@ai-ecoverse/slicc-kernel 1.136.3 → 1.136.5

package/README.md

@@ -225,7 +225,7 @@ A WASI preview1 or WASIX program (Zig, Rust, Go, wasi-libc or wasix-libc C) has
 { "slicc": { "abi": "wasi", "commands": { "rg": { "wasm": "bin/rg.wasm" }, "rustc": { "script": "bin/rustc" } } } }
 ```
 
-A command's name is any single path component without whitespace or control characters, so coreutils' `[` is in `/usr/bin` too; a name that is empty, `.` or `..`, or has a `/`, a space, a tab, a newline, NUL or another control character is skipped. Entries may also set `argv0`, `args` and `env`, and a package can set `slicc.env` for all of its commands. A WASI entry with `"preopenRoot": true` also gets `/` as a preopen (see [WASI programs](#wasi-programs)). An entry with `"argv0Path": true` gets the absolute path it was run by as `argv[0]` when that path is a link outside `/bin` and `/usr/bin` to the command, as a venv's `bin/python` is (the `#!` line of a script naming such a link included), so it can find what sits beside that link; other entries keep their `argv0`. In `env`, `${package}` is the package directory, `${cwd}` the process's working directory, and `${NAME}` the caller's `NAME` when the program starts (a default naming an unset variable is left out); a relative path that exists in the package (`lib/python3.14`, `./`) becomes that absolute path. The caller's environment wins over these defaults; a `null` value removes the variable for the command, after the caller's environment is applied (a host-networked program can drop the kernel's proxy settings that way), and a command entry can set a variable its package's `slicc.env` removes. The catalog reads its roots in order, and the first root that provides a name wins it: a user's own global packages (for that user's processes), `/node_modules`, root's global packages, then each appended root. Within a root, packages are read by name and the first wins (compared as strings by UTF-16 code unit, so a scoped `@scope/name` comes before names that start with a letter, but after those that start with a digit), whatever order the file system lists them in; a `PNPM_HOME`'s install groups count as one root, read group by group (by the group directory's name, effectively arbitrary for pnpm's hashed names), each by package name. A variant can take over from the package it extends with `"slicc": { "replaces": ["@ai-ecoverse/wasm-imagemagick"] }`: when it and a package it names are in the same root, it wins every command name they share, whatever the order; names only the other provides stay the other's, a third package that provides the name and sorts first still wins it, and packages that replace each other fall back to the name order. A replace never reaches into an earlier root, so root's global packages can't take a name from `/node_modules` or a user's own packages. The field must be an array of package names; anything else is ignored. `sh` runs bash as `sh` unless a package provides its own. A package's `engines.slicc-kernel` is a floor the kernel holds it to: when the running kernel's version doesn't satisfy that npm range (comparators, `^`, `~`, x-ranges, hyphen ranges, `||`), or the range can't be read, its commands are refused. They stay in `/usr/bin`, and running one by name, by path or as a `#!` interpreter exits 126 with `<cmd>: <pkg>@<version> needs slicc-kernel <range>; this kernel is <version>` on stderr. Each refused package is logged once to the console. A non-string `engines.slicc-kernel`, or none, is no constraint. A development build reports the newest release tag as `<tag>+dev` and checks against that; a build of unknown version (`0.0.0`) checks nothing. Only commands are refused: a package without commands (a `py-*` library, a side module) isn't, and a refused package that replaces base commands makes those commands fail with 126 rather than fall back to the package it replaces. The installed commands appear as executables in a virtual `/usr/bin` and `/bin`, so `PATH` lookups, `command -v` and `ls /usr/bin` work without writing anything to OPFS. An entry reads as its program, as a PATH search that opens what it finds expects (`ruby -S rake`, `perl -S`, Pod::Usage looking itself up, bundler checking that `/usr/bin/ruby` isn't empty). A script command reads as its script, a JS command as its module, and a WASI or Emscripten command as its `.wasm`, so `cat /usr/bin/hello` prints the script and `head -c4 /usr/bin/cat` gives `\0asm`. The entry is a plain file and no link: it stays a root-owned `0755` regular file with its own inode, `readlink` of it is `EINVAL`, and `which` and `command -v` print `/usr/bin/<name>`. Its size and times are the program's when the caller may read the program (anyone, for a kernel-internal look or with users off, only when everyone may), and 0 and the epoch otherwise. Running it still runs the catalog command, with its `env`, `args` and `argv0`. The read is the caller's: with users on, reading an entry also needs `r` on its program, and that includes a user's own commands in `~/.local/share/pnpm/bin`, so an entry whose program the caller can't read is `EACCES`. A process can also run a program by the path of its glue when the `.wasm` sits next to it, a wasm module by its own path (as a WASI program; when it is the `wasm` of a WASI command in the caller's catalog, the user's own packages included, it runs as that command, with its `env` defaults, `args` and `argv0`, the command whose name matches the file's, without `.wasm`, if several share it, while a copy elsewhere runs bare), and a script through its `#!` line (including `#!/usr/bin/env name`). Executing any other file fails with `ENOEXEC`, so bash runs it as a shell script, as POSIX shells do. A spawn by a bare name (no `/`) that the catalog doesn't have, and that didn't ask for no search (a WASIX `posix_spawn` or `execve`, as opposed to its `posix_spawnp`/`execvp`, keeps its bare name), searches the `PATH` of the spawn's own environment, in order, with an empty entry meaning the working directory; each candidate is run exactly as a spawn of that path would be. The first that runs wins; if one was found but refused and nothing else matched, the spawn fails with `EACCES` (126), otherwise `ENOENT` (127). A catalog command still wins over the same name on `PATH`, the reverse of a shell's order. A searched bare name is never looked up in the working directory itself: a file of that name there runs only through an empty `PATH` entry, as with `execvp` ([#1234](https://github.com/ai-ecoverse/slicc-kernel/issues/1234)). The `PATH` searched is the new process's, from the spawn's environment; POSIX `posix_spawnp` uses the caller's, which is the same unless the caller hands the child another one. This is a stopgap for the Emscripten shim's `posix_spawnp`, which hands the kernel the bare name (`timeout 5 myscript`, [#1165](https://github.com/ai-ecoverse/slicc-kernel/issues/1165)); it goes once the shipped packages search `PATH` themselves ([#1168](https://github.com/ai-ecoverse/slicc-kernel/issues/1168)). A `..` in a path that is run is resolved physically, as the file system resolves it: `pkg/../tools/x` after a symlinked `pkg` is the `tools/x` beside the link's target, and its exec permission is checked there. The walk is the caller's: with users on, each directory it passes needs search (`x`) permission (`EACCES`, 126 in bash, as on Linux), and a sudo process follows only the links it trusts, as for any other path. Commands also come from pnpm's global directory. Every process gets a `PNPM_HOME` and has `$PNPM_HOME/bin` on `PATH`: root's is `/usr/local/share/pnpm` (unless the embedder sets its own), a user's `~/.local/share/pnpm` (see [Users](#users)). The kernel scans each of pnpm's global install groups (`$PNPM_HOME/global/*/<group>/node_modules`) after `/node_modules`, which wins when both provide a command. The catalog is re-read whenever anything under either changes, so `pnpm add -g @ai-ecoverse/wasi-ripgrep` makes `rg` work in the same shell, and `pnpm remove -g` removes it again.
+A command's name is any single path component without whitespace or control characters, so coreutils' `[` is in `/usr/bin` too; a name that is empty, `.` or `..`, or has a `/`, a space, a tab, a newline, NUL or another control character is skipped. Entries may also set `argv0`, `args` and `env`, and a package can set `slicc.env` for all of its commands. A WASI entry with `"preopenRoot": true` also gets `/` as a preopen (see [WASI programs](#wasi-programs)). An entry with `"argv0Path": true` gets the absolute path it was run by as `argv[0]` when that path is a link outside `/bin` and `/usr/bin` to the command, as a venv's `bin/python` is (the `#!` line of a script naming such a link included), so it can find what sits beside that link; other entries keep their `argv0`. In `env`, `${package}` is the package directory, `${cwd}` the process's working directory, and `${NAME}` the caller's `NAME` when the program starts (a default naming an unset variable is left out); a relative path that exists in the package (`lib/python3.14`, `./`) becomes that absolute path. The caller's environment wins over these defaults; a `null` value removes the variable for the command, after the caller's environment is applied (a host-networked program can drop the kernel's proxy settings that way), and a command entry can set a variable its package's `slicc.env` removes. The catalog reads its roots in order, and the first root that provides a name wins it: a user's own global packages (for that user's processes), `/node_modules`, root's global packages, then each appended root. Within a root, packages are read by name and the first wins (compared as strings by UTF-16 code unit, so a scoped `@scope/name` comes before names that start with a letter, but after those that start with a digit), whatever order the file system lists them in; a `PNPM_HOME`'s install groups count as one root, read group by group (by the group directory's name, effectively arbitrary for pnpm's hashed names), each by package name. A variant can take over from the package it extends with `"slicc": { "replaces": ["@ai-ecoverse/wasm-imagemagick"] }`: when it and a package it names are in the same root, it wins every command name they share, whatever the order; names only the other provides stay the other's, a third package that provides the name and sorts first still wins it, and packages that replace each other fall back to the name order. A replace never reaches into an earlier root, so root's global packages can't take a name from `/node_modules` or a user's own packages. The field must be an array of package names; anything else is ignored. `sh` runs bash as `sh` unless a package provides its own. A package's `engines.slicc-kernel` is a floor the kernel holds it to: when the running kernel's version doesn't satisfy that npm range (comparators, `^`, `~`, x-ranges, hyphen ranges, `||`), or the range can't be read, its commands are refused. They stay in `/usr/bin`, and running one by name, by path or as a `#!` interpreter exits 126 with `<cmd>: <pkg>@<version> needs slicc-kernel <range>; this kernel is <version>` on stderr. Each refused package is logged once to the console. A non-string `engines.slicc-kernel`, or none, is no constraint. A development build reports the newest release tag as `<tag>+dev` and checks against that; a build of unknown version (`0.0.0`) checks nothing. The refusal follows the program, not the name: its glue or `.wasm` run by path (directly or through a symlink), and a byte-identical copy of its glue beside it named for one of its commands (#390, #899), exit 126 with the same message ([#1235](https://github.com/ai-ecoverse/slicc-kernel/issues/1235)). Only commands are refused: a package without commands (a `py-*` library, a side module) isn't, and a refused package that replaces base commands makes those commands fail with 126 rather than fall back to the package it replaces. The installed commands appear as executables in a virtual `/usr/bin` and `/bin`, so `PATH` lookups, `command -v` and `ls /usr/bin` work without writing anything to OPFS. An entry reads as its program, as a PATH search that opens what it finds expects (`ruby -S rake`, `perl -S`, Pod::Usage looking itself up, bundler checking that `/usr/bin/ruby` isn't empty). A script command reads as its script, a JS command as its module, and a WASI or Emscripten command as its `.wasm`, so `cat /usr/bin/hello` prints the script and `head -c4 /usr/bin/cat` gives `\0asm`. The entry is a plain file and no link: it stays a root-owned `0755` regular file with its own inode, `readlink` of it is `EINVAL`, and `which` and `command -v` print `/usr/bin/<name>`. Its size and times are the program's when the caller may read the program (anyone, for a kernel-internal look or with users off, only when everyone may), and 0 and the epoch otherwise. Running it still runs the catalog command, with its `env`, `args` and `argv0`. The read is the caller's: with users on, reading an entry also needs `r` on its program, and that includes a user's own commands in `~/.local/share/pnpm/bin`, so an entry whose program the caller can't read is `EACCES`. A process can also run a program by the path of its glue when the `.wasm` sits next to it, a wasm module by its own path (as a WASI program; when it is the `wasm` of a WASI command in the caller's catalog, the user's own packages included, it runs as that command, with its `env` defaults, `args` and `argv0`, the command whose name matches the file's, without `.wasm`, if several share it, while a copy elsewhere runs bare), and a script through its `#!` line (including `#!/usr/bin/env name`). Executing any other file fails with `ENOEXEC`, so bash runs it as a shell script, as POSIX shells do. A spawn by a bare name (no `/`) that the catalog doesn't have, and that didn't ask for no search (a WASIX `posix_spawn` or `execve`, as opposed to its `posix_spawnp`/`execvp`, keeps its bare name), searches the `PATH` of the spawn's own environment, in order, with an empty entry meaning the working directory; each candidate is run exactly as a spawn of that path would be. The first that runs wins; if one was found but refused and nothing else matched, the spawn fails with `EACCES` (126), otherwise `ENOENT` (127). A catalog command still wins over the same name on `PATH`, the reverse of a shell's order. A searched bare name is never looked up in the working directory itself: a file of that name there runs only through an empty `PATH` entry, as with `execvp` ([#1234](https://github.com/ai-ecoverse/slicc-kernel/issues/1234)). The `PATH` searched is the new process's, from the spawn's environment; POSIX `posix_spawnp` uses the caller's, which is the same unless the caller hands the child another one. This is a stopgap for the Emscripten shim's `posix_spawnp`, which hands the kernel the bare name (`timeout 5 myscript`, [#1165](https://github.com/ai-ecoverse/slicc-kernel/issues/1165)); it goes once the shipped packages search `PATH` themselves ([#1168](https://github.com/ai-ecoverse/slicc-kernel/issues/1168)). A `..` in a path that is run is resolved physically, as the file system resolves it: `pkg/../tools/x` after a symlinked `pkg` is the `tools/x` beside the link's target, and its exec permission is checked there. The walk is the caller's: with users on, each directory it passes needs search (`x`) permission (`EACCES`, 126 in bash, as on Linux), and a sudo process follows only the links it trusts, as for any other path. Commands also come from pnpm's global directory. Every process gets a `PNPM_HOME` and has `$PNPM_HOME/bin` on `PATH`: root's is `/usr/local/share/pnpm` (unless the embedder sets its own), a user's `~/.local/share/pnpm` (see [Users](#users)). The kernel scans each of pnpm's global install groups (`$PNPM_HOME/global/*/<group>/node_modules`) after `/node_modules`, which wins when both provide a command. The catalog is re-read whenever anything under either changes, so `pnpm add -g @ai-ecoverse/wasi-ripgrep` makes `rg` work in the same shell, and `pnpm remove -g` removes it again.
 
 **More roots:** `createKernel({ commands: { append: ['/opt/user/node_modules'] } })` (and `createNodeKernel`) scans more directories, each absolute and normalised (anything else throws a `TypeError`). A name is looked up in a user's own global packages first, then in `modules`, then in root's global packages, then in the appended roots in the order given, and the first match wins, so an appended root never shadows another command (or `sudo`). Their commands are in `/usr/bin` for every user, like root's global packages, and their `binfmt` and file system entries count too. A package in an appended root also gets a command for each `bin` entry of its `package.json` (a string `bin` is named after the package, without its scope), which runs as a `#!` script; a name its `slicc.commands` gives wins. A `bin` entry is skipped when its name isn't a command name (see above), or its file, with symlinks resolved, isn't a regular file inside the package. `/node_modules` and the global packages keep reading only `slicc.commands`. A missing root counts as empty until it appears, and an install or removal in a root is picked up as it happens. With `users: 'enforce'` a root counts only when it and every directory above it are root's and not writable by group or others; another root is skipped without a word. Under `'report'` such a root is still scanned, and reported once to `onDenial` and the report log as `{ pid: 0, uid: 0, op: 'commands', path, errno: 'EACCES' }`. Running a `bin` command needs `r` and `x` on its file under `users` (see [Permissions](#permissions)), checked when it runs, so a `0644` file is `EACCES` under `'enforce'`.
 
@@ -505,10 +505,20 @@ The module's default export (or its `main` export) is called with a context and
         - `AUTH LOGIN`: the password line (the second line, or the first after `AUTH LOGIN <user>`) is decoded, substituted (`auth-login`) and re-encoded; the user line goes out as written.
         - Every other line goes out as written. After the first `AUTH`, or once `MAIL`, `RCPT`, `DATA` or `BDAT` is seen, so is the rest of the session. A line still unfinished after 2 s, or longer than 4 KiB, is sent as written, and so is the rest.
       - **pg:** a session that starts with a protocol 3 `StartupMessage` (after `sslmode`'s `SSLRequest` upgrade, or with direct TLS) is followed message by message. The only position is the **`PasswordMessage` answering `AuthenticationCleartextPassword` (`R` 3)**, as the program read it from the server. The password is substituted (`password-cleartext`) and the message is framed again. **SCRAM-SHA-256** (`R` 10, the pg 14+ default) works with an unmodified client:
-        - **What the server is offered:** in a session that can substitute, the kernel offers the program only `SCRAM-SHA-256`, never `-PLUS`. The program's client computes its proof from the placeholder. Dropping `-PLUS` costs nothing here: the kernel terminates and verifies the TLS itself, so channel binding would only bind to the kernel's own session. A client that **requires** channel binding (libpq's `channel_binding=require`) refuses the connection and never gets the value, so leave it at `prefer` or `disable` for sealed SCRAM.
+        - **What the program is offered:** the server's mechanisms. `SCRAM-SHA-256-PLUS` is offered only when the kernel can bind to the server: a verified session whose leaf certificate's signature hash is SHA-256, SHA-384 or SHA-512, with MD5 and SHA-1 counting as SHA-256 (RFC 5929 §4.1). With any other hash (RSA-PSS or Ed25519, say), `-PLUS` is dropped. So libpq's default `channel_binding=prefer`, `require`, and node-postgres' `enableChannelBinding` all work.
+        - **Channel binding (`tls-server-end-point`):** the kernel changes only what the server would refuse.
+          - `n,,` goes out as written.
+          - `y,,` goes out as written to a server that didn't offer `-PLUS`. Otherwise it becomes `SCRAM-SHA-256-PLUS` with `p=tls-server-end-point,,` (or `n,,` when the kernel can't bind), because pg refuses `y,,` from a client after offering `-PLUS`.
+          - `p=tls-server-end-point,,` keeps its header. Its `c=` binding data becomes the hash of the leaf the kernel verified, when the program's differs.
+          - Any other `p=` type is changed to the kernel's choice.
+
+          So a program that asks for binding is bound to the real server. A program using its own password in such a session still authenticates whenever nothing had to change: `n,,`, `y,,` without `-PLUS`, or a right `p=`.
+        - **The vault:** substitution with `-PLUS` (a program's `p=tls-server-end-point`) needs slicc-vault ≥ 1.15.1. An older vault refuses `p=` with `EINVAL` and fails closed. A program's `p=tls-unique` or `p=tls-exporter` fails in a substituting session either way: the vault refuses it with a placeholder (`EINVAL`), and with the program's own password, the kernel's rewrite to `tls-server-end-point` invalidates its proof. PostgreSQL supports only `tls-server-end-point` anyway.
+        - **Two auth messages:** the vault and the check against the placeholder see the program's own messages (P). The server sees the kernel's (S), with its header and `c=`. The real proof is computed over S, and the server's signature is verified over S before the program gets the placeholder's signature over P.
         - **The match:** the kernel sends the three SCRAM messages and that proof to the vault (`scram-sha-256`, with no placeholders), and the vault names the one bound placeholder whose proof matches.
         - **The exchange:** the kernel recomputes the proof from the value and sends that instead. It checks the server's final signature against the value **before** it hands the program the signature its own placeholder-based check expects. A server whose signature doesn't verify, or that answers with an error, ends the session (`EPROTO`) without passing it on. The salted password and the derived keys are wiped after the exchange.
-        - **Requirements:** only the plain GS2 header (`n,,`) and the bare RFC 5802 messages; at most 100000 iterations.
+        - **Requirements:** a GS2 header without an authorization identity (`n,,`, `y,,` or `p=<type>,,`), whose `c=` starts with it, and the bare RFC 5802 messages; at most 100000 iterations.
+        - **A stale vault value:** on a verified session, a value the server no longer accepts makes its final signature fail to verify. The program sees `EPROTO`, not pg's `28P01`. This is by design: the kernel never passes on a signature it couldn't check.
 
         Anything else goes out as written: the startup, an MD5 (`R` 5) answer, every later message, and a frame over 16 KiB. A server whose `pg_hba` asks for MD5 gets the placeholder, and refuses.
       - **Vault anchors** (§3.19.6) are for private-CA services such as managed pg and corporate APIs.
@@ -1266,6 +1276,16 @@ Not part of the run yet: the rest of bios's setup (the `rest` shard, the upgrade
 
 The WASIX fixtures of `test/integration/epoll.test.mjs` (#674), under `test/integration/fixtures/`, are committed with their sources, build scripts and built wasm.
 
+### `pg-fixture` with `plus`
+
+`test/integration/pg-fixture.mjs`, `pgFixture(t, cert, password, { plus: true })`: pg-gateway's SCRAM-SHA-256 server, which offers `SCRAM-SHA-256-PLUS` too and refuses as PostgreSQL's `auth-scram.c` does (jsh#531):
+- `y,,` after it offered `-PLUS`: "SCRAM channel binding negotiation error";
+- `p=` with `SCRAM-SHA-256`, and `SCRAM-SHA-256-PLUS` without `p=`;
+- a channel-binding type other than `tls-server-end-point`;
+- a `c=` other than base64 of the GS2 header plus, for `-PLUS`, the SHA-256 of its leaf.
+
+The refusals and the client-final messages are recorded in `seen.plus`. The real-server check is slicc-jsh's, against PostgreSQL over SSL.
+
 ### `heldcwd`
 
 `test/integration/fixtures/heldcwd`: a Rust wasm32-wasip1 program, built by `build.sh` with rustup's wasm32-wasip1 target, for the [working directory](#the-working-directory) rows (#1164).

package/dist/kernel-worker.js

@@ -7098,7 +7098,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.136.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.136.5" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -18560,6 +18560,66 @@ async function anchorFor(engine, chain2, host, found) {
   return void 0;
 }
 
+// src/kernel/net/sealed-binding.ts
+var HASH_OF_SIGNATURE = {
+  "1.2.840.113549.1.1.4": "SHA-256",
+  "1.2.840.113549.1.1.5": "SHA-256",
+  "1.2.840.10045.4.1": "SHA-256",
+  "1.2.840.10040.4.3": "SHA-256",
+  "1.2.840.113549.1.1.11": "SHA-256",
+  "1.2.840.10045.4.3.2": "SHA-256",
+  "1.2.840.113549.1.1.12": "SHA-384",
+  "1.2.840.10045.4.3.3": "SHA-384",
+  "1.2.840.113549.1.1.13": "SHA-512",
+  "1.2.840.10045.4.3.4": "SHA-512"
+};
+function tlv3(der2, at) {
+  const tag = der2[at];
+  let len = der2[at + 1];
+  if (tag === void 0 || len === void 0) return void 0;
+  let start2 = at + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 4) return void 0;
+    len = 0;
+    for (let i = 0; i < n; i++) len = len * 256 + (der2[start2 + i] ?? 0);
+    start2 += n;
+  }
+  const end = start2 + len;
+  return end <= der2.length ? { tag, start: start2, end } : void 0;
+}
+function oidText(bytes) {
+  const first = bytes[0] ?? 0;
+  const parts2 = [Math.floor(first / 40), first % 40];
+  let value2 = 0;
+  for (const b of bytes.subarray(1)) {
+    value2 = value2 * 128 + (b & 127);
+    if ((b & 128) === 0) {
+      parts2.push(value2);
+      value2 = 0;
+    }
+  }
+  return parts2.join(".");
+}
+function signatureOid(cert) {
+  const outer = tlv3(cert, 0);
+  if (outer?.tag !== 48) return void 0;
+  const tbs = tlv3(cert, outer.start);
+  if (tbs?.tag !== 48) return void 0;
+  const algorithm = tlv3(cert, tbs.end);
+  if (algorithm?.tag !== 48) return void 0;
+  const oid2 = tlv3(cert, algorithm.start);
+  if (oid2?.tag !== 6) return void 0;
+  return oidText(cert.subarray(oid2.start, oid2.end));
+}
+async function endPointBinding(cert) {
+  if (!cert) return void 0;
+  const oid2 = signatureOid(cert);
+  const hash = oid2 === void 0 ? void 0 : HASH_OF_SIGNATURE[oid2];
+  if (!hash) return void 0;
+  return new Uint8Array(await crypto.subtle.digest(hash, cert));
+}
+
 // node_modules/@ai-ecoverse/slicc-scrub/dist/index.js
 var FRAGMENT = 16;
 var MIN_VALUE = 8;
@@ -19295,25 +19355,35 @@ function base64Of(bytes) {
   for (const b of bytes) bin += String.fromCharCode(b);
   return btoa(bin);
 }
-function clientFirstBare(message3) {
-  const m = /^n,,(n=[^,]*,r=[^,]+)$/.exec(message3);
-  return m ? m[1] : void 0;
+function clientFirstOf(message3) {
+  const m = /^((?:n|y|p=[A-Za-z0-9.-]+),,)(n=[^,]*,r=[^,]+)$/.exec(message3);
+  return m ? { header: m[1], bare: m[2] } : void 0;
+}
+var latinBytes = (text) => Uint8Array.from(text, (c) => c.charCodeAt(0));
+function channelOf(header3, binding) {
+  const head = latinBytes(header3);
+  const all = new Uint8Array(head.length + (binding?.length ?? 0));
+  all.set(head);
+  if (binding) all.set(binding, head.length);
+  return base64Of(all);
 }
 var SERVER_FIRST = /^r=([^,]+),s=([^,]+),i=(\d{1,6})$/;
-var CLIENT_FINAL = /^(c=biws,r=([^,]+)),p=([^,]+)$/;
+var CLIENT_FINAL = /^(c=([A-Za-z0-9+/]+={0,2}),r=([^,]+)),p=([^,]+)$/;
 var SCRAM_MAX = 1024;
 function exchangeOf(clientFirst, serverFirst, clientFinal) {
-  const bare = clientFirstBare(clientFirst);
+  const first = clientFirstOf(clientFirst);
+  const bare = first?.bare;
   const sf = SERVER_FIRST.exec(serverFirst);
   const fin = CLIENT_FINAL.exec(clientFinal);
   if (!bare || !sf || !fin || [bare, serverFirst, clientFinal].some((t) => t.length > SCRAM_MAX))
     return void 0;
+  const channel = base64Bytes(fin[2]);
   const cnonce = bare.slice(bare.indexOf(",r=") + 3);
   const nonce = sf[1];
   const salt = base64Bytes(sf[2]);
   const iterations = Number(sf[3]);
-  const proof = base64Bytes(fin[3]);
-  const ok4 = fin[2] === nonce && nonce.startsWith(cnonce) && iterations >= 1 && iterations <= 1e5 && salt !== void 0 && proof?.length === 32;
+  const proof = base64Bytes(fin[4]);
+  const ok4 = channel !== void 0 && latin(channel).startsWith(first.header) && fin[3] === nonce && nonce.startsWith(cnonce) && iterations >= 1 && iterations <= 1e5 && salt !== void 0 && proof?.length === 32;
   if (!ok4) return void 0;
   return {
     exchange: {
@@ -19323,9 +19393,16 @@ function exchangeOf(clientFirst, serverFirst, clientFinal) {
       salt,
       iterations
     },
-    proof
+    proof,
+    channel,
+    nonce
   };
 }
+function latin(bytes) {
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
 async function hmac(key, data) {
   const k = await crypto.subtle.importKey(
     "raw",
@@ -19392,16 +19469,23 @@ function sniffPg(start2) {
   const length2 = int32(bytes, 0);
   return length2 >= 8 && length2 <= PG_MESSAGE_MAX && int32(bytes, 4) === PROTOCOL_3 ? "yes" : "no";
 }
+var PLAIN = "SCRAM-SHA-256";
 var PLUS = "SCRAM-SHA-256-PLUS";
+var END_POINT = "p=tls-server-end-point,,";
 var SASL = 10;
 var SASL_CONTINUE = 11;
 var SASL_FINAL = 12;
-function latin(bytes) {
+function latin2(bytes) {
   let out = "";
   for (const b of bytes) out += String.fromCharCode(b);
   return out;
 }
 var PgServer = class {
+  binding;
+  plus = false;
+  constructor(binding) {
+    this.binding = binding;
+  }
   buffer = new Uint8Array(0);
   skip = 0;
   cleartext = false;
@@ -19415,20 +19499,22 @@ var PgServer = class {
     if (this.expect && code !== SASL_FINAL) this.failed = true;
     this.cleartext = message3.length === 9 && code === CLEARTEXT;
     if (code === SASL) return this.mechanisms(message3);
-    else if (code === SASL_CONTINUE) this.serverFirst = latin(message3.subarray(9));
+    else if (code === SASL_CONTINUE) this.serverFirst = latin2(message3.subarray(9));
     else if (code === SASL_FINAL) this.final(message3);
     return message3;
   }
   mechanisms(message3) {
     this.sasl = true;
-    const names2 = latin(message3.subarray(9)).split("\0").filter((n) => n !== "" && n !== PLUS);
-    return frame3(82, `${latin(message3.subarray(5, 9))}${names2.map((n) => `${n}\0`).join("")}\0`);
+    const offered = latin2(message3.subarray(9)).split("\0").filter((n) => n !== "");
+    this.plus = offered.includes(PLUS);
+    const names2 = offered.filter((n) => n !== PLUS || this.binding !== void 0);
+    return frame3(82, `${latin2(message3.subarray(5, 9))}${names2.map((n) => `${n}\0`).join("")}\0`);
   }
   final(message3) {
     const expect = this.expect;
     if (!expect) return;
     this.expect = void 0;
-    const data = latin(message3.subarray(9));
+    const data = latin2(message3.subarray(9));
     if (data !== expect.real || expect.fake.length !== expect.real.length) {
       this.failed = true;
       return;
@@ -19503,9 +19589,9 @@ function pgLength(bytes, started) {
   const length2 = int32(bytes, started ? 1 : 0);
   return started ? 1 + length2 : length2;
 }
-var MECHANISMS = /* @__PURE__ */ new Set(["SCRAM-SHA-256"]);
+var MECHANISMS = /* @__PURE__ */ new Set([PLAIN, PLUS]);
 async function cleartext(message3, asks) {
-  const body = latin(message3.subarray(5));
+  const body = latin2(message3.subarray(5));
   if (!body.endsWith("\0") || body.indexOf("\0") !== body.length - 1)
     return { bytes: message3, done: true };
   const password = body.slice(0, -1);
@@ -19517,14 +19603,30 @@ async function cleartext(message3, asks) {
   return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
 }
 function initial(message3) {
-  const body = latin(message3.subarray(5));
+  const body = latin2(message3.subarray(5));
   const nul = body.indexOf("\0");
-  if (nul < 0 || !MECHANISMS.has(body.slice(0, nul)) || body.length < nul + 5) return void 0;
+  const mechanism = body.slice(0, nul);
+  if (nul < 0 || !MECHANISMS.has(mechanism) || body.length < nul + 5) return void 0;
   const data = message3.subarray(5 + nul + 5);
-  return int32(message3, 5 + nul + 1) === data.length ? latin(data) : void 0;
+  return int32(message3, 5 + nul + 1) === data.length ? { mechanism, data: latin2(data) } : void 0;
+}
+function int32Text(n) {
+  return String.fromCharCode(n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255);
+}
+function serverHeader(header3, server) {
+  if (header3 === "n,,") return header3;
+  if (header3 === "y,," && !server.plus) return header3;
+  if (header3 === END_POINT && server.binding) return header3;
+  return server.plus && server.binding ? END_POINT : "n,,";
+}
+function rewritten(first, header3) {
+  const parsed2 = clientFirstOf(first.data);
+  if (!parsed2 || parsed2.header === header3) return first;
+  return { mechanism: header3 === END_POINT ? PLUS : PLAIN, data: `${header3}${parsed2.bare}` };
 }
 var PgClient = class {
   clientFirst;
+  header = "n,,";
   server;
   asks;
   constructor(server, asks) {
@@ -19539,17 +19641,28 @@ var PgClient = class {
       return cleartext(message3, this.asks);
     }
     if (server.sasl && this.clientFirst === void 0) {
-      this.clientFirst = initial(message3);
-      return { bytes: message3, done: this.clientFirst === void 0 };
+      const first = initial(message3);
+      const parsed2 = first && clientFirstOf(first.data);
+      if (!first || !parsed2) return { bytes: message3, done: true };
+      this.clientFirst = first.data;
+      this.header = serverHeader(parsed2.header, server);
+      const sent = rewritten(first, this.header);
+      if (sent === first) return { bytes: message3, done: false };
+      return {
+        bytes: frame3(112, `${sent.mechanism}\0${int32Text(sent.data.length)}${sent.data}`),
+        done: false
+      };
     }
     if (this.clientFirst !== void 0 && server.serverFirst !== void 0)
       return this.final(message3, this.clientFirst, server.serverFirst);
     return { bytes: message3, done: true };
   }
   async final(message3, first, serverFirst) {
-    const got = exchangeOf(first, serverFirst, latin(message3.subarray(5)));
+    const got = exchangeOf(first, serverFirst, latin2(message3.subarray(5)));
     if (!got) return { bytes: message3, done: true };
     const x = got.exchange;
+    const binding = this.header === END_POINT ? this.server.binding : void 0;
+    const serverFinal = `c=${channelOf(this.header, binding)},r=${got.nonce}`;
     const values = usable(
       await this.asks.scram({
         clientFirstBare: x.clientFirstBare,
@@ -19559,16 +19672,19 @@ var PgClient = class {
       })
     );
     const [entry, ...more] = Object.entries(values);
-    if (!entry || more.length > 0) return { bytes: message3, done: true };
+    const own = { bytes: frame3(112, `${serverFinal},p=${base64Of(got.proof)}`), done: true };
+    if (!entry || more.length > 0)
+      return serverFinal === x.clientFinalBare ? { bytes: message3, done: true } : own;
     const [placeholder, value2] = entry;
     const fake = await scramKeys(placeholder, x);
-    if (!sameBytes(fake.proof, got.proof)) return { bytes: message3, done: true };
-    const real = await scramKeys(saslprep(value2), x);
+    if (!sameBytes(fake.proof, got.proof))
+      return serverFinal === x.clientFinalBare ? { bytes: message3, done: true } : own;
+    const real = await scramKeys(saslprep(value2), { ...x, clientFinalBare: serverFinal });
     this.server.expect = {
       real: `v=${base64Of(real.serverSignature)}`,
       fake: `v=${base64Of(fake.serverSignature)}`
     };
-    const bytes = frame3(112, `${x.clientFinalBare},p=${base64Of(real.proof)}`);
+    const bytes = frame3(112, `${serverFinal},p=${base64Of(real.proof)}`);
     for (const k of [real.proof, real.serverSignature, fake.proof, fake.serverSignature]) k.fill(0);
     return { bytes, values, done: true };
   }
@@ -19967,7 +20083,7 @@ function idle() {
   return new Promise((resolve2) => setTimeout(() => resolve2(IDLE2), SCRUB_IDLE_MS));
 }
 function sealedConn(conn, s) {
-  const pg = new PgServer();
+  const pg = new PgServer(s.binding);
   const scope = s.broker.sessions.scope(s.pid, s.host);
   const writer = substitutes(s) ? new SessionWriter(conn, s, pg, scope) : void 0;
   const observed = {
@@ -20258,6 +20374,8 @@ function secure(prepared, seal) {
       const session = sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
       if (!session) return made2;
       made2.info.substitutes = substitutes(session);
+      if (made2.info.substitutes && session.verified)
+        session.binding = await endPointBinding(made2.info.peerCertificates[0]);
       return { conn: sealedConn(made2.conn, session), info: made2.info };
     } finally {
       prepared.own?.release();
@@ -26718,7 +26836,8 @@ function refusing(command) {
     argv0: command.name,
     args: [`${command.name}: ${command.refused}`],
     refused: command.refused,
-    shows: command.script ?? command.wasm
+    shows: command.script ?? command.wasm,
+    origin: { abi: command.abi, glue: command.glue, wasm: command.wasm }
   };
 }
 
@@ -26734,7 +26853,7 @@ var RULE = new RegExp(
   String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?(?:Cwd\s+(${WORD})\s+)?Cmnd(?:\s+(.*))?$`
 );
 var TERM = /^[A-Za-z0-9._+-]+$/;
-var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
+var PLAIN2 = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
 function failed2(errno3, error) {
   return { error, errno: errno3 };
@@ -26761,7 +26880,7 @@ function splitWords(text) {
   return words2;
 }
 function quoteWord(word) {
-  return PLAIN.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
+  return PLAIN2.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
 }
 function validWho(who) {
   if (who === "ALL") return true;
@@ -27810,7 +27929,7 @@ var Launcher = class {
       const byPath = !COMMAND2.test(path) && (await this.commands()).get(linked2)?.argv0Path === true;
       return target && byPath ? { ...target, argv0: path } : target;
     }
-    const own = await this.commandAt(glue, scope);
+    const own = await this.ownOrRefused(glue, baseName2(file), scope);
     if (own) return own.script ? void 0 : { ...targetOf(own), ...asked };
     const head = await this.head(glue);
     if (!head) return void 0;
@@ -27834,6 +27953,31 @@ var Launcher = class {
     if (!owner) return void 0;
     return { ...targetOf(owner), ...asked, ...owner.glue === glue ? {} : { copy: glue } };
   }
+  async ownOrRefused(path, name2, scope) {
+    return await this.commandAt(path, scope) ?? await this.refusedAt(path, name2, scope);
+  }
+  async refusedAt(path, name2, scope) {
+    const refused3 = [...(await this.commands(scope)).values()].filter((c) => c.origin);
+    if (refused3.length === 0 || !await this.base.exists(path)) return void 0;
+    const real = await physicalPathAsync(this.base, path).catch(() => path);
+    const at = async (c, which) => {
+      const own = c.origin[which];
+      return own === path || await physicalPathAsync(this.base, own).catch(() => own) === real;
+    };
+    const owners = [];
+    for (const c of refused3) {
+      if (await at(c, "glue") || await at(c, "wasm")) owners.push(c);
+    }
+    if (owners.length > 0) return owners.find((c) => c.name === name2) ?? owners[0];
+    const dir = real.slice(0, real.lastIndexOf("/"));
+    for (const c of refused3) {
+      const origin = c.origin;
+      if (origin.abi !== "emscripten" || c.name !== name2) continue;
+      const own = await physicalPathAsync(this.base, origin.glue).catch(() => origin.glue);
+      if (own.slice(0, own.lastIndexOf("/")) === dir && await this.sameFile(real, own)) return c;
+    }
+    return void 0;
+  }
   async glueOwner(glue, name2, scope) {
     const commands = [...(await this.commands(scope)).values()];
     const owners = commands.filter((c) => c.abi === "emscripten" && !c.script && c.glue === glue);