@ai-ecoverse/slicc-kernel 1.128.2 → 1.130.0

package/dist/kernel-worker.js

@@ -544,14 +544,14 @@ var Integrity = class {
     if (!this.root.version) return void 0;
     return `${real}\0${await this.root.version(real)}`;
   }
-  async read(path, caller, plain2, asked) {
-    return (await this.readKeyed(path, caller, plain2, asked)).bytes;
+  async read(path, caller, plain3, asked) {
+    return (await this.readKeyed(path, caller, plain3, asked)).bytes;
   }
-  async readKeyed(path, caller, plain2, asked) {
+  async readKeyed(path, caller, plain3, asked) {
     const found = await this.real(path, asked);
-    if (found === void 0) return { bytes: await plain2() };
+    if (found === void 0) return { bytes: await plain3() };
     const { real, name: name2 } = found;
-    const read = name2 !== real ? { bytes: await plain2(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const read = name2 !== real ? { bytes: await plain3(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
     const { bytes } = read;
     const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
     await this.verify(name2, bytes, caller, EXEC_OPS);
@@ -560,9 +560,9 @@ var Integrity = class {
   get readsChecked() {
     return this.sources.length > 0;
   }
-  async readSource(path, caller, plain2) {
+  async readSource(path, caller, plain3) {
     const found = await this.source(path);
-    return found === void 0 ? plain2() : this.checked(found, caller, plain2);
+    return found === void 0 ? plain3() : this.checked(found, caller, plain3);
   }
   async openSource(path, caller, real) {
     const found = await this.source(path, real);
@@ -572,10 +572,10 @@ var Integrity = class {
     }
     await this.checked(found, caller, () => this.root.readFileBuffer(found.real));
   }
-  async checked(found, caller, plain2) {
+  async checked(found, caller, plain3) {
     const { real, name: name2 } = found;
     if (name2 !== real || !this.root.readVersioned) {
-      const bytes2 = await plain2();
+      const bytes2 = await plain3();
       await this.verify(name2, bytes2, caller, READ_OPS);
       return bytes2;
     }
@@ -636,8 +636,8 @@ var Integrity = class {
     }
   }
   async expected(path) {
-    const answer = await this.lookup(path);
-    return typeof answer === "string" ? answer.toLowerCase() : void 0;
+    const answer2 = await this.lookup(path);
+    return typeof answer2 === "string" ? answer2.toLowerCase() : void 0;
   }
   say(event) {
     try {
@@ -983,12 +983,12 @@ var RemoteWatch = class {
   }
   greeted(peer) {
     this.arrived(peer);
-    const answer = () => {
+    const answer2 = () => {
       this.channel.postMessage({ here: this.tab, to: peer });
       if (this.mine.length > 0) void this.announce(this.mine);
     };
-    if (this.quiet) void this.quiet().then(answer, answer);
-    else answer();
+    if (this.quiet) void this.quiet().then(answer2, answer2);
+    else answer2();
   }
   announced({ tab, paths, seq: seq2 }) {
     const from = tab;
@@ -3232,11 +3232,11 @@ function frame(opcode, payload) {
   return out;
 }
 function clientFrame(opcode, payload) {
-  const plain2 = frame(opcode, payload);
-  const head = plain2.length - payload.length;
+  const plain3 = frame(opcode, payload);
+  const head = plain3.length - payload.length;
   const mask = crypto.getRandomValues(new Uint8Array(4));
-  const out = new Uint8Array(plain2.length + 4);
-  out.set(plain2.subarray(0, head));
+  const out = new Uint8Array(plain3.length + 4);
+  out.set(plain3.subarray(0, head));
   out[1] = out[1] | 128;
   out.set(mask, head);
   for (let i = 0; i < payload.length; i++) {
@@ -7020,7 +7020,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.128.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.130.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12378,13 +12378,13 @@ async function chown(entry, path, req) {
 }
 async function runMkdir(entry, path, req) {
   const { fs } = entry;
-  const plain2 = plainDirMode(entry, req.mode);
+  const plain3 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh2 = plain2 !== void 0 && !await fs.exists(path);
+  const fresh2 = plain3 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh2) await fs.chmod(path, plain2);
+  if (fresh2) await fs.chmod(path, plain3);
   return done2;
 }
 async function shownAs(entry, path, st) {
@@ -12392,8 +12392,8 @@ async function shownAs(entry, path, st) {
   return callerStat(guardOf(entry), await real?.catch(() => path) ?? path, st);
 }
 function readSource(entry, path) {
-  const plain2 = () => entry.fs.readFileBuffer(path);
-  return entry.source ? entry.source.read(path, plain2) : plain2();
+  const plain3 = () => entry.fs.readFileBuffer(path);
+  return entry.source ? entry.source.read(path, plain3) : plain3();
 }
 async function run(entry, path, req) {
   const { fs, cwd } = entry;
@@ -16336,11 +16336,11 @@ function carriesUdp(uplink) {
   return uplink.traits.udp === true && typeof uplink.udp === "function";
 }
 function answerOf(result) {
-  const answer = Array.isArray(result) ? { addresses: result } : result;
-  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  const answer2 = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer2?.addresses) ? answer2.addresses.filter((a) => typeof a === "string") : [];
   return {
     addresses,
-    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+    ...typeof answer2?.ttl === "number" && answer2.ttl >= 0 ? { ttl: answer2.ttl } : {}
   };
 }
 var NEVER = new Routes(true);
@@ -16528,9 +16528,9 @@ var Resolver = class {
   async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
     const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
-    let answer;
+    let answer2;
     try {
-      answer = answerOf(
+      answer2 = answerOf(
         await Promise.race([
           uplink.resolve(name2, family, timeout),
           new Promise(
@@ -16541,8 +16541,8 @@ var Resolver = class {
     } catch {
       return [];
     }
-    const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
-    if (addresses.length > 0) this.remember(id2, addresses, answer.ttl);
+    const addresses = answer2.addresses.filter((a) => this.usable(name2, a, family));
+    if (addresses.length > 0) this.remember(id2, addresses, answer2.ttl);
     return addresses;
   }
   usable(name2, address, family) {
@@ -18490,6 +18490,95 @@ async function substituteHead(head, ask) {
 `, values };
 }
 
+// src/kernel/net/sealed-smtp.ts
+var SMTP_LINE_MAX = 4096;
+var GREETING = ["EHLO ", "HELO "];
+function sniffSmtp(start2) {
+  const upper = start2.toUpperCase();
+  for (const word of GREETING) {
+    if (upper.startsWith(word)) return "yes";
+    if (word.startsWith(upper)) return "more";
+  }
+  return "no";
+}
+function decoded(b64) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) return void 0;
+  try {
+    return atob(b64);
+  } catch {
+    return void 0;
+  }
+}
+async function swapped2(text, position, ask) {
+  const placeholders = placeholdersIn(text);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
+  const values = usable(await ask(position, placeholders));
+  if (Object.keys(values).length === 0) return void 0;
+  return { text: replaced(text, values), values };
+}
+async function plain2(b64, ask) {
+  const text = decoded(b64);
+  const fields = text?.split("\0");
+  if (fields?.length !== 3) return { line: b64 };
+  const [authz, user, pass2] = fields;
+  if (placeholdersIn(authz + user).length > 0) return { line: b64 };
+  const done5 = await swapped2(pass2, "auth-plain", ask);
+  if (!done5) return { line: b64 };
+  return { line: btoa(`${authz}\0${user}\0${done5.text}`), values: done5.values };
+}
+async function login(b64, ask) {
+  const text = decoded(b64);
+  const done5 = text === void 0 ? void 0 : await swapped2(text, "auth-login", ask);
+  return done5 ? { line: btoa(done5.text), values: done5.values } : { line: b64 };
+}
+var SmtpClient = class {
+  state = "command";
+  ask;
+  constructor(ask) {
+    this.ask = ask;
+  }
+  get done() {
+    return this.state === "done";
+  }
+  async line(text) {
+    const state = this.state;
+    if (state === "done") return { line: text };
+    if (state === "plain" || state === "password") {
+      this.state = "done";
+      if (text === "*") return { line: text };
+      return state === "plain" ? plain2(text, this.ask) : login(text, this.ask);
+    }
+    if (state === "user") {
+      this.state = text === "*" ? "done" : "password";
+      return { line: text };
+    }
+    return this.command(text);
+  }
+  async command(text) {
+    const m = /^AUTH[ \t]+(PLAIN|LOGIN)(?:[ \t]+(\S+))?$/i.exec(text);
+    if (!m) {
+      if (/^(MAIL|RCPT|DATA|BDAT|AUTH)\b/i.test(text)) this.state = "done";
+      return { line: text };
+    }
+    const mech = m[1].toUpperCase();
+    const arg = m[2];
+    if (mech === "LOGIN") {
+      this.state = arg === void 0 ? "user" : "password";
+      return { line: text };
+    }
+    if (arg === void 0) {
+      this.state = "plain";
+      return { line: text };
+    }
+    this.state = "done";
+    const out = await plain2(arg, this.ask);
+    return {
+      line: `${text.slice(0, text.length - arg.length)}${out.line}`,
+      ...out.values ? { values: out.values } : {}
+    };
+  }
+};
+
 // src/kernel/net/sealed-conn.ts
 var HEAD_IDLE_MS = 2e3;
 function substitutes(s) {
@@ -18521,12 +18610,25 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-var Http1Writer = class {
+function modeOf(start2) {
+  const http = sniffHttp1(start2);
+  const smtp = sniffSmtp(start2);
+  if (http === "yes") return "http1";
+  if (smtp === "yes") return "smtp";
+  return http === "no" && smtp === "no" ? "pass" : void 0;
+}
+function crlf(bytes) {
+  for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
+  return -1;
+}
+var SessionWriter = class {
   buffer = new Uint8Array(0);
-  passing = false;
+  mode = "sniff";
   timer;
   chain = Promise.resolve();
   failed;
+  session = sessionId();
+  smtp;
   conn;
   s;
   scope;
@@ -18534,6 +18636,9 @@ var Http1Writer = class {
     this.conn = conn;
     this.s = s;
     this.scope = scope;
+    this.smtp = new SmtpClient(
+      (position, placeholders) => this.ask("smtp", position, placeholders)
+    );
   }
   write(bytes) {
     const run2 = this.chain.then(() => this.take(bytes));
@@ -18543,30 +18648,78 @@ var Http1Writer = class {
     );
     return run2;
   }
+  async ask(protocol, position, placeholders, head) {
+    const s = this.s;
+    const values = await s.broker.sessionMaterialize({
+      stamp: await s.stamp(),
+      session: this.session,
+      host: s.host,
+      port: s.port,
+      protocol,
+      position,
+      verified: s.verified,
+      handshakeAt: s.handshakeAt,
+      exit: s.exit,
+      placeholders,
+      ...head ? { head } : {}
+    });
+    return values;
+  }
+  remember(values) {
+    this.scope.add(
+      Object.entries(values).map(([placeholder, value2]) => ({ name: "sealed", value: value2, placeholder }))
+    );
+  }
   async take(bytes) {
     if (this.failed !== void 0) throw this.failed;
-    if (this.passing) return this.conn.write(bytes);
+    if (this.mode === "pass") return this.conn.write(bytes);
     clearTimeout(this.timer);
     const joined4 = new Uint8Array(this.buffer.length + bytes.length);
     joined4.set(this.buffer);
     joined4.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined4;
-    const sniff = sniffHttp1(latin12(joined4.subarray(0, 8)));
-    const end = sniff === "yes" ? headEnd2(joined4) : -1;
-    if (sniff === "no" || end > HEAD_MAX || end < 0 && joined4.length > HEAD_MAX)
-      await this.release();
-    else if (end >= 0) await this.substitute(end);
-    else this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
+    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "pass") await this.release();
+    else if (this.mode === "http1") await this.http1();
+    else if (this.mode === "smtp") await this.lines();
+    if (this.mode !== "pass" && this.buffer.length > 0)
+      this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
     return bytes.length;
   }
+  async http1() {
+    const end = headEnd2(this.buffer);
+    if (end > HEAD_MAX || end < 0 && this.buffer.length > HEAD_MAX) await this.release();
+    else if (end >= 0) await this.substitute(end);
+  }
+  async lines() {
+    for (; ; ) {
+      const at = crlf(this.buffer);
+      if (at < 0) break;
+      if (at > SMTP_LINE_MAX) return this.release();
+      const all = this.buffer;
+      this.buffer = all.slice(at + 2);
+      const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
+      all.fill(0);
+      if ("values" in out && out.values) this.remember(out.values);
+      const line = bytesOf(`${out.line}\r
+`);
+      try {
+        await writeAll4(this.conn, line);
+      } finally {
+        line.fill(0);
+      }
+      if (this.smtp.done) return this.release();
+    }
+    if (this.buffer.length > SMTP_LINE_MAX) await this.release();
+  }
   idle() {
     this.chain = this.chain.then(() => this.release()).catch((err) => {
       this.failed ??= err;
     });
   }
   async release() {
-    this.passing = true;
+    this.mode = "pass";
     const out = this.buffer;
     this.buffer = new Uint8Array(0);
     try {
@@ -18576,37 +18729,15 @@ var Http1Writer = class {
     }
   }
   async substitute(end) {
-    this.passing = true;
+    this.mode = "pass";
     const all = this.buffer;
     this.buffer = new Uint8Array(0);
-    const s = this.s;
-    const session = sessionId();
     const done5 = await substituteHead(
       latin12(all.subarray(0, end)),
-      async (position, placeholders, head2) => s.broker.sessionMaterialize({
-        stamp: await s.stamp(),
-        session,
-        host: s.host,
-        port: s.port,
-        protocol: "http1",
-        position,
-        verified: s.verified,
-        handshakeAt: s.handshakeAt,
-        exit: s.exit,
-        placeholders,
-        head: head2
-      })
+      (position, placeholders, head2) => this.ask("http1", position, placeholders, head2)
     ).catch(() => void 0);
     const head = done5 ? bytesOf(done5.head) : all.subarray(0, end);
-    if (done5) {
-      this.scope.add(
-        Object.entries(done5.values).map(([placeholder, value2]) => ({
-          name: "sealed",
-          value: value2,
-          placeholder
-        }))
-      );
-    }
+    if (done5) this.remember(done5.values);
     try {
       await writeAll4(this.conn, head);
       await writeAll4(this.conn, all.subarray(end));
@@ -18617,14 +18748,14 @@ var Http1Writer = class {
   }
   flushed() {
     clearTimeout(this.timer);
-    this.chain = this.chain.then(() => this.passing ? void 0 : this.release());
+    this.chain = this.chain.then(() => this.mode === "pass" ? void 0 : this.release());
     return this.chain;
   }
   drop() {
     clearTimeout(this.timer);
     this.buffer.fill(0);
     this.buffer = new Uint8Array(0);
-    this.passing = true;
+    this.mode = "pass";
   }
 };
 var IDLE2 = /* @__PURE__ */ Symbol("idle");
@@ -18635,11 +18766,9 @@ var ScrubReader = class {
   held = false;
   ended = false;
   conn;
-  s;
   scope;
-  constructor(conn, s, scope) {
+  constructor(conn, scope) {
     this.conn = conn;
-    this.s = s;
     this.scope = scope;
   }
   current() {
@@ -18698,8 +18827,8 @@ function idle() {
 }
 function sealedConn(conn, s) {
   const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new Http1Writer(conn, s, scope) : void 0;
-  const reader = new ScrubReader(conn, s, scope);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, scope) : void 0;
+  const reader = new ScrubReader(conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
@@ -19825,6 +19954,12 @@ function tlsOverTransport(req, proc) {
   return { fd: proc.fds.install(new OpenFile(mine), 3), alpnProtocol: "http/1.1", servername };
 }
 
+// src/kernel/test-hooks.ts
+var SYSCALL_HOOK = /* @__PURE__ */ Symbol.for("slicc-kernel.test.syscall");
+function testSyscallHook() {
+  return globalThis[SYSCALL_HOOK];
+}
+
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;
 var O_WRONLY = 1;
@@ -21039,7 +21174,8 @@ var WasmProcess = class {
       cwd,
       ...moved2,
       ...group,
-      ...exec ? { exec } : {}
+      ...exec ? { exec } : {},
+      search: req.search
     };
     const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (deathSignal !== void 0) this.onDeath(pgid === 0 || session ? -pid : pid, deathSignal);
@@ -21062,8 +21198,8 @@ var WasmProcess = class {
   spares(sig) {
     const { caught, ignored } = this.signalMasks();
     const bit = isSignal(sig) ? sigbit(sig) : 0;
-    const answer = (ignored & bit) !== 0 ? "ignore" : (caught & bit) !== 0 ? "spare" : "terminate";
-    return { ok: true, kind: "json", json: answer };
+    const answer2 = (ignored & bit) !== 0 ? "ignore" : (caught & bit) !== 0 ? "spare" : "terminate";
+    return { ok: true, kind: "json", json: answer2 };
   }
   async killSelf(sig, target, probe) {
     if (!this.options.exitSignal) throw new KernelError("ENOSYS");
@@ -21125,6 +21261,8 @@ var WasmProcess = class {
     return void 0;
   }
   async syscall(req, cancelled, block) {
+    const hook = testSyscallHook();
+    if (hook) await hook({ pid: this.pid, op: req.op });
     this.options.onSyscall?.(req);
     this.calls += 1;
     const started = performance.now();
@@ -21422,18 +21560,18 @@ var WasmProcess = class {
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open2 = { ...req, path };
-      const plain2 = this.plainMode(req.mode);
+      const plain3 = this.plainMode(req.mode);
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner(req.mode));
-        if (plain2 !== void 0) await fs.chmod?.(path, plain2);
+        if (plain3 !== void 0) await fs.chmod?.(path, plain3);
         this.fds.installAt(fd, this.openVfsFile(open2, void 0, fs));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const marks = this.options.owners || plain2 !== void 0;
+          const marks = this.options.owners || plain3 !== void 0;
           const fresh2 = marks && !await present3(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open2, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2 && plain2 !== void 0) await fs.chmod?.(path, plain2);
+          if (fresh2 && plain3 !== void 0) await fs.chmod?.(path, plain3);
           else if (fresh2) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
@@ -22178,10 +22316,10 @@ var WasmProcess = class {
       cwd: typeof req.cwd === "string" && req.cwd.startsWith("/") ? req.cwd : "/",
       ...typeof req.term === "string" ? { term: req.term } : {}
     };
-    const answer = await sudo(call, this.blockingSignal(cancelled));
-    if (!("grant" in answer)) return answer;
+    const answer2 = await sudo(call, this.blockingSignal(cancelled));
+    if (!("grant" in answer2)) return answer2;
     if (this.dying) throw new KernelError("EINTR");
-    const { file, argv, env, cwd, cred, caller } = answer.grant;
+    const { file, argv, env, cwd, cred, caller } = answer2.grant;
     const stdio = [{ fd: 0 }, { fd: 1 }, { fd: 2 }];
     return {
       pid: await this.children.spawn({ file, argv, env, cwd, pgid: 0 }, stdio, [], {
@@ -22341,6 +22479,153 @@ var WASM_THREAD_SPAWN = "wasm-thread-spawn";
 var WASM_THREAD_INIT = "wasm-thread-init";
 var WASM_THREAD_EXIT = "wasm-thread-exit";
 var WASM_MAX_THREADS = 256;
+var JS_THREAD_SPAWN = "js-thread-spawn";
+var JS_THREAD_INIT = "js-thread-init";
+var JS_THREAD_EXIT = "js-thread-exit";
+var JS_MAX_THREADS = 256;
+var JS_DEFAULT_THREADS = 16;
+var JS_THREAD_NO_MEMORY = 256;
+var JS_THREAD_CRASHED = 257;
+
+// src/kernel/js-threads.ts
+var JS_OOM = /out of memory|Array buffer allocation failed|Cannot allocate Wasm memory|could not allocate memory|ERR_WORKER_OUT_OF_MEMORY/i;
+var ENDING = { ok: false, errno: "EINTR", message: "the thread is ending" };
+var MAIN_ONLY = { ok: true, kind: "void" };
+function track(ops, req, result) {
+  if (req.op === "async-submit" && result.ok && result.kind === "json") {
+    if (typeof result.json === "number") ops.set(result.json, req.token);
+  } else if (req.op === "async-cancel" || req.op === "async-take" && (result.ok || result.errno !== "EAGAIN")) {
+    ops.delete(req.id);
+  }
+}
+function cores() {
+  const n = globalThis.navigator?.hardwareConcurrency;
+  return typeof n === "number" && Number.isInteger(n) && n > 0 ? n : 0;
+}
+function jsThreadCap(env) {
+  const asked = Number.parseInt(env.SLICC_JS_THREADS ?? "", 10);
+  if (asked >= 1) return Math.min(asked, JS_MAX_THREADS);
+  return Math.min(JS_MAX_THREADS, Math.max(JS_DEFAULT_THREADS, 2 * cores()));
+}
+function codeOf4(code) {
+  if (code === JS_THREAD_NO_MEMORY || code === JS_THREAD_CRASHED) return code;
+  return typeof code === "number" && Number.isInteger(code) ? code & 255 : JS_THREAD_CRASHED;
+}
+function answer(control, message3) {
+  control.postMessage(message3);
+}
+var JsThreads = class {
+  deps;
+  live = /* @__PURE__ */ new Map();
+  headers = /* @__PURE__ */ new Map();
+  frozen = false;
+  last = 0;
+  closed = false;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  get size() {
+    return this.live.size;
+  }
+  spawn(msg) {
+    const { control, port } = msg;
+    if (this.closed || this.live.size >= this.deps.cap) {
+      answer(
+        control,
+        this.closed ? { errno: "ESRCH", message: "the process is ending" } : { errno: "EAGAIN", message: `more than ${this.deps.cap} threads` }
+      );
+      control.close();
+      port.close();
+      return;
+    }
+    const tid = ++this.last;
+    const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
+    const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
+    if (this.frozen) Atomics.store(header3, SAB_I_STOP, 1);
+    const worker = this.deps.createWorker();
+    const clock = this.deps.clocks.thread(tid + 1, sab);
+    let ended = false;
+    const end = (code) => {
+      if (ended) return;
+      ended = true;
+      this.live.delete(tid);
+      this.headers.delete(tid);
+      this.deps.wakes.delete(header3);
+      for (const [id2, token] of ops) {
+        void this.deps.dispatch({ op: "async-cancel", id: id2, token });
+      }
+      ops.clear();
+      worker.removeEventListener("message", onMessage);
+      worker.removeEventListener("error", onError);
+      control.removeEventListener("message", onControl);
+      responder.dispose();
+      lane.dispose();
+      this.deps.clocks.threadEnded(tid + 1);
+      worker.terminate();
+      answer(control, { exited: code });
+      control.close();
+    };
+    const ops = /* @__PURE__ */ new Map();
+    const dispatch2 = async (req, block) => {
+      if (isWasmSyscall(req) && req.op === "proc-exit") {
+        queueMicrotask(() => end(req.status & 255));
+        return ENDING;
+      }
+      if (isWasmSyscall(req) && req.op === "sig-mask") return MAIN_ONLY;
+      const result = await this.deps.dispatch(req, block);
+      if (!ended) track(ops, req, result);
+      return result;
+    };
+    const responder = this.deps.attach(worker, sab, this.deps.clocks.timed(clock, dispatch2));
+    const lane = this.deps.openLane(dispatch2);
+    const onMessage = (event) => {
+      const data = event.data;
+      if (data?.type === JS_THREAD_EXIT) end(codeOf4(data.code));
+      else if (data?.type === JS_THREAD_SPAWN) this.spawn(event.data);
+      else if (data?.type === WASM_PROCESS_ERROR) this.crashed(String(data.message), end);
+    };
+    const onError = (event) => {
+      event.preventDefault();
+      this.crashed(String(event.message ?? "worker error"), end);
+    };
+    const onControl = (event) => {
+      if (event.data?.terminate === true) end(1);
+    };
+    worker.addEventListener("message", onMessage);
+    worker.addEventListener("error", onError);
+    control.addEventListener("message", onControl);
+    control.start();
+    this.live.set(tid, end);
+    this.headers.set(tid, header3);
+    this.deps.wakes.add(header3);
+    const init = {
+      ...this.deps.init(sab, lane.lane),
+      type: JS_THREAD_INIT,
+      thread: { tid, port, data: msg.data }
+    };
+    try {
+      worker.postMessage(init, [lane.lane.port, port, ...msg.transfer ?? []]);
+    } catch {
+      end(JS_THREAD_CRASHED);
+      return;
+    }
+    answer(control, { tid });
+  }
+  crashed(message3, end) {
+    end(JS_OOM.test(message3) ? JS_THREAD_NO_MEMORY : JS_THREAD_CRASHED);
+  }
+  stopped(stopped) {
+    this.frozen = stopped;
+    for (const header3 of this.headers.values()) {
+      Atomics.store(header3, SAB_I_STOP, stopped ? 1 : 0);
+      Atomics.notify(header3, SAB_I_STOP);
+    }
+  }
+  close() {
+    this.closed = true;
+    for (const end of [...this.live.values()]) end(1);
+  }
+};
 
 // src/kernel/host.ts
 var CRASHED = 70;
@@ -22443,6 +22728,7 @@ function threadSignalsOf(sab) {
 function threadCancel(thread) {
   return unblocked(thread.header) !== 0 ? AbortSignal.abort() : thread.interrupt.signal;
 }
+var asyncFanout = /* @__PURE__ */ new WeakMap();
 function notifiers(header3) {
   return {
     onPending(sig) {
@@ -22450,8 +22736,10 @@ function notifiers(header3) {
       Atomics.notify(header3, SAB_I_SIGNALS);
     },
     onAsync() {
-      Atomics.add(header3, SAB_I_ASYNC, 1);
-      Atomics.notify(header3, SAB_I_ASYNC);
+      for (const at of [header3, ...asyncFanout.get(header3) ?? []]) {
+        Atomics.add(at, SAB_I_ASYNC, 1);
+        Atomics.notify(at, SAB_I_ASYNC);
+      }
     }
   };
 }
@@ -22682,6 +22970,7 @@ function spawnWasmProcess(opts) {
     dispatch: clocks.timed(void 0, dispatch2)
   });
   const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
+  const jsThreads = jsThreadsOf(opts, process, token, dispatch2, clocks, header3);
   const { promise: exited, resolve: settle3 } = Promise.withResolvers();
   let done5 = false;
   let endedBy;
@@ -22695,6 +22984,7 @@ function spawnWasmProcess(opts) {
     worker.removeEventListener("message", onMessage);
     worker.removeEventListener("error", onError);
     for (const tid of [...threads.keys()]) endThread(tid);
+    jsThreads?.close();
     responder.dispose();
     lane?.dispose();
     revokeSyncFsToken(token);
@@ -22718,6 +23008,8 @@ function spawnWasmProcess(opts) {
       finish(...dying.status(data.code));
     } else if (data?.type === WASM_THREAD_SPAWN && data.thread) {
       spawnThread(data.thread);
+    } else if (data?.type === JS_THREAD_SPAWN && jsThreads) {
+      jsThreads.spawn(data);
     }
   };
   const onMessage = (event) => handle(event.data);
@@ -22791,13 +23083,35 @@ function spawnWasmProcess(opts) {
     termsig: () => endedBy,
     onState: (listener) => process.onState(listener),
     memory: () => Atomics.load(header3, SAB_I_MEMORY) * 65536,
+    ...processViews(process, opts, header3),
+    writesBack: () => opts.program.abi === "wasi" && !done5,
+    ...clockViews(clocks)
+  };
+}
+function jsThreadsOf(opts, process, token, dispatch2, clocks, header3) {
+  if (opts.program.abi !== "js") return void 0;
+  const wakes = /* @__PURE__ */ new Set();
+  asyncFanout.set(header3, wakes);
+  const threads = new JsThreads({
+    wakes,
+    cap: jsThreadCap(opts.env),
+    createWorker: opts.createWorker,
+    init: (sab, lane) => processInit(opts, sab, process.umask, copyCred(process.cred), lane),
+    openLane: (laneDispatch) => openLane(token, laneDispatch),
+    attach: (worker, sab, threadDispatch) => attachSyncSabResponder(worker, sab, token, { dispatch: threadDispatch }),
+    dispatch: dispatch2,
+    clocks
+  });
+  process.onState((state) => threads.stopped(state === "stopped"));
+  return threads;
+}
+function processViews(process, opts, header3) {
+  return {
     ignoredSignals: (fork) => process.inheritable(fork),
     blockedSignals: () => opts.program.abi === "wasi" ? loadBlocked(header3) : [0, 0],
     signalMasks: () => process.signalMasks(),
     umask: () => process.umask,
-    cred: () => copyCred(process.cred),
-    writesBack: () => opts.program.abi === "wasi" && !done5,
-    ...clockViews(clocks)
+    cred: () => copyCred(process.cred)
   };
 }
 function clockViews(clocks) {
@@ -23576,15 +23890,15 @@ function isRecord(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function serialized(reply) {
-  let plain2;
+  let plain3;
   try {
     const text = JSON.stringify(reply);
-    plain2 = text === void 0 ? void 0 : JSON.parse(text);
+    plain3 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
     return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
-  if (!isRecord(plain2)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
-  const { v: _, ...rest2 } = plain2;
+  if (!isRecord(plain3)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
+  const { v: _, ...rest2 } = plain3;
   return JSON.stringify({ v: 1, ...rest2 });
 }
 function lineOf2(err) {
@@ -24115,8 +24429,8 @@ var FSA_CAPABILITIES = {
   ranges: true,
   sessions: true
 };
-var codeOf4 = (err) => err?.code;
-var denied = (err) => codeOf4(err) === "EACCES" || err?.name === "NotAllowedError";
+var codeOf5 = (err) => err?.code;
+var denied = (err) => codeOf5(err) === "EACCES" || err?.name === "NotAllowedError";
 function attrOf(st) {
   return {
     kind: st.isDirectory ? "directory" : st.isSymbolicLink ? "symlink" : "file",
@@ -24138,7 +24452,7 @@ function kernelFsHandlers(fs) {
     try {
       return await fs.stat(path);
     } catch (err) {
-      if (codeOf4(err) === "ENOENT") return void 0;
+      if (codeOf5(err) === "ENOENT") return void 0;
       throw err;
     }
   }
@@ -24331,7 +24645,7 @@ function parseFstab(text) {
   });
   return lines2;
 }
-function codeOf5(err) {
+function codeOf6(err) {
   const code = err?.code;
   return typeof code === "string" ? code : "EIO";
 }
@@ -24369,18 +24683,18 @@ async function mountLine({ line, spec, invalid }, mount, signal, retries, discar
       break;
     } catch (err) {
       failed3 = err;
-      if (FINAL.has(codeOf5(err)) || attempt === retries.length) break;
+      if (FINAL.has(codeOf6(err)) || attempt === retries.length) break;
       await wait(retries[attempt], signal);
     }
   }
-  const code = codeOf5(failed3);
+  const code = codeOf6(failed3);
   return { line, target: spec.target, code, error: String(failed3?.message ?? code) };
 }
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf6 = (err) => err?.code;
-var unreachable = (err) => codeOf6(err) === "ENOTCONN";
+var codeOf7 = (err) => err?.code;
+var unreachable = (err) => codeOf7(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -24557,7 +24871,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     try {
       return { opened: await opening2(), restore: void 0 };
     } catch (err) {
-      if (!flags2.write || codeOf6(err) !== "EACCES") throw err;
+      if (!flags2.write || codeOf7(err) !== "EACCES") throw err;
       const was = await client.call("stat", { path: rel(path) });
       const mode = was.mode ?? 0;
       if (mode & 128) throw err;
@@ -25546,13 +25860,13 @@ function splitWords(text) {
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
-    const [, single, double, escaped, plain2, space] = m;
+    const [, single, double, escaped, plain3, space] = m;
     if (space !== void 0) {
       if (word !== void 0) words2.push(word);
       word = void 0;
       continue;
     }
-    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain2));
+    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain3));
   }
   if (word !== void 0) words2.push(word);
   return words2;
@@ -25777,14 +26091,14 @@ var Sudo = class {
     if (this.pending.has(cred.ruid)) return failed2("EBUSY", "sudo: another request is pending");
     this.pending.add(cred.ruid);
     try {
-      const answer = await this.ask(caller, self, target, parsed2.command, path, cwd, signal);
-      if (typeof answer !== "string") return answer;
+      const answer2 = await this.ask(caller, self, target, parsed2.command, path, cwd, signal);
+      if (typeof answer2 !== "string") return answer2;
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer === "always" && !await this.remember(self, target, cwd, argv)) {
+      if (answer2 === "always" && !await this.remember(self, target, cwd, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
       return grant();
@@ -25839,11 +26153,11 @@ ${lines2}
     );
     try {
       const answered2 = Promise.resolve().then(() => approve(req, { signal: control.signal })).catch(() => "deny");
-      const answer = await Promise.race([answered2, aborted2]);
-      if (answer === "aborted" || control.signal.aborted) {
+      const answer2 = await Promise.race([answered2, aborted2]);
+      if (answer2 === "aborted" || control.signal.aborted) {
         return control.signal.reason === "expired" ? failed2("ETIMEDOUT", "sudo: the request expired") : failed2("EINTR", "sudo: the request was withdrawn");
       }
-      return answer === "once" || answer === "always" ? answer : failed2("EACCES", "sudo: approval denied");
+      return answer2 === "once" || answer2 === "always" ? answer2 : failed2("EACCES", "sudo: approval denied");
     } finally {
       clearTimeout(timer);
       requester.removeEventListener("abort", withdraw);
@@ -26745,16 +27059,52 @@ var Launcher = class {
     for (const bin of planned?.bins ?? []) await need(g, "exec", bin, R_OK | X_OK);
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
   }
-  async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const refused3 = async (err) => {
+  async checkedPlan(req, ctx, fds) {
+    try {
+      return await this.planOrSearch(req, ctx);
+    } catch (err) {
       await fds.closeAll();
-      throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+      throw err;
+    }
+  }
+  async planOrSearch(req, ctx) {
+    const bare = !req.file.includes("/") && !COMMAND2.test(req.file);
+    try {
+      return await this.planOne(req, ctx);
+    } catch (err) {
+      const code = codeOf8(err);
+      const searched = bare && req.search !== false && (code === "ENOENT" || code === "ENOEXEC");
+      if (!searched || await this.commandAt(req.file, ctx.scope)) throw err;
+      const found = await this.onPath(req, ctx);
+      if (found) return found;
+      throw err;
+    }
+  }
+  async onPath(req, ctx) {
+    const path = req.env.PATH;
+    if (typeof path !== "string") return void 0;
+    let denied2 = false;
+    for (const dir of path.split(":")) {
+      const file = dir === "" ? `./${req.file}` : `${dir.replace(/\/+$/, "")}/${req.file}`;
+      try {
+        return await this.planOne({ ...req, file }, ctx);
+      } catch (err) {
+        const code = codeOf8(err);
+        if (code === "EACCES") denied2 = true;
+        else if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+      }
+    }
+    if (denied2) throw new SpawnError("EACCES");
+    return void 0;
+  }
+  async planOne(req, { ppid, cred, scope }) {
+    const refused3 = (err) => {
+      throw codeOf8(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
     const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
     await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
     if (planned) return planned;
-    await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
   }
   async enterable(g, cwd) {
@@ -26921,12 +27271,12 @@ var Launcher = class {
     return `${path}:${st.size}:${st.mtime.getTime()}`;
   }
   verified(path, caller, fs = this.base) {
-    const plain2 = () => fs.readFileBuffer(path);
-    return this.integrity ? this.integrity.read(path, caller, plain2) : plain2();
+    const plain3 = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain3) : plain3();
   }
   keyed(path, caller, asked) {
-    const plain2 = async () => this.base.readFileBuffer(path);
-    return this.integrity ? this.integrity.readKeyed(path, caller, plain2, asked) : plain2().then((bytes) => ({ bytes }));
+    const plain3 = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain3, asked) : plain3().then((bytes) => ({ bytes }));
   }
   cached(cache, key, load) {
     const hit = cache.get(key);
@@ -27123,7 +27473,7 @@ var Launcher = class {
     });
     return {
       source: {
-        read: (path, plain2) => integrity.readSource(path, caller(), plain2),
+        read: (path, plain3) => integrity.readSource(path, caller(), plain3),
         open: (path, real) => integrity.openSource(path, caller(), real)
       }
     };
@@ -28030,9 +28380,9 @@ var Launcher = class {
       }
     );
   }
-  environment(cwd, extra, account, login = false) {
+  environment(cwd, extra, account, login2 = false) {
     const env = {
-      ...login ? networkEnv(this.hostname) : this.env,
+      ...login2 ? networkEnv(this.hostname) : this.env,
       ...userEnv(account, this.pnpmHome),
       PWD: cwd,
       ...extra
@@ -28259,6 +28609,9 @@ var Launcher = class {
 function cronLocks() {
   return globalThis.navigator?.locks;
 }
+function codeOf8(err) {
+  return err?.code;
+}
 
 // src/pin.ts
 function pinScript(url) {
@@ -28296,14 +28649,14 @@ function clipboardAsker(port) {
       await ask("write", stamp, text);
     }
   };
-  const answer = ({ id: id2, text, error }) => {
+  const answer2 = ({ id: id2, text, error }) => {
     const waiting = asks.get(id2);
     if (!waiting) return;
     asks.delete(id2);
     if (error) waiting.reject(Object.assign(new Error(error.message), { name: error.name }));
     else waiting.resolve(text);
   };
-  return { hook, answer };
+  return { hook, answer: answer2 };
 }
 
 // src/integrity-relay.ts
@@ -28317,14 +28670,14 @@ function integrityAsker(port) {
     port.postMessage({ integrityAsk: { id: id2, path } });
     return waiting.promise;
   };
-  const answer = ({ id: id2, hash, error }) => {
+  const answer2 = ({ id: id2, hash, error }) => {
     const waiting = asks.get(id2);
     if (!waiting) return;
     asks.delete(id2);
     if (error !== void 0) waiting.reject(new Error(error));
     else waiting.resolve(hash);
   };
-  return { lookup: lookup2, answer };
+  return { lookup: lookup2, answer: answer2 };
 }
 
 // src/kernel/net/remote-transport.ts
@@ -28548,14 +28901,14 @@ function sealedAsker(port) {
     port.postMessage({ sealedAsk: { id: id2, req } });
     return waiting.promise.finally(() => signal.removeEventListener("abort", abort));
   };
-  const answer = ({ id: id2, reply, error }) => {
+  const answer2 = ({ id: id2, reply, error }) => {
     const waiting = asks.get(id2);
     if (!waiting) return;
     asks.delete(id2);
     if (reply) waiting.resolve(reply);
     else waiting.reject(new Error(error ?? "no reply"));
   };
-  return { hook, answer };
+  return { hook, answer: answer2 };
 }
 
 // src/serve.ts
@@ -28668,8 +29021,8 @@ function sudoApprovals(port) {
       );
       port.postMessage({ sudoAsk: req });
     }),
-    answer({ id: id2, answer }) {
-      waiting.get(id2)?.(answer);
+    answer({ id: id2, answer: answer2 }) {
+      waiting.get(id2)?.(answer2);
       waiting.delete(id2);
     }
   };
@@ -28763,10 +29116,10 @@ function policyAsker(port) {
   return {
     mountPolicy: (policy) => policy === void 0 ? {} : { processMounts: policy === "ask" ? askPolicy : policy },
     allowed(data) {
-      const answer = data.mountAllowed;
-      if (!answer) return false;
-      policies.get(answer.id)?.(answer.allowed);
-      policies.delete(answer.id);
+      const answer2 = data.mountAllowed;
+      if (!answer2) return false;
+      policies.get(answer2.id)?.(answer2.allowed);
+      policies.delete(answer2.id);
       return true;
     }
   };