@ai-ecoverse/slicc-kernel 1.128.2 → 1.129.0

package/README.md

@@ -225,7 +225,7 @@ A WASI preview1 or WASIX program (Zig, Rust, Go, wasi-libc or wasix-libc C) has
 { "slicc": { "abi": "wasi", "commands": { "rg": { "wasm": "bin/rg.wasm" }, "rustc": { "script": "bin/rustc" } } } }
 ```
 
-A command's name is any single path component without whitespace or control characters, so coreutils' `[` is in `/usr/bin` too; a name that is empty, `.` or `..`, or has a `/`, a space, a tab, a newline, NUL or another control character is skipped. Entries may also set `argv0`, `args` and `env`, and a package can set `slicc.env` for all of its commands. A WASI entry with `"preopenRoot": true` also gets `/` as a preopen (see [WASI programs](#wasi-programs)). An entry with `"argv0Path": true` gets the absolute path it was run by as `argv[0]` when that path is a link outside `/bin` and `/usr/bin` to the command, as a venv's `bin/python` is (the `#!` line of a script naming such a link included), so it can find what sits beside that link; other entries keep their `argv0`. In `env`, `${package}` is the package directory, `${cwd}` the process's working directory, and `${NAME}` the caller's `NAME` when the program starts (a default naming an unset variable is left out); a relative path that exists in the package (`lib/python3.14`, `./`) becomes that absolute path. The caller's environment wins over these defaults; a `null` value removes the variable for the command, after the caller's environment is applied (a host-networked program can drop the kernel's proxy settings that way), and a command entry can set a variable its package's `slicc.env` removes. The catalog reads its roots in order, and the first root that provides a name wins it: a user's own global packages (for that user's processes), `/node_modules`, root's global packages, then each appended root. Within a root, packages are read by name and the first wins (compared as strings by UTF-16 code unit, so a scoped `@scope/name` comes before names that start with a letter, but after those that start with a digit), whatever order the file system lists them in; a `PNPM_HOME`'s install groups count as one root, read group by group (by the group directory's name, effectively arbitrary for pnpm's hashed names), each by package name. A variant can take over from the package it extends with `"slicc": { "replaces": ["@ai-ecoverse/wasm-imagemagick"] }`: when it and a package it names are in the same root, it wins every command name they share, whatever the order; names only the other provides stay the other's, a third package that provides the name and sorts first still wins it, and packages that replace each other fall back to the name order. A replace never reaches into an earlier root, so root's global packages can't take a name from `/node_modules` or a user's own packages. The field must be an array of package names; anything else is ignored. `sh` runs bash as `sh` unless a package provides its own. A package's `engines.slicc-kernel` is a floor the kernel holds it to: when the running kernel's version doesn't satisfy that npm range (comparators, `^`, `~`, x-ranges, hyphen ranges, `||`), or the range can't be read, its commands are refused. They stay in `/usr/bin`, and running one by name, by path or as a `#!` interpreter exits 126 with `<cmd>: <pkg>@<version> needs slicc-kernel <range>; this kernel is <version>` on stderr. Each refused package is logged once to the console. A non-string `engines.slicc-kernel`, or none, is no constraint. A development build reports the newest release tag as `<tag>+dev` and checks against that; a build of unknown version (`0.0.0`) checks nothing. Only commands are refused: a package without commands (a `py-*` library, a side module) isn't, and a refused package that replaces base commands makes those commands fail with 126 rather than fall back to the package it replaces. The installed commands appear as executables in a virtual `/usr/bin` and `/bin`, so `PATH` lookups, `command -v` and `ls /usr/bin` work without writing anything to OPFS. An entry reads as its program, as a PATH search that opens what it finds expects (`ruby -S rake`, `perl -S`, Pod::Usage looking itself up, bundler checking that `/usr/bin/ruby` isn't empty). A script command reads as its script, a JS command as its module, and a WASI or Emscripten command as its `.wasm`, so `cat /usr/bin/hello` prints the script and `head -c4 /usr/bin/cat` gives `\0asm`. The entry is a plain file and no link: it stays a root-owned `0755` regular file with its own inode, `readlink` of it is `EINVAL`, and `which` and `command -v` print `/usr/bin/<name>`. Its size and times are the program's when the caller may read the program (anyone, for a kernel-internal look or with users off, only when everyone may), and 0 and the epoch otherwise. Running it still runs the catalog command, with its `env`, `args` and `argv0`. The read is the caller's: with users on, reading an entry also needs `r` on its program, and that includes a user's own commands in `~/.local/share/pnpm/bin`, so an entry whose program the caller can't read is `EACCES`. A process can also run a program by the path of its glue when the `.wasm` sits next to it, a wasm module by its own path (as a WASI program; when it is the `wasm` of a WASI command in the caller's catalog, the user's own packages included, it runs as that command, with its `env` defaults, `args` and `argv0`, the command whose name matches the file's, without `.wasm`, if several share it, while a copy elsewhere runs bare), and a script through its `#!` line (including `#!/usr/bin/env name`). Executing any other file fails with `ENOEXEC`, so bash runs it as a shell script, as POSIX shells do. A `..` in a path that is run is resolved physically, as the file system resolves it: `pkg/../tools/x` after a symlinked `pkg` is the `tools/x` beside the link's target, and its exec permission is checked there. The walk is the caller's: with users on, each directory it passes needs search (`x`) permission (`EACCES`, 126 in bash, as on Linux), and a sudo process follows only the links it trusts, as for any other path. Commands also come from pnpm's global directory. Every process gets a `PNPM_HOME` and has `$PNPM_HOME/bin` on `PATH`: root's is `/usr/local/share/pnpm` (unless the embedder sets its own), a user's `~/.local/share/pnpm` (see [Users](#users)). The kernel scans each of pnpm's global install groups (`$PNPM_HOME/global/*/<group>/node_modules`) after `/node_modules`, which wins when both provide a command. The catalog is re-read whenever anything under either changes, so `pnpm add -g @ai-ecoverse/wasi-ripgrep` makes `rg` work in the same shell, and `pnpm remove -g` removes it again.
+A command's name is any single path component without whitespace or control characters, so coreutils' `[` is in `/usr/bin` too; a name that is empty, `.` or `..`, or has a `/`, a space, a tab, a newline, NUL or another control character is skipped. Entries may also set `argv0`, `args` and `env`, and a package can set `slicc.env` for all of its commands. A WASI entry with `"preopenRoot": true` also gets `/` as a preopen (see [WASI programs](#wasi-programs)). An entry with `"argv0Path": true` gets the absolute path it was run by as `argv[0]` when that path is a link outside `/bin` and `/usr/bin` to the command, as a venv's `bin/python` is (the `#!` line of a script naming such a link included), so it can find what sits beside that link; other entries keep their `argv0`. In `env`, `${package}` is the package directory, `${cwd}` the process's working directory, and `${NAME}` the caller's `NAME` when the program starts (a default naming an unset variable is left out); a relative path that exists in the package (`lib/python3.14`, `./`) becomes that absolute path. The caller's environment wins over these defaults; a `null` value removes the variable for the command, after the caller's environment is applied (a host-networked program can drop the kernel's proxy settings that way), and a command entry can set a variable its package's `slicc.env` removes. The catalog reads its roots in order, and the first root that provides a name wins it: a user's own global packages (for that user's processes), `/node_modules`, root's global packages, then each appended root. Within a root, packages are read by name and the first wins (compared as strings by UTF-16 code unit, so a scoped `@scope/name` comes before names that start with a letter, but after those that start with a digit), whatever order the file system lists them in; a `PNPM_HOME`'s install groups count as one root, read group by group (by the group directory's name, effectively arbitrary for pnpm's hashed names), each by package name. A variant can take over from the package it extends with `"slicc": { "replaces": ["@ai-ecoverse/wasm-imagemagick"] }`: when it and a package it names are in the same root, it wins every command name they share, whatever the order; names only the other provides stay the other's, a third package that provides the name and sorts first still wins it, and packages that replace each other fall back to the name order. A replace never reaches into an earlier root, so root's global packages can't take a name from `/node_modules` or a user's own packages. The field must be an array of package names; anything else is ignored. `sh` runs bash as `sh` unless a package provides its own. A package's `engines.slicc-kernel` is a floor the kernel holds it to: when the running kernel's version doesn't satisfy that npm range (comparators, `^`, `~`, x-ranges, hyphen ranges, `||`), or the range can't be read, its commands are refused. They stay in `/usr/bin`, and running one by name, by path or as a `#!` interpreter exits 126 with `<cmd>: <pkg>@<version> needs slicc-kernel <range>; this kernel is <version>` on stderr. Each refused package is logged once to the console. A non-string `engines.slicc-kernel`, or none, is no constraint. A development build reports the newest release tag as `<tag>+dev` and checks against that; a build of unknown version (`0.0.0`) checks nothing. Only commands are refused: a package without commands (a `py-*` library, a side module) isn't, and a refused package that replaces base commands makes those commands fail with 126 rather than fall back to the package it replaces. The installed commands appear as executables in a virtual `/usr/bin` and `/bin`, so `PATH` lookups, `command -v` and `ls /usr/bin` work without writing anything to OPFS. An entry reads as its program, as a PATH search that opens what it finds expects (`ruby -S rake`, `perl -S`, Pod::Usage looking itself up, bundler checking that `/usr/bin/ruby` isn't empty). A script command reads as its script, a JS command as its module, and a WASI or Emscripten command as its `.wasm`, so `cat /usr/bin/hello` prints the script and `head -c4 /usr/bin/cat` gives `\0asm`. The entry is a plain file and no link: it stays a root-owned `0755` regular file with its own inode, `readlink` of it is `EINVAL`, and `which` and `command -v` print `/usr/bin/<name>`. Its size and times are the program's when the caller may read the program (anyone, for a kernel-internal look or with users off, only when everyone may), and 0 and the epoch otherwise. Running it still runs the catalog command, with its `env`, `args` and `argv0`. The read is the caller's: with users on, reading an entry also needs `r` on its program, and that includes a user's own commands in `~/.local/share/pnpm/bin`, so an entry whose program the caller can't read is `EACCES`. A process can also run a program by the path of its glue when the `.wasm` sits next to it, a wasm module by its own path (as a WASI program; when it is the `wasm` of a WASI command in the caller's catalog, the user's own packages included, it runs as that command, with its `env` defaults, `args` and `argv0`, the command whose name matches the file's, without `.wasm`, if several share it, while a copy elsewhere runs bare), and a script through its `#!` line (including `#!/usr/bin/env name`). Executing any other file fails with `ENOEXEC`, so bash runs it as a shell script, as POSIX shells do. A spawn by a bare name (no `/`) that the catalog doesn't have, and that didn't ask for no search (a WASIX `posix_spawn` or `execve`, as opposed to its `posix_spawnp`/`execvp`, keeps its bare name), searches the `PATH` of the spawn's own environment, in order, with an empty entry meaning the working directory; each candidate is run exactly as a spawn of that path would be. The first that runs wins; if one was found but refused and nothing else matched, the spawn fails with `EACCES` (126), otherwise `ENOENT` (127). A catalog command still wins over the same name on `PATH`, the reverse of a shell's order. The `PATH` searched is the new process's, from the spawn's environment; POSIX `posix_spawnp` uses the caller's, which is the same unless the caller hands the child another one. This is a stopgap for the Emscripten shim's `posix_spawnp`, which hands the kernel the bare name (`timeout 5 myscript`, [#1165](https://github.com/ai-ecoverse/slicc-kernel/issues/1165)); it goes once the shipped packages search `PATH` themselves ([#1168](https://github.com/ai-ecoverse/slicc-kernel/issues/1168)). A `..` in a path that is run is resolved physically, as the file system resolves it: `pkg/../tools/x` after a symlinked `pkg` is the `tools/x` beside the link's target, and its exec permission is checked there. The walk is the caller's: with users on, each directory it passes needs search (`x`) permission (`EACCES`, 126 in bash, as on Linux), and a sudo process follows only the links it trusts, as for any other path. Commands also come from pnpm's global directory. Every process gets a `PNPM_HOME` and has `$PNPM_HOME/bin` on `PATH`: root's is `/usr/local/share/pnpm` (unless the embedder sets its own), a user's `~/.local/share/pnpm` (see [Users](#users)). The kernel scans each of pnpm's global install groups (`$PNPM_HOME/global/*/<group>/node_modules`) after `/node_modules`, which wins when both provide a command. The catalog is re-read whenever anything under either changes, so `pnpm add -g @ai-ecoverse/wasi-ripgrep` makes `rg` work in the same shell, and `pnpm remove -g` removes it again.
 
 **More roots:** `createKernel({ commands: { append: ['/opt/user/node_modules'] } })` (and `createNodeKernel`) scans more directories, each absolute and normalised (anything else throws a `TypeError`). A name is looked up in a user's own global packages first, then in `modules`, then in root's global packages, then in the appended roots in the order given, and the first match wins, so an appended root never shadows another command (or `sudo`). Their commands are in `/usr/bin` for every user, like root's global packages, and their `binfmt` and file system entries count too. A package in an appended root also gets a command for each `bin` entry of its `package.json` (a string `bin` is named after the package, without its scope), which runs as a `#!` script; a name its `slicc.commands` gives wins. A `bin` entry is skipped when its name isn't a command name (see above), or its file, with symlinks resolved, isn't a regular file inside the package. `/node_modules` and the global packages keep reading only `slicc.commands`. A missing root counts as empty until it appears, and an install or removal in a root is picked up as it happens. With `users: 'enforce'` a root counts only when it and every directory above it are root's and not writable by group or others; another root is skipped without a word. Under `'report'` such a root is still scanned, and reported once to `onDenial` and the report log as `{ pid: 0, uid: 0, op: 'commands', path, errno: 'EACCES' }`. Running a `bin` command needs `r` and `x` on its file under `users` (see [Permissions](#permissions)), checked when it runs, so a `0644` file is `EACCES` under `'enforce'`.
 
@@ -465,13 +465,17 @@ The module's default export (or its `main` export) is called with a context and
 
       Then:
       - **HTTP/1.1:** if the **first request head** the program writes on the session (it starts with a standard method) has placeholders (`fnox_proxy_<24 hex>`) in exactly one header line, either in the value or in the `user:password` of `Basic` credentials, the kernel asks the vault once (`sessionMaterialize`, below) for that header's position.
+      - **SMTP:** a session whose first line is `EHLO` or `HELO` (implicit TLS, or after a STARTTLS upgrade; bytes written before the upgrade are never substituted) is read line by line, and only the `AUTH` exchange is a position:
+        - `AUTH PLAIN <blob>`, or the line after a bare `AUTH PLAIN`: the kernel decodes the blob, and asks the vault (`auth-plain`) only when the placeholders are in the **password field**. A placeholder in the user or authorization identity goes out as written. It substitutes there and re-encodes.
+        - `AUTH LOGIN`: the password line (the second line, or the first after `AUTH LOGIN <user>`) is decoded, substituted (`auth-login`) and re-encoded; the user line goes out as written.
+        - Every other line goes out as written. After the first `AUTH`, or once `MAIL`, `RCPT`, `DATA` or `BDAT` is seen, so is the rest of the session. A line still unfinished after 2 s, or longer than 4 KiB, is sent as written, and so is the rest.
       - **What goes out:** the placeholders the vault answers with a value of at least 8 bytes go out as that value (`Basic` decoded, substituted and re-encoded). Everything else goes out as written:
         - the request line and the body;
         - other headers;
         - a head with placeholders in two header lines;
         - later requests on the same connection;
         - anything once the head passes 16 KiB, or once the program pauses for 2 s in the middle of it;
-        - SMTP and pg, which come next.
+        - pg, which comes next.
       - **What's read back:** once a process has had a value substituted for a host, everything its whole process tree reads from any A2 session to that host is scrubbed: the process itself, its ancestors and every descendant (forked, spawned or exec'd, before or after the substitution; a forked child's own new session included) with [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub), as S2 does: the value comes back as its placeholder, and a fragment or an encoded form (JSON, percent, HTML, base64, hex) as `[redacted:sealed]`. The scrub stays until the whole tree has ended. A process outside the tree isn't covered. A value shorter than 8 bytes is never substituted, as it couldn't be scrubbed.
       - **The bound:** the server the value goes to is the one the vault rule names, verified against the kernel's own roots. Substitution trusts that server not to reflect the value back in a form the scrub doesn't know (encrypted under a key the program chose, say). That's the same residual as A1's.
       - **Elsewhere:** a placeholder written into any other A2 session reaches the server as written. It isn't the secret, so nothing leaks.
@@ -603,6 +607,8 @@ In the browser, the page serves the uplink to the kernel worker over the same po
 
 `fakeCronClock(start?, utc?)` is a clock for the kernel's cron to run on in tests, so a test moves time instead of waiting for it. It starts at `start` (default 2026-01-01T00:00Z) and reads schedules in UTC unless `utc` is `false`. `now()` is the fake time. `sleep(until, signal)` resolves when `advance(ms)` moves time to `until` or past it, or when `signal` aborts. `set(ms)` sets the wall clock, forward or back, and wakes every sleeper, as a scheduler's next periodic wake would after a real clock change. `sleepers` counts the sleeps still waiting. `flush()` resolves once every sleeper that a time move woke has gone back to sleep for a later time, which is the point where a scheduler has done what was due. It never resolves while nothing sleeps.
 
+`setTestSyscallHook(hook)` is **test-only**: while set, every process kernel call (the `WasmSyscall` requests: process, fd, socket, signal and job calls; not the path-only file system requests such as `read`, `write` or `rename`) of a process in this Node process first awaits `hook({ pid, op })`. `pid` is the kernel's own pid of the process, which for an exec'd image is not the pid the program sees (`getpid()`, `ps` show the pid it took over). A test can then act at an exact point (write a ^C when a shell forks) or hold a call (delay a child's `proc-setpgid`). `setTestSyscallHook(undefined)` clears it. Unset, which is the default, it does nothing.
+
 ### Browser automation (CDP)
 
 Programs drive a browser with the Chrome DevTools Protocol over a WebSocket, whichever host actually has the browser: slicc-extension's `chrome.debugger`, slicc-node's or slicc-swift's CDP proxy, or a test harness. The kernel relays; it does not launch a browser.

package/dist/kernel-worker.js

@@ -544,14 +544,14 @@ var Integrity = class {
     if (!this.root.version) return void 0;
     return `${real}\0${await this.root.version(real)}`;
   }
-  async read(path, caller, plain2, asked) {
-    return (await this.readKeyed(path, caller, plain2, asked)).bytes;
+  async read(path, caller, plain3, asked) {
+    return (await this.readKeyed(path, caller, plain3, asked)).bytes;
   }
-  async readKeyed(path, caller, plain2, asked) {
+  async readKeyed(path, caller, plain3, asked) {
     const found = await this.real(path, asked);
-    if (found === void 0) return { bytes: await plain2() };
+    if (found === void 0) return { bytes: await plain3() };
     const { real, name: name2 } = found;
-    const read = name2 !== real ? { bytes: await plain2(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const read = name2 !== real ? { bytes: await plain3(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
     const { bytes } = read;
     const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
     await this.verify(name2, bytes, caller, EXEC_OPS);
@@ -560,9 +560,9 @@ var Integrity = class {
   get readsChecked() {
     return this.sources.length > 0;
   }
-  async readSource(path, caller, plain2) {
+  async readSource(path, caller, plain3) {
     const found = await this.source(path);
-    return found === void 0 ? plain2() : this.checked(found, caller, plain2);
+    return found === void 0 ? plain3() : this.checked(found, caller, plain3);
   }
   async openSource(path, caller, real) {
     const found = await this.source(path, real);
@@ -572,10 +572,10 @@ var Integrity = class {
     }
     await this.checked(found, caller, () => this.root.readFileBuffer(found.real));
   }
-  async checked(found, caller, plain2) {
+  async checked(found, caller, plain3) {
     const { real, name: name2 } = found;
     if (name2 !== real || !this.root.readVersioned) {
-      const bytes2 = await plain2();
+      const bytes2 = await plain3();
       await this.verify(name2, bytes2, caller, READ_OPS);
       return bytes2;
     }
@@ -3232,11 +3232,11 @@ function frame(opcode, payload) {
   return out;
 }
 function clientFrame(opcode, payload) {
-  const plain2 = frame(opcode, payload);
-  const head = plain2.length - payload.length;
+  const plain3 = frame(opcode, payload);
+  const head = plain3.length - payload.length;
   const mask = crypto.getRandomValues(new Uint8Array(4));
-  const out = new Uint8Array(plain2.length + 4);
-  out.set(plain2.subarray(0, head));
+  const out = new Uint8Array(plain3.length + 4);
+  out.set(plain3.subarray(0, head));
   out[1] = out[1] | 128;
   out.set(mask, head);
   for (let i = 0; i < payload.length; i++) {
@@ -7020,7 +7020,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.128.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.129.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12378,13 +12378,13 @@ async function chown(entry, path, req) {
 }
 async function runMkdir(entry, path, req) {
   const { fs } = entry;
-  const plain2 = plainDirMode(entry, req.mode);
+  const plain3 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh2 = plain2 !== void 0 && !await fs.exists(path);
+  const fresh2 = plain3 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh2) await fs.chmod(path, plain2);
+  if (fresh2) await fs.chmod(path, plain3);
   return done2;
 }
 async function shownAs(entry, path, st) {
@@ -12392,8 +12392,8 @@ async function shownAs(entry, path, st) {
   return callerStat(guardOf(entry), await real?.catch(() => path) ?? path, st);
 }
 function readSource(entry, path) {
-  const plain2 = () => entry.fs.readFileBuffer(path);
-  return entry.source ? entry.source.read(path, plain2) : plain2();
+  const plain3 = () => entry.fs.readFileBuffer(path);
+  return entry.source ? entry.source.read(path, plain3) : plain3();
 }
 async function run(entry, path, req) {
   const { fs, cwd } = entry;
@@ -18490,6 +18490,95 @@ async function substituteHead(head, ask) {
 `, values };
 }
 
+// src/kernel/net/sealed-smtp.ts
+var SMTP_LINE_MAX = 4096;
+var GREETING = ["EHLO ", "HELO "];
+function sniffSmtp(start2) {
+  const upper = start2.toUpperCase();
+  for (const word of GREETING) {
+    if (upper.startsWith(word)) return "yes";
+    if (word.startsWith(upper)) return "more";
+  }
+  return "no";
+}
+function decoded(b64) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) return void 0;
+  try {
+    return atob(b64);
+  } catch {
+    return void 0;
+  }
+}
+async function swapped2(text, position, ask) {
+  const placeholders = placeholdersIn(text);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
+  const values = usable(await ask(position, placeholders));
+  if (Object.keys(values).length === 0) return void 0;
+  return { text: replaced(text, values), values };
+}
+async function plain2(b64, ask) {
+  const text = decoded(b64);
+  const fields = text?.split("\0");
+  if (fields?.length !== 3) return { line: b64 };
+  const [authz, user, pass2] = fields;
+  if (placeholdersIn(authz + user).length > 0) return { line: b64 };
+  const done5 = await swapped2(pass2, "auth-plain", ask);
+  if (!done5) return { line: b64 };
+  return { line: btoa(`${authz}\0${user}\0${done5.text}`), values: done5.values };
+}
+async function login(b64, ask) {
+  const text = decoded(b64);
+  const done5 = text === void 0 ? void 0 : await swapped2(text, "auth-login", ask);
+  return done5 ? { line: btoa(done5.text), values: done5.values } : { line: b64 };
+}
+var SmtpClient = class {
+  state = "command";
+  ask;
+  constructor(ask) {
+    this.ask = ask;
+  }
+  get done() {
+    return this.state === "done";
+  }
+  async line(text) {
+    const state = this.state;
+    if (state === "done") return { line: text };
+    if (state === "plain" || state === "password") {
+      this.state = "done";
+      if (text === "*") return { line: text };
+      return state === "plain" ? plain2(text, this.ask) : login(text, this.ask);
+    }
+    if (state === "user") {
+      this.state = text === "*" ? "done" : "password";
+      return { line: text };
+    }
+    return this.command(text);
+  }
+  async command(text) {
+    const m = /^AUTH[ \t]+(PLAIN|LOGIN)(?:[ \t]+(\S+))?$/i.exec(text);
+    if (!m) {
+      if (/^(MAIL|RCPT|DATA|BDAT|AUTH)\b/i.test(text)) this.state = "done";
+      return { line: text };
+    }
+    const mech = m[1].toUpperCase();
+    const arg = m[2];
+    if (mech === "LOGIN") {
+      this.state = arg === void 0 ? "user" : "password";
+      return { line: text };
+    }
+    if (arg === void 0) {
+      this.state = "plain";
+      return { line: text };
+    }
+    this.state = "done";
+    const out = await plain2(arg, this.ask);
+    return {
+      line: `${text.slice(0, text.length - arg.length)}${out.line}`,
+      ...out.values ? { values: out.values } : {}
+    };
+  }
+};
+
 // src/kernel/net/sealed-conn.ts
 var HEAD_IDLE_MS = 2e3;
 function substitutes(s) {
@@ -18521,12 +18610,25 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-var Http1Writer = class {
+function modeOf(start2) {
+  const http = sniffHttp1(start2);
+  const smtp = sniffSmtp(start2);
+  if (http === "yes") return "http1";
+  if (smtp === "yes") return "smtp";
+  return http === "no" && smtp === "no" ? "pass" : void 0;
+}
+function crlf(bytes) {
+  for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
+  return -1;
+}
+var SessionWriter = class {
   buffer = new Uint8Array(0);
-  passing = false;
+  mode = "sniff";
   timer;
   chain = Promise.resolve();
   failed;
+  session = sessionId();
+  smtp;
   conn;
   s;
   scope;
@@ -18534,6 +18636,9 @@ var Http1Writer = class {
     this.conn = conn;
     this.s = s;
     this.scope = scope;
+    this.smtp = new SmtpClient(
+      (position, placeholders) => this.ask("smtp", position, placeholders)
+    );
   }
   write(bytes) {
     const run2 = this.chain.then(() => this.take(bytes));
@@ -18543,30 +18648,78 @@ var Http1Writer = class {
     );
     return run2;
   }
+  async ask(protocol, position, placeholders, head) {
+    const s = this.s;
+    const values = await s.broker.sessionMaterialize({
+      stamp: await s.stamp(),
+      session: this.session,
+      host: s.host,
+      port: s.port,
+      protocol,
+      position,
+      verified: s.verified,
+      handshakeAt: s.handshakeAt,
+      exit: s.exit,
+      placeholders,
+      ...head ? { head } : {}
+    });
+    return values;
+  }
+  remember(values) {
+    this.scope.add(
+      Object.entries(values).map(([placeholder, value2]) => ({ name: "sealed", value: value2, placeholder }))
+    );
+  }
   async take(bytes) {
     if (this.failed !== void 0) throw this.failed;
-    if (this.passing) return this.conn.write(bytes);
+    if (this.mode === "pass") return this.conn.write(bytes);
     clearTimeout(this.timer);
     const joined4 = new Uint8Array(this.buffer.length + bytes.length);
     joined4.set(this.buffer);
     joined4.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined4;
-    const sniff = sniffHttp1(latin12(joined4.subarray(0, 8)));
-    const end = sniff === "yes" ? headEnd2(joined4) : -1;
-    if (sniff === "no" || end > HEAD_MAX || end < 0 && joined4.length > HEAD_MAX)
-      await this.release();
-    else if (end >= 0) await this.substitute(end);
-    else this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
+    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "pass") await this.release();
+    else if (this.mode === "http1") await this.http1();
+    else if (this.mode === "smtp") await this.lines();
+    if (this.mode !== "pass" && this.buffer.length > 0)
+      this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
     return bytes.length;
   }
+  async http1() {
+    const end = headEnd2(this.buffer);
+    if (end > HEAD_MAX || end < 0 && this.buffer.length > HEAD_MAX) await this.release();
+    else if (end >= 0) await this.substitute(end);
+  }
+  async lines() {
+    for (; ; ) {
+      const at = crlf(this.buffer);
+      if (at < 0) break;
+      if (at > SMTP_LINE_MAX) return this.release();
+      const all = this.buffer;
+      this.buffer = all.slice(at + 2);
+      const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
+      all.fill(0);
+      if ("values" in out && out.values) this.remember(out.values);
+      const line = bytesOf(`${out.line}\r
+`);
+      try {
+        await writeAll4(this.conn, line);
+      } finally {
+        line.fill(0);
+      }
+      if (this.smtp.done) return this.release();
+    }
+    if (this.buffer.length > SMTP_LINE_MAX) await this.release();
+  }
   idle() {
     this.chain = this.chain.then(() => this.release()).catch((err) => {
       this.failed ??= err;
     });
   }
   async release() {
-    this.passing = true;
+    this.mode = "pass";
     const out = this.buffer;
     this.buffer = new Uint8Array(0);
     try {
@@ -18576,37 +18729,15 @@ var Http1Writer = class {
     }
   }
   async substitute(end) {
-    this.passing = true;
+    this.mode = "pass";
     const all = this.buffer;
     this.buffer = new Uint8Array(0);
-    const s = this.s;
-    const session = sessionId();
     const done5 = await substituteHead(
       latin12(all.subarray(0, end)),
-      async (position, placeholders, head2) => s.broker.sessionMaterialize({
-        stamp: await s.stamp(),
-        session,
-        host: s.host,
-        port: s.port,
-        protocol: "http1",
-        position,
-        verified: s.verified,
-        handshakeAt: s.handshakeAt,
-        exit: s.exit,
-        placeholders,
-        head: head2
-      })
+      (position, placeholders, head2) => this.ask("http1", position, placeholders, head2)
     ).catch(() => void 0);
     const head = done5 ? bytesOf(done5.head) : all.subarray(0, end);
-    if (done5) {
-      this.scope.add(
-        Object.entries(done5.values).map(([placeholder, value2]) => ({
-          name: "sealed",
-          value: value2,
-          placeholder
-        }))
-      );
-    }
+    if (done5) this.remember(done5.values);
     try {
       await writeAll4(this.conn, head);
       await writeAll4(this.conn, all.subarray(end));
@@ -18617,14 +18748,14 @@ var Http1Writer = class {
   }
   flushed() {
     clearTimeout(this.timer);
-    this.chain = this.chain.then(() => this.passing ? void 0 : this.release());
+    this.chain = this.chain.then(() => this.mode === "pass" ? void 0 : this.release());
     return this.chain;
   }
   drop() {
     clearTimeout(this.timer);
     this.buffer.fill(0);
     this.buffer = new Uint8Array(0);
-    this.passing = true;
+    this.mode = "pass";
   }
 };
 var IDLE2 = /* @__PURE__ */ Symbol("idle");
@@ -18635,11 +18766,9 @@ var ScrubReader = class {
   held = false;
   ended = false;
   conn;
-  s;
   scope;
-  constructor(conn, s, scope) {
+  constructor(conn, scope) {
     this.conn = conn;
-    this.s = s;
     this.scope = scope;
   }
   current() {
@@ -18698,8 +18827,8 @@ function idle() {
 }
 function sealedConn(conn, s) {
   const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new Http1Writer(conn, s, scope) : void 0;
-  const reader = new ScrubReader(conn, s, scope);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, scope) : void 0;
+  const reader = new ScrubReader(conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
@@ -19825,6 +19954,12 @@ function tlsOverTransport(req, proc) {
   return { fd: proc.fds.install(new OpenFile(mine), 3), alpnProtocol: "http/1.1", servername };
 }
 
+// src/kernel/test-hooks.ts
+var SYSCALL_HOOK = /* @__PURE__ */ Symbol.for("slicc-kernel.test.syscall");
+function testSyscallHook() {
+  return globalThis[SYSCALL_HOOK];
+}
+
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;
 var O_WRONLY = 1;
@@ -21039,7 +21174,8 @@ var WasmProcess = class {
       cwd,
       ...moved2,
       ...group,
-      ...exec ? { exec } : {}
+      ...exec ? { exec } : {},
+      search: req.search
     };
     const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (deathSignal !== void 0) this.onDeath(pgid === 0 || session ? -pid : pid, deathSignal);
@@ -21125,6 +21261,8 @@ var WasmProcess = class {
     return void 0;
   }
   async syscall(req, cancelled, block) {
+    const hook = testSyscallHook();
+    if (hook) await hook({ pid: this.pid, op: req.op });
     this.options.onSyscall?.(req);
     this.calls += 1;
     const started = performance.now();
@@ -21422,18 +21560,18 @@ var WasmProcess = class {
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open2 = { ...req, path };
-      const plain2 = this.plainMode(req.mode);
+      const plain3 = this.plainMode(req.mode);
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner(req.mode));
-        if (plain2 !== void 0) await fs.chmod?.(path, plain2);
+        if (plain3 !== void 0) await fs.chmod?.(path, plain3);
         this.fds.installAt(fd, this.openVfsFile(open2, void 0, fs));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const marks = this.options.owners || plain2 !== void 0;
+          const marks = this.options.owners || plain3 !== void 0;
           const fresh2 = marks && !await present3(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open2, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2 && plain2 !== void 0) await fs.chmod?.(path, plain2);
+          if (fresh2 && plain3 !== void 0) await fs.chmod?.(path, plain3);
           else if (fresh2) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
@@ -23576,15 +23714,15 @@ function isRecord(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function serialized(reply) {
-  let plain2;
+  let plain3;
   try {
     const text = JSON.stringify(reply);
-    plain2 = text === void 0 ? void 0 : JSON.parse(text);
+    plain3 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
     return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
-  if (!isRecord(plain2)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
-  const { v: _, ...rest2 } = plain2;
+  if (!isRecord(plain3)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
+  const { v: _, ...rest2 } = plain3;
   return JSON.stringify({ v: 1, ...rest2 });
 }
 function lineOf2(err) {
@@ -25546,13 +25684,13 @@ function splitWords(text) {
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
-    const [, single, double, escaped, plain2, space] = m;
+    const [, single, double, escaped, plain3, space] = m;
     if (space !== void 0) {
       if (word !== void 0) words2.push(word);
       word = void 0;
       continue;
     }
-    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain2));
+    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain3));
   }
   if (word !== void 0) words2.push(word);
   return words2;
@@ -26745,16 +26883,52 @@ var Launcher = class {
     for (const bin of planned?.bins ?? []) await need(g, "exec", bin, R_OK | X_OK);
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
   }
-  async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const refused3 = async (err) => {
+  async checkedPlan(req, ctx, fds) {
+    try {
+      return await this.planOrSearch(req, ctx);
+    } catch (err) {
       await fds.closeAll();
-      throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+      throw err;
+    }
+  }
+  async planOrSearch(req, ctx) {
+    const bare = !req.file.includes("/") && !COMMAND2.test(req.file);
+    try {
+      return await this.planOne(req, ctx);
+    } catch (err) {
+      const code = codeOf7(err);
+      const searched = bare && req.search !== false && (code === "ENOENT" || code === "ENOEXEC");
+      if (!searched || await this.commandAt(req.file, ctx.scope)) throw err;
+      const found = await this.onPath(req, ctx);
+      if (found) return found;
+      throw err;
+    }
+  }
+  async onPath(req, ctx) {
+    const path = req.env.PATH;
+    if (typeof path !== "string") return void 0;
+    let denied2 = false;
+    for (const dir of path.split(":")) {
+      const file = dir === "" ? `./${req.file}` : `${dir.replace(/\/+$/, "")}/${req.file}`;
+      try {
+        return await this.planOne({ ...req, file }, ctx);
+      } catch (err) {
+        const code = codeOf7(err);
+        if (code === "EACCES") denied2 = true;
+        else if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+      }
+    }
+    if (denied2) throw new SpawnError("EACCES");
+    return void 0;
+  }
+  async planOne(req, { ppid, cred, scope }) {
+    const refused3 = (err) => {
+      throw codeOf7(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
     const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
     await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
     if (planned) return planned;
-    await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
   }
   async enterable(g, cwd) {
@@ -26921,12 +27095,12 @@ var Launcher = class {
     return `${path}:${st.size}:${st.mtime.getTime()}`;
   }
   verified(path, caller, fs = this.base) {
-    const plain2 = () => fs.readFileBuffer(path);
-    return this.integrity ? this.integrity.read(path, caller, plain2) : plain2();
+    const plain3 = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain3) : plain3();
   }
   keyed(path, caller, asked) {
-    const plain2 = async () => this.base.readFileBuffer(path);
-    return this.integrity ? this.integrity.readKeyed(path, caller, plain2, asked) : plain2().then((bytes) => ({ bytes }));
+    const plain3 = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain3, asked) : plain3().then((bytes) => ({ bytes }));
   }
   cached(cache, key, load) {
     const hit = cache.get(key);
@@ -27123,7 +27297,7 @@ var Launcher = class {
     });
     return {
       source: {
-        read: (path, plain2) => integrity.readSource(path, caller(), plain2),
+        read: (path, plain3) => integrity.readSource(path, caller(), plain3),
         open: (path, real) => integrity.openSource(path, caller(), real)
       }
     };
@@ -28030,9 +28204,9 @@ var Launcher = class {
       }
     );
   }
-  environment(cwd, extra, account, login = false) {
+  environment(cwd, extra, account, login2 = false) {
     const env = {
-      ...login ? networkEnv(this.hostname) : this.env,
+      ...login2 ? networkEnv(this.hostname) : this.env,
       ...userEnv(account, this.pnpmHome),
       PWD: cwd,
       ...extra
@@ -28259,6 +28433,9 @@ var Launcher = class {
 function cronLocks() {
   return globalThis.navigator?.locks;
 }
+function codeOf7(err) {
+  return err?.code;
+}
 
 // src/pin.ts
 function pinScript(url) {