@ai-ecoverse/slicc-kernel 1.124.11 → 1.124.13

package/dist/kernel-worker.js

@@ -4655,8 +4655,8 @@ function uplinkLink(conn, onReset) {
     open = false;
     conn.close();
   };
-  void inbound(conn, rx).catch(() => {
-    onReset();
+  void inbound(conn, rx).catch((err) => {
+    onReset(err);
     close();
     tx.closeRead();
   }).finally(() => rx.closeWrite());
@@ -4747,7 +4747,7 @@ var KernelSocket = class _KernelSocket {
   state = "open";
   dialing;
   failed;
-  reset = false;
+  reset;
   local;
   peer;
   peerCred;
@@ -4786,19 +4786,20 @@ var KernelSocket = class _KernelSocket {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
     const bytes = await pipeCall(() => rx.read(max, signal));
-    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
   async peek(max, signal) {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
     const bytes = await pipeCall(() => rx.peek(max, signal));
-    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
   async write(bytes, signal) {
     const { tx } = this.connection();
     if (this.writeShut) throw new KernelError("EPIPE");
+    if (this.reset?.code === "EPROTO") throw this.reset;
     return pipeCall(() => tx.write(bytes, signal));
   }
   poll() {
@@ -4983,8 +4984,8 @@ var KernelSocket = class _KernelSocket {
         this.dialing = void 0;
         this.switch = conn;
         this.attach(
-          uplinkLink(conn, () => {
-            this.reset = true;
+          uplinkLink(conn, (err) => {
+            this.reset = err instanceof KernelError && err.code === "EPROTO" ? err : new KernelError("ECONNRESET");
             this.changes.wake();
           })
         );
@@ -6625,7 +6626,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.124.11" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.124.13" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -7682,16 +7683,24 @@ var UnlinkedKeeper = class {
     gated();
     const held = /* @__PURE__ */ new Map();
     const hidden = /* @__PURE__ */ new Map();
-    for (; ; ) {
-      await take();
-      const now = this.heldWithin(target);
-      const next3 = paths.filter((path) => now.has(path) && !held.has(path));
-      if (next3.length === 0) break;
-      for (const path of next3) {
-        held.set(path, now.get(path));
-        const at = await this.hide(path);
-        if (at !== void 0) hidden.set(path, at);
+    const moved2 = [];
+    try {
+      for (; ; ) {
+        await take();
+        const now = this.heldWithin(target);
+        const next3 = paths.filter((path) => now.has(path) && !held.has(path));
+        if (next3.length === 0) break;
+        for (const path of next3) {
+          const holders = now.get(path);
+          held.set(path, holders);
+          for (const holder of holders) moved2.push(holder.moving?.(path) ?? (() => void 0));
+          const at = await this.hide(path);
+          if (at !== void 0) hidden.set(path, at);
+        }
       }
+    } catch (err) {
+      for (const settle3 of moved2) settle3();
+      throw err;
     }
     sealed();
     const done4 = () => {
@@ -7704,6 +7713,7 @@ var UnlinkedKeeper = class {
       files.set(path, file);
       for (const holder of holders) holder.keep(path, file);
     }
+    for (const settle3 of moved2) settle3();
     return {
       moved: new Set(hidden.keys()),
       commit: () => {
@@ -12394,6 +12404,10 @@ function attachSyncSabResponder(port, sab, token, opts) {
     Atomics.add(header3, SAB_I_PUB, 1);
     Atomics.notify(header3, SAB_I_PUB);
     if (offset + chunk2 >= entry.payload.byteLength) drop(id2);
+    else if (entry.timer) {
+      clearTimeout(entry.timer);
+      entry.timer = setTimeout(() => drop(id2), PENDING_TTL_MS);
+    }
   }
   function settle3(id2, result) {
     if (disposed) return;
@@ -14769,6 +14783,8 @@ function realmCa(owner, store) {
 
 // src/kernel/net/tls-engine.ts
 var TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
+var TLS_CLIENT_NO_SNI = 2;
+var TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -14825,10 +14841,22 @@ var TlsEngine = class {
       this.m._free(ptr);
     }
   }
+  withSecret(bytes, fn) {
+    const ptr = this.put(bytes);
+    try {
+      return fn(ptr);
+    } finally {
+      this.m.HEAPU8.fill(0, ptr, ptr + bytes.length + 1);
+      this.m._free(ptr);
+    }
+  }
   intoScratch(fn) {
     const n = fn(this.scratch, SCRATCH);
     return n > 0 ? this.taken(n) : n;
   }
+  get sessionControls() {
+    return typeof this.m._tls_client_cert === "function";
+  }
   get client() {
     return typeof this.m._tls_client_new === "function" ? this.m : void 0;
   }
@@ -14981,6 +15009,27 @@ var TlsSession = class {
     const out = this.engine.intoScratch((p, max) => this.c._tls_alpn(this.ptr, p, max));
     return out instanceof Uint8Array ? new TextDecoder().decode(out) : void 0;
   }
+  ownCert(chain2, key, pass2) {
+    const set3 = this.m._tls_client_cert;
+    const keyLen = key[0] === 45 ? key.length + 1 : key.length;
+    const ret = this.engine.withBytes(
+      chain2,
+      (c) => this.engine.withSecret(
+        key,
+        (k) => this.engine.withSecret(
+          pass2,
+          (p) => set3(this.ptr, c, chain2.length, k, keyLen, pass2.length > 0 ? p : 0, pass2.length)
+        )
+      )
+    );
+    if (ret !== 0) throw this.engine.error(ret, "client certificate");
+  }
+  get ciphersuite() {
+    return this.m._tls_ciphersuite(this.ptr);
+  }
+  get nameMismatch() {
+    return this.m._tls_name_mismatch(this.ptr) === 1;
+  }
   peerChain() {
     const chain2 = [];
     const count2 = this.c._tls_peer_count(this.ptr);
@@ -16399,11 +16448,11 @@ async function runChild(req, deps) {
     if (pid !== 0) kill();
     decided.resolve();
   };
-  const controls = [];
+  const controls2 = [];
   const capture = () => {
     const { promise, resolve: resolve2 } = Promise.withResolvers();
     const control = { shut: false, ended: resolve2, eof: promise };
-    controls.push(control);
+    controls2.push(control);
     return { capture: true, max, overflow: () => stop("ENOBUFS"), control };
   };
   const decided = Promise.withResolvers();
@@ -16437,11 +16486,11 @@ async function runChild(req, deps) {
   let status;
   try {
     status = await reaped(deps, pid);
-    const open = controls.filter((c) => c.opened);
+    const open = controls2.filter((c) => c.opened);
     await Promise.race([Promise.all(open.map((c) => c.eof)), decided.promise]);
   } finally {
     cancel?.();
-    for (const control of controls) control.shut = true;
+    for (const control of controls2) control.shut = true;
   }
   const out = deps.children.captured(pid, 1);
   const err = deps.children.captured(pid, 2);
@@ -17023,6 +17072,47 @@ function encodeReceived(got) {
   return out;
 }
 
+// src/kernel/net/tls-ciphers.ts
+var SUITES = [
+  [4865, "TLS_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", "TLSv1.3"],
+  [4866, "TLS_AES_256_GCM_SHA384", "TLS_AES_256_GCM_SHA384", "TLSv1.3"],
+  [4867, "TLS_CHACHA20_POLY1305_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLSv1.3"],
+  [4868, "TLS_AES_128_CCM_SHA256", "TLS_AES_128_CCM_SHA256", "TLSv1.3"],
+  [4869, "TLS_AES_128_CCM_8_SHA256", "TLS_AES_128_CCM_8_SHA256", "TLSv1.3"],
+  [49195, "ECDHE-ECDSA-AES128-GCM-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [49196, "ECDHE-ECDSA-AES256-GCM-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [49199, "ECDHE-RSA-AES128-GCM-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [49200, "ECDHE-RSA-AES256-GCM-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [52392, "ECDHE-RSA-CHACHA20-POLY1305", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLSv1.2"],
+  [
+    52393,
+    "ECDHE-ECDSA-CHACHA20-POLY1305",
+    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+    "TLSv1.2"
+  ],
+  [49187, "ECDHE-ECDSA-AES128-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
+  [49188, "ECDHE-ECDSA-AES256-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
+  [49191, "ECDHE-RSA-AES128-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
+  [49192, "ECDHE-RSA-AES256-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
+  [49161, "ECDHE-ECDSA-AES128-SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
+  [49162, "ECDHE-ECDSA-AES256-SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
+  [49171, "ECDHE-RSA-AES128-SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
+  [49172, "ECDHE-RSA-AES256-SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
+  [156, "AES128-GCM-SHA256", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [157, "AES256-GCM-SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [158, "DHE-RSA-AES128-GCM-SHA256", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [159, "DHE-RSA-AES256-GCM-SHA384", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"]
+];
+function cipherOf(id2, protocol) {
+  const known = SUITES.find(([n]) => n === id2);
+  const hex3 = `0x${id2.toString(16).padStart(4, "0").toUpperCase()}`;
+  return {
+    name: known?.[1] ?? hex3,
+    standardName: known?.[2] ?? hex3,
+    version: known?.[3] ?? protocol
+  };
+}
+
 // src/kernel/net/tls-client.ts
 var WRITE_CHUNK = 16 * 1024;
 var BADCERT = [
@@ -17039,6 +17129,15 @@ function verifyCode(flags2) {
   if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
   return BADCERT.find(([bit]) => (flags2 & bit) !== 0)?.[1] ?? "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
 }
+function isIP(name2) {
+  return ipv4Bytes(name2) !== void 0 || name2.includes(":") && ipv6Groups(name2) !== void 0;
+}
+function clientFlags(o) {
+  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0);
+}
+function openSession(o) {
+  return o.engine.clientSession(o.store, o.servername, o.alpn, clientFlags(o));
+}
 var Ciphertext = class {
   queue = [];
   ended = false;
@@ -17111,17 +17210,39 @@ async function handshake(conn, o, session, inbox) {
     }
   }
 }
+function controlsOf(o, session, protocol) {
+  if (!o.engine.sessionControls) return {};
+  const checked = o.checkHostname !== false && !o.insecure;
+  return {
+    cipher: cipherOf(session.ciphersuite, protocol),
+    clientCertificate: o.clientCertificate === true,
+    sni: o.sni !== false && !isIP(o.servername),
+    hostnameChecked: checked,
+    ...o.insecure ? {} : { hostnameMatches: checked || !session.nameMismatch }
+  };
+}
 function infoOf(o, session) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
+  const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
   return {
-    protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+    protocol,
     alpnProtocol: session.alpn ?? false,
     authorized: code === void 0,
     ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
-    peerCertificates: session.peerChain()
+    peerCertificates: session.peerChain(),
+    ...controlsOf(o, session, protocol)
   };
 }
+var FATAL_ALERT = -30592;
+function alerted(err) {
+  if (err.code === FATAL_ALERT)
+    return new KernelError(
+      "EPROTO",
+      `ERR_SSL_FATAL_ALERT: the server ended the session: ${err.message}`
+    );
+  return new KernelError("EPROTO", `ERR_SSL_PROTOCOL_ERROR: ${err.message}`);
+}
 function plaintext(conn, session, inbox) {
   let freed = false;
   let writeClosed = false;
@@ -17136,7 +17257,12 @@ function plaintext(conn, session, inbox) {
     async read() {
       for (; ; ) {
         if (freed) return null;
-        const got = session.read();
+        let got;
+        try {
+          got = session.read();
+        } catch (err) {
+          throw alerted(err);
+        }
         await send(conn, session);
         if (got instanceof Uint8Array) return got;
         if (got === "eof") return null;
@@ -17164,8 +17290,7 @@ function plaintext(conn, session, inbox) {
   };
 }
 async function tlsClient(conn, o, taken = new Uint8Array(0)) {
-  const flags2 = o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0;
-  const session = o.engine.clientSession(o.store, o.servername, o.alpn, flags2);
+  const session = o.session ?? openSession(o);
   const inbox = new Ciphertext(conn, session);
   inbox.hand(taken);
   try {
@@ -17178,10 +17303,10 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
 }
 
 // src/kernel/net/tls-uplink.ts
-var isIP = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
+var isIP2 = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
 var LABEL2 = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$/;
 function serverName(name2) {
-  if (isIP(name2.replace(/^\[|\]$/g, ""))) return name2.replace(/^\[|\]$/g, "");
+  if (isIP2(name2.replace(/^\[|\]$/g, ""))) return name2.replace(/^\[|\]$/g, "");
   const bare = name2.endsWith(".") ? name2.slice(0, -1) : name2;
   if (bare.length === 0 || bare.length > 253 || !bare.split(".").every((l) => LABEL2.test(l))) {
     throw new KernelError(
@@ -17231,9 +17356,66 @@ function sessionOf(info, servername) {
       authorizationText: info.authorizationText
     } : {},
     servername,
-    peerCertificates: info.peerCertificates.map(encode)
+    peerCertificates: info.peerCertificates.map(encode),
+    ...controls(info)
   };
 }
+function controls(info) {
+  if (!info.cipher) return {};
+  return {
+    cipher: info.cipher,
+    clientCertificate: info.clientCertificate === true,
+    sni: info.sni !== false,
+    hostnameChecked: info.hostnameChecked === true,
+    ...info.hostnameMatches === void 0 ? {} : { hostnameMatches: info.hostnameMatches }
+  };
+}
+var KEY_ERRORS = [
+  [-3, "ERR_OSSL_X509_KEY_VALUES_MISMATCH"],
+  [-15232, "ERR_OSSL_BAD_DECRYPT"],
+  [-15360, "ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED"]
+];
+function keyRefused(err) {
+  const code = err instanceof TlsError ? err.code : 0;
+  const name2 = KEY_ERRORS.find(([n]) => n === code)?.[1] ?? "ERR_OSSL_UNSUPPORTED";
+  const text = code === -3 ? "the key does not match the certificate" : err.message;
+  return new KernelError("EPROTO", `${name2}: ${text}`);
+}
+function takeCert(req) {
+  const cert = req.clientCert;
+  if (!cert) return void 0;
+  delete req.clientCert;
+  if (!Array.isArray(cert.chain) || cert.chain.length === 0 || typeof cert.key !== "string")
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: cert and key go together");
+  let ders;
+  let key;
+  try {
+    ders = cert.chain.map(base64Der);
+    key = base64Der(cert.key);
+  } catch {
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: cert or key is not base64");
+  }
+  const chain2 = new Uint8Array(ders.reduce((n, d) => n + d.length, 0));
+  let at = 0;
+  for (const der of ders) {
+    chain2.set(der, at);
+    at += der.length;
+  }
+  const pass2 = new TextEncoder().encode(cert.passphrase ?? "");
+  return { chain: chain2, key, pass: pass2 };
+}
+function withCert(session, cert) {
+  if (!cert) return;
+  try {
+    session.ownCert(cert.chain, cert.key, cert.pass);
+  } catch (err) {
+    throw keyRefused(err);
+  }
+}
+function wipe(cert) {
+  cert?.key.fill(0);
+  cert?.pass.fill(0);
+}
 async function setUp(support, req) {
   const engine = await support.engine();
   if (!engine.client)
@@ -17251,21 +17433,66 @@ async function setUp(support, req) {
   }
   return { engine, store: own, own };
 }
-function secure(support, req, servername) {
-  return async (raw) => {
-    const { engine, store, own } = await setUp(support, req);
+async function prepare(support, req, servername) {
+  const cert = takeCert(req);
+  try {
+    return await prepareWith(support, req, servername, cert);
+  } catch (err) {
+    if (err instanceof KernelError) throw err;
+    throw new KernelError("ENOTSUP", err instanceof Error ? err.message : String(err));
+  } finally {
+    wipe(cert);
+  }
+}
+async function prepareWith(support, req, servername, cert) {
+  if (req.checkHostname === false && req.insecure === true) {
+    throw new KernelError(
+      "EINVAL",
+      "ERR_INVALID_ARG_VALUE: checkHostname: false needs rejectUnauthorized"
+    );
+  }
+  const { engine, store, own } = await setUp(support, req);
+  const options = {
+    engine,
+    store,
+    servername,
+    alpn: req.alpn ?? [],
+    insecure: req.insecure === true,
+    ...req.sni === false ? { sni: false } : {},
+    ...req.checkHostname === false ? { checkHostname: false } : {},
+    clientCertificate: cert !== void 0
+  };
+  let session;
+  try {
+    const controls2 = req.sni === false || req.checkHostname === false || cert !== void 0;
+    if (controls2 && !engine.sessionControls) {
+      throw new KernelError("ENOTSUP", "the installed tls engine has no client certificates");
+    }
+    session = openSession(options);
+    withCert(session, cert);
+    return { options: { ...options, session }, own };
+  } catch (err) {
+    session?.free();
+    own?.release();
+    throw err;
+  }
+}
+function secure(prepared) {
+  let ran = false;
+  const make = async (raw) => {
+    ran = true;
     try {
-      return await tlsClient(raw, {
-        engine,
-        store,
-        servername,
-        alpn: req.alpn ?? [],
-        insecure: req.insecure === true
-      });
+      return await tlsClient(raw, prepared.options);
     } finally {
-      own?.release();
+      prepared.own?.release();
     }
   };
+  const abandon = () => {
+    if (ran) return;
+    prepared.options.session.free();
+    prepared.own?.release();
+  };
+  return { make, abandon };
 }
 function supportOf(net) {
   const support = net.tlsClient;
@@ -17274,7 +17501,7 @@ function supportOf(net) {
 }
 async function uplinkAddress(proc, host) {
   const bare = host.replace(/^\[|\]$/g, "");
-  if (isIP(bare)) return bare;
+  if (isIP2(bare)) return bare;
   const [first] = await proc.resolve(host, 0, () => proc.blocking());
   if (!first) throw new KernelError("ENOENT", `ENOTFOUND: ${host}`);
   return first;
@@ -17288,18 +17515,26 @@ async function connectSecure(proc, socket, host, port, req) {
     throw new KernelError("ENOTSUP", "TLS in the kernel needs a destination the uplink routes");
   const support = supportOf(proc.net);
   let info;
-  const make = secure(support, req, servername);
-  await socket.connectSecure({ family: "inet", host: address, port }, route, async (conn) => {
-    info = await conn.upgrade(make);
-  });
+  const { make, abandon } = secure(await prepare(support, req, servername));
+  try {
+    await socket.connectSecure({ family: "inet", host: address, port }, route, async (conn) => {
+      info = await conn.upgrade(make);
+    });
+  } finally {
+    abandon();
+  }
   return sessionOf(info, servername);
 }
 async function upgradeSecure(proc, socket, req) {
   const peer = socket.peer;
   const host = req.servername || (peer?.family === "inet" ? peer.host : "");
   const servername = serverName(host);
-  const info = await socket.upgradeSecure(secure(supportOf(proc.net), req, servername));
-  return sessionOf(info, servername);
+  const { make, abandon } = secure(await prepare(supportOf(proc.net), req, servername));
+  try {
+    return sessionOf(await socket.upgradeSecure(make), servername);
+  } finally {
+    abandon();
+  }
 }
 
 // src/kernel/unix-dgram.ts
@@ -17661,17 +17896,23 @@ var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
   8883
 ]);
 var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
+function sessionControls(req) {
+  return req.sni === false || req.checkHostname === false || req.clientCert !== void 0;
+}
 function wantsKernel(req) {
   if (req.path === "kernel") return true;
   if (req.path === "transport") return false;
-  return Array.isArray(req.ca) || req.alpn !== void 0 && req.alpn.length > 0 && !req.alpn.includes("http/1.1") || NOT_HTTP_PORTS.has(req.port);
+  return Array.isArray(req.ca) || sessionControls(req) || req.alpn !== void 0 && req.alpn.length > 0 && !req.alpn.includes("http/1.1") || NOT_HTTP_PORTS.has(req.port);
 }
 async function secureConnect(req, proc) {
   if (!Number.isInteger(req.port) || req.port < 1 || req.port > 65535)
     throw new KernelError("EINVAL");
   const kernelPath = wantsKernel(req) && await uplinked(proc, req.host);
   if (!kernelPath) {
-    if (req.path === "kernel" || Array.isArray(req.ca)) throw new KernelError("ENOTSUP");
+    if (req.path === "kernel" || Array.isArray(req.ca) || sessionControls(req)) {
+      delete req.clientCert;
+      throw new KernelError("ENOTSUP");
+    }
     return { ...tlsOverTransport(req, proc), path: "transport", substitutes: true };
   }
   const socket = proc.net.socket("inet");
@@ -17805,13 +18046,17 @@ var VfsNode = class {
     const ranged2 = await this.prepare();
     await ranged2?.pin();
   }
+  moving = /* @__PURE__ */ new Set();
   async load() {
     if (this.revoked) throw new KernelError("EIO");
-    if (!this.data) {
+    while (!this.data) {
+      const at = this.path;
       try {
-        this.data = await this.fs.readFileBuffer(this.path);
+        this.data = await this.fs.readFileBuffer(at);
       } catch (err) {
         if (!isMissing(err)) throw err;
+        while (this.moving.size > 0) await Promise.all(this.moving);
+        if (this.path !== at) continue;
         this.data = new Uint8Array(0);
         this.missing = true;
       }
@@ -18165,6 +18410,16 @@ var VfsNodes = class {
     this.byPath.set(file.hidden, node);
     this.kept.set(node, file);
   }
+  moving(path) {
+    const node = this.byPath.get(path);
+    if (!node) return () => void 0;
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
+    node.moving.add(promise);
+    return () => {
+      node.moving.delete(promise);
+      resolve2();
+    };
+  }
   unkeep(path, file) {
     const node = this.byPath.get(file.hidden);
     if (!node) return;
@@ -21452,7 +21707,7 @@ function register(automaton, sources, ids, bytes, source) {
   }
   sources[id2].push(source);
 }
-function prepare(secrets) {
+function prepare2(secrets) {
   const main = new Automaton();
   const wrap = new Automaton();
   const sources = [];
@@ -21603,7 +21858,7 @@ function merge(into, from) {
   }
 }
 function compile(secrets, options = {}) {
-  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const c = prepare2(secrets.map((secret) => ({ ...secret })));
   const decoder4 = new TextDecoder();
   const idleMs = options.idleMs ?? 250;
   const scrubBytes = (input) => {