@ai-ecoverse/slicc-kernel 1.125.1 → 1.125.2

package/dist/kernel-worker.js

@@ -528,9 +528,9 @@ var Integrity = class {
     const at = normalizePath(path);
     const real = known ?? await this.root.realpath?.(at, true).catch(() => void 0) ?? at;
     if (isProtected(this.prefixes, real)) return { real, name: real };
-    const names = asked === void 0 ? [] : await namesOf(this.root, asked);
-    if (real !== at) names.push(...await namesOf(this.root, at));
-    const name2 = names.findLast((p) => isProtected(this.prefixes, p));
+    const names2 = asked === void 0 ? [] : await namesOf(this.root, asked);
+    if (real !== at) names2.push(...await namesOf(this.root, at));
+    const name2 = names2.findLast((p) => isProtected(this.prefixes, p));
     return name2 === void 0 ? void 0 : { real, name: name2 };
   }
   async key(path, asked) {
@@ -1118,8 +1118,8 @@ function sidecar(meta) {
   const guarded2 = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
     throw translate(err, pathOf(args), "sidecar", false);
   });
-  const names = meta.fresh ? [...META_OPS, "fresh"] : META_OPS;
-  const ops = Object.fromEntries(names.map((op) => [op, guarded2(op)]));
+  const names2 = meta.fresh ? [...META_OPS, "fresh"] : META_OPS;
+  const ops = Object.fromEntries(names2.map((op) => [op, guarded2(op)]));
   const { updateMany } = meta;
   ops.updateMany = updateMany ? (changes) => updateMany.call(meta, changes).catch((err) => {
     throw translate(err, changes[0]?.path ?? "/", "sidecar", false);
@@ -2478,11 +2478,11 @@ var WRITES = [
   "lutimes",
   "chown"
 ];
-for (const [names, op] of [
+for (const [names2, op] of [
   [READS, "read"],
   [WRITES, "write"]
 ]) {
-  for (const name2 of names) {
+  for (const name2 of names2) {
     const proto = OpfsFs.prototype;
     const inner = proto[name2];
     proto[name2] = async function(...args) {
@@ -3495,11 +3495,11 @@ var Perms = class {
     this.fs = fs;
   }
   async learn(path) {
-    const names = chain(path);
+    const names2 = chain(path);
     const perms = await ancestryOf(this.fs, path);
-    for (let i = 0; i < names.length; i++) {
+    for (let i = 0; i < names2.length; i++) {
       const perm = perms[i];
-      this.known.set(names[i], perm);
+      this.known.set(names2[i], perm);
       if (perm === void 0 || perm.link !== void 0) break;
     }
   }
@@ -5731,8 +5731,8 @@ function userEnv(account, system) {
     PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
   };
 }
-function groupsOf(groups, names) {
-  return names.map((g) => {
+function groupsOf(groups, names2) {
+  return names2.map((g) => {
     const row = groups.find((r) => r.name === g);
     if (!row) throw fsError("ENOENT", `no group ${g}`);
     return row;
@@ -6632,7 +6632,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.125.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.125.2" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -6787,9 +6787,9 @@ async function withPackagePaths(fs, pkg, command) {
   return { ...command, env };
 }
 async function packages(fs, modules) {
-  const names = await fs.readdir(modules).catch(() => []);
+  const names2 = await fs.readdir(modules).catch(() => []);
   const packageNames = [];
-  for (const name2 of names) {
+  for (const name2 of names2) {
     if (name2.startsWith(".")) continue;
     if (!name2.startsWith("@")) {
       packageNames.push(name2);
@@ -7582,7 +7582,7 @@ var UnlinkedKeeper = class {
         [name2]: (path, ...rest2) => unreplaced(path, () => call.call(fs, path, ...rest2))
       };
     };
-    const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
+    const visible = (names2) => names2.filter((name2) => name2 !== UNLINKED_DIR);
     const counted2 = (st) => {
       const hidden = keeper.links.get(`${st.dev ?? 0}:${st.ino}`) ?? 0;
       return hidden === 0 || st.nlink === void 0 ? st : { ...st, nlink: Math.max(0, st.nlink - hidden) };
@@ -7801,10 +7801,10 @@ var UnlinkedKeeper = class {
     if (!query && !owner) return Promise.resolve();
     return this.serial(async () => {
       const dir = dirOf(root);
-      const names = await this.fs.readdir(dir).catch(() => void 0);
-      if (!names) return;
+      const names2 = await this.fs.readdir(dir).catch(() => void 0);
+      if (!names2) return;
       const held = query && new Set(((await query()).held ?? []).map((lock) => lock.name));
-      for (const name2 of names) {
+      for (const name2 of names2) {
         const id2 = name2.slice(0, name2.lastIndexOf("."));
         const at = id2.indexOf("~");
         const dead = id2 !== this.instance && (at < 0 ? held !== void 0 && !held.has(lockName(id2)) : owner?.alive(id2.slice(0, at)) === false);
@@ -8007,11 +8007,11 @@ var CronService = class {
       const account = await this.host.lookup(job.user);
       if (account) out.push({ source: "system", account, job });
     }
-    const names = await fs.readdir(SPOOL_DIR).catch((err) => {
+    const names2 = await fs.readdir(SPOOL_DIR).catch((err) => {
       if (err?.code === "ENOENT") return [];
       throw err;
     });
-    for (const name2 of names.sort()) {
+    for (const name2 of names2.sort()) {
       if (name2.startsWith(".") || name2.endsWith("~")) continue;
       const path = `${SPOOL_DIR}/${name2}`;
       const account = await this.host.lookup(name2);
@@ -9036,6 +9036,37 @@ var FileChanges = class {
     }
   }
 };
+var ChangeView = class {
+  view;
+  constructor(sab) {
+    this.view = new Int32Array(sab);
+  }
+  now() {
+    return Atomics.load(this.view, GEN);
+  }
+  clean() {
+    return this.view.length > DIRTY && Atomics.load(this.view, DIRTY) === 0;
+  }
+  foreign() {
+    return this.view.length > FOREIGN && Atomics.load(this.view, FOREIGN) === 1;
+  }
+  changedSince(seen, path) {
+    const now = Atomics.load(this.view, GEN);
+    const distance = now - seen >>> 0;
+    if (distance === 0) return { now, changed: false };
+    if (distance > RING_SIZE) return { now, changed: true };
+    const hash = changeHash(normal(path));
+    for (let i = 1; i <= distance; i++) {
+      const g = seen + i | 0;
+      const at = RING + (g & RING_SIZE - 1) * SLOT;
+      if (Atomics.load(this.view, at) !== g) return { now, changed: true };
+      const hit = Atomics.load(this.view, at + 1) === hash;
+      if (Atomics.load(this.view, at) !== g) return { now, changed: true };
+      if (hit) return { now, changed: true };
+    }
+    return { now, changed: false };
+  }
+};
 
 // src/fs/commands.ts
 var S_IFDIR2 = 16384;
@@ -9083,7 +9114,7 @@ async function shownTarget(fs, target) {
   const st = await quiet(fs.stat(target));
   return st?.isFile && await readsAs2(fs, NOBODY, target) ? st : void 0;
 }
-function withCommandDirs(fs, names, userDir = async () => void 0, owners = false, targetOf2 = async () => void 0) {
+function withCommandDirs(fs, names2, userDir = async () => void 0, owners = false, targetOf2 = async () => void 0) {
   async function nearest(path) {
     const st = await fs.stat(path).catch(() => void 0);
     if (st || path === "/") return st ?? {};
@@ -9097,7 +9128,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   async function children2(path) {
     if (path === "/") return ["bin", "usr"];
     if (path === "/usr") return ["bin"];
-    if (path === "/bin" || path === "/usr/bin") return [...await names()];
+    if (path === "/bin" || path === "/usr/bin") return [...await names2()];
     const own = await userDir(path);
     return own?.size ? [...own] : void 0;
   }
@@ -9107,7 +9138,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     }
     const name2 = COMMAND.exec(path)?.[1];
     if (name2 !== void 0) {
-      return (await names()).has(name2) ? owned4(synthetic(false, path)) : void 0;
+      return (await names2()).has(name2) ? owned4(synthetic(false, path)) : void 0;
     }
     if ((await userDir(path))?.size) return owned4(synthetic(true, path), path);
     const slash = path.lastIndexOf("/");
@@ -9118,7 +9149,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   let generation;
   const targets = /* @__PURE__ */ new Map();
   async function targetStat(target) {
-    const now = await names();
+    const now = await names2();
     if (now !== generation) {
       generation = now;
       targets.clear();
@@ -9627,12 +9658,12 @@ var FsWatchers = class {
       writeFile: content(fs.writeFile.bind(fs), written2),
       ...fs.createExclusive ? { createExclusive: content(fs.createExclusive.bind(fs), () => ["rename"]) } : {},
       mkdir: async (path, options) => {
-        const created3 = [];
+        const created4 = [];
         if (options?.recursive) {
           const parts2 = normalizePath(path).split("/").filter(Boolean);
           for (let at = 1; at < parts2.length; at++) {
             const ancestor = `/${parts2.slice(0, at).join("/")}`;
-            if (created3.length > 0 || !await fs.exists(ancestor)) created3.push(ancestor);
+            if (created4.length > 0 || !await fs.exists(ancestor)) created4.push(ancestor);
           }
         }
         const fresh2 = !options?.recursive || !(this.covers(path) && await fs.exists(path));
@@ -9641,8 +9672,8 @@ var FsWatchers = class {
           await fs.mkdir(path, options);
           done4 = true;
         } finally {
-          this.report([...created3, path]);
-          if (done4) this.emit("rename", fresh2 ? [...created3, path] : created3);
+          this.report([...created4, path]);
+          if (done4) this.emit("rename", fresh2 ? [...created4, path] : created4);
         }
       },
       rm: reshaping(after(fs.rm.bind(fs), (path) => [path], "rename")),
@@ -11616,12 +11647,12 @@ var MountFs = class _MountFs {
     return await this.base.hasOwner?.(path) ?? true;
   }
   async ancestry(path) {
-    const names = chain(normalizePath(path));
-    const first = names.findIndex((name2) => this.at(name2));
+    const names2 = chain(normalizePath(path));
+    const first = names2.findIndex((name2) => this.at(name2));
     if (first < 0) return ancestryOf(this.base, path);
-    const out = first === 0 ? [] : await ancestryOf(this.base, names[first - 1]);
+    const out = first === 0 ? [] : await ancestryOf(this.base, names2[first - 1]);
     if (out.length < first || out.some((perm) => perm?.link !== void 0)) return out;
-    for (const name2 of names.slice(first)) {
+    for (const name2 of names2.slice(first)) {
       const st = await this.lstat(name2).catch(() => void 0);
       if (!st) break;
       out.push(permOf(st, st.isSymbolicLink ? await this.readlink(name2) : void 0));
@@ -12111,8 +12142,8 @@ async function guard(g, path, req, cwd) {
 async function opening(entry, path, mode) {
   const g = guardOf(entry);
   const want = (mode & HOLD_READ ? R_OK : 0) | (mode & HOLD_WRITE ? W_OK : 0);
-  const created3 = (mode & HOLD_CREATED) !== 0 && entry.created?.take(path) === true;
-  if (g && want !== 0 && !created3) {
+  const created4 = (mode & HOLD_CREATED) !== 0 && entry.created?.take(path) === true;
+  if (g && want !== 0 && !created4) {
     await need(g, "open", path, want, { directory: false });
   }
 }
@@ -12294,6 +12325,7 @@ async function dispatchSyncFs(req) {
   served++;
   const entry = resolveSyncFsToken(req.token);
   if (!entry) return { ok: false, errno: "EACCES", message: "sync-fs: unknown or revoked token" };
+  if (req.identity && req.op === "create") return created2(entry, req);
   if (!req.identity || !IDENTITY_OPS.has(req.op)) return dispatchOne(entry, req);
   const { fs, cwd } = entry;
   const path = fs.resolvePath(cwd, req.path);
@@ -12312,16 +12344,24 @@ async function dispatchSyncFs(req) {
     return toErrno(err);
   }
 }
+async function created2(entry, req) {
+  const result = await dispatchOne(entry, req);
+  if (!result.ok) return result;
+  const seen = entry.changes?.now();
+  const looked = await dispatchOne(entry, { ...req, op: "stat" });
+  if (!looked.ok || looked.kind !== "json") return json2(null);
+  return seen === void 0 ? looked : json2({ ...looked.json, seen });
+}
 var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
 async function rmPermitted(entry, path, req, refused3) {
   const st = await entry.fs.lstat(path).catch(() => void 0);
   if (!st?.isDirectory) return refused3;
   const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
   if ("refused" in unlisted) return unlisted.refused;
-  const names = await entry.fs.readdir(path).catch(() => void 0);
-  if (!names) return refused3;
+  const names2 = await entry.fs.readdir(path).catch(() => void 0);
+  if (!names2) return refused3;
   let first;
-  for (const name2 of names) {
+  for (const name2 of names2) {
     const child = await dispatchOne(entry, {
       ...req,
       path: joinName(path, name2)
@@ -12379,7 +12419,27 @@ async function newDevName(entry, path, req) {
   if (there) return void 0;
   return { ok: false, errno: refused3, message: `${target}: no new names in /dev or /proc` };
 }
+var MISS_OPS = /* @__PURE__ */ new Set(["stat", "lstat"]);
+async function linkFree(fs, path) {
+  for (let at = path.indexOf("/", 1); ; at = path.indexOf("/", at + 1)) {
+    let st;
+    try {
+      st = await fs.lstat(at === -1 ? path : path.slice(0, at));
+    } catch (err) {
+      return err.code === "ENOENT";
+    }
+    if (st.isSymbolicLink || at === -1) return false;
+  }
+}
 async function dispatchOne(entry, req) {
+  const result = await dispatchPath(entry, req);
+  if (result.ok || result.errno !== "ENOENT" || !req.direct || !MISS_OPS.has(req.op) || req.handle !== void 0) {
+    return result;
+  }
+  const path = entry.fs.resolvePath(entry.cwd, req.path);
+  return await linkFree(entry.fs, path) ? { ...result, direct: true } : result;
+}
+async function dispatchPath(entry, req) {
   const { fs, cwd } = entry;
   try {
     const path = fs.resolvePath(cwd, req.path);
@@ -12466,7 +12526,13 @@ function encodeSabResult(result) {
   if (!result.ok) {
     return {
       status: SAB_STATUS_ERRNO,
-      payload: encoder3.encode(JSON.stringify({ errno: result.errno, message: result.message }))
+      payload: encoder3.encode(
+        JSON.stringify({
+          errno: result.errno,
+          message: result.message,
+          ...result.direct ? { direct: true } : {}
+        })
+      )
     };
   }
   switch (result.kind) {
@@ -15006,8 +15072,8 @@ var TlsEngine = class {
     return n < 0 ? `${text}\u2026` : text;
   }
 };
-function alpnWire(names) {
-  const parts2 = names.map((name2) => new TextEncoder().encode(name2));
+function alpnWire(names2) {
+  const parts2 = names2.map((name2) => new TextEncoder().encode(name2));
   const out = new Uint8Array(parts2.reduce((n, p) => n + p.length + 1, 0));
   let at = 0;
   for (const part of parts2) {
@@ -15141,6 +15207,10 @@ var TlsSession = class {
   get ciphersuite() {
     return this.m._tls_ciphersuite(this.ptr);
   }
+  get lastAlert() {
+    const last = this.m._tls_last_alert;
+    return last ? last(this.ptr) : -1;
+  }
   get nameMismatch() {
     return this.m._tls_name_mismatch(this.ptr) === 1;
   }
@@ -17192,6 +17262,62 @@ function encodeReceived(got) {
   return out;
 }
 
+// src/kernel/net/tls-chain.ts
+var CN_MISMATCH = 4;
+var NOT_TRUSTED = 8;
+function tlv2(der, at) {
+  if (at + 2 > der.length) return void 0;
+  const first = der[at + 1];
+  let body = at + 2;
+  let length2 = first;
+  if (first & 128) {
+    const n = first & 127;
+    if (n === 0 || n > 4 || body + n > der.length) return void 0;
+    length2 = 0;
+    for (let i = 0; i < n; i++) length2 = length2 * 256 + der[body + i];
+    body += n;
+  }
+  const end = body + length2;
+  return end > der.length ? void 0 : { start: at, body, end };
+}
+function names(der) {
+  const cert = tlv2(der, 0);
+  const tbs = cert && tlv2(der, cert.body);
+  if (!tbs) return void 0;
+  const fields = [];
+  for (let at = tbs.body; at < tbs.end && fields.length < 6; ) {
+    const field4 = tlv2(der, at);
+    if (!field4) return void 0;
+    if (fields.length > 0 || der[at] !== 160) fields.push(field4);
+    at = field4.end;
+  }
+  const [, , issuer, , subject] = fields;
+  if (!issuer || !subject) return void 0;
+  return [der.subarray(issuer.start, issuer.end), der.subarray(subject.start, subject.end)];
+}
+function selfIssued(der) {
+  const pair = der && names(der);
+  if (!pair) return false;
+  const [issuer, subject] = pair;
+  return issuer.length === subject.length && issuer.every((b, i) => b === subject[i]);
+}
+function untrusted(chain2) {
+  if (chain2.length === 1) {
+    return selfIssued(chain2[0]) ? "DEPTH_ZERO_SELF_SIGNED_CERT" : "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+  }
+  return selfIssued(chain2.at(-1)) ? "SELF_SIGNED_CERT_IN_CHAIN" : "UNABLE_TO_GET_ISSUER_CERT_LOCALLY";
+}
+function chainError(flags2, chain2) {
+  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+  const rest2 = flags2 & ~CN_MISMATCH;
+  if (rest2 === 0) return void 0;
+  if (rest2 & NOT_TRUSTED) return untrusted(chain2);
+  return verifyCode(rest2);
+}
+function nameMatches(flags2) {
+  return flags2 !== -1 && (flags2 & CN_MISMATCH) === 0;
+}
+
 // src/kernel/net/tls-ciphers.ts
 var SUITES = [
   [4865, "TLS_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", "TLSv1.3"],
@@ -17309,7 +17435,11 @@ function refused2(engine, session, err) {
   if (code && flags2 !== -1)
     return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
   const text = err instanceof TlsError ? err.message : String(err);
-  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}`);
+  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+}
+function alertOf(session) {
+  const alert = session.lastAlert;
+  return alert >= 0 ? ` (alert ${alert})` : "";
 }
 async function handshake(conn, o, session, inbox) {
   for (; ; ) {
@@ -17330,7 +17460,12 @@ async function handshake(conn, o, session, inbox) {
     }
   }
 }
-function controlsOf(o, session, protocol) {
+function insecureOf(session, chain2) {
+  const flags2 = session.verifyResult;
+  const error = chainError(flags2, chain2);
+  return { hostnameMatches: nameMatches(flags2), ...error ? { chainError: error } : {} };
+}
+function controlsOf(o, session, protocol, chain2) {
   if (!o.engine.sessionControls) return {};
   const checked = o.checkHostname !== false && !o.insecure;
   return {
@@ -17338,28 +17473,29 @@ function controlsOf(o, session, protocol) {
     clientCertificate: o.clientCertificate === true,
     sni: o.sni !== false && !isIP(o.servername),
     hostnameChecked: checked,
-    ...o.insecure ? {} : { hostnameMatches: checked || !session.nameMismatch }
+    ...o.insecure ? insecureOf(session, chain2) : { hostnameMatches: checked || !session.nameMismatch }
   };
 }
 function infoOf(o, session) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
   const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
+  const chain2 = session.peerChain();
   return {
     protocol,
     alpnProtocol: session.alpn ?? false,
     authorized: code === void 0,
     ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
-    peerCertificates: session.peerChain(),
-    ...controlsOf(o, session, protocol)
+    peerCertificates: chain2,
+    ...controlsOf(o, session, protocol, chain2)
   };
 }
 var FATAL_ALERT = -30592;
-function alerted(err) {
+function alerted(err, session) {
   if (err.code === FATAL_ALERT)
     return new KernelError(
       "EPROTO",
-      `ERR_SSL_FATAL_ALERT: the server ended the session: ${err.message}`
+      `ERR_SSL_FATAL_ALERT: the server ended the session: ${err.message}${alertOf(session)}`
     );
   return new KernelError("EPROTO", `ERR_SSL_PROTOCOL_ERROR: ${err.message}`);
 }
@@ -17381,7 +17517,7 @@ function plaintext(conn, session, inbox) {
         try {
           got = session.read();
         } catch (err) {
-          throw alerted(err);
+          throw alerted(err, session);
         }
         await send(conn, session);
         if (got instanceof Uint8Array) return got;
@@ -17487,7 +17623,8 @@ function controls(info) {
     clientCertificate: info.clientCertificate === true,
     sni: info.sni !== false,
     hostnameChecked: info.hostnameChecked === true,
-    ...info.hostnameMatches === void 0 ? {} : { hostnameMatches: info.hostnameMatches }
+    ...info.hostnameMatches === void 0 ? {} : { hostnameMatches: info.hostnameMatches },
+    ...info.chainError ? { chainError: info.chainError } : {}
   };
 }
 var KEY_ERRORS = [
@@ -20724,6 +20861,7 @@ function holdingToken(opts, holds2, caller) {
     ...opts.fresh ? { fresh: (path) => opts.fresh?.(path, caller.umask()) } : {},
     ...opts.source ? { source: opts.source } : {},
     ...opts.replacements ? { replacements: opts.replacements } : {},
+    ...opts.changes ? { changes: new ChangeView(opts.changes) } : {},
     fs: opts.fs,
     noLinks: opts.noLinks,
     cwd: opts.cwd,
@@ -20743,7 +20881,7 @@ function linksOf(opts) {
 function clipboardName(opts) {
   return opts.program.abi === "js" ? {} : { clipboardName: opts.argv0 };
 }
-function processOptions(opts, header3, hooks, created3) {
+function processOptions(opts, header3, hooks, created4) {
   return {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
@@ -20753,7 +20891,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.source ? { source: opts.source } : {},
     noLinks: opts.noLinks,
-    ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3, ...linksOf(opts) } } : {},
+    ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created4, ...linksOf(opts) } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
     ...opts.settling ? { settling: opts.settling } : {},
@@ -20836,7 +20974,7 @@ function spawnWasmProcess(opts) {
   const blocked2 = opts.fork?.wasi?.blocked ?? opts.blocked;
   if (blocked2 && anyBlocked(blocked2) && opts.program.abi === "wasi") storeBlocked(header3, blocked2);
   const threadSignals = /* @__PURE__ */ new Map();
-  const created3 = new Created();
+  const created4 = new Created();
   const process = new WasmProcess(
     opts.pid,
     opts.fds,
@@ -20852,7 +20990,7 @@ function spawnWasmProcess(opts) {
           exitSignal: (sig) => queueMicrotask(() => finish(128 + sig, sig))
         } : { exitSignal: (sig) => terminate(128 + sig, sig) }
       },
-      created3
+      created4
     )
   );
   publishStops(process, header3);
@@ -20861,7 +20999,7 @@ function spawnWasmProcess(opts) {
   const token = holdingToken(opts, holds2, {
     cred: () => process.cred,
     umask: () => process.umask,
-    created: created3,
+    created: created4,
     holdsKept: async (path) => path.includes(`/${UNLINKED_DIR}/`) && (holds2.keeps(path) || await process.holds(path))
   });
   heldBy(process, holds2, opts.replacements);
@@ -21551,10 +21689,10 @@ var HOSTS_PATH = "/etc/hosts";
 function parseHosts(text) {
   const table = /* @__PURE__ */ new Map();
   for (const raw of text.split("\n")) {
-    const [address, ...names] = raw.replace(/#.*/, "").trim().split(/\s+/);
-    if (!address || names.length === 0) continue;
+    const [address, ...names2] = raw.replace(/#.*/, "").trim().split(/\s+/);
+    if (!address || names2.length === 0) continue;
     if (ipv4Bytes(address) === void 0 && ipv6Groups(address) === void 0) continue;
-    for (const name2 of names) {
+    for (const name2 of names2) {
       const key = name2.toLowerCase().replace(/\.$/, "");
       const known = table.get(key) ?? [];
       if (!known.includes(address)) known.push(address);
@@ -23875,7 +24013,7 @@ var ChunkedBytes = class {
 function idOption2(value2) {
   return value2 !== void 0 && /^\d+$/.test(value2) ? Number(value2) : 0;
 }
-function created2(ino, kind, mode, from, owner) {
+function created3(ino, kind, mode, from, owner) {
   const now = Date.now();
   return {
     kind,
@@ -23910,7 +24048,7 @@ function attr(node) {
 }
 function tmpfs() {
   let inodes = 0;
-  const make = (kind, mode, from, owner) => created2(++inodes, kind, mode, from, owner);
+  const make = (kind, mode, from, owner) => created3(++inodes, kind, mode, from, owner);
   const root = make("directory", 16877);
   const handles = /* @__PURE__ */ new Map();
   let nextFh = 0;
@@ -23930,10 +24068,10 @@ function tmpfs() {
     return node;
   }
   function parent(path) {
-    const names = parts2(path);
-    const name2 = names.pop();
+    const names2 = parts2(path);
+    const name2 = names2.pop();
     if (name2 === void 0) throw fsError2("EBUSY", "the root of a mount");
-    const dir = find(`/${names.join("/")}`);
+    const dir = find(`/${names2.join("/")}`);
     if (dir.kind !== "directory") throw fsError2("ENOTDIR", path);
     return { dir, name: name2 };
   }
@@ -24413,12 +24551,12 @@ var Sudo = class {
   }
   async policy() {
     const rules = await this.policyFile(SUDOERS);
-    const names = await this.o.fs.readdir(SUDOERS_D).catch(() => []);
-    if (names.length > 0 && !await this.trusted(SUDOERS_D)) {
+    const names2 = await this.o.fs.readdir(SUDOERS_D).catch(() => []);
+    if (names2.length > 0 && !await this.trusted(SUDOERS_D)) {
       this.warn(`sudo: ${SUDOERS_D} skipped: it must be root's and writable by root only`);
       return rules;
     }
-    for (const name2 of [...names].sort()) {
+    for (const name2 of [...names2].sort()) {
       if (name2.startsWith(".") || name2.endsWith("~")) continue;
       rules.push(...await this.policyFile(`${SUDOERS_D}/${name2}`));
     }
@@ -24498,8 +24636,8 @@ var Sudo = class {
     }
     const path = await this.locate(word, cwd);
     if (!path) return failed2("ENOENT", `sudo: ${word}: command not found`);
-    const untrusted = await this.untrusted(path, cwd, word);
-    if (untrusted) return untrusted;
+    const untrusted2 = await this.untrusted(path, cwd, word);
+    if (untrusted2) return untrusted2;
     const argv = [path, ...args];
     const matching = rules.filter(
       (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
@@ -24778,10 +24916,10 @@ function shebang(head) {
   return new TextDecoder().decode(head.subarray(0, SHEBANG_MAX)).slice(2).split("\n")[0].trim().split(/[ \t]+/);
 }
 async function rootOnly(fs, path, dir = false) {
-  const names = chain(path);
-  for (const [i, at] of names.entries()) {
+  const names2 = chain(path);
+  for (const [i, at] of names2.entries()) {
     const st = await fs.lstat(at).catch(() => void 0);
-    const kind = i === names.length - 1 && !dir ? st?.isFile : st?.isDirectory;
+    const kind = i === names2.length - 1 && !dir ? st?.isFile : st?.isDirectory;
     if (!kind || st?.uid !== 0 || (st.mode & 18) !== 0) return false;
   }
   return true;
@@ -25790,7 +25928,7 @@ var Launcher = class {
       return { glue, module: module2 };
     }
     const { module, memory, foreign } = await this.module(target.wasm, caller, asked);
-    const names = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
+    const names2 = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
     const imports = target.imports ? await this.text(target.imports, caller) : void 0;
     return {
       abi: "wasi",
@@ -25799,7 +25937,7 @@ var Launcher = class {
       ...memory ? { memory } : {},
       foreign,
       path: target.wasm,
-      ...names ? { names } : {},
+      ...names2 ? { names: names2 } : {},
       ...imports !== void 0 ? { imports } : {},
       ...target.preopenRoot ? { preopenRoot: true } : {}
     };
@@ -26581,10 +26719,10 @@ var Launcher = class {
     const real = await this.realLayoutPath("/tmp");
     const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
     if (real !== void 0 && st?.isDirectory && this.base.hasOwner && !await this.base.hasOwner(real)) {
-      const names = await this.base.readdir(real).catch(() => void 0);
+      const names2 = await this.base.readdir(real).catch(() => void 0);
       let removed = 0;
-      let left = names === void 0 ? 1 : 0;
-      for (const name2 of names ?? []) {
+      let left = names2 === void 0 ? 1 : 0;
+      for (const name2 of names2 ?? []) {
         const path = joinName(real, name2);
         if (await this.base.hasOwner(path)) continue;
         const failed3 = this.inUse(path) ? "busy" : await this.base.rm(path, { recursive: true, force: true }).catch(String);
@@ -26862,12 +27000,12 @@ var Launcher = class {
   }
   named = /* @__PURE__ */ new WeakMap();
   commandNames(commands) {
-    let names = this.named.get(commands);
-    if (!names) {
-      names = new Set(commands.keys());
-      this.named.set(commands, names);
+    let names2 = this.named.get(commands);
+    if (!names2) {
+      names2 = new Set(commands.keys());
+      this.named.set(commands, names2);
     }
-    return names;
+    return names2;
   }
   async entryTarget(path) {
     const system = COMMAND2.exec(path)?.[1];