@ai-ecoverse/slicc-kernel 1.128.2 → 1.130.0

package/dist/node.js

@@ -3821,14 +3821,14 @@ var Integrity = class {
     if (!this.root.version) return void 0;
     return `${real}\0${await this.root.version(real)}`;
   }
-  async read(path, caller, plain2, asked) {
-    return (await this.readKeyed(path, caller, plain2, asked)).bytes;
+  async read(path, caller, plain3, asked) {
+    return (await this.readKeyed(path, caller, plain3, asked)).bytes;
   }
-  async readKeyed(path, caller, plain2, asked) {
+  async readKeyed(path, caller, plain3, asked) {
     const found = await this.real(path, asked);
-    if (found === void 0) return { bytes: await plain2() };
+    if (found === void 0) return { bytes: await plain3() };
     const { real, name: name2 } = found;
-    const read = name2 !== real ? { bytes: await plain2(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const read = name2 !== real ? { bytes: await plain3(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
     const { bytes } = read;
     const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
     await this.verify(name2, bytes, caller, EXEC_OPS);
@@ -3837,9 +3837,9 @@ var Integrity = class {
   get readsChecked() {
     return this.sources.length > 0;
   }
-  async readSource(path, caller, plain2) {
+  async readSource(path, caller, plain3) {
     const found = await this.source(path);
-    return found === void 0 ? plain2() : this.checked(found, caller, plain2);
+    return found === void 0 ? plain3() : this.checked(found, caller, plain3);
   }
   async openSource(path, caller, real) {
     const found = await this.source(path, real);
@@ -3849,10 +3849,10 @@ var Integrity = class {
     }
     await this.checked(found, caller, () => this.root.readFileBuffer(found.real));
   }
-  async checked(found, caller, plain2) {
+  async checked(found, caller, plain3) {
     const { real, name: name2 } = found;
     if (name2 !== real || !this.root.readVersioned) {
-      const bytes2 = await plain2();
+      const bytes2 = await plain3();
       await this.verify(name2, bytes2, caller, READ_OPS);
       return bytes2;
     }
@@ -3913,8 +3913,8 @@ var Integrity = class {
     }
   }
   async expected(path) {
-    const answer = await this.lookup(path);
-    return typeof answer === "string" ? answer.toLowerCase() : void 0;
+    const answer2 = await this.lookup(path);
+    return typeof answer2 === "string" ? answer2.toLowerCase() : void 0;
   }
   say(event) {
     try {
@@ -4247,12 +4247,12 @@ var RemoteWatch = class {
   }
   greeted(peer) {
     this.arrived(peer);
-    const answer = () => {
+    const answer2 = () => {
       this.channel.postMessage({ here: this.tab, to: peer });
       if (this.mine.length > 0) void this.announce(this.mine);
     };
-    if (this.quiet) void this.quiet().then(answer, answer);
-    else answer();
+    if (this.quiet) void this.quiet().then(answer2, answer2);
+    else answer2();
   }
   announced({ tab, paths, seq: seq2 }) {
     const from = tab;
@@ -6785,11 +6785,11 @@ function frame(opcode, payload) {
   return out;
 }
 function clientFrame(opcode, payload) {
-  const plain2 = frame(opcode, payload);
-  const head = plain2.length - payload.length;
+  const plain3 = frame(opcode, payload);
+  const head = plain3.length - payload.length;
   const mask = crypto.getRandomValues(new Uint8Array(4));
-  const out = new Uint8Array(plain2.length + 4);
-  out.set(plain2.subarray(0, head));
+  const out = new Uint8Array(plain3.length + 4);
+  out.set(plain3.subarray(0, head));
   out[1] = out[1] | 128;
   out.set(mask, head);
   for (let i = 0; i < payload.length; i++) {
@@ -7392,7 +7392,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.128.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.130.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12391,13 +12391,13 @@ async function chown(entry, path, req) {
 }
 async function runMkdir(entry, path, req) {
   const { fs } = entry;
-  const plain2 = plainDirMode(entry, req.mode);
+  const plain3 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh2 = plain2 !== void 0 && !await fs.exists(path);
+  const fresh2 = plain3 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh2) await fs.chmod(path, plain2);
+  if (fresh2) await fs.chmod(path, plain3);
   return done;
 }
 async function shownAs(entry, path, st) {
@@ -12405,8 +12405,8 @@ async function shownAs(entry, path, st) {
   return callerStat(guardOf(entry), await real?.catch(() => path) ?? path, st);
 }
 function readSource(entry, path) {
-  const plain2 = () => entry.fs.readFileBuffer(path);
-  return entry.source ? entry.source.read(path, plain2) : plain2();
+  const plain3 = () => entry.fs.readFileBuffer(path);
+  return entry.source ? entry.source.read(path, plain3) : plain3();
 }
 async function run(entry, path, req) {
   const { fs, cwd } = entry;
@@ -16301,11 +16301,11 @@ function carriesUdp(uplink) {
   return uplink.traits.udp === true && typeof uplink.udp === "function";
 }
 function answerOf(result) {
-  const answer = Array.isArray(result) ? { addresses: result } : result;
-  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  const answer2 = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer2?.addresses) ? answer2.addresses.filter((a) => typeof a === "string") : [];
   return {
     addresses,
-    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+    ...typeof answer2?.ttl === "number" && answer2.ttl >= 0 ? { ttl: answer2.ttl } : {}
   };
 }
 var NEVER = new Routes(true);
@@ -16383,9 +16383,9 @@ var Resolver = class {
   async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
     const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
-    let answer;
+    let answer2;
     try {
-      answer = answerOf(
+      answer2 = answerOf(
         await Promise.race([
           uplink.resolve(name2, family, timeout),
           new Promise(
@@ -16396,8 +16396,8 @@ var Resolver = class {
     } catch {
       return [];
     }
-    const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
-    if (addresses.length > 0) this.remember(id2, addresses, answer.ttl);
+    const addresses = answer2.addresses.filter((a) => this.usable(name2, a, family));
+    if (addresses.length > 0) this.remember(id2, addresses, answer2.ttl);
     return addresses;
   }
   usable(name2, address, family) {
@@ -18345,6 +18345,95 @@ async function substituteHead(head, ask) {
 `, values };
 }
 
+// src/kernel/net/sealed-smtp.ts
+var SMTP_LINE_MAX = 4096;
+var GREETING = ["EHLO ", "HELO "];
+function sniffSmtp(start2) {
+  const upper = start2.toUpperCase();
+  for (const word of GREETING) {
+    if (upper.startsWith(word)) return "yes";
+    if (word.startsWith(upper)) return "more";
+  }
+  return "no";
+}
+function decoded(b64) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) return void 0;
+  try {
+    return atob(b64);
+  } catch {
+    return void 0;
+  }
+}
+async function swapped2(text, position, ask) {
+  const placeholders = placeholdersIn(text);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
+  const values = usable(await ask(position, placeholders));
+  if (Object.keys(values).length === 0) return void 0;
+  return { text: replaced(text, values), values };
+}
+async function plain2(b64, ask) {
+  const text = decoded(b64);
+  const fields = text?.split("\0");
+  if (fields?.length !== 3) return { line: b64 };
+  const [authz, user, pass2] = fields;
+  if (placeholdersIn(authz + user).length > 0) return { line: b64 };
+  const done4 = await swapped2(pass2, "auth-plain", ask);
+  if (!done4) return { line: b64 };
+  return { line: btoa(`${authz}\0${user}\0${done4.text}`), values: done4.values };
+}
+async function login(b64, ask) {
+  const text = decoded(b64);
+  const done4 = text === void 0 ? void 0 : await swapped2(text, "auth-login", ask);
+  return done4 ? { line: btoa(done4.text), values: done4.values } : { line: b64 };
+}
+var SmtpClient = class {
+  state = "command";
+  ask;
+  constructor(ask) {
+    this.ask = ask;
+  }
+  get done() {
+    return this.state === "done";
+  }
+  async line(text) {
+    const state = this.state;
+    if (state === "done") return { line: text };
+    if (state === "plain" || state === "password") {
+      this.state = "done";
+      if (text === "*") return { line: text };
+      return state === "plain" ? plain2(text, this.ask) : login(text, this.ask);
+    }
+    if (state === "user") {
+      this.state = text === "*" ? "done" : "password";
+      return { line: text };
+    }
+    return this.command(text);
+  }
+  async command(text) {
+    const m = /^AUTH[ \t]+(PLAIN|LOGIN)(?:[ \t]+(\S+))?$/i.exec(text);
+    if (!m) {
+      if (/^(MAIL|RCPT|DATA|BDAT|AUTH)\b/i.test(text)) this.state = "done";
+      return { line: text };
+    }
+    const mech = m[1].toUpperCase();
+    const arg = m[2];
+    if (mech === "LOGIN") {
+      this.state = arg === void 0 ? "user" : "password";
+      return { line: text };
+    }
+    if (arg === void 0) {
+      this.state = "plain";
+      return { line: text };
+    }
+    this.state = "done";
+    const out = await plain2(arg, this.ask);
+    return {
+      line: `${text.slice(0, text.length - arg.length)}${out.line}`,
+      ...out.values ? { values: out.values } : {}
+    };
+  }
+};
+
 // src/kernel/net/sealed-conn.ts
 var HEAD_IDLE_MS = 2e3;
 function substitutes(s) {
@@ -18376,12 +18465,25 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-var Http1Writer = class {
+function modeOf(start2) {
+  const http = sniffHttp1(start2);
+  const smtp = sniffSmtp(start2);
+  if (http === "yes") return "http1";
+  if (smtp === "yes") return "smtp";
+  return http === "no" && smtp === "no" ? "pass" : void 0;
+}
+function crlf(bytes) {
+  for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
+  return -1;
+}
+var SessionWriter = class {
   buffer = new Uint8Array(0);
-  passing = false;
+  mode = "sniff";
   timer;
   chain = Promise.resolve();
   failed;
+  session = sessionId();
+  smtp;
   conn;
   s;
   scope;
@@ -18389,6 +18491,9 @@ var Http1Writer = class {
     this.conn = conn;
     this.s = s;
     this.scope = scope;
+    this.smtp = new SmtpClient(
+      (position, placeholders) => this.ask("smtp", position, placeholders)
+    );
   }
   write(bytes) {
     const run2 = this.chain.then(() => this.take(bytes));
@@ -18398,30 +18503,78 @@ var Http1Writer = class {
     );
     return run2;
   }
+  async ask(protocol, position, placeholders, head) {
+    const s = this.s;
+    const values = await s.broker.sessionMaterialize({
+      stamp: await s.stamp(),
+      session: this.session,
+      host: s.host,
+      port: s.port,
+      protocol,
+      position,
+      verified: s.verified,
+      handshakeAt: s.handshakeAt,
+      exit: s.exit,
+      placeholders,
+      ...head ? { head } : {}
+    });
+    return values;
+  }
+  remember(values) {
+    this.scope.add(
+      Object.entries(values).map(([placeholder, value2]) => ({ name: "sealed", value: value2, placeholder }))
+    );
+  }
   async take(bytes) {
     if (this.failed !== void 0) throw this.failed;
-    if (this.passing) return this.conn.write(bytes);
+    if (this.mode === "pass") return this.conn.write(bytes);
     clearTimeout(this.timer);
     const joined4 = new Uint8Array(this.buffer.length + bytes.length);
     joined4.set(this.buffer);
     joined4.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined4;
-    const sniff = sniffHttp1(latin12(joined4.subarray(0, 8)));
-    const end = sniff === "yes" ? headEnd2(joined4) : -1;
-    if (sniff === "no" || end > HEAD_MAX || end < 0 && joined4.length > HEAD_MAX)
-      await this.release();
-    else if (end >= 0) await this.substitute(end);
-    else this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
+    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "pass") await this.release();
+    else if (this.mode === "http1") await this.http1();
+    else if (this.mode === "smtp") await this.lines();
+    if (this.mode !== "pass" && this.buffer.length > 0)
+      this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
     return bytes.length;
   }
+  async http1() {
+    const end = headEnd2(this.buffer);
+    if (end > HEAD_MAX || end < 0 && this.buffer.length > HEAD_MAX) await this.release();
+    else if (end >= 0) await this.substitute(end);
+  }
+  async lines() {
+    for (; ; ) {
+      const at = crlf(this.buffer);
+      if (at < 0) break;
+      if (at > SMTP_LINE_MAX) return this.release();
+      const all = this.buffer;
+      this.buffer = all.slice(at + 2);
+      const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
+      all.fill(0);
+      if ("values" in out && out.values) this.remember(out.values);
+      const line = bytesOf(`${out.line}\r
+`);
+      try {
+        await writeAll4(this.conn, line);
+      } finally {
+        line.fill(0);
+      }
+      if (this.smtp.done) return this.release();
+    }
+    if (this.buffer.length > SMTP_LINE_MAX) await this.release();
+  }
   idle() {
     this.chain = this.chain.then(() => this.release()).catch((err) => {
       this.failed ??= err;
     });
   }
   async release() {
-    this.passing = true;
+    this.mode = "pass";
     const out = this.buffer;
     this.buffer = new Uint8Array(0);
     try {
@@ -18431,37 +18584,15 @@ var Http1Writer = class {
     }
   }
   async substitute(end) {
-    this.passing = true;
+    this.mode = "pass";
     const all = this.buffer;
     this.buffer = new Uint8Array(0);
-    const s = this.s;
-    const session = sessionId();
     const done4 = await substituteHead(
       latin12(all.subarray(0, end)),
-      async (position, placeholders, head2) => s.broker.sessionMaterialize({
-        stamp: await s.stamp(),
-        session,
-        host: s.host,
-        port: s.port,
-        protocol: "http1",
-        position,
-        verified: s.verified,
-        handshakeAt: s.handshakeAt,
-        exit: s.exit,
-        placeholders,
-        head: head2
-      })
+      (position, placeholders, head2) => this.ask("http1", position, placeholders, head2)
     ).catch(() => void 0);
     const head = done4 ? bytesOf(done4.head) : all.subarray(0, end);
-    if (done4) {
-      this.scope.add(
-        Object.entries(done4.values).map(([placeholder, value2]) => ({
-          name: "sealed",
-          value: value2,
-          placeholder
-        }))
-      );
-    }
+    if (done4) this.remember(done4.values);
     try {
       await writeAll4(this.conn, head);
       await writeAll4(this.conn, all.subarray(end));
@@ -18472,14 +18603,14 @@ var Http1Writer = class {
   }
   flushed() {
     clearTimeout(this.timer);
-    this.chain = this.chain.then(() => this.passing ? void 0 : this.release());
+    this.chain = this.chain.then(() => this.mode === "pass" ? void 0 : this.release());
     return this.chain;
   }
   drop() {
     clearTimeout(this.timer);
     this.buffer.fill(0);
     this.buffer = new Uint8Array(0);
-    this.passing = true;
+    this.mode = "pass";
   }
 };
 var IDLE2 = /* @__PURE__ */ Symbol("idle");
@@ -18490,11 +18621,9 @@ var ScrubReader = class {
   held = false;
   ended = false;
   conn;
-  s;
   scope;
-  constructor(conn, s, scope) {
+  constructor(conn, scope) {
     this.conn = conn;
-    this.s = s;
     this.scope = scope;
   }
   current() {
@@ -18553,8 +18682,8 @@ function idle() {
 }
 function sealedConn(conn, s) {
   const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new Http1Writer(conn, s, scope) : void 0;
-  const reader = new ScrubReader(conn, s, scope);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, scope) : void 0;
+  const reader = new ScrubReader(conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
@@ -19680,6 +19809,12 @@ function tlsOverTransport(req, proc) {
   return { fd: proc.fds.install(new OpenFile(mine), 3), alpnProtocol: "http/1.1", servername };
 }
 
+// src/kernel/test-hooks.ts
+var SYSCALL_HOOK = /* @__PURE__ */ Symbol.for("slicc-kernel.test.syscall");
+function testSyscallHook() {
+  return globalThis[SYSCALL_HOOK];
+}
+
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;
 var O_WRONLY = 1;
@@ -20894,7 +21029,8 @@ var WasmProcess = class {
       cwd,
       ...moved2,
       ...group,
-      ...exec ? { exec } : {}
+      ...exec ? { exec } : {},
+      search: req.search
     };
     const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (deathSignal !== void 0) this.onDeath(pgid === 0 || session ? -pid : pid, deathSignal);
@@ -20917,8 +21053,8 @@ var WasmProcess = class {
   spares(sig) {
     const { caught, ignored } = this.signalMasks();
     const bit = isSignal(sig) ? sigbit(sig) : 0;
-    const answer = (ignored & bit) !== 0 ? "ignore" : (caught & bit) !== 0 ? "spare" : "terminate";
-    return { ok: true, kind: "json", json: answer };
+    const answer2 = (ignored & bit) !== 0 ? "ignore" : (caught & bit) !== 0 ? "spare" : "terminate";
+    return { ok: true, kind: "json", json: answer2 };
   }
   async killSelf(sig, target, probe2) {
     if (!this.options.exitSignal) throw new KernelError("ENOSYS");
@@ -20980,6 +21116,8 @@ var WasmProcess = class {
     return void 0;
   }
   async syscall(req, cancelled, block) {
+    const hook = testSyscallHook();
+    if (hook) await hook({ pid: this.pid, op: req.op });
     this.options.onSyscall?.(req);
     this.calls += 1;
     const started = performance.now();
@@ -21277,18 +21415,18 @@ var WasmProcess = class {
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open = { ...req, path };
-      const plain2 = this.plainMode(req.mode);
+      const plain3 = this.plainMode(req.mode);
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner(req.mode));
-        if (plain2 !== void 0) await fs.chmod?.(path, plain2);
+        if (plain3 !== void 0) await fs.chmod?.(path, plain3);
         this.fds.installAt(fd, this.openVfsFile(open, void 0, fs));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const marks = this.options.owners || plain2 !== void 0;
+          const marks = this.options.owners || plain3 !== void 0;
           const fresh2 = marks && !await present3(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2 && plain2 !== void 0) await fs.chmod?.(path, plain2);
+          if (fresh2 && plain3 !== void 0) await fs.chmod?.(path, plain3);
           else if (fresh2) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
@@ -22033,10 +22171,10 @@ var WasmProcess = class {
       cwd: typeof req.cwd === "string" && req.cwd.startsWith("/") ? req.cwd : "/",
       ...typeof req.term === "string" ? { term: req.term } : {}
     };
-    const answer = await sudo(call, this.blockingSignal(cancelled));
-    if (!("grant" in answer)) return answer;
+    const answer2 = await sudo(call, this.blockingSignal(cancelled));
+    if (!("grant" in answer2)) return answer2;
     if (this.dying) throw new KernelError("EINTR");
-    const { file, argv, env, cwd, cred, caller } = answer.grant;
+    const { file, argv, env, cwd, cred, caller } = answer2.grant;
     const stdio = [{ fd: 0 }, { fd: 1 }, { fd: 2 }];
     return {
       pid: await this.children.spawn({ file, argv, env, cwd, pgid: 0 }, stdio, [], {
@@ -22196,6 +22334,153 @@ var WASM_THREAD_SPAWN = "wasm-thread-spawn";
 var WASM_THREAD_INIT = "wasm-thread-init";
 var WASM_THREAD_EXIT = "wasm-thread-exit";
 var WASM_MAX_THREADS = 256;
+var JS_THREAD_SPAWN = "js-thread-spawn";
+var JS_THREAD_INIT = "js-thread-init";
+var JS_THREAD_EXIT = "js-thread-exit";
+var JS_MAX_THREADS = 256;
+var JS_DEFAULT_THREADS = 16;
+var JS_THREAD_NO_MEMORY = 256;
+var JS_THREAD_CRASHED = 257;
+
+// src/kernel/js-threads.ts
+var JS_OOM = /out of memory|Array buffer allocation failed|Cannot allocate Wasm memory|could not allocate memory|ERR_WORKER_OUT_OF_MEMORY/i;
+var ENDING = { ok: false, errno: "EINTR", message: "the thread is ending" };
+var MAIN_ONLY = { ok: true, kind: "void" };
+function track(ops, req, result) {
+  if (req.op === "async-submit" && result.ok && result.kind === "json") {
+    if (typeof result.json === "number") ops.set(result.json, req.token);
+  } else if (req.op === "async-cancel" || req.op === "async-take" && (result.ok || result.errno !== "EAGAIN")) {
+    ops.delete(req.id);
+  }
+}
+function cores() {
+  const n = globalThis.navigator?.hardwareConcurrency;
+  return typeof n === "number" && Number.isInteger(n) && n > 0 ? n : 0;
+}
+function jsThreadCap(env) {
+  const asked = Number.parseInt(env.SLICC_JS_THREADS ?? "", 10);
+  if (asked >= 1) return Math.min(asked, JS_MAX_THREADS);
+  return Math.min(JS_MAX_THREADS, Math.max(JS_DEFAULT_THREADS, 2 * cores()));
+}
+function codeOf4(code) {
+  if (code === JS_THREAD_NO_MEMORY || code === JS_THREAD_CRASHED) return code;
+  return typeof code === "number" && Number.isInteger(code) ? code & 255 : JS_THREAD_CRASHED;
+}
+function answer(control, message3) {
+  control.postMessage(message3);
+}
+var JsThreads = class {
+  deps;
+  live = /* @__PURE__ */ new Map();
+  headers = /* @__PURE__ */ new Map();
+  frozen = false;
+  last = 0;
+  closed = false;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  get size() {
+    return this.live.size;
+  }
+  spawn(msg) {
+    const { control, port } = msg;
+    if (this.closed || this.live.size >= this.deps.cap) {
+      answer(
+        control,
+        this.closed ? { errno: "ESRCH", message: "the process is ending" } : { errno: "EAGAIN", message: `more than ${this.deps.cap} threads` }
+      );
+      control.close();
+      port.close();
+      return;
+    }
+    const tid = ++this.last;
+    const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
+    const header4 = new Int32Array(sab, 0, SAB_HEADER_I32);
+    if (this.frozen) Atomics.store(header4, SAB_I_STOP, 1);
+    const worker = this.deps.createWorker();
+    const clock = this.deps.clocks.thread(tid + 1, sab);
+    let ended = false;
+    const end = (code) => {
+      if (ended) return;
+      ended = true;
+      this.live.delete(tid);
+      this.headers.delete(tid);
+      this.deps.wakes.delete(header4);
+      for (const [id2, token] of ops) {
+        void this.deps.dispatch({ op: "async-cancel", id: id2, token });
+      }
+      ops.clear();
+      worker.removeEventListener("message", onMessage);
+      worker.removeEventListener("error", onError);
+      control.removeEventListener("message", onControl);
+      responder.dispose();
+      lane.dispose();
+      this.deps.clocks.threadEnded(tid + 1);
+      worker.terminate();
+      answer(control, { exited: code });
+      control.close();
+    };
+    const ops = /* @__PURE__ */ new Map();
+    const dispatch2 = async (req, block) => {
+      if (isWasmSyscall(req) && req.op === "proc-exit") {
+        queueMicrotask(() => end(req.status & 255));
+        return ENDING;
+      }
+      if (isWasmSyscall(req) && req.op === "sig-mask") return MAIN_ONLY;
+      const result = await this.deps.dispatch(req, block);
+      if (!ended) track(ops, req, result);
+      return result;
+    };
+    const responder = this.deps.attach(worker, sab, this.deps.clocks.timed(clock, dispatch2));
+    const lane = this.deps.openLane(dispatch2);
+    const onMessage = (event) => {
+      const data = event.data;
+      if (data?.type === JS_THREAD_EXIT) end(codeOf4(data.code));
+      else if (data?.type === JS_THREAD_SPAWN) this.spawn(event.data);
+      else if (data?.type === WASM_PROCESS_ERROR) this.crashed(String(data.message), end);
+    };
+    const onError = (event) => {
+      event.preventDefault();
+      this.crashed(String(event.message ?? "worker error"), end);
+    };
+    const onControl = (event) => {
+      if (event.data?.terminate === true) end(1);
+    };
+    worker.addEventListener("message", onMessage);
+    worker.addEventListener("error", onError);
+    control.addEventListener("message", onControl);
+    control.start();
+    this.live.set(tid, end);
+    this.headers.set(tid, header4);
+    this.deps.wakes.add(header4);
+    const init = {
+      ...this.deps.init(sab, lane.lane),
+      type: JS_THREAD_INIT,
+      thread: { tid, port, data: msg.data }
+    };
+    try {
+      worker.postMessage(init, [lane.lane.port, port, ...msg.transfer ?? []]);
+    } catch {
+      end(JS_THREAD_CRASHED);
+      return;
+    }
+    answer(control, { tid });
+  }
+  crashed(message3, end) {
+    end(JS_OOM.test(message3) ? JS_THREAD_NO_MEMORY : JS_THREAD_CRASHED);
+  }
+  stopped(stopped) {
+    this.frozen = stopped;
+    for (const header4 of this.headers.values()) {
+      Atomics.store(header4, SAB_I_STOP, stopped ? 1 : 0);
+      Atomics.notify(header4, SAB_I_STOP);
+    }
+  }
+  close() {
+    this.closed = true;
+    for (const end of [...this.live.values()]) end(1);
+  }
+};
 
 // src/kernel/host.ts
 var CRASHED = 70;
@@ -22298,6 +22583,7 @@ function threadSignalsOf(sab) {
 function threadCancel(thread) {
   return unblocked(thread.header) !== 0 ? AbortSignal.abort() : thread.interrupt.signal;
 }
+var asyncFanout = /* @__PURE__ */ new WeakMap();
 function notifiers(header4) {
   return {
     onPending(sig) {
@@ -22305,8 +22591,10 @@ function notifiers(header4) {
       Atomics.notify(header4, SAB_I_SIGNALS);
     },
     onAsync() {
-      Atomics.add(header4, SAB_I_ASYNC, 1);
-      Atomics.notify(header4, SAB_I_ASYNC);
+      for (const at of [header4, ...asyncFanout.get(header4) ?? []]) {
+        Atomics.add(at, SAB_I_ASYNC, 1);
+        Atomics.notify(at, SAB_I_ASYNC);
+      }
     }
   };
 }
@@ -22537,6 +22825,7 @@ function spawnWasmProcess(opts) {
     dispatch: clocks.timed(void 0, dispatch2)
   });
   const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
+  const jsThreads = jsThreadsOf(opts, process2, token, dispatch2, clocks, header4);
   const { promise: exited, resolve: settle } = Promise.withResolvers();
   let done4 = false;
   let endedBy;
@@ -22550,6 +22839,7 @@ function spawnWasmProcess(opts) {
     worker.removeEventListener("message", onMessage);
     worker.removeEventListener("error", onError);
     for (const tid of [...threads.keys()]) endThread(tid);
+    jsThreads?.close();
     responder.dispose();
     lane?.dispose();
     revokeSyncFsToken(token);
@@ -22573,6 +22863,8 @@ function spawnWasmProcess(opts) {
       finish(...dying.status(data.code));
     } else if (data?.type === WASM_THREAD_SPAWN && data.thread) {
       spawnThread(data.thread);
+    } else if (data?.type === JS_THREAD_SPAWN && jsThreads) {
+      jsThreads.spawn(data);
     }
   };
   const onMessage = (event) => handle(event.data);
@@ -22646,13 +22938,35 @@ function spawnWasmProcess(opts) {
     termsig: () => endedBy,
     onState: (listener) => process2.onState(listener),
     memory: () => Atomics.load(header4, SAB_I_MEMORY) * 65536,
+    ...processViews(process2, opts, header4),
+    writesBack: () => opts.program.abi === "wasi" && !done4,
+    ...clockViews(clocks)
+  };
+}
+function jsThreadsOf(opts, process2, token, dispatch2, clocks, header4) {
+  if (opts.program.abi !== "js") return void 0;
+  const wakes = /* @__PURE__ */ new Set();
+  asyncFanout.set(header4, wakes);
+  const threads = new JsThreads({
+    wakes,
+    cap: jsThreadCap(opts.env),
+    createWorker: opts.createWorker,
+    init: (sab, lane) => processInit(opts, sab, process2.umask, copyCred(process2.cred), lane),
+    openLane: (laneDispatch) => openLane(token, laneDispatch),
+    attach: (worker, sab, threadDispatch) => attachSyncSabResponder(worker, sab, token, { dispatch: threadDispatch }),
+    dispatch: dispatch2,
+    clocks
+  });
+  process2.onState((state) => threads.stopped(state === "stopped"));
+  return threads;
+}
+function processViews(process2, opts, header4) {
+  return {
     ignoredSignals: (fork) => process2.inheritable(fork),
     blockedSignals: () => opts.program.abi === "wasi" ? loadBlocked(header4) : [0, 0],
     signalMasks: () => process2.signalMasks(),
     umask: () => process2.umask,
-    cred: () => copyCred(process2.cred),
-    writesBack: () => opts.program.abi === "wasi" && !done4,
-    ...clockViews(clocks)
+    cred: () => copyCred(process2.cred)
   };
 }
 function clockViews(clocks) {
@@ -23431,15 +23745,15 @@ function isRecord(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function serialized(reply) {
-  let plain2;
+  let plain3;
   try {
     const text = JSON.stringify(reply);
-    plain2 = text === void 0 ? void 0 : JSON.parse(text);
+    plain3 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
     return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
-  if (!isRecord(plain2)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
-  const { v: _, ...rest2 } = plain2;
+  if (!isRecord(plain3)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
+  const { v: _, ...rest2 } = plain3;
   return JSON.stringify({ v: 1, ...rest2 });
 }
 function lineOf2(err) {
@@ -23970,8 +24284,8 @@ var FSA_CAPABILITIES = {
   ranges: true,
   sessions: true
 };
-var codeOf4 = (err) => err?.code;
-var denied = (err) => codeOf4(err) === "EACCES" || err?.name === "NotAllowedError";
+var codeOf5 = (err) => err?.code;
+var denied = (err) => codeOf5(err) === "EACCES" || err?.name === "NotAllowedError";
 function attrOf(st) {
   return {
     kind: st.isDirectory ? "directory" : st.isSymbolicLink ? "symlink" : "file",
@@ -23993,7 +24307,7 @@ function kernelFsHandlers(fs) {
     try {
       return await fs.stat(path);
     } catch (err) {
-      if (codeOf4(err) === "ENOENT") return void 0;
+      if (codeOf5(err) === "ENOENT") return void 0;
       throw err;
     }
   }
@@ -24186,7 +24500,7 @@ function parseFstab(text) {
   });
   return lines2;
 }
-function codeOf5(err) {
+function codeOf6(err) {
   const code = err?.code;
   return typeof code === "string" ? code : "EIO";
 }
@@ -24224,18 +24538,18 @@ async function mountLine({ line, spec, invalid }, mount, signal, retries, discar
       break;
     } catch (err) {
       failed3 = err;
-      if (FINAL.has(codeOf5(err)) || attempt === retries.length) break;
+      if (FINAL.has(codeOf6(err)) || attempt === retries.length) break;
       await wait(retries[attempt], signal);
     }
   }
-  const code = codeOf5(failed3);
+  const code = codeOf6(failed3);
   return { line, target: spec.target, code, error: String(failed3?.message ?? code) };
 }
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf6 = (err) => err?.code;
-var unreachable = (err) => codeOf6(err) === "ENOTCONN";
+var codeOf7 = (err) => err?.code;
+var unreachable = (err) => codeOf7(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -24412,7 +24726,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     try {
       return { opened: await opening2(), restore: void 0 };
     } catch (err) {
-      if (!flags2.write || codeOf6(err) !== "EACCES") throw err;
+      if (!flags2.write || codeOf7(err) !== "EACCES") throw err;
       const was = await client.call("stat", { path: rel(path) });
       const mode = was.mode ?? 0;
       if (mode & 128) throw err;
@@ -24837,7 +25151,7 @@ var PortTransport = class {
   }
 };
 var errorOf = (err) => ({
-  code: typeof codeOf6(err) === "string" ? codeOf6(err) : "EIO",
+  code: typeof codeOf7(err) === "string" ? codeOf7(err) : "EIO",
   message: err?.message ?? String(err)
 });
 function serveHostfsPort(port, transport) {
@@ -24851,14 +25165,14 @@ function serveHostfsPort(port, transport) {
   };
   const send2 = (reply, transfer = []) => port.postMessage(reply, transfer);
   const pending = /* @__PURE__ */ new Set();
-  const track = (work) => {
+  const track2 = (work) => {
     pending.add(work);
     const done4 = () => pending.delete(work);
     work.then(done4, done4);
     return work;
   };
-  const answer = async (name2, body) => {
-    const result = await track(transport.call(name2, body));
+  const answer2 = async (name2, body) => {
+    const result = await track2(transport.call(name2, body));
     const opened2 = result?.fh;
     if (name2 === "open" && typeof opened2 === "number") handles.add(opened2);
     if (name2 === "release") handles.delete(body?.fh);
@@ -24872,7 +25186,7 @@ function serveHostfsPort(port, transport) {
     if (op === "ping") return send2({ id: id2, pong: true });
     if (op === "bye") return stop();
     if (op === "cleanup")
-      return void Promise.allSettled([...pending]).then(() => answer(data.name, data.body)).catch(() => {
+      return void Promise.allSettled([...pending]).then(() => answer2(data.name, data.body)).catch(() => {
       });
     if (op === "unwatch") return watches.get(id2)?.abort();
     if (op === "watch") {
@@ -24894,7 +25208,7 @@ function serveHostfsPort(port, transport) {
     }
     try {
       if (op === "read") {
-        const read = await track(
+        const read = await track2(
           transport.read(
             data.fh,
             data.offset,
@@ -24906,13 +25220,13 @@ function serveHostfsPort(port, transport) {
         return send2({ id: id2, bytes }, [bytes.buffer]);
       }
       if (op === "write") {
-        await track(
+        await track2(
           transport.write(data.fh, data.offset, data.bytes)
         );
         return send2({ id: id2 });
       }
       if (op !== "call") throw fsError2("EINVAL", `unknown hostfs port op ${op}`);
-      send2({ id: id2, result: await answer(data.name, data.body) });
+      send2({ id: id2, result: await answer2(data.name, data.body) });
     } catch (err) {
       send2({ id: id2, error: errorOf(err) });
     }
@@ -25473,13 +25787,13 @@ function splitWords(text) {
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
-    const [, single, double, escaped, plain2, space] = m;
+    const [, single, double, escaped, plain3, space] = m;
     if (space !== void 0) {
       if (word !== void 0) words2.push(word);
       word = void 0;
       continue;
     }
-    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain2));
+    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain3));
   }
   if (word !== void 0) words2.push(word);
   return words2;
@@ -25704,14 +26018,14 @@ var Sudo = class {
     if (this.pending.has(cred.ruid)) return failed2("EBUSY", "sudo: another request is pending");
     this.pending.add(cred.ruid);
     try {
-      const answer = await this.ask(caller, self, target, parsed2.command, path, cwd, signal);
-      if (typeof answer !== "string") return answer;
+      const answer2 = await this.ask(caller, self, target, parsed2.command, path, cwd, signal);
+      if (typeof answer2 !== "string") return answer2;
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer === "always" && !await this.remember(self, target, cwd, argv)) {
+      if (answer2 === "always" && !await this.remember(self, target, cwd, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
       return grant();
@@ -25766,11 +26080,11 @@ ${lines2}
     );
     try {
       const answered = Promise.resolve().then(() => approve(req, { signal: control.signal })).catch(() => "deny");
-      const answer = await Promise.race([answered, aborted2]);
-      if (answer === "aborted" || control.signal.aborted) {
+      const answer2 = await Promise.race([answered, aborted2]);
+      if (answer2 === "aborted" || control.signal.aborted) {
         return control.signal.reason === "expired" ? failed2("ETIMEDOUT", "sudo: the request expired") : failed2("EINTR", "sudo: the request was withdrawn");
       }
-      return answer === "once" || answer === "always" ? answer : failed2("EACCES", "sudo: approval denied");
+      return answer2 === "once" || answer2 === "always" ? answer2 : failed2("EACCES", "sudo: approval denied");
     } finally {
       clearTimeout(timer);
       requester.removeEventListener("abort", withdraw);
@@ -26668,16 +26982,52 @@ var Launcher = class {
     for (const bin of planned?.bins ?? []) await need(g, "exec", bin, R_OK | X_OK);
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
   }
-  async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const refused3 = async (err) => {
+  async checkedPlan(req, ctx, fds) {
+    try {
+      return await this.planOrSearch(req, ctx);
+    } catch (err) {
       await fds.closeAll();
-      throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+      throw err;
+    }
+  }
+  async planOrSearch(req, ctx) {
+    const bare = !req.file.includes("/") && !COMMAND2.test(req.file);
+    try {
+      return await this.planOne(req, ctx);
+    } catch (err) {
+      const code = codeOf8(err);
+      const searched = bare && req.search !== false && (code === "ENOENT" || code === "ENOEXEC");
+      if (!searched || await this.commandAt(req.file, ctx.scope)) throw err;
+      const found = await this.onPath(req, ctx);
+      if (found) return found;
+      throw err;
+    }
+  }
+  async onPath(req, ctx) {
+    const path = req.env.PATH;
+    if (typeof path !== "string") return void 0;
+    let denied2 = false;
+    for (const dir of path.split(":")) {
+      const file = dir === "" ? `./${req.file}` : `${dir.replace(/\/+$/, "")}/${req.file}`;
+      try {
+        return await this.planOne({ ...req, file }, ctx);
+      } catch (err) {
+        const code = codeOf8(err);
+        if (code === "EACCES") denied2 = true;
+        else if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+      }
+    }
+    if (denied2) throw new SpawnError("EACCES");
+    return void 0;
+  }
+  async planOne(req, { ppid, cred, scope }) {
+    const refused3 = (err) => {
+      throw codeOf8(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
     const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
     await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
     if (planned) return planned;
-    await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
   }
   async enterable(g, cwd) {
@@ -26844,12 +27194,12 @@ var Launcher = class {
     return `${path}:${st.size}:${st.mtime.getTime()}`;
   }
   verified(path, caller, fs = this.base) {
-    const plain2 = () => fs.readFileBuffer(path);
-    return this.integrity ? this.integrity.read(path, caller, plain2) : plain2();
+    const plain3 = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain3) : plain3();
   }
   keyed(path, caller, asked) {
-    const plain2 = async () => this.base.readFileBuffer(path);
-    return this.integrity ? this.integrity.readKeyed(path, caller, plain2, asked) : plain2().then((bytes) => ({ bytes }));
+    const plain3 = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain3, asked) : plain3().then((bytes) => ({ bytes }));
   }
   cached(cache, key, load) {
     const hit = cache.get(key);
@@ -27046,7 +27396,7 @@ var Launcher = class {
     });
     return {
       source: {
-        read: (path, plain2) => integrity.readSource(path, caller(), plain2),
+        read: (path, plain3) => integrity.readSource(path, caller(), plain3),
         open: (path, real) => integrity.openSource(path, caller(), real)
       }
     };
@@ -27953,9 +28303,9 @@ var Launcher = class {
       }
     );
   }
-  environment(cwd, extra, account, login = false) {
+  environment(cwd, extra, account, login2 = false) {
     const env = {
-      ...login ? networkEnv(this.hostname) : this.env,
+      ...login2 ? networkEnv(this.hostname) : this.env,
       ...userEnv(account, this.pnpmHome),
       PWD: cwd,
       ...extra
@@ -28182,6 +28532,9 @@ var Launcher = class {
 function cronLocks() {
   return globalThis.navigator?.locks;
 }
+function codeOf8(err) {
+  return err?.code;
+}
 
 // src/node/loopback.ts
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -28198,11 +28551,11 @@ function ipv4Place(address) {
   return void 0;
 }
 function placeOf(address) {
-  const plain2 = address.replace(/^\[(.*)\]$/, "$1").toLowerCase();
-  const kind = isIP3(plain2);
-  if (kind === 4) return ipv4Place(plain2);
+  const plain3 = address.replace(/^\[(.*)\]$/, "$1").toLowerCase();
+  const kind = isIP3(plain3);
+  if (kind === 4) return ipv4Place(plain3);
   if (kind !== 6) return void 0;
-  const words2 = hextets2(plain2);
+  const words2 = hextets2(plain3);
   const embedded2 = words2.slice(0, 5).every((w) => w === 0) && (words2[5] === 65535 || words2[5] === 0);
   if (embedded2 && (words2[5] === 65535 || words2[6] !== 0)) return ipv4Place(ipv4Of(words2));
   if (words2.slice(0, 7).every((w) => w === 0) && (words2[7] ?? 0) <= 1) return "loopback";
@@ -28251,10 +28604,10 @@ function connectRefusal(address, port, place) {
   return Object.assign(new Error(why), { status: 403, code: "EACCES" });
 }
 async function addressesOf(host, resolve2) {
-  const plain2 = host.replace(/^\[(.*)\]$/, "$1");
-  if (isIP3(plain2)) return [plain2];
-  if (loopbackName2(plain2)) return ["127.0.0.1"];
-  return resolve2(plain2).catch(() => []);
+  const plain3 = host.replace(/^\[(.*)\]$/, "$1");
+  if (isIP3(plain3)) return [plain3];
+  if (loopbackName2(plain3)) return ["127.0.0.1"];
+  return resolve2(plain3).catch(() => []);
 }
 async function checkDestination(target, policy, resolve2 = resolveHost) {
   const url = new URL(target);
@@ -28592,7 +28945,7 @@ import { connect as tls } from "node:tls";
 var PROBE_MS = 3e3;
 var PASSED = /* @__PURE__ */ new Set(["ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ETIMEDOUT", "ECONNRESET"]);
 var NO_NAME = /* @__PURE__ */ new Set(["ENOTFOUND", "EAI_AGAIN", "EAI_NONAME", "EAI_FAIL", "ENODATA"]);
-function codeOf7(e) {
+function codeOf9(e) {
   const code = e?.code;
   return typeof code === "string" ? code : void 0;
 }
@@ -28621,7 +28974,7 @@ function probe(secure2, host, port, ms, signal) {
     signal?.addEventListener("abort", stop, { once: true });
     socket.once(secure2 ? "secureConnect" : "connect", () => done4("EPROTO"));
     socket.once("error", (e) => {
-      const code = codeOf7(e) ?? "";
+      const code = codeOf9(e) ?? "";
       done4(PASSED.has(code) ? code : "EPROTO");
     });
   });
@@ -28636,7 +28989,7 @@ async function diagnose(url, ms = PROBE_MS, signal) {
     await abortable(lookup3(host), signal);
   } catch (e) {
     if (signal?.aborted) throw signal.reason;
-    return NO_NAME.has(codeOf7(e) ?? "") ? "EAI_NONAME" : void 0;
+    return NO_NAME.has(codeOf9(e) ?? "") ? "EAI_NONAME" : void 0;
   }
   const code = await probe(secure2, host, port, ms, signal);
   signal?.throwIfAborted();
@@ -28655,7 +29008,7 @@ function diagnosing(transport, check = byDefault) {
       try {
         return await open(request);
       } catch (e) {
-        if (request.signal.aborted || !(e instanceof Error) || codeOf7(e)) throw e;
+        if (request.signal.aborted || !(e instanceof Error) || codeOf9(e)) throw e;
         const code = await abortable(
           check(request.url, request.signal).catch(() => void 0),
           request.signal