+    const out = session.take();
+    if (out.length === 0) return;
+    for (let at = 0; at < out.length; ) {
+      const n = await conn.write(out.subarray(at));
+      if (!(n > 0)) throw new KernelError("EPIPE");
+      at += n;
+    }
+  }
+}
+function refused2(engine, session, err) {
+  const flags2 = session.verifyResult;
+  const code = verifyCode(flags2);
+  if (code && flags2 !== -1)
+    return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
+  const text = err instanceof TlsError ? err.message : String(err);
+  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}`);
+}
+async function handshake(conn, o, session, inbox) {
+  for (; ; ) {
+    let done4;
+    try {
+      done4 = session.handshake();
+    } catch (err) {
+      await send(conn, session).catch(() => void 0);
+      throw refused2(o.engine, session, err);
+    }
+    await send(conn, session);
+    if (done4) return;
+    if (!await inbox.more()) {
+      throw new KernelError(
+        "ECONNRESET",
+        "the server closed the connection during the TLS handshake"
+      );
+    }
+  }
+}
+function infoOf(o, session) {
+  const flags2 = session.verifyResult;
+  const code = verifyCode(flags2);
+  return {
+    protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+    alpnProtocol: session.alpn ?? false,
+    authorized: code === void 0,
+    ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
+    peerCertificates: session.peerChain()
+  };
+}
+function plaintext(conn, session, inbox) {
+  let freed = false;
+  let writeClosed = false;
+  const free = () => {
+    if (freed) return;
+    freed = true;
+    session.free();
+  };
+  return {
+    localAddr: conn.localAddr,
+    remoteAddr: conn.remoteAddr,
+    async read() {
+      for (; ; ) {
+        if (freed) return null;
+        const got = session.read();
+        await send(conn, session);
+        if (got instanceof Uint8Array) return got;
+        if (got === "eof") return null;
+        await inbox.more();
+      }
+    },
+    async write(bytes) {
+      if (freed) throw new KernelError("EPIPE");
+      for (; ; ) {
+        const n = session.write(bytes.subarray(0, WRITE_CHUNK));
+        await send(conn, session);
+        if (n > 0) return n;
+      }
+    },
+    closeWrite() {
+      if (writeClosed || freed) return;
+      writeClosed = true;
+      session.close();
+      void send(conn, session).catch(() => void 0).finally(() => conn.closeWrite());
+    },
+    close() {
+      free();
+      conn.close();
+    }
+  };
+}
+async function tlsClient(conn, o, taken = new Uint8Array(0)) {
+  const flags2 = o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0;
+  const session = o.engine.clientSession(o.store, o.servername, o.alpn, flags2);
+  const inbox = new Ciphertext(conn, session);
+  inbox.hand(taken);
+  try {
+    await handshake(conn, o, session, inbox);
+    return { conn: plaintext(conn, session, inbox), info: infoOf(o, session) };
+  } catch (err) {
+    session.free();
+    throw err;
+  }
+}
+
+// src/kernel/net/tls-uplink.ts
+var isIP = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
+var LABEL2 = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$/;
+function serverName(name2) {
+  if (isIP(name2.replace(/^\[|\]$/g, ""))) return name2.replace(/^\[|\]$/g, "");
+  const bare = name2.endsWith(".") ? name2.slice(0, -1) : name2;
+  if (bare.length === 0 || bare.length > 253 || !bare.split(".").every((l) => LABEL2.test(l))) {
+    throw new KernelError(
+      "EINVAL",
+      `ERR_INVALID_ARG_VALUE: not a host name: ${JSON.stringify(name2)}`
+    );
+  }
+  return name2;
+}
+var defaults = /* @__PURE__ */ new WeakMap();
+function defaultStore(engine, roots) {
+  let store = defaults.get(engine);
+  if (!store) {
+    const made2 = roots().then((bundle) => {
+      const s = engine.store();
+      s.addBundle(bundle);
+      return s;
+    });
+    store = made2;
+    defaults.set(engine, made2);
+    made2.catch(() => {
+      if (defaults.get(engine) === made2) defaults.delete(engine);
+    });
+  }
+  return store;
+}
+function base64Der(text) {
+  const bin = atob(text);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function encode(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function sessionOf(info, servername) {
+  return {
+    path: "kernel",
+    substitutes: false,
+    protocol: info.protocol,
+    alpnProtocol: info.alpnProtocol,
+    authorized: info.authorized,
+    ...info.authorizationError ? {
+      authorizationError: info.authorizationError,
+      authorizationText: info.authorizationText
+    } : {},
+    servername,
+    peerCertificates: info.peerCertificates.map(encode)
+  };
+}
+async function setUp(support, req) {
+  const engine = await support.engine();
+  if (!engine.client)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no client sessions");
+  const custom = Array.isArray(req.ca) ? req.ca : void 0;
+  if (!custom) return { engine, store: await defaultStore(engine, support.roots), own: void 0 };
+  if (custom.length === 0)
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: ca has no certificate");
+  const own = engine.store();
+  try {
+    for (const der of custom) own.add(base64Der(der));
+  } catch (err) {
+    own.release();
+    throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
+  }
+  return { engine, store: own, own };
+}
+function secure(support, req, servername) {
+  return async (raw) => {
+    const { engine, store, own } = await setUp(support, req);
+    try {
+      return await tlsClient(raw, {
+        engine,
+        store,
+        servername,
+        alpn: req.alpn ?? [],
+        insecure: req.insecure === true
+      });
+    } finally {
+      own?.release();
+    }
+  };
+}
+function supportOf(net) {
+  const support = net.tlsClient;
+  if (!support) throw new KernelError("ENOTSUP", "no tls engine for client sessions");
+  return support;
+}
+async function uplinkAddress(proc, host) {
+  const bare = host.replace(/^\[|\]$/g, "");
+  if (isIP(bare)) return bare;
+  const [first] = await proc.resolve(host, 0, () => proc.blocking());
+  if (!first) throw new KernelError("ENOENT", `ENOTFOUND: ${host}`);
+  return first;
+}
+async function connectSecure(proc, socket, host, port, req) {
+  const servername = serverName(req.servername || host);
+  if (isLoopbackHost(servername) || isLoopbackHost(host)) throw new KernelError("ENOTSUP");
+  const address = await uplinkAddress(proc, host);
+  const route = proc.net.uplinkFor(address);
+  if (!route)
+    throw new KernelError("ENOTSUP", "TLS in the kernel needs a destination the uplink routes");
+  const support = supportOf(proc.net);
+  let info;
+  const make = secure(support, req, servername);
+  await socket.connectSecure({ family: "inet", host: address, port }, route, async (conn) => {
+    info = await conn.upgrade(make);
+  });
+  return sessionOf(info, servername);
+}
+async function upgradeSecure(proc, socket, req) {
+  const peer = socket.peer;
+  const host = req.servername || (peer?.family === "inet" ? peer.host : "");
+  const servername = serverName(host);
+  const info = await socket.upgradeSecure(secure(supportOf(proc.net), req, servername));
+  return sessionOf(info, servername);
+}
+
 // src/kernel/unix-dgram.ts
 var SOL_SOCKET3 = 1;
 var SO_TYPE3 = 3;
@@ -16677,7 +17236,8 @@ var SOCKET_OPS = [
   "sock-resolve",
   "sock-sendto",
   "sock-recvfrom",
-  "sock-tls"
+  "sock-tls",
+  "sock-tls-upgrade"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -16750,7 +17310,9 @@ async function socketSyscall(req, proc) {
       return ok3(addresses);
     }
     case "sock-tls":
-      return ok3(tlsOverTransport(req, proc));
+      return ok3(await secureConnect(req, proc));
+    case "sock-tls-upgrade":
+      return ok3(await upgradeSecure(proc, socketAt(fds, req.fd), req));
     default:
       return datagram(req, proc);
   }
@@ -16872,6 +17434,36 @@ var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
   8883
 ]);
 var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
+function wantsKernel(req) {
+  if (req.path === "kernel") return true;
+  if (req.path === "transport") return false;
+  return Array.isArray(req.ca) || req.alpn !== void 0 && req.alpn.length > 0 && !req.alpn.includes("http/1.1") || NOT_HTTP_PORTS.has(req.port);
+}
+async function secureConnect(req, proc) {
+  if (!Number.isInteger(req.port) || req.port < 1 || req.port > 65535)
+    throw new KernelError("EINVAL");
+  const kernelPath = wantsKernel(req) && await uplinked(proc, req.host);
+  if (!kernelPath) {
+    if (req.path === "kernel" || Array.isArray(req.ca)) throw new KernelError("ENOTSUP");
+    return { ...tlsOverTransport(req, proc), path: "transport", substitutes: true };
+  }
+  const socket = proc.net.socket("inet");
+  const fd = proc.fds.install(new OpenFile(socket), 3);
+  try {
+    return { fd, ...await connectSecure(proc, socket, req.host, req.port, req) };
+  } catch (e) {
+    await Promise.resolve(proc.fds.close(fd));
+    throw e;
+  }
+}
+async function uplinked(proc, host) {
+  if (!proc.net.tlsClient || isLoopbackHost(host)) return false;
+  try {
+    return proc.net.uplinkFor(await uplinkAddress(proc, host)) !== void 0;
+  } catch {
+    return false;
+  }
+}
 function tlsOverTransport(req, proc) {
   if (req.ca) throw new KernelError("ENOTSUP");
   if (req.alpn && req.alpn.length > 0 && !req.alpn.includes("http/1.1")) {
@@ -19872,10 +20464,10 @@ var JobTable = class {
   signalForeground(tty, fallback, sig) {
     this.killGroup(this.tcgetpgrp(tty, fallback), sig);
   }
-  fromKeyboard(send) {
+  fromKeyboard(send2) {
     this.keyboard = true;
     try {
-      send();
+      send2();
     } finally {
       this.keyboard = false;
     }
@@ -20186,6 +20778,12 @@ var LockService = class {
   lock(pid, path, exclusive, fd) {
     return this.table.lock(pid, path, exclusive, fd);
   }
+  wholeFree(pid, path, exclusive) {
+    return this.table.wholeFree(pid, path, exclusive);
+  }
+  flockFree(key, owner, kind) {
+    return this.table.flockFree(key, owner, kind);
+  }
   unlock(pid, path) {
     this.table.unlock(pid, path);
   }
@@ -20861,7 +21459,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
       await changed(signal);
     }
   };
-  const send = async (out, signal) => {
+  const send2 = async (out, signal) => {
     const write = file.write;
     for (let at = 0; at < out.length; ) {
       try {
@@ -20896,7 +21494,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
           raise();
           if (timer !== void 0) clearTimeout(timer);
           timer = void 0;
-          await send(stream2.push(taken), signal);
+          await send2(stream2.push(taken), signal);
         } finally {
           busy = false;
           if (quiet3()) wake();
@@ -21242,19 +21840,19 @@ var SettlingChildren = class {
     this.held = this.held.filter((h) => this.blocking(h.pgid));
     for (const h of ready2) h.send();
   }
-  deliver(sig, pgid, send, foreground) {
+  deliver(sig, pgid, send2, foreground) {
     if (!KEY_SIGNALS.has(sig)) {
-      send();
+      send2();
     } else if (this.blocking(pgid)) {
-      this.held.push({ pgid, send });
+      this.held.push({ pgid, send: send2 });
     } else if (foreground) {
-      send();
+      send2();
       const moved2 = () => {
-        if (foreground() !== pgid) send();
+        if (foreground() !== pgid) send2();
       };
       this.parked.push({ pgid, send: moved2 });
     } else {
-      send();
+      send2();
     }
   }
   blocking(pgid) {
@@ -21399,9 +21997,9 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
-    const refused2 = driverVersionError(message3.protocol);
-    if (refused2) {
-      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused2, errno: "EPROTO" } });
+    const refused3 = driverVersionError(message3.protocol);
+    if (refused3) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused3, errno: "EPROTO" } });
       return;
     }
     try {
@@ -22386,7 +22984,7 @@ function serveHostfsPort(port, transport) {
     });
     handles.clear();
   };
-  const send = (reply, transfer = []) => port.postMessage(reply, transfer);
+  const send2 = (reply, transfer = []) => port.postMessage(reply, transfer);
   const pending = /* @__PURE__ */ new Set();
   const track = (work) => {
     pending.add(work);
@@ -22406,7 +23004,7 @@ function serveHostfsPort(port, transport) {
     data
   }) => {
     const { id: id2, op } = data;
-    if (op === "ping") return send({ id: id2, pong: true });
+    if (op === "ping") return send2({ id: id2, pong: true });
     if (op === "bye") return stop();
     if (op === "cleanup")
       return void Promise.allSettled([...pending]).then(() => answer(data.name, data.body)).catch(() => {
@@ -22418,12 +23016,12 @@ function serveHostfsPort(port, transport) {
       try {
         await transport.watch(
           stop2.signal,
-          (event) => send({ id: id2, event }),
-          () => send({ id: id2, open: true })
+          (event) => send2({ id: id2, event }),
+          () => send2({ id: id2, open: true })
         );
-        send({ id: id2, end: true });
+        send2({ id: id2, end: true });
       } catch (err) {
-        send({ id: id2, error: errorOf(err) });
+        send2({ id: id2, error: errorOf(err) });
       } finally {
         watches.delete(id2);
       }
@@ -22440,18 +23038,18 @@ function serveHostfsPort(port, transport) {
           )
         );
         const bytes = read.slice();
-        return send({ id: id2, bytes }, [bytes.buffer]);
+        return send2({ id: id2, bytes }, [bytes.buffer]);
       }
       if (op === "write") {
         await track(
           transport.write(data.fh, data.offset, data.bytes)
         );
-        return send({ id: id2 });
+        return send2({ id: id2 });
       }
       if (op !== "call") throw fsError2("EINVAL", `unknown hostfs port op ${op}`);
-      send({ id: id2, result: await answer(data.name, data.body) });
+      send2({ id: id2, result: await answer(data.name, data.body) });
     } catch (err) {
-      send({ id: id2, error: errorOf(err) });
+      send2({ id: id2, error: errorOf(err) });
     }
   };
   const stop = () => {
@@ -23538,9 +24136,9 @@ function interpreter(head) {
   if (words2[0] === "-S") words2.shift();
   return baseName2(words2[0] ?? "");
 }
-function expandDefaults(defaults, env) {
+function expandDefaults(defaults2, env) {
   const out = {};
-  for (const [key, value2] of Object.entries(defaults ?? {})) {
+  for (const [key, value2] of Object.entries(defaults2 ?? {})) {
     let missing4 = false;
     const expanded = value2.replace(ENV_REFERENCE, (_, name2) => {
       const set3 = Object.hasOwn(env, name2) ? env[name2] : void 0;
@@ -23790,6 +24388,7 @@ var Launcher = class {
     enableNetwork(this.net, {
       transport: this.transport,
       engine: kernelTlsEngine(packageTlsEngine(this.verifiedFs(options.fs), this.modulesDir)),
+      roots: packageTlsRoots(this.verifiedFs(options.fs), this.modulesDir),
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
@@ -24202,13 +24801,13 @@ var Launcher = class {
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
   }
   async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const refused2 = async (err) => {
+    const refused3 = async (err) => {
       await fds.closeAll();
       throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
     };
-    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused2);
+    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
-    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused2);
+    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
     if (planned) return planned;
     await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
@@ -25043,10 +25642,10 @@ var Launcher = class {
       return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh2));
     };
   }
-  keySignal(tty, fallback, sig, send) {
+  keySignal(tty, fallback, sig, send2) {
     const pgid = this.jobs.tcgetpgrp(tty, fallback);
     const foreground = () => this.jobs.tcgetpgrp(tty, fallback);
-    const keyed = () => this.jobs.fromKeyboard(send);
+    const keyed = () => this.jobs.fromKeyboard(send2);
     this.settling.deliver(sig, pgid, keyed, tty.reading ? void 0 : foreground);
   }
   async resolvePrefixes() {
@@ -25691,7 +26290,7 @@ function cronLocks() {
 import { AsyncLocalStorage } from "node:async_hooks";
 import { subscribe } from "node:diagnostics_channel";
 import { lookup as lookup2 } from "node:dns/promises";
-import { isIP } from "node:net";
+import { isIP as isIP2 } from "node:net";
 var DEVTOOLS_PORTS = [9222, 9223, 9224, 9225, 9226, 9227, 9228, 9229];
 var METADATA_V6 = [64768, 3778, 0, 0, 0, 0, 0, 596].join(":");
 var resolveHost = async (host) => (await lookup2(host, { all: true, verbatim: true })).map((a) => a.address);
@@ -25703,7 +26302,7 @@ function ipv4Place(address) {
 }
 function placeOf(address) {
   const plain2 = address.replace(/^\[(.*)\]$/, "$1").toLowerCase();
-  const kind = isIP(plain2);
+  const kind = isIP2(plain2);
   if (kind === 4) return ipv4Place(plain2);
   if (kind !== 6) return void 0;
   const words2 = hextets2(plain2);
@@ -25756,7 +26355,7 @@ function connectRefusal(address, port, place) {
 }
 async function addressesOf(host, resolve2) {
   const plain2 = host.replace(/^\[(.*)\]$/, "$1");
-  if (isIP(plain2)) return [plain2];
+  if (isIP2(plain2)) return [plain2];
   if (loopbackName2(plain2)) return ["127.0.0.1"];
   return resolve2(plain2).catch(() => []);
 }
@@ -26091,7 +26690,7 @@ function isMemoryRoot(handle) {
 
 // src/node/ws-diagnose.ts
 import { lookup as lookup3 } from "node:dns/promises";
-import { isIP as isIP2, connect as tcp } from "node:net";
+import { isIP as isIP3, connect as tcp } from "node:net";
 import { connect as tls } from "node:tls";
 var PROBE_MS = 3e3;
 var PASSED = /* @__PURE__ */ new Set(["ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ETIMEDOUT", "ECONNRESET"]);
@@ -26111,9 +26710,9 @@ function abortable(work, signal) {
   });
   return Promise.race([work, aborted2]).finally(() => signal.removeEventListener("abort", stop));
 }
-function probe(secure, host, port, ms, signal) {
+function probe(secure2, host, port, ms, signal) {
   return new Promise((resolve2) => {
-    const socket = secure ? tls({ host, port, ...isIP2(host) ? {} : { servername: host } }) : tcp({ host, port });
+    const socket = secure2 ? tls({ host, port, ...isIP3(host) ? {} : { servername: host } }) : tcp({ host, port });
     const stop = () => done4("ABORTED");
     const done4 = (code) => {
       clearTimeout(timer);
@@ -26123,7 +26722,7 @@ function probe(secure, host, port, ms, signal) {
     };
     const timer = setTimeout(() => done4("ETIMEDOUT"), ms);
     signal?.addEventListener("abort", stop, { once: true });
-    socket.once(secure ? "secureConnect" : "connect", () => done4("EPROTO"));
+    socket.once(secure2 ? "secureConnect" : "connect", () => done4("EPROTO"));
     socket.once("error", (e) => {
       const code = codeOf7(e) ?? "";
       done4(PASSED.has(code) ? code : "EPROTO");
@@ -26133,8 +26732,8 @@ function probe(secure, host, port, ms, signal) {
 async function diagnose(url, ms = PROBE_MS, signal) {
   const at = new URL(url);
   const host = at.hostname.replace(/^\[(.*)\]$/, "$1");
-  const secure = at.protocol === "wss:";
-  const port = Number(at.port) || (secure ? 443 : 80);
+  const secure2 = at.protocol === "wss:";
+  const port = Number(at.port) || (secure2 ? 443 : 80);
   signal?.throwIfAborted();
   try {
     await abortable(lookup3(host), signal);
@@ -26142,7 +26741,7 @@ async function diagnose(url, ms = PROBE_MS, signal) {
     if (signal?.aborted) throw signal.reason;
     return NO_NAME.has(codeOf7(e) ?? "") ? "EAI_NONAME" : void 0;
   }
-  const code = await probe(secure, host, port, ms, signal);
+  const code = await probe(secure2, host, port, ms, signal);
   signal?.throwIfAborted();
   return code;
 }
@@ -26912,7 +27511,7 @@ async function terminalOn(channel, argv, opts) {
   );
   done4.catch(started.reject);
   const pid = await started.promise;
-  const send = (action) => void channel.call({ op: "terminal", terminal: id2, ...action }).catch(() => void 0);
+  const send2 = (action) => void channel.call({ op: "terminal", terminal: id2, ...action }).catch(() => void 0);
   return {
     pid,
     exited: done4,
@@ -26924,10 +27523,10 @@ async function terminalOn(channel, argv, opts) {
       listener = next3;
       if (next3) for (const bytes of backlog.splice(0)) next3(bytes);
     },
-    write: (data) => send({ action: "write", bytes: bytesOf2(data) }),
-    resize: (cols, rows) => send({ action: "resize", cols, rows }),
-    signal: (name2) => send({ action: "signal", signal: name2 }),
-    close: () => send({ action: "close" })
+    write: (data) => send2({ action: "write", bytes: bytesOf2(data) }),
+    resize: (cols, rows) => send2({ action: "resize", cols, rows }),
+    signal: (name2) => send2({ action: "signal", signal: name2 }),
+    close: () => send2({ action: "close" })
   };
 }
 function fsOn(channel) {
@@ -27000,9 +27599,9 @@ async function greet(channel, lock, timeoutMs) {
   } finally {
     clearTimeout(timer);
   }
-  const refused2 = hello.error ?? versionError(hello.protocol);
-  if (refused2) {
-    const error = new Error(refused2);
+  const refused3 = hello.error ?? versionError(hello.protocol);
+  if (refused3) {
+    const error = new Error(refused3);
     channel.end(error);
     throw error;
   }