@ai-ecoverse/slicc-kernel 1.125.3 → 1.125.4

package/dist/kernel-worker.js

@@ -1097,8 +1097,8 @@ var ERRNO_BY_DOM_ERROR = {
 var reported = /* @__PURE__ */ new Set();
 function translate(err, path, op = "lookup", mapped = true) {
   if (typeof err?.code === "string") return err;
-  const raw = err?.name;
-  const name2 = typeof raw === "string" ? raw : "Error";
+  const raw2 = err?.name;
+  const name2 = typeof raw2 === "string" ? raw2 : "Error";
   const code = name2 === "QuotaExceededError" ? "ENOSPC" : mapped && ERRNO_BY_DOM_ERROR[name2] || "EIO";
   const error = Object.assign(fsError(code, path), { domName: name2, op, cause: err });
   if (code !== "EIO" && code !== "ENOSPC") return error;
@@ -2049,26 +2049,26 @@ var OpfsFs = class {
     const found = await this.locate(path, true);
     const handle = found.handle;
     if (handle.kind !== "directory") throw fsError("ENOTDIR", path);
-    const children2 = /* @__PURE__ */ new Map();
-    for await (const child of handle.values()) children2.set(child.name, child);
+    const children3 = /* @__PURE__ */ new Map();
+    for await (const child of handle.values()) children3.set(child.name, child);
     for (const link2 of await this.meta.links(found.path)) {
       const name2 = baseOf(link2.path);
-      if (!children2.has(name2)) children2.set(name2, link2);
+      if (!children3.has(name2)) children3.set(name2, link2);
     }
-    return [found.path, [...children2].sort(([a], [b]) => a < b ? -1 : 1)];
+    return [found.path, [...children3].sort(([a], [b]) => a < b ? -1 : 1)];
   }
   async readdir(path) {
     return (await this.listing(path))[1].map(([name2]) => name2);
   }
   async readdirStat(path) {
-    const [dir, children2] = await this.listing(path);
+    const [dir, children3] = await this.listing(path);
     const base = dir === "/" ? "" : dir;
-    const touched = children2.map(([name2]) => this.timesOf(`${base}/${name2}`));
-    const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
+    const touched = children3.map(([name2]) => this.timesOf(`${base}/${name2}`));
+    const metas = await this.meta.get(children3.map(([name2]) => `${base}/${name2}`));
     const handed2 = this.owners ? await this.handedTo(dir) : void 0;
     const owned4 = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
     return Promise.all(
-      children2.map(async ([name2, child], i) => {
+      children3.map(async ([name2, child], i) => {
         if (!isHandle(child)) return [name2, owned4(this.linkStat(child), child)];
         const stat = await this.statOf(`${base}/${name2}`, child, metas[i], touched[i]).catch(
           () => null
@@ -4516,8 +4516,8 @@ var SwitchConn = class {
   switching = false;
   secure;
   failed;
-  constructor(raw) {
-    this.raw = raw;
+  constructor(raw2) {
+    this.raw = raw2;
   }
   get localAddr() {
     return this.raw.localAddr;
@@ -4970,9 +4970,9 @@ var KernelSocket = class _KernelSocket {
       () => void 0
     );
     return Promise.race([dialled, abandoned]).then(
-      async (raw) => {
+      async (raw2) => {
         if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
-        const conn = new SwitchConn(raw);
+        const conn = new SwitchConn(raw2);
         if (secure2) {
           clearTimeout(timer);
           try {
@@ -6517,10 +6517,10 @@ function partial(text) {
     text
   );
   if (!m) return void 0;
-  const raw = [m[1], m[2], m[3]];
-  if (!raw.every((p) => p === void 0 || PART.test(p))) return void 0;
+  const raw2 = [m[1], m[2], m[3]];
+  if (!raw2.every((p) => p === void 0 || PART.test(p))) return void 0;
   const parts2 = [];
-  for (const p of raw) {
+  for (const p of raw2) {
     if (p === void 0 || /^[xX*]$/.test(p) || parts2.includes(void 0)) parts2.push(void 0);
     else parts2.push(Number(p));
   }
@@ -6632,7 +6632,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.125.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.125.4" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -6653,10 +6653,10 @@ function inside(pkg, rel2) {
   if (clean.startsWith("/") || clean.split("/").includes("..")) return void 0;
   return `${pkg}/${clean}`;
 }
-function envOf(pkg, raw) {
+function envOf(pkg, raw2) {
   const env = {};
-  if (!raw || typeof raw !== "object") return env;
-  for (const [key, value2] of Object.entries(raw)) {
+  if (!raw2 || typeof raw2 !== "object") return env;
+  for (const [key, value2] of Object.entries(raw2)) {
     if (!ENV_KEY.test(key)) continue;
     if (typeof value2 === "string") env[key] = value2.replace(PACKAGE, pkg);
     else if (value2 === null) env[key] = null;
@@ -6675,15 +6675,15 @@ function envFields(merged2) {
     ...unset.length > 0 ? { unset } : {}
   };
 }
-function argsOf(pkg, raw) {
-  if (!Array.isArray(raw) || raw.length === 0) return void 0;
-  if (!raw.every((arg) => typeof arg === "string")) return void 0;
-  return raw.map((arg) => arg.replace(PACKAGE, pkg));
+function argsOf(pkg, raw2) {
+  if (!Array.isArray(raw2) || raw2.length === 0) return void 0;
+  if (!raw2.every((arg) => typeof arg === "string")) return void 0;
+  return raw2.map((arg) => arg.replace(PACKAGE, pkg));
 }
 var warnedVariants = /* @__PURE__ */ new Set();
-function variantOf(pkg, raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-  const { env, wasm } = raw;
+function variantOf(pkg, raw2) {
+  if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) return void 0;
+  const { env, wasm } = raw2;
   const path = inside(pkg, wasm);
   if (!path || !env || typeof env !== "object" || Array.isArray(env)) return void 0;
   const pairs = Object.entries(env);
@@ -6693,13 +6693,13 @@ function variantOf(pkg, raw) {
   }
   return { env: Object.fromEntries(pairs), wasm: path };
 }
-function variantsOf(pkg, name2, raw) {
-  if (raw === void 0) return void 0;
-  const variants = Array.isArray(raw) ? raw.map((one) => variantOf(pkg, one)) : [void 0];
+function variantsOf(pkg, name2, raw2) {
+  if (raw2 === void 0) return void 0;
+  const variants = Array.isArray(raw2) ? raw2.map((one) => variantOf(pkg, one)) : [void 0];
   if (variants.every((one) => one !== void 0)) {
     return variants.length > 0 ? variants : void 0;
   }
-  const key = `${pkg}:${name2}:${JSON.stringify(raw)}`;
+  const key = `${pkg}:${name2}:${JSON.stringify(raw2)}`;
   if (!warnedVariants.has(key)) {
     warnedVariants.add(key);
     console.warn(`slicc-kernel: ${pkg}: ${name2}: ignoring malformed "variants", running its wasm`);
@@ -6711,22 +6711,22 @@ function variantFor(variants, env) {
     (one) => Object.entries(one.env).every(([key, value2]) => env[key] === value2)
   )?.wasm;
 }
-function abiOf(raw, fallback) {
-  const abi = raw ?? fallback;
+function abiOf(raw2, fallback) {
+  const abi = raw2 ?? fallback;
   return abi === "emscripten" || abi === "wasi" || abi === "js" ? abi : void 0;
 }
-function commandOf(pkg, name2, raw, packageAbi, shared) {
-  const withEnv = envFields({ ...shared, ...envOf(pkg, raw.env) });
-  const script = inside(pkg, raw.script);
+function commandOf(pkg, name2, raw2, packageAbi, shared) {
+  const withEnv = envFields({ ...shared, ...envOf(pkg, raw2.env) });
+  const script = inside(pkg, raw2.script);
   if (script) {
     return { name: name2, abi: packageAbi, glue: script, wasm: script, argv0: name2, script, ...withEnv };
   }
-  const abi = abiOf(raw.abi, packageAbi);
-  const fixed = typeof raw.argv0 === "string" && raw.argv0 !== "";
-  const argv0 = fixed ? raw.argv0 : name2;
-  const args = argsOf(pkg, raw.args);
+  const abi = abiOf(raw2.abi, packageAbi);
+  const fixed = typeof raw2.argv0 === "string" && raw2.argv0 !== "";
+  const argv0 = fixed ? raw2.argv0 : name2;
+  const args = argsOf(pkg, raw2.args);
   if (abi === "js") {
-    const module = inside(pkg, raw.module);
+    const module = inside(pkg, raw2.module);
     if (!module) return void 0;
     return {
       name: name2,
@@ -6735,16 +6735,16 @@ function commandOf(pkg, name2, raw, packageAbi, shared) {
       wasm: module,
       argv0,
       ...fixed ? { argv0Fixed: true } : {},
-      ...raw.argv0Path === true ? { argv0Path: true } : {},
+      ...raw2.argv0Path === true ? { argv0Path: true } : {},
       ...args ? { args } : {},
       ...withEnv
     };
   }
-  const wasm = inside(pkg, raw.wasm);
-  const glue = abi === "wasi" ? wasm : inside(pkg, raw.glue);
+  const wasm = inside(pkg, raw2.wasm);
+  const glue = abi === "wasi" ? wasm : inside(pkg, raw2.glue);
   if (!abi || !glue || !wasm) return void 0;
-  const imports = abi === "wasi" ? inside(pkg, raw.imports) : void 0;
-  const variants = variantsOf(pkg, name2, raw.variants);
+  const imports = abi === "wasi" ? inside(pkg, raw2.imports) : void 0;
+  const variants = variantsOf(pkg, name2, raw2.variants);
   return {
     name: name2,
     abi,
@@ -6752,8 +6752,8 @@ function commandOf(pkg, name2, raw, packageAbi, shared) {
     wasm,
     argv0,
     ...fixed ? { argv0Fixed: true } : {},
-    ...raw.argv0Path === true ? { argv0Path: true } : {},
-    ...abi === "wasi" && raw.preopenRoot === true ? { preopenRoot: true } : {},
+    ...raw2.argv0Path === true ? { argv0Path: true } : {},
+    ...abi === "wasi" && raw2.preopenRoot === true ? { preopenRoot: true } : {},
     ...args ? { args } : {},
     ...withEnv,
     ...imports ? { imports } : {},
@@ -6768,11 +6768,11 @@ function commandsOf(pkg, manifest) {
   if (!packageAbi || !entries || typeof entries !== "object") return [];
   const shared = envOf(pkg, slicc.env);
   const out = [];
-  for (const [name2, raw] of Object.entries(entries)) {
-    if (!commandName(name2) || !raw || typeof raw !== "object") {
+  for (const [name2, raw2] of Object.entries(entries)) {
+    if (!commandName(name2) || !raw2 || typeof raw2 !== "object") {
       continue;
     }
-    const command = commandOf(pkg, name2, raw, packageAbi, shared);
+    const command = commandOf(pkg, name2, raw2, packageAbi, shared);
     if (command) out.push(command);
   }
   return out;
@@ -7323,8 +7323,8 @@ function hashId(text) {
     a = Math.imul(a ^ c, 16777619);
     b = Math.imul(b ^ c, 1540483477);
   }
-  const hex3 = (n) => (n >>> 0).toString(16).padStart(8, "0");
-  return hex3(a) + hex3(b);
+  const hex4 = (n) => (n >>> 0).toString(16).padStart(8, "0");
+  return hex4(a) + hex4(b);
 }
 function split2(text, count2) {
   const words2 = [];
@@ -7372,9 +7372,9 @@ function parseCrontab(text, path, system = false) {
   const env = {};
   const ctx = { path, system, names: /* @__PURE__ */ new Set() };
   let name2;
-  for (const [index, raw] of text.split("\n").entries()) {
+  for (const [index, raw2] of text.split("\n").entries()) {
     const line = index + 1;
-    const content = raw.trim();
+    const content = raw2.trim();
     const named = NAME_LINE.exec(content);
     if (named) {
       name2 = named[1];
@@ -9125,7 +9125,7 @@ function withCommandDirs(fs, names2, userDir = async () => void 0, owners = fals
     const { uid = 0, gid = 0 } = dir === void 0 ? {} : await nearest(dir);
     return { ...stat2, uid, gid };
   }
-  async function children2(path) {
+  async function children3(path) {
     if (path === "/") return ["bin", "usr"];
     if (path === "/usr") return ["bin"];
     if (path === "/bin" || path === "/usr/bin") return [...await names2()];
@@ -9220,7 +9220,7 @@ function withCommandDirs(fs, names2, userDir = async () => void 0, owners = fals
     stat: (path) => stat(path, (p) => fs.stat(p)),
     lstat: (path) => stat(path, (p) => fs.lstat(p)),
     async readdir(path) {
-      const extra = await children2(path);
+      const extra = await children3(path);
       if (!extra) return fs.readdir(path);
       const real = await fs.readdir(path).catch((err) => {
         if (missing3(err)) return [];
@@ -9229,7 +9229,7 @@ function withCommandDirs(fs, names2, userDir = async () => void 0, owners = fals
       return [.../* @__PURE__ */ new Set([...real, ...extra])].sort();
     },
     async readdirStat(path) {
-      const extra = await children2(path);
+      const extra = await children3(path);
       if (!extra) return fs.readdirStat(path);
       const real = await fs.readdirStat(path).catch((err) => {
         if (missing3(err)) return [];
@@ -10907,6 +10907,7 @@ var MountTable = class {
     if (paths === true) {
       mount.attrs.clear();
       mount.lists.clear();
+      this.deps.doubted?.(target);
       this.deps.changed?.(target);
       return;
     }
@@ -14343,15 +14344,15 @@ function parseHead(bytes) {
 }
 async function readHead(incoming, signal) {
   for (; ; ) {
-    let raw;
+    let raw2;
     try {
-      raw = await incoming.head(MAX_HEAD2, signal);
+      raw2 = await incoming.head(MAX_HEAD2, signal);
     } catch (err) {
       if (err instanceof KernelError) throw err;
       throw errno2("EPROTO", "the response head is malformed or too large");
     }
-    if (!raw) throw errno2("ECONNRESET", "the connection closed before a response");
-    const head = parseHead(raw);
+    if (!raw2) throw errno2("ECONNRESET", "the connection closed before a response");
+    const head = parseHead(raw2);
     if (head.status < 100 || head.status >= 200 || head.status === 101) return head;
   }
 }
@@ -14737,9 +14738,9 @@ async function keyId(spki) {
     await crypto.subtle.digest("SHA-1", publicKeyBits(spki))
   );
 }
-function ecdsaDer(raw) {
-  const half = raw.length / 2;
-  return seq(integer(raw.subarray(0, half)), integer(raw.subarray(half)));
+function ecdsaDer(raw2) {
+  const half = raw2.length / 2;
+  return seq(integer(raw2.subarray(0, half)), integer(raw2.subarray(half)));
 }
 function randomSerial() {
   const serial = crypto.getRandomValues(new Uint8Array(16));
@@ -16884,8 +16885,8 @@ var SemHandles = class _SemHandles {
     this.byHandle.clear();
   }
 };
-function semName(raw) {
-  const name2 = raw.replace(/^\/+/, "");
+function semName(raw2) {
+  const name2 = raw2.replace(/^\/+/, "");
   if (name2 === "" || name2.includes("/") || name2 === "." || name2 === "..") {
     throw new KernelError("EINVAL");
   }
@@ -17280,20 +17281,111 @@ function tlv2(der, at) {
   const end = body + length2;
   return end > der.length ? void 0 : { start: at, body, end };
 }
-function names(der) {
-  const cert = tlv2(der, 0);
-  const tbs = cert && tlv2(der, cert.body);
-  if (!tbs) return void 0;
+function children2(der, outer, max) {
   const fields = [];
-  for (let at = tbs.body; at < tbs.end && fields.length < 6; ) {
+  for (let at = outer.body; at < outer.end && fields.length < max; ) {
     const field4 = tlv2(der, at);
     if (!field4) return void 0;
-    if (fields.length > 0 || der[at] !== 160) fields.push(field4);
+    fields.push(field4);
     at = field4.end;
   }
-  const [, , issuer, , subject] = fields;
+  return fields;
+}
+function tbsFields(der) {
+  const outer = tlv2(der, 0);
+  const cert = outer && children2(der, outer, 3);
+  const tbs = cert?.[0] && children2(der, cert[0], 8);
+  if (!cert || !tbs) return void 0;
+  return { cert, tbs: der[tbs[0]?.start ?? 0] === 160 ? tbs.slice(1) : tbs };
+}
+var raw = (der, t) => der.subarray(t.start, t.end);
+function names(der) {
+  const fields = tbsFields(der)?.tbs;
+  const [, , issuer, , subject] = fields ?? [];
   if (!issuer || !subject) return void 0;
-  return [der.subarray(issuer.start, issuer.end), der.subarray(subject.start, subject.end)];
+  return [raw(der, issuer), raw(der, subject)];
+}
+var hex2 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+var HASHES = {
+  "2a864886f70d01010b": ["RSASSA-PKCS1-v1_5", "SHA-256"],
+  "2a864886f70d01010c": ["RSASSA-PKCS1-v1_5", "SHA-384"],
+  "2a864886f70d01010d": ["RSASSA-PKCS1-v1_5", "SHA-512"],
+  "2a8648ce3d040302": ["ECDSA", "SHA-256"],
+  "2a8648ce3d040303": ["ECDSA", "SHA-384"],
+  "2a8648ce3d040304": ["ECDSA", "SHA-512"],
+  "2b6570": ["Ed25519", ""]
+};
+var CURVES = {
+  "2a8648ce3d030107": ["P-256", 32],
+  "2b81040022": ["P-384", 48],
+  "2b81040023": ["P-521", 66]
+};
+function oidOf(der, algorithm, index = 0) {
+  const parts2 = children2(der, algorithm, 2);
+  const oid2 = parts2?.[index];
+  return oid2 && der[oid2.start] === 6 ? hex2(der.subarray(oid2.body, oid2.end)) : void 0;
+}
+function curveOf(der, spki) {
+  const algorithm = children2(der, spki, 1)?.[0];
+  const curve = algorithm && oidOf(der, algorithm, 1);
+  return curve ? CURVES[curve] : void 0;
+}
+function fixedEcdsa(sig, size) {
+  const outer = tlv2(sig, 0);
+  const ints = outer && children2(sig, outer, 2);
+  if (ints?.length !== 2) return void 0;
+  const out = new Uint8Array(size * 2);
+  for (const [i, int] of ints.entries()) {
+    let value2 = sig.subarray(int.body, int.end);
+    while (value2.length > size && value2[0] === 0) value2 = value2.subarray(1);
+    if (value2.length > size) return void 0;
+    out.set(value2, (i + 1) * size - value2.length);
+  }
+  return out;
+}
+function signedOf(der) {
+  const parts2 = tbsFields(der);
+  const [tbs, algorithm, value2] = parts2?.cert ?? [];
+  const spki = parts2?.tbs[5];
+  if (!tbs || !algorithm || !value2 || !spki || der[value2.start] !== 3) return void 0;
+  const known = HASHES[oidOf(der, algorithm) ?? ""];
+  if (!known) return "unknown";
+  const [scheme, hash] = known;
+  const curve = scheme === "ECDSA" ? curveOf(der, spki) : void 0;
+  if (scheme === "ECDSA" && !curve) return "unknown";
+  const signature = der.subarray(value2.body + 1, value2.end);
+  return {
+    tbs: raw(der, tbs),
+    spki: raw(der, spki),
+    signature,
+    scheme,
+    hash,
+    ...curve ? { curve } : {}
+  };
+}
+async function verifiesItself(s) {
+  const name2 = s.curve?.[0];
+  const algorithm = s.scheme === "ECDSA" ? { name: "ECDSA", namedCurve: name2 } : s.hash ? { name: s.scheme, hash: s.hash } : { name: s.scheme };
+  const key = await crypto.subtle.importKey("spki", new Uint8Array(s.spki), algorithm, false, [
+    "verify"
+  ]);
+  const signature = s.curve ? fixedEcdsa(s.signature, s.curve[1]) : s.signature;
+  if (!signature) return false;
+  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : { name: s.scheme };
+  return crypto.subtle.verify(params, key, new Uint8Array(signature), new Uint8Array(s.tbs));
+}
+async function selfSigned(der) {
+  if (!selfIssued(der)) return false;
+  const signed = signedOf(der);
+  if (signed === "unknown") return true;
+  if (!signed) return false;
+  return verifiesItself(signed).catch(() => false);
+}
+async function chainShape(chain2) {
+  return {
+    leafSelfSigned: chain2.length === 1 && await selfSigned(chain2[0]),
+    topSelfSigned: chain2.length > 1 && await selfSigned(chain2.at(-1))
+  };
 }
 function selfIssued(der) {
   const pair = der && names(der);
@@ -17301,17 +17393,17 @@ function selfIssued(der) {
   const [issuer, subject] = pair;
   return issuer.length === subject.length && issuer.every((b, i) => b === subject[i]);
 }
-function untrusted(chain2) {
+function untrusted(chain2, shape) {
   if (chain2.length === 1) {
-    return selfIssued(chain2[0]) ? "DEPTH_ZERO_SELF_SIGNED_CERT" : "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+    return shape.leafSelfSigned ? "DEPTH_ZERO_SELF_SIGNED_CERT" : "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
   }
-  return selfIssued(chain2.at(-1)) ? "SELF_SIGNED_CERT_IN_CHAIN" : "UNABLE_TO_GET_ISSUER_CERT_LOCALLY";
+  return shape.topSelfSigned ? "SELF_SIGNED_CERT_IN_CHAIN" : "UNABLE_TO_GET_ISSUER_CERT_LOCALLY";
 }
-function chainError(flags2, chain2) {
+function chainError(flags2, chain2, shape) {
   if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
   const rest2 = flags2 & ~CN_MISMATCH;
   if (rest2 === 0) return void 0;
-  if (rest2 & NOT_TRUSTED) return untrusted(chain2);
+  if (rest2 & NOT_TRUSTED) return untrusted(chain2, shape);
   return verifyCode(rest2);
 }
 function nameMatches(flags2) {
@@ -17351,10 +17443,10 @@ var SUITES = [
 ];
 function cipherOf(id2, protocol) {
   const known = SUITES.find(([n]) => n === id2);
-  const hex3 = `0x${id2.toString(16).padStart(4, "0").toUpperCase()}`;
+  const hex4 = `0x${id2.toString(16).padStart(4, "0").toUpperCase()}`;
   return {
-    name: known?.[1] ?? hex3,
-    standardName: known?.[2] ?? hex3,
+    name: known?.[1] ?? hex4,
+    standardName: known?.[2] ?? hex4,
     version: known?.[3] ?? protocol
   };
 }
@@ -17460,12 +17552,12 @@ async function handshake(conn, o, session, inbox) {
     }
   }
 }
-function insecureOf(session, chain2) {
+function insecureOf(session, chain2, shape) {
   const flags2 = session.verifyResult;
-  const error = chainError(flags2, chain2);
+  const error = chainError(flags2, chain2, shape);
   return { hostnameMatches: nameMatches(flags2), ...error ? { chainError: error } : {} };
 }
-function controlsOf(o, session, protocol, chain2) {
+function controlsOf(o, session, protocol, chain2, shape) {
   if (!o.engine.sessionControls) return {};
   const checked = o.checkHostname !== false && !o.insecure;
   return {
@@ -17473,21 +17565,22 @@ function controlsOf(o, session, protocol, chain2) {
     clientCertificate: o.clientCertificate === true,
     sni: o.sni !== false && !isIP(o.servername),
     hostnameChecked: checked,
-    ...o.insecure ? insecureOf(session, chain2) : { hostnameMatches: checked || !session.nameMismatch }
+    ...o.insecure ? insecureOf(session, chain2, shape) : { hostnameMatches: checked || !session.nameMismatch }
   };
 }
-function infoOf(o, session) {
+async function infoOf(o, session) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
   const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
   const chain2 = session.peerChain();
+  const shape = await chainShape(o.insecure ? chain2 : []);
   return {
     protocol,
     alpnProtocol: session.alpn ?? false,
     authorized: code === void 0,
     ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
     peerCertificates: chain2,
-    ...controlsOf(o, session, protocol, chain2)
+    ...controlsOf(o, session, protocol, chain2, shape)
   };
 }
 var FATAL_ALERT = -30592;
@@ -17551,7 +17644,8 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
   inbox.hand(taken);
   try {
     await handshake(conn, o, session, inbox);
-    return { conn: plaintext(conn, session, inbox), info: infoOf(o, session) };
+    const info = await infoOf(o, session);
+    return { conn: plaintext(conn, session, inbox), info };
   } catch (err) {
     session.free();
     throw err;
@@ -17736,10 +17830,10 @@ async function prepareWith(support, req, servername, cert) {
 }
 function secure(prepared) {
   let ran = false;
-  const make = async (raw) => {
+  const make = async (raw2) => {
     ran = true;
     try {
-      return await tlsClient(raw, prepared.options);
+      return await tlsClient(raw2, prepared.options);
     } finally {
       prepared.own?.release();
     }
@@ -18223,6 +18317,7 @@ var SEEK_SET = 0;
 var SEEK_CUR = 1;
 var SEEK_END = 2;
 var WRITEBACK_MS = 250;
+var UNREACHABLE2 = /* @__PURE__ */ new Set(["ENOMEDIUM", "ENOTCONN", "ENODEV", "EIO"]);
 var WRITEBACK_COST_FACTOR = 10;
 function isMissing(err) {
   if (err?.code === "ENOENT") return true;
@@ -18240,6 +18335,8 @@ var VfsNode = class {
   queue = Promise.resolve();
   writeBack;
   writeBackCost = 0;
+  failed = false;
+  doubt = false;
   opens = 0;
   writers = 0;
   missing = false;
@@ -18388,6 +18485,7 @@ var VfsNode = class {
   }
   async pwrite(bytes, at) {
     if (bytes.length === 0) return 0;
+    await this.settled();
     await this.fits(at + bytes.length);
     const ranged2 = await this.prepare();
     if (ranged2) {
@@ -18403,6 +18501,7 @@ var VfsNode = class {
     return bytes.length;
   }
   async truncate(size) {
+    await this.settled();
     await this.fits(size);
     const ranged2 = await this.prepare();
     if (ranged2) {
@@ -18415,6 +18514,20 @@ var VfsNode = class {
     this.length = size;
     this.markDirty();
   }
+  doubted() {
+    if (this.dirty) this.failed = true;
+    else if (!this.orphaned) this.doubt = true;
+  }
+  async settled() {
+    if (this.failed) return this.flush();
+    if (!this.doubt) return;
+    const err = await this.fs.stat?.(this.path).then(
+      () => void 0,
+      (e) => e
+    );
+    if (UNREACHABLE2.has(err?.code ?? "")) throw err;
+    this.doubt = false;
+  }
   markDirty() {
     this.dirty = true;
     this.recount();
@@ -18423,7 +18536,9 @@ var VfsNode = class {
     const delay = Math.max(WRITEBACK_MS, this.writeBackCost * WRITEBACK_COST_FACTOR);
     this.writeBack = setTimeout(() => {
       this.writeBack = void 0;
-      this.serial(() => this.flush()).catch(() => void 0);
+      this.serial(() => this.flush()).catch(() => {
+        this.failed = true;
+      });
     }, delay);
   }
   ensure(need2) {
@@ -18436,7 +18551,10 @@ var VfsNode = class {
   }
   async flush() {
     if (this.revoked && this.dirty) throw new KernelError("EIO");
-    if (!this.dirty || this.orphaned || !(this.data || this.ranged)) return;
+    if (!this.dirty || this.orphaned || !(this.data || this.ranged)) {
+      this.failed = false;
+      return;
+    }
     this.dirty = false;
     const started = performance.now();
     try {
@@ -18448,6 +18566,7 @@ var VfsNode = class {
     } finally {
       this.recount();
     }
+    this.failed = false;
     this.writeBackCost = performance.now() - started;
   }
 };
@@ -18688,6 +18807,9 @@ var VfsNodes = class {
   rewritten(path) {
     this.byPath.get(path)?.reread();
   }
+  doubted(path) {
+    for (const [p, node] of this.byPath) if (within7(p, path)) node.doubted();
+  }
   async flush(path) {
     for (const [p, node] of this.byPath) if (within7(p, path)) await node.serial(() => node.flush());
   }
@@ -21688,8 +21810,8 @@ function isMessage(data) {
 var HOSTS_PATH = "/etc/hosts";
 function parseHosts(text) {
   const table = /* @__PURE__ */ new Map();
-  for (const raw of text.split("\n")) {
-    const [address, ...names2] = raw.replace(/#.*/, "").trim().split(/\s+/);
+  for (const raw2 of text.split("\n")) {
+    const [address, ...names2] = raw2.replace(/#.*/, "").trim().split(/\s+/);
     if (!address || names2.length === 0) continue;
     if (ipv4Bytes(address) === void 0 && ipv6Groups(address) === void 0) continue;
     for (const name2 of names2) {
@@ -21844,7 +21966,7 @@ function base642(bytes, padded = true) {
 function urlSafe(text) {
   return text.replace(/\+/g, "-").replace(/\//g, "_");
 }
-function hex2(bytes) {
+function hex3(bytes) {
   let out = "";
   for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
   return out;
@@ -21900,12 +22022,12 @@ function encodings(bytes) {
   return [...standard, ...standard.map(urlSafe)];
 }
 function shapes(value2) {
-  const raw = utf82(value2);
+  const raw2 = utf82(value2);
   const seen = /* @__PURE__ */ new Set([value2]);
   const out = [];
-  if (raw.length < FRAGMENT) out.push({ bytes: raw, form: "raw" });
-  for (let offset = 0; raw.length >= FRAGMENT && offset + FRAGMENT <= raw.length; offset++) {
-    out.push({ bytes: raw.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
+  if (raw2.length < FRAGMENT) out.push({ bytes: raw2, form: "raw" });
+  for (let offset = 0; raw2.length >= FRAGMENT && offset + FRAGMENT <= raw2.length; offset++) {
+    out.push({ bytes: raw2.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
   }
   const add = (text, form) => {
     if (seen.has(text)) return;
@@ -21923,9 +22045,9 @@ function shapes(value2) {
   }
   for (const text of percent(value2)) add(text, "percent");
   for (const text of [html(value2, "&#39;"), html(value2, "&#x27;")]) add(text, "html");
-  for (const text of encodings(raw)) add(text, "base64");
-  add(hex2(raw), "hex");
-  add(hex2(raw).toUpperCase(), "hex");
+  for (const text of encodings(raw2)) add(text, "base64");
+  add(hex3(raw2), "hex");
+  add(hex3(raw2).toUpperCase(), "hex");
   return out;
 }
 function wrappable(form) {
@@ -23136,8 +23258,8 @@ var GENERIC = /* @__PURE__ */ new Set([
 ]);
 function parseMountOptions(data) {
   const options = {};
-  for (const raw of data.split(",")) {
-    const item = raw.trim();
+  for (const raw2 of data.split(",")) {
+    const item = raw2.trim();
     if (!item || GENERIC.has(item)) continue;
     if (item === "rw") {
       delete options.ro;
@@ -23194,8 +23316,8 @@ function unescape(field4) {
 }
 function parseFstab(text) {
   const lines2 = [];
-  text.split("\n").forEach((raw, index) => {
-    const content = raw.replace(/#.*$/, "").trim();
+  text.split("\n").forEach((raw2, index) => {
+    const content = raw2.replace(/#.*$/, "").trim();
     if (!content) return;
     const [source, target, type, options = "defaults"] = content.split(/\s+/).map(unescape);
     if (source === void 0 || target === void 0 || type === void 0) return;
@@ -25164,6 +25286,9 @@ var Launcher = class {
         if (paths.some((path) => this.pnpmChain.has(path))) this.pnpmStale();
         this.watchers.changed(...paths);
       },
+      doubted: (target) => {
+        for (const nodes of this.openFiles) nodes.doubted(target);
+      },
       reshaped: () => this.watchers.reshaped(),
       owners: this.owners
     });