@ai-ecoverse/slicc-kernel 1.136.8 → 1.137.0

package/dist/kernel-worker.js

@@ -2427,8 +2427,8 @@ var OpfsFs = class {
   renamingDirs = /* @__PURE__ */ new Set();
   intents = 0;
   async intend(rename, at = `${RENAMES}/${crypto.randomUUID()}`) {
-    const record = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
-    await this.meta.update(at, () => ({ path: at, rename: record }));
+    const record2 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
+    await this.meta.update(at, () => ({ path: at, rename: record2 }));
     return at;
   }
   async rollBack(from, to, intents) {
@@ -2939,7 +2939,7 @@ async function rootId(factory, root, locks = globalThis.navigator?.locks) {
       const all = await request(
         db.transaction(ROOTS_STORE, "readonly").objectStore(ROOTS_STORE).getAll()
       );
-      for (const record of all) if (await same(record.handle, root)) return record.id;
+      for (const record2 of all) if (await same(record2.handle, root)) return record2.id;
       const id2 = crypto.randomUUID();
       if (await used(root)) await seed(factory, nameOf(id2));
       const tx = db.transaction(ROOTS_STORE, "readwrite");
@@ -4879,6 +4879,15 @@ function isHostname(name2) {
 function ownNames(hostname) {
   return [.../* @__PURE__ */ new Set([hostname.toLowerCase(), ...LIBC_HOSTNAMES])];
 }
+function hostsFile(hostname = DEFAULT_HOSTNAME) {
+  return [
+    "127.0.0.1 localhost localhost.localdomain",
+    "::1 localhost ip6-localhost",
+    `${HOSTNAME_ADDRESS} ${ownNames(hostname).join(" ")}`,
+    `${HOST_LOOPBACK_ADDRESS.join(".")} ${HOST_LOOPBACK}`,
+    ""
+  ].join("\n");
+}
 
 // src/kernel/net/routes.ts
 var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
@@ -5563,6 +5572,7 @@ var LOCAL_ONLY = new Routes();
 var LoopbackNet = class {
   bound = /* @__PURE__ */ new Map();
   dgrams = /* @__PURE__ */ new Map();
+  dgramServices = /* @__PURE__ */ new Map();
   unixDgrams = /* @__PURE__ */ new Map();
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
@@ -5613,9 +5623,16 @@ var LoopbackNet = class {
   releaseDgram(addr, socket) {
     if (this.dgrams.get(addr.port) === socket) this.dgrams.delete(addr.port);
   }
-  deliverDgram(port, datagram2) {
+  serveDgram(port, serve) {
+    this.dgramServices.set(port, serve);
+  }
+  deliverDgram(port, datagram2, to) {
     const target = this.dgrams.get(port);
-    return target ? target.deliver(datagram2) : false;
+    if (target) return target.deliver(datagram2);
+    const service = this.dgramServices.get(port);
+    if (!service) return false;
+    service(datagram2, to ?? { family: "inet", host: "127.0.0.1", port });
+    return true;
   }
   bindable(addr, kernel) {
     if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
@@ -7098,7 +7115,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.136.8" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.137.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -8616,11 +8633,11 @@ var CronService = class {
     }
     if (this.stopping.signal.aborted) return;
     const exit = ended.signal ? `signal=${ended.signal}` : `exit=${ended.status}`;
-    const header3 = encoder.encode(`--- ${iso} ${exit} missed=${missed} ---
+    const header4 = encoder.encode(`--- ${iso} ${exit} missed=${missed} ---
 `);
     const body = output.bytes();
     const newline = body.length > 0 && body[body.length - 1] !== 10 ? encoder.encode("\n") : new Uint8Array();
-    await this.append(log, concat2([header3, body, newline]), account.uid, account.gid).catch(
+    await this.append(log, concat2([header4, body, newline]), account.uid, account.gid).catch(
       (err) => this.error(messageOf(err))
     );
   }
@@ -9428,8 +9445,8 @@ var FileWatches = class {
   live = /* @__PURE__ */ new Set();
   local;
   remote;
-  constructor(local, remote) {
-    this.local = local;
+  constructor(local2, remote) {
+    this.local = local2;
     this.remote = remote;
   }
   announce() {
@@ -13149,18 +13166,18 @@ var SAB_I_ASYNC = 14;
 var SAB_I_STOP = 15;
 var SAB_I_BLOCKED = 16;
 var SAB_I_BLOCKED_HI = 17;
-function loadBlocked(header3) {
-  return [Atomics.load(header3, SAB_I_BLOCKED), Atomics.load(header3, SAB_I_BLOCKED_HI)];
+function loadBlocked(header4) {
+  return [Atomics.load(header4, SAB_I_BLOCKED), Atomics.load(header4, SAB_I_BLOCKED_HI)];
 }
-function storeBlocked(header3, [low, high]) {
-  Atomics.store(header3, SAB_I_BLOCKED_HI, high);
-  Atomics.store(header3, SAB_I_BLOCKED, low);
+function storeBlocked(header4, [low, high]) {
+  Atomics.store(header4, SAB_I_BLOCKED_HI, high);
+  Atomics.store(header4, SAB_I_BLOCKED, low);
 }
 var anyBlocked = (mask) => mask !== void 0 && (mask[0] !== 0 || mask[1] !== 0);
 var U32 = 2 ** 32;
-function storeU53(header3, lo, hi, value2) {
-  Atomics.store(header3, hi, Math.floor(value2 / U32));
-  Atomics.store(header3, lo, value2 % U32 | 0);
+function storeU53(header4, lo, hi, value2) {
+  Atomics.store(header4, hi, Math.floor(value2 / U32));
+  Atomics.store(header4, lo, value2 % U32 | 0);
 }
 var SAB_STATE_READY = 2;
 var SAB_STATUS_BYTES = 1;
@@ -13209,7 +13226,7 @@ function sabViews(sab) {
 var PENDING_TTL_MS = SYNC_FS_REQUEST_TIMEOUT_MS + 5e3;
 function attachSyncSabResponder(port, sab, token, opts) {
   const views = sabViews(sab);
-  const { header: header3, window } = views;
+  const { header: header4, window } = views;
   const pending = /* @__PURE__ */ new Map();
   let disposed = false;
   const { dispatch: dispatch2 } = opts;
@@ -13220,20 +13237,20 @@ function attachSyncSabResponder(port, sab, token, opts) {
     pending.delete(id2);
   }
   function publish(id2, entry, offset) {
-    if (Atomics.load(header3, SAB_I_REQ) !== id2) {
+    if (Atomics.load(header4, SAB_I_REQ) !== id2) {
       drop(id2);
       return;
     }
     const chunk2 = Math.min(window.byteLength, entry.payload.byteLength - offset);
     if (chunk2 > 0) window.set(entry.payload.subarray(offset, offset + chunk2));
-    Atomics.store(header3, SAB_I_STATUS, entry.status);
-    storeU53(header3, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
-    Atomics.store(header3, SAB_I_CHUNK, chunk2);
-    storeU53(header3, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
-    Atomics.store(header3, SAB_I_SEQ, id2);
-    Atomics.store(header3, SAB_I_STATE, SAB_STATE_READY);
-    Atomics.add(header3, SAB_I_PUB, 1);
-    Atomics.notify(header3, SAB_I_PUB);
+    Atomics.store(header4, SAB_I_STATUS, entry.status);
+    storeU53(header4, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
+    Atomics.store(header4, SAB_I_CHUNK, chunk2);
+    storeU53(header4, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
+    Atomics.store(header4, SAB_I_SEQ, id2);
+    Atomics.store(header4, SAB_I_STATE, SAB_STATE_READY);
+    Atomics.add(header4, SAB_I_PUB, 1);
+    Atomics.notify(header4, SAB_I_PUB);
     if (offset + chunk2 >= entry.payload.byteLength) drop(id2);
     else if (entry.timer) {
       clearTimeout(entry.timer);
@@ -13448,6 +13465,15 @@ var ProcessClocks = class {
   }
 };
 
+// src/kernel/proc-info.ts
+function mayTrace(viewer, target) {
+  const by = viewer?.cred;
+  const of = target.cred;
+  if (!by || !of || by.euid === 0) return true;
+  const uid = of.ruid === by.euid && of.euid === by.euid && of.suid === by.euid;
+  return uid && of.rgid === by.egid && of.egid === by.egid && of.sgid === by.egid;
+}
+
 // src/fs/pages.ts
 var PAGE = 64 * 1024;
 var READAHEAD = 1024 * 1024;
@@ -14003,7 +14029,16 @@ var ProcTree = class {
     if (!/^[1-9]\d*$/.test(top) || !this.alive(Number(top))) return void 0;
     if (leaf === "task") return this.task(Number(top), rest2);
     if (rest2.length > 0) return void 0;
-    if (leaf === void 0) return { kind: "dir", names: () => [...PID_NAMES, "task"] };
+    if (leaf === void 0) {
+      const exe = () => this.info(Number(top))?.exe === void 0 ? [] : ["exe"];
+      return { kind: "dir", names: () => [...PID_NAMES, ...exe(), "task"] };
+    }
+    if (leaf === "exe") {
+      const info = this.info(Number(top));
+      if (info?.exe === void 0) return void 0;
+      const denied2 = !mayTrace(this.ownInfo(), info);
+      return { kind: "link", target: info.exe, ...denied2 ? { denied: denied2 } : {} };
+    }
     if (!PID_NAMES.includes(leaf)) return void 0;
     return {
       kind: "file",
@@ -14015,6 +14050,10 @@ var ProcTree = class {
       }
     };
   }
+  ownInfo() {
+    const processes2 = this.listing().processes;
+    return processes2.find((p) => p.tid === this.pid) ?? processes2.find((p) => p.pid === this.pid);
+  }
   info(pid) {
     return this.listing().processes.find((p) => p.pid === pid);
   }
@@ -14078,6 +14117,7 @@ var ProcTree = class {
   readlink(path) {
     const node = this.find(path, false);
     if (node.kind !== "link") throw syncError("EINVAL", path);
+    if (node.denied) throw syncError("EACCES", path);
     return node.target;
   }
   exists(path) {
@@ -15482,8 +15522,8 @@ function sameCert(a, b) {
   if (!a || !b) return a === b;
   return a.cert.length === b.cert.length && a.cert.every((byte, i) => byte === b.cert[i]);
 }
-function winner(current, expected, record) {
-  return sameCert(current, expected) ? record : current;
+function winner(current, expected, record2) {
+  return sameCert(current, expected) ? record2 : current;
 }
 var DAY = 24 * 60 * 60 * 1e3;
 var CA_LIFETIME = 3650 * DAY;
@@ -15516,15 +15556,15 @@ function indexedDbCaStore(dbName = "slicc-realm-ca") {
       const store = (await open2()).transaction("ca").objectStore("ca");
       return await request2(store.get(owner));
     },
-    async swap(owner, expected, record) {
+    async swap(owner, expected, record2) {
       const tx = (await open2()).transaction("ca", "readwrite");
       const store = tx.objectStore("ca");
-      let stored = record;
+      let stored = record2;
       const read = store.get(owner);
       read.onsuccess = () => {
         const current = read.result;
-        const kept = winner(current, expected, record);
-        if (kept === record) store.put(record, owner);
+        const kept = winner(current, expected, record2);
+        if (kept === record2) store.put(record2, owner);
         else stored = kept;
       };
       await new Promise((resolve2, reject) => {
@@ -15544,14 +15584,14 @@ function validLeafName(host) {
 }
 var RealmCa = class _RealmCa {
   record;
-  constructor(record) {
-    this.record = record;
+  constructor(record2) {
+    this.record = record2;
   }
   static async open(owner, store, now = Date.now()) {
     const stored = await store.get(owner).catch(() => void 0);
     if (stored && stored.notAfter - now > CA_RENEW_BEFORE) return new _RealmCa(stored);
-    const record = await _RealmCa.create(owner, now);
-    return new _RealmCa(await store.swap(owner, stored, record));
+    const record2 = await _RealmCa.create(owner, now);
+    return new _RealmCa(await store.swap(owner, stored, record2));
   }
   static async create(owner, now) {
     const pair = await crypto.subtle.generateKey(ECDSA, false, ["sign", "verify"]);
@@ -16082,8 +16122,8 @@ function memoryCaStore() {
   const records = /* @__PURE__ */ new Map();
   return {
     get: async (owner) => records.get(owner),
-    swap: async (owner, expected, record) => {
-      const kept = winner(records.get(owner), expected, record);
+    swap: async (owner, expected, record2) => {
+      const kept = winner(records.get(owner), expected, record2);
       records.set(owner, kept);
       return kept;
     }
@@ -16213,10 +16253,10 @@ var WsHandles = class {
   open = /* @__PURE__ */ new Map();
   next;
   local;
-  constructor(transport, next3, local) {
+  constructor(transport, next3, local2) {
     this.transport = transport;
     this.next = next3;
-    this.local = local;
+    this.local = local2;
   }
   owns(handle) {
     return this.open.has(handle);
@@ -16245,8 +16285,8 @@ var WsHandles = class {
     return { ok: true, kind: "json", json: handle };
   }
   async connect(handle, req, entry) {
-    const { transport, local } = this;
-    const port = local?.port(req.url);
+    const { transport, local: local2 } = this;
+    const port = local2?.port(req.url);
     const open2 = { protocols: req.protocols, headers: req.headers, signal: entry.abort.signal };
     if (port === void 0 && (!transport.traits.websocket || !transport.websocket)) {
       return fail("ENOTSUP", NO_WEBSOCKET2);
@@ -16256,7 +16296,7 @@ var WsHandles = class {
       socket = port === void 0 ? await transport.websocket({
         url: toHostLoopback(req.url),
         ...open2
-      }) : await local.websocket({ url: req.url, ...open2 }, port);
+      }) : await local2.websocket({ url: req.url, ...open2 }, port);
     } catch (e) {
       return fail(errnoOf(e), message(e));
     }
@@ -16387,11 +16427,11 @@ var HttpHandles = class {
   ws;
   owner;
   local;
-  constructor(transport, owner, local) {
+  constructor(transport, owner, local2) {
     this.transport = transport;
     this.owner = owner;
-    this.local = local;
-    this.ws = new WsHandles(transport, () => ++this.nextHandle, local);
+    this.local = local2;
+    this.ws = new WsHandles(transport, () => ++this.nextHandle, local2);
   }
   syscall(req) {
     if (req.op.startsWith("net-ws-")) return this.ws.syscall(req);
@@ -16543,6 +16583,43 @@ var HttpHandles = class {
   }
 };
 
+// src/kernel/net/hosts-file.ts
+var HOSTS_PATH = "/etc/hosts";
+function parseHosts(text) {
+  const table = /* @__PURE__ */ new Map();
+  for (const raw2 of text.split("\n")) {
+    const [address, ...names2] = raw2.replace(/#.*/, "").trim().split(/\s+/);
+    if (!address || names2.length === 0) continue;
+    if (ipv4Bytes(address) === void 0 && ipv6Groups(address) === void 0) continue;
+    for (const name2 of names2) {
+      const key = name2.toLowerCase().replace(/\.$/, "");
+      const known = table.get(key) ?? [];
+      if (!known.includes(address)) known.push(address);
+      table.set(key, known);
+    }
+  }
+  return table;
+}
+function hostsReader(fs, path = HOSTS_PATH) {
+  let stamp = "";
+  let table;
+  return async () => {
+    const st = await fs.stat(path).catch(() => void 0);
+    if (!st?.isFile) {
+      stamp = "";
+      table = void 0;
+      return void 0;
+    }
+    const now = `${st.ino}:${st.size}:${st.mtime.getTime()}`;
+    if (now === stamp && table) return table;
+    const text = await fs.readFile(path).catch(() => void 0);
+    if (text === void 0) return void 0;
+    stamp = now;
+    table = parseHosts(text);
+    return table;
+  };
+}
+
 // src/kernel/net/uplink.ts
 function carriesUdp(uplink) {
   return uplink.traits.udp === true && typeof uplink.udp === "function";
@@ -16559,13 +16636,15 @@ var NEVER = new Routes(true);
 var RemoteUplink = class {
   traits;
   routes;
+  nameserver;
   port;
   waiting = /* @__PURE__ */ new Map();
   nextId = 0;
-  constructor(port, traits, routes) {
+  constructor(port, traits, routes, nameserver) {
     this.port = port;
     this.traits = traits;
     this.routes = routes;
+    this.nameserver = nameserver;
   }
   receive(reply) {
     const waiter = this.waiting.get(reply.uid);
@@ -16688,6 +16767,7 @@ var Resolver = class {
   timeoutMs;
   log;
   own;
+  builtin;
   cache = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   hosts;
@@ -16698,6 +16778,7 @@ var Resolver = class {
     this.timeoutMs = options.timeoutMs ?? RESOLVE_TIMEOUT_MS;
     this.log = options.log ?? ((message3) => console.warn(message3));
     this.own = ownNames(options.hostname ?? DEFAULT_HOSTNAME);
+    this.builtin = parseHosts(hostsFile(options.hostname ?? DEFAULT_HOSTNAME));
     this.hosts = options.hosts;
   }
   async fromFile(key, family) {
@@ -16707,18 +16788,34 @@ var Resolver = class {
     const v6 = listed.filter((a) => ipv4Bytes(a) === void 0);
     return family === 4 ? v4 : family === 6 ? v6 : [...v4, ...v6];
   }
+  async known(name2) {
+    const key = name2.toLowerCase().replace(/\.$/, "");
+    if (ipv4Bytes(key) || ipv6Groups(key)) return false;
+    if (hostsEntry(key, this.own) !== void 0) return true;
+    return ((await this.hosts?.().catch(() => void 0))?.get(key)?.length ?? 0) > 0;
+  }
+  async reverse(address) {
+    const v6 = ipv6Groups(address)?.join(":");
+    const same3 = (a) => a === address || v6 !== void 0 && ipv6Groups(a)?.join(":") === v6;
+    const file = await this.hosts?.().catch(() => void 0);
+    for (const table of [file, this.builtin]) {
+      for (const [name2, addresses] of table ?? []) if (addresses.some(same3)) return name2;
+    }
+    if (ipv4Bytes(address)?.[0] === 127) return "localhost";
+    return void 0;
+  }
   async resolve(name2, family, blocking) {
     const key = name2.toLowerCase().replace(/\.$/, "");
-    const local = hostsEntry(key, this.own);
+    const local2 = hostsEntry(key, this.own);
     if (ipv6Groups(key)) {
-      const v4 = family !== 6 && local ? [local] : [];
+      const v4 = family !== 6 && local2 ? [local2] : [];
       return family === 4 ? v4 : [...v4, key];
     }
     const listed = this.hosts ? await this.fromFile(key, family) : void 0;
     if (listed?.length) return listed;
-    if (local) {
+    if (local2) {
       const six = loopbackName(key, this.own) ? ["::1"] : [];
-      return family === 6 ? six : family === 4 ? [local] : [local, ...six];
+      return family === 6 ? six : family === 4 ? [local2] : [local2, ...six];
     }
     if (!this.uplink || key === "") return [];
     const asked = this.uplink.traits.ipv6 ? family : 4;
@@ -17757,14 +17854,15 @@ var KernelDgram = class {
     const max = familyOf(target.host) === 6 ? MAX_DATAGRAM_V6 : MAX_DATAGRAM_V4;
     if (bytes.length > max) throw new KernelError("EMSGSIZE");
     const where = this.route(target.host);
-    const local = this.bound();
+    const local2 = this.bound();
     if (where === "uplink") return this.sendUp(bytes, target);
     const from = {
       family: "inet",
-      host: local.host === "0.0.0.0" ? "127.0.0.1" : local.host,
-      port: local.port
+      host: local2.host === "0.0.0.0" ? "127.0.0.1" : local2.host,
+      port: local2.port
     };
-    const delivered = this.net.deliverDgram(target.port, { bytes: bytes.slice(), from });
+    const dest = { family: "inet", host: canonicalHost(target.host), port: target.port };
+    const delivered = this.net.deliverDgram(target.port, { bytes: bytes.slice(), from }, dest);
     if (!delivered && this.peer && sameAddr(this.peer, target)) {
       this.pending = "ECONNREFUSED";
       this.changes.wake();
@@ -19361,8 +19459,8 @@ function clientFirstOf(message3) {
   return m ? { header: m[1], bare: m[2] } : void 0;
 }
 var latinBytes = (text) => Uint8Array.from(text, (c) => c.charCodeAt(0));
-function channelOf(header3, binding) {
-  const head = latinBytes(header3);
+function channelOf(header4, binding) {
+  const head = latinBytes(header4);
   const all = new Uint8Array(head.length + (binding?.length ?? 0));
   all.set(head);
   if (binding) all.set(binding, head.length);
@@ -19484,6 +19582,7 @@ function latin2(bytes) {
 var PgServer = class {
   binding;
   plus = false;
+  touch;
   constructor(binding) {
     this.binding = binding;
   }
@@ -19505,6 +19604,7 @@ var PgServer = class {
     return message3;
   }
   mechanisms(message3) {
+    if (this.touch !== true) return message3;
     this.sasl = true;
     const offered = latin2(message3.subarray(9)).split("\0").filter((n) => n !== "");
     this.plus = offered.includes(PLUS);
@@ -19585,8 +19685,8 @@ function frame3(type, body) {
   return out;
 }
 function pgLength(bytes, started) {
-  const header3 = started ? 5 : 4;
-  if (bytes.length < header3) return void 0;
+  const header4 = started ? 5 : 4;
+  if (bytes.length < header4) return void 0;
   const length2 = int32(bytes, started ? 1 : 0);
   return started ? 1 + length2 : length2;
 }
@@ -19614,16 +19714,16 @@ function initial(message3) {
 function int32Text(n) {
   return String.fromCharCode(n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255);
 }
-function serverHeader(header3, server) {
-  if (header3 === "n,,") return header3;
-  if (header3 === "y,," && !server.plus) return header3;
-  if (header3 === END_POINT && server.binding) return header3;
+function serverHeader(header4, server) {
+  if (header4 === "n,,") return header4;
+  if (header4 === "y,," && !server.plus) return header4;
+  if (header4 === END_POINT && server.binding) return header4;
   return server.plus && server.binding ? END_POINT : "n,,";
 }
-function rewritten(first, header3) {
+function rewritten(first, header4) {
   const parsed2 = clientFirstOf(first.data);
-  if (!parsed2 || parsed2.header === header3) return first;
-  return { mechanism: header3 === END_POINT ? PLUS : PLAIN, data: `${header3}${parsed2.bare}` };
+  if (!parsed2 || parsed2.header === header4) return first;
+  return { mechanism: header4 === END_POINT ? PLUS : PLAIN, data: `${header4}${parsed2.bare}` };
 }
 var PgClient = class {
   clientFirst;
@@ -19864,6 +19964,10 @@ var SessionWriter = class {
     this.proven ??= this.prove(protocol).catch(() => void 0);
     return this.proven;
   }
+  async mayTouch() {
+    if (this.s.verified) return true;
+    return (await this.proof("pg"))?.anchor !== void 0;
+  }
   async prove(protocol) {
     const s = this.s;
     if (s.anchoring) {
@@ -19913,7 +20017,10 @@ var SessionWriter = class {
     this.buffer.fill(0);
     this.buffer = joined4;
     if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
-    if (this.mode === "pg") this.sawPg = true;
+    if (this.mode === "pg" && !this.sawPg) {
+      this.sawPg = true;
+      if (!this.s.verified) void this.proof("pg");
+    }
     if (this.mode === "pass") await this.release();
     else if (this.mode === "http1") await this.http1();
     else if (this.mode === "smtp") await this.lines();
@@ -20093,6 +20200,7 @@ function sealedConn(conn, s) {
       for (; ; ) {
         const bytes = await conn.read();
         if (!bytes) return bytes;
+        if (writer?.sawPg && pg.touch === void 0) pg.touch = await writer.mayTouch();
         const out = writer?.sawPg ? pg.filter(bytes) : bytes;
         if (pg.failed) {
           conn.close();
@@ -20740,8 +20848,8 @@ async function datagram(req, proc) {
   const ready2 = pollFile(dgram).readable;
   if (req.nonblock && !ready2) throw new KernelError("EAGAIN");
   const got = await dgram.receive(req.max, req.peek, ready2 ? void 0 : proc.blocking());
-  const { bytes, from, truncated } = got;
-  return { ok: true, kind: "bytes", bytes: encodeReceived({ bytes, truncated, ...from }) };
+  const { bytes, from, truncated: truncated2 } = got;
+  return { ok: true, kind: "bytes", bytes: encodeReceived({ bytes, truncated: truncated2, ...from }) };
 }
 async function unixDatagram(req, dgram, proc) {
   if (req.op === "sock-sendto") {
@@ -20751,11 +20859,11 @@ async function unixDatagram(req, dgram, proc) {
   const ready2 = pollFile(dgram).readable;
   if (req.nonblock && !ready2) throw new KernelError("EAGAIN");
   const got = await dgram.receive(req.max, req.peek, ready2 ? void 0 : proc.blocking());
-  const { bytes, from, truncated } = got;
+  const { bytes, from, truncated: truncated2 } = got;
   return {
     ok: true,
     kind: "bytes",
-    bytes: encodeReceived({ bytes, truncated, host: from.path, port: 0, unix: true })
+    bytes: encodeReceived({ bytes, truncated: truncated2, host: from.path, port: 0, unix: true })
   };
 }
 function domainOf(socket) {
@@ -23506,9 +23614,9 @@ var JsThreads = class {
     const { control, port } = msg;
     const tid = ++this.last;
     const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
-    const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
+    const header4 = new Int32Array(sab, 0, SAB_HEADER_I32);
     const owned4 = new SharedArrayBuffer(4 * (1 + JS_THREAD_OWNED_FDS));
-    if (this.frozen) Atomics.store(header3, SAB_I_STOP, 1);
+    if (this.frozen) Atomics.store(header4, SAB_I_STOP, 1);
     const clock = this.deps.clocks.thread(tid + 1, sab);
     let ended = false;
     const end = (code) => {
@@ -23516,7 +23624,7 @@ var JsThreads = class {
       ended = true;
       this.live.delete(tid);
       this.headers.delete(tid);
-      this.deps.wakes.delete(header3);
+      this.deps.wakes.delete(header4);
       for (const [id2, token] of ops) {
         void this.deps.dispatch({ op: "async-cancel", id: id2, token });
       }
@@ -23566,8 +23674,8 @@ var JsThreads = class {
     control.addEventListener("message", onControl);
     control.start();
     this.live.set(tid, end);
-    this.headers.set(tid, header3);
-    this.deps.wakes.add(header3);
+    this.headers.set(tid, header4);
+    this.deps.wakes.add(header4);
     const init = {
       ...this.deps.init(sab, lane.lane),
       type: JS_THREAD_INIT,
@@ -23587,9 +23695,9 @@ var JsThreads = class {
   }
   stopped(stopped) {
     this.frozen = stopped;
-    for (const header3 of this.headers.values()) {
-      Atomics.store(header3, SAB_I_STOP, stopped ? 1 : 0);
-      Atomics.notify(header3, SAB_I_STOP);
+    for (const header4 of this.headers.values()) {
+      Atomics.store(header4, SAB_I_STOP, stopped ? 1 : 0);
+      Atomics.notify(header4, SAB_I_STOP);
     }
   }
   close() {
@@ -23634,13 +23742,13 @@ var Dying = class {
   hard;
   busy = 0;
   finish;
-  start(code, sig, header3, process, finish) {
+  start(code, sig, header4, process, finish) {
     if (this.ending) return;
     this.ending = { code, sig };
     this.finish = finish;
     this.hard = setTimeout(finish, KILL_HARD_MS);
     this.arm();
-    Atomics.store(header3, SAB_I_KILLED, code);
+    Atomics.store(header4, SAB_I_KILLED, code);
     process.die();
   }
   serve(req, work) {
@@ -23687,8 +23795,8 @@ function unblockedThread(threads, sig) {
   }
   return void 0;
 }
-function unblocked(header3) {
-  return Atomics.load(header3, SAB_I_SIGNALS) & ~Atomics.load(header3, SAB_I_BLOCKED);
+function unblocked(header4) {
+  return Atomics.load(header4, SAB_I_SIGNALS) & ~Atomics.load(header4, SAB_I_BLOCKED);
 }
 function threadCall(process, req, cancelled, block) {
   return isWasmSyscall(req) ? process.syscall(req, cancelled, block) : dispatchSyncFs(req);
@@ -23700,24 +23808,24 @@ function threadCancel(thread) {
   return unblocked(thread.header) !== 0 ? AbortSignal.abort() : thread.interrupt.signal;
 }
 var asyncFanout = /* @__PURE__ */ new WeakMap();
-function notifiers(header3) {
+function notifiers(header4) {
   return {
     onPending(sig) {
-      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
-      Atomics.notify(header3, SAB_I_SIGNALS);
+      Atomics.or(header4, SAB_I_SIGNALS, sigbit(sig));
+      Atomics.notify(header4, SAB_I_SIGNALS);
     },
     onAsync() {
-      for (const at of [header3, ...asyncFanout.get(header3) ?? []]) {
+      for (const at of [header4, ...asyncFanout.get(header4) ?? []]) {
         Atomics.add(at, SAB_I_ASYNC, 1);
         Atomics.notify(at, SAB_I_ASYNC);
       }
     }
   };
 }
-function publishStops(process, header3) {
+function publishStops(process, header4) {
   process.onState((state) => {
-    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
-    Atomics.notify(header3, SAB_I_STOP);
+    Atomics.store(header4, SAB_I_STOP, state === "stopped" ? 1 : 0);
+    Atomics.notify(header4, SAB_I_STOP);
   });
 }
 function transferOf(opts, lane) {
@@ -23809,7 +23917,7 @@ function linksOf(opts) {
 function clipboardName(opts) {
   return opts.program.abi === "js" ? {} : { clipboardName: opts.argv0 };
 }
-function processOptions(opts, header3, hooks, created4) {
+function processOptions(opts, header4, hooks, created4) {
   return {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
@@ -23848,16 +23956,16 @@ function processOptions(opts, header3, hooks, created4) {
     watches: opts.watches,
     onReap: opts.onReap,
     resolver: opts.resolver,
-    ...notifiers(header3),
-    onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
-    hasPending: () => unblocked(header3) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
+    ...notifiers(header4),
+    onTimer: (which) => void Atomics.or(header4, SAB_I_TIMERS, 1 << which),
+    hasPending: () => unblocked(header4) !== 0 || Atomics.load(header4, SAB_I_TIMERS) !== 0,
     raise: hooks.raise,
     threadKill: hooks.threadKill,
     unblockedThread: hooks.unblockedThread,
     ...hooks.exitNow ? { exitNow: hooks.exitNow } : {},
     ...hooks.exitSignal ? { exitSignal: hooks.exitSignal } : {},
-    ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header3, SAB_I_SIGNALS) } : {},
-    ...opts.program.abi === "wasi" ? { blockedBits: () => Atomics.load(header3, SAB_I_BLOCKED) } : {}
+    ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header4, SAB_I_SIGNALS) } : {},
+    ...opts.program.abi === "wasi" ? { blockedBits: () => Atomics.load(header4, SAB_I_BLOCKED) } : {}
   };
 }
 function threadInit(opts, program, sab, cred, thread, main) {
@@ -23923,9 +24031,9 @@ async function crashReport(process, onError, message3) {
 function spawnWasmProcess(opts) {
   const { promise: ready2, resolve: started } = readiness(opts.program.abi);
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
-  const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
+  const header4 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const blocked2 = opts.fork?.wasi?.blocked ?? opts.blocked;
-  if (blocked2 && anyBlocked(blocked2) && opts.program.abi === "wasi") storeBlocked(header3, blocked2);
+  if (blocked2 && anyBlocked(blocked2) && opts.program.abi === "wasi") storeBlocked(header4, blocked2);
   const threadSignals = /* @__PURE__ */ new Map();
   const created4 = new Created();
   const process = new WasmProcess(
@@ -23933,7 +24041,7 @@ function spawnWasmProcess(opts) {
     opts.fds,
     processOptions(
       opts,
-      header3,
+      header4,
       {
         raise: (sig, info) => signal(sig, info),
         threadKill: (tid, sig) => killThread(threadSignals.get(tid), process.signalMasks().caught, sig),
@@ -23946,7 +24054,7 @@ function spawnWasmProcess(opts) {
       created4
     )
   );
-  publishStops(process, header3);
+  publishStops(process, header4);
   const holds2 = new HeldPaths();
   opts.held?.add(holds2);
   const token = holdingToken(opts, holds2, {
@@ -23967,7 +24075,7 @@ function spawnWasmProcess(opts) {
     dispatch: clocks.timed(void 0, dispatch2)
   });
   const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
-  const jsThreads = jsThreadsOf(opts, process, token, dispatch2, clocks, header3);
+  const jsThreads = jsThreadsOf(opts, process, token, dispatch2, clocks, header4);
   const { promise: exited, resolve: settle3 } = Promise.withResolvers();
   let done5 = false;
   const crash = new CrashSlot((message3) => crashReport(process, opts.onError, message3));
@@ -24066,7 +24174,7 @@ function spawnWasmProcess(opts) {
   );
   const terminate = (code, sig) => {
     if (opts.program.abi !== "wasi" || done5) finish(code, sig);
-    else dying.start(code, sig, header3, process, () => finish(code, sig));
+    else dying.start(code, sig, header4, process, () => finish(code, sig));
   };
   const signal = (sig, info) => {
     if (process.signal(sig, info) === "terminate")
@@ -24081,16 +24189,16 @@ function spawnWasmProcess(opts) {
     signal,
     termsig: () => endedBy,
     onState: (listener) => process.onState(listener),
-    memory: () => Atomics.load(header3, SAB_I_MEMORY) * 65536,
-    ...processViews(process, opts, header3),
+    memory: () => Atomics.load(header4, SAB_I_MEMORY) * 65536,
+    ...processViews(process, opts, header4),
     writesBack: () => opts.program.abi === "wasi" && !done5,
     ...clockViews(clocks)
   };
 }
-function jsThreadsOf(opts, process, token, dispatch2, clocks, header3) {
+function jsThreadsOf(opts, process, token, dispatch2, clocks, header4) {
   if (opts.program.abi !== "js") return void 0;
   const wakes = /* @__PURE__ */ new Set();
-  asyncFanout.set(header3, wakes);
+  asyncFanout.set(header4, wakes);
   const threads = new JsThreads({
     wakes,
     cap: jsThreadCap(opts.env),
@@ -24105,10 +24213,10 @@ function jsThreadsOf(opts, process, token, dispatch2, clocks, header3) {
   process.onState((state) => threads.stopped(state === "stopped"));
   return threads;
 }
-function processViews(process, opts, header3) {
+function processViews(process, opts, header4) {
   return {
     ignoredSignals: (fork) => process.inheritable(fork),
-    blockedSignals: () => opts.program.abi === "wasi" ? loadBlocked(header3) : [0, 0],
+    blockedSignals: () => opts.program.abi === "wasi" ? loadBlocked(header4) : [0, 0],
     signalMasks: () => process.signalMasks(),
     umask: () => process.umask,
     cred: () => copyCred(process.cred)
@@ -24666,42 +24774,398 @@ function isMessage(data) {
   return adopt !== null && Array.isArray(adopt.records) && Array.isArray(adopt.flocks);
 }
 
-// src/kernel/net/hosts-file.ts
-var HOSTS_PATH = "/etc/hosts";
-function parseHosts(text) {
-  const table = /* @__PURE__ */ new Map();
-  for (const raw2 of text.split("\n")) {
-    const [address, ...names2] = raw2.replace(/#.*/, "").trim().split(/\s+/);
-    if (!address || names2.length === 0) continue;
-    if (ipv4Bytes(address) === void 0 && ipv6Groups(address) === void 0) continue;
-    for (const name2 of names2) {
-      const key = name2.toLowerCase().replace(/\.$/, "");
-      const known = table.get(key) ?? [];
-      if (!known.includes(address)) known.push(address);
-      table.set(key, known);
+// src/kernel/net/dns-stub.ts
+var DNS_PORT = 53;
+var DNS_STUB_ADDRESS = "127.0.0.53";
+var RESOLV_CONF_PATH = "/etc/resolv.conf";
+var RESOLV_CONF = `nameserver ${DNS_STUB_ADDRESS}
+options edns0
+`;
+var DNS_STUB_TTL = 30;
+var DNS_FORWARD_TIMEOUT_MS = 5e3;
+var DNS_TCP_IDLE_MS = 1e4;
+var DNS_TCP_MAX = 64;
+var DNS_UDP_INFLIGHT = 64;
+var TYPE_A = 1;
+var TYPE_PTR = 12;
+var TYPE_AAAA = 28;
+var TYPE_OPT = 41;
+var CLASS_IN = 1;
+var NOERROR = 0;
+var FORMERR = 1;
+var SERVFAIL = 2;
+var NXDOMAIN = 3;
+var NOTIMP = 4;
+var QR = 32768;
+var AA = 1024;
+var TC = 512;
+var RD = 256;
+var RA = 128;
+var CD = 16;
+var UDP_PLAIN = 512;
+var UDP_EDNS = 1232;
+var UDP_MAX = 4096;
+var DOH_MAX = 65535;
+var LOCAL_ZONES = ["localhost", "slicc.internal"];
+var MESSAGE = "application/dns-message";
+var u16 = (b, at) => b[at] << 8 | b[at + 1];
+function skipName(b, at) {
+  let i = at;
+  for (let hops = 0; hops < 128; hops++) {
+    if (i >= b.length) return void 0;
+    const len = b[i];
+    if (len === 0) return i + 1;
+    if ((len & 192) === 192) return i + 2 <= b.length ? i + 2 : void 0;
+    if (len & 192) return void 0;
+    i += len + 1;
+  }
+  return void 0;
+}
+function readName(b, at) {
+  const labels = [];
+  let i = at;
+  let size = 0;
+  for (; ; ) {
+    if (i >= b.length) return void 0;
+    const len = b[i];
+    if (len === 0) break;
+    if (len & 192) return void 0;
+    size += len + 1;
+    if (size > 254 || i + 1 + len > b.length) return void 0;
+    labels.push(new TextDecoder().decode(b.subarray(i + 1, i + 1 + len)));
+    i += len + 1;
+  }
+  return { name: labels.join(".").toLowerCase(), end: i + 1 };
+}
+function parseQuery(b) {
+  if (b.length < 12) return void 0;
+  const id2 = u16(b, 0);
+  const flags2 = u16(b, 2);
+  if (flags2 & QR) return void 0;
+  if (flags2 >> 11 & 15) return { ok: false, id: id2, flags: flags2, rcode: NOTIMP };
+  if (u16(b, 4) !== 1) return { ok: false, id: id2, flags: flags2, rcode: FORMERR };
+  const read = readName(b, 12);
+  if (!read || read.end + 4 > b.length) return { ok: false, id: id2, flags: flags2, rcode: FORMERR };
+  const type = u16(b, read.end);
+  const klass = u16(b, read.end + 2);
+  const end = read.end + 4;
+  let edns;
+  let at = end;
+  const records = u16(b, 6) + u16(b, 8) + u16(b, 10);
+  for (let n = 0; n < records; n++) {
+    const after = skipName(b, at);
+    if (after === void 0 || after + 10 > b.length)
+      return { ok: false, id: id2, flags: flags2, rcode: FORMERR };
+    if (u16(b, after) === TYPE_OPT) edns = Math.max(UDP_PLAIN, u16(b, after + 2));
+    at = after + 10 + u16(b, after + 8);
+    if (at > b.length) return { ok: false, id: id2, flags: flags2, rcode: FORMERR };
+  }
+  return { ok: true, question: { id: id2, flags: flags2, name: read.name, type, klass, end, edns } };
+}
+function encodeName(name2) {
+  const out = [];
+  for (const label of name2.split(".").filter(Boolean)) {
+    const bytes = new TextEncoder().encode(label);
+    out.push(bytes.length, ...bytes);
+  }
+  out.push(0);
+  return out;
+}
+function header2(id2, flags2, counts) {
+  const out = [id2 >> 8, id2 & 255, flags2 >> 8, flags2 & 255];
+  for (const c of counts) out.push(c >> 8, c & 255);
+  return out;
+}
+function opt() {
+  return [0, 0, TYPE_OPT, UDP_EDNS >> 8, UDP_EDNS & 255, 0, 0, 0, 0, 0, 0];
+}
+function record(type, rdata) {
+  const ttl = DNS_STUB_TTL;
+  return [
+    192,
+    12,
+    type >> 8,
+    type & 255,
+    0,
+    CLASS_IN,
+    ttl >>> 24 & 255,
+    ttl >>> 16 & 255,
+    ttl >>> 8 & 255,
+    ttl & 255,
+    rdata.length >> 8,
+    rdata.length & 255,
+    ...rdata
+  ];
+}
+function replyFlags(query, rcode, aa) {
+  return QR | query & 30720 | (aa ? AA : 0) | query & RD | RA | query & CD | rcode;
+}
+function answers(reply, q) {
+  if (reply.length < 12 || !(u16(reply, 2) & QR) || u16(reply, 4) !== 1) return false;
+  const read = readName(reply, 12);
+  if (!read || read.end + 4 > reply.length) return false;
+  return read.name === q.name && u16(reply, read.end) === q.type && u16(reply, read.end + 2) === q.klass;
+}
+function errorReply(id2, flags2, rcode) {
+  return new Uint8Array(header2(id2, replyFlags(flags2, rcode, false), [0, 0, 0, 0]));
+}
+function answerReply(query, q, rcode, answers2, aa) {
+  const extra = q.edns !== void 0 ? [opt()] : [];
+  return new Uint8Array([
+    ...header2(q.id, replyFlags(q.flags, rcode, aa), [1, answers2.length, 0, extra.length]),
+    ...query.subarray(12, q.end),
+    ...answers2.flat(),
+    ...extra.flat()
+  ]);
+}
+function truncated(reply, q, query) {
+  const limit = q.edns !== void 0 ? Math.min(q.edns, UDP_MAX) : UDP_PLAIN;
+  if (reply.length <= limit) return reply;
+  const flags2 = u16(reply, 2) | TC;
+  const extra = q.edns !== void 0 ? [opt()] : [];
+  return new Uint8Array([
+    ...header2(q.id, flags2, [1, 0, 0, extra.length]),
+    ...query.subarray(12, q.end),
+    ...extra.flat()
+  ]);
+}
+function ipv6Text(groups) {
+  return groups.map((g) => g.toString(16)).join(":");
+}
+function reverseAddress(name2) {
+  if (name2.endsWith(".in-addr.arpa")) {
+    const parts2 = name2.slice(0, -".in-addr.arpa".length).split(".");
+    if (parts2.length !== 4) return void 0;
+    const text = parts2.reverse().join(".");
+    return ipv4Bytes(text) ? text.split(".").map(Number).join(".") : void 0;
+  }
+  if (name2.endsWith(".ip6.arpa")) {
+    const nibbles = name2.slice(0, -".ip6.arpa".length).split(".");
+    if (nibbles.length !== 32 || !nibbles.every((n) => /^[0-9a-f]$/.test(n))) return void 0;
+    const hex4 = nibbles.reverse().join("");
+    const groups = Array.from(
+      { length: 8 },
+      (_, i) => Number.parseInt(hex4.slice(i * 4, i * 4 + 4), 16)
+    );
+    return ipv6Text(groups);
+  }
+  return void 0;
+}
+function local(name2) {
+  return LOCAL_ZONES.some((zone) => name2 === zone || name2.endsWith(`.${zone}`));
+}
+function literal(name2) {
+  return ipv4Bytes(name2) !== void 0 || ipv6Groups(name2) !== void 0;
+}
+function addressData(address, type) {
+  if (type === TYPE_A) return ipv4Bytes(address);
+  const groups = type === TYPE_AAAA ? ipv6Groups(address) : void 0;
+  return groups?.flatMap((g) => [g >> 8, g & 255]);
+}
+var DnsStub = class {
+  resolver;
+  forwarder;
+  timeoutMs;
+  constructor(options) {
+    this.resolver = options.resolver;
+    this.forwarder = options.forward;
+    this.timeoutMs = options.timeoutMs ?? DNS_FORWARD_TIMEOUT_MS;
+  }
+  async answer(query, udp) {
+    const parsed2 = parseQuery(query);
+    if (!parsed2) return void 0;
+    if (!parsed2.ok) return errorReply(parsed2.id, parsed2.flags, parsed2.rcode);
+    const q = parsed2.question;
+    const reply = await this.reply(query, q).catch(
+      () => answerReply(query, q, SERVFAIL, [], false)
+    );
+    return udp ? truncated(reply, q, query) : reply;
+  }
+  async reply(query, q) {
+    if (q.klass !== CLASS_IN || literal(q.name)) return this.forward(query, q);
+    if (q.type === TYPE_PTR) {
+      const address = reverseAddress(q.name);
+      const name2 = address !== void 0 ? await this.reverse(address) : void 0;
+      if (name2 !== void 0)
+        return answerReply(query, q, NOERROR, [record(TYPE_PTR, encodeName(name2))], true);
+      return this.forward(query, q);
+    }
+    if (q.type === TYPE_A || q.type === TYPE_AAAA) {
+      const addresses = q.name === "" ? [] : await this.lookup(q.name);
+      const answers2 = addresses.flatMap((a) => {
+        const data = addressData(a, q.type);
+        return data ? [record(q.type, data)] : [];
+      });
+      if (answers2.length > 0 || local(q.name) || await this.known(q.name)) {
+        const rcode = addresses.length > 0 ? NOERROR : NXDOMAIN;
+        return answerReply(query, q, rcode, answers2, local(q.name));
+      }
+      return this.forward(query, q);
+    }
+    if (await this.known(q.name)) return answerReply(query, q, NOERROR, [], true);
+    if (local(q.name)) {
+      const there = (await this.lookup(q.name)).length > 0;
+      return answerReply(query, q, there ? NOERROR : NXDOMAIN, [], true);
     }
+    return this.forward(query, q);
   }
-  return table;
+  lookup(name2) {
+    return this.resolver.resolve(name2, 0).catch(() => []);
+  }
+  known(name2) {
+    return this.resolver.known(name2).catch(() => false);
+  }
+  reverse(address) {
+    return this.resolver.reverse(address).catch(() => void 0);
+  }
+  async forward(query, q) {
+    if (!this.forwarder) return answerReply(query, q, SERVFAIL, [], false);
+    const asked = query.slice();
+    asked[0] = 0;
+    asked[1] = 0;
+    const got = await this.forwarder(asked, AbortSignal.timeout(this.timeoutMs)).catch(
+      () => void 0
+    );
+    if (!got || !answers(got, q)) return answerReply(query, q, SERVFAIL, [], false);
+    const reply = got.slice();
+    reply[0] = q.id >> 8;
+    reply[1] = q.id & 255;
+    return reply;
+  }
+};
+async function collect(body, max) {
+  const parts2 = [];
+  let size = 0;
+  for await (const part of body) {
+    size += part.length;
+    if (size > max) return void 0;
+    parts2.push(part);
+  }
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const part of parts2) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
 }
-function hostsReader(fs, path = HOSTS_PATH) {
-  let stamp = "";
-  let table;
-  return async () => {
-    const st = await fs.stat(path).catch(() => void 0);
-    if (!st?.isFile) {
-      stamp = "";
-      table = void 0;
+function dohForward(transport, url) {
+  return async (query, signal) => {
+    const res = await transport.fetch({
+      url,
+      method: "POST",
+      headers: [
+        ["content-type", MESSAGE],
+        ["accept", MESSAGE]
+      ],
+      body: query,
+      signal
+    });
+    const type = res.headers.find(([k]) => k.toLowerCase() === "content-type")?.[1] ?? "";
+    if (res.status !== 200 || type.split(";")[0].trim().toLowerCase() !== MESSAGE) {
+      await res.cancel().catch(() => void 0);
       return void 0;
     }
-    const now = `${st.ino}:${st.size}:${st.mtime.getTime()}`;
-    if (now === stamp && table) return table;
-    const text = await fs.readFile(path).catch(() => void 0);
-    if (text === void 0) return void 0;
-    stamp = now;
-    table = parseHosts(text);
-    return table;
+    return collect(res.body, DOH_MAX);
+  };
+}
+function uplinkForward(uplink, server) {
+  return async (query, signal) => {
+    const conn = await uplink.dial({ network: "tcp", host: server, port: DNS_PORT, signal });
+    const stop = () => conn.close();
+    signal.addEventListener("abort", stop, { once: true });
+    try {
+      await conn.write(new Uint8Array([query.length >> 8, query.length & 255, ...query]));
+      let got = new Uint8Array();
+      for (; ; ) {
+        if (got.length >= 2 && got.length >= 2 + u16(got, 0)) return got.slice(2, 2 + u16(got, 0));
+        const piece = await conn.read();
+        if (!piece) return void 0;
+        const next3 = new Uint8Array(got.length + piece.length);
+        next3.set(got);
+        next3.set(piece, got.length);
+        got = next3;
+      }
+    } finally {
+      signal.removeEventListener("abort", stop);
+      conn.close();
+    }
   };
 }
+function dnsForward(uplink, transport, doh) {
+  const server = uplink?.nameserver;
+  if (uplink && server && (ipv4Bytes(server) || ipv6Groups(server)))
+    return uplinkForward(uplink, server);
+  return typeof doh === "string" ? dohForward(transport, doh) : void 0;
+}
+function kernelDnsStub(resolver, transport, uplink, doh) {
+  return new DnsStub({ resolver, forward: dnsForward(uplink, transport, doh) });
+}
+async function readExactly(conn, size, signal) {
+  const out = new Uint8Array(size);
+  let at = 0;
+  while (at < size) {
+    const piece = await conn.read(size - at, signal);
+    if (piece.length === 0) return void 0;
+    out.set(piece, at);
+    at += piece.length;
+  }
+  return out;
+}
+async function serveTcp(stub, conn) {
+  try {
+    for (; ; ) {
+      const idle2 = AbortSignal.timeout(DNS_TCP_IDLE_MS);
+      const size = await readExactly(conn, 2, idle2);
+      if (!size) return;
+      const query = await readExactly(conn, u16(size, 0), idle2);
+      if (!query) return;
+      const reply = await stub.answer(query, false);
+      if (!reply) return;
+      const framed = new Uint8Array([reply.length >> 8, reply.length & 255, ...reply]);
+      const sent = await conn.write(framed, AbortSignal.timeout(DNS_TCP_IDLE_MS));
+      if (sent < framed.length) return;
+    }
+  } catch {
+    return;
+  } finally {
+    conn.close();
+  }
+}
+function enableDnsStub(net, stub) {
+  const at = { family: "inet", host: "127.0.0.1", port: DNS_PORT };
+  net.reserve(DNS_PORT);
+  net.kernelOnly(DNS_PORT, true);
+  net.activate(at, () => {
+    const listener = net.listen(at);
+    const open2 = /* @__PURE__ */ new Set();
+    void (async () => {
+      for (; ; ) {
+        const conn = await listener.accept().catch(() => void 0);
+        if (!conn) return;
+        if (open2.size >= DNS_TCP_MAX) {
+          conn.close();
+          continue;
+        }
+        open2.add(conn);
+        void serveTcp(stub, conn).finally(() => open2.delete(conn));
+      }
+    })();
+  });
+  let inflight = 0;
+  net.serveDgram(DNS_PORT, (datagram2, to) => {
+    if (inflight >= DNS_UDP_INFLIGHT) return;
+    inflight++;
+    void stub.answer(datagram2.bytes, true).then(
+      (reply) => {
+        if (!reply) return;
+        const from = { family: "inet", host: to.host, port: DNS_PORT };
+        net.deliverDgram(datagram2.from.port, { bytes: reply, from });
+      },
+      () => void 0
+    ).finally(() => inflight--);
+  });
+}
 
 // src/kernel/net/redirect-hops.ts
 var HELD_MS = 3e4;
@@ -24709,13 +25173,13 @@ var HELD_MAX = 64;
 var HELD_PER_OWNER = 8;
 var MATCHED = ["range", "if-none-match", "if-modified-since", "if-range", "accept-encoding"];
 var KERNEL = -1;
-function header2(headers, name2) {
+function header3(headers, name2) {
   const values = headers.filter(([n]) => n.toLowerCase() === name2).map(([, v]) => v);
   return values.length > 0 ? values.join(", ") : void 0;
 }
 function fingerprint(headers) {
-  const fields = MATCHED.map((name2) => header2(headers, name2) ?? "");
-  return JSON.stringify([...fields, header2(headers, "authorization") !== void 0]);
+  const fields = MATCHED.map((name2) => header3(headers, name2) ?? "");
+  return JSON.stringify([...fields, header3(headers, "authorization") !== void 0]);
 }
 function unauthorized(print) {
   return JSON.stringify([...JSON.parse(print).slice(0, -1), false]);
@@ -24758,7 +25222,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
   };
   const replay = (chain2) => {
     const [hop, ...rest2] = chain2.hops;
-    const location = hop && header2(hop.headers, "location");
+    const location = hop && header3(hop.headers, "location");
     if (!hop || location === void 0) return chain2.final;
     const target = new URL(location, hop.url);
     target.hash = "";
@@ -24883,7 +25347,7 @@ function materializable(req) {
   if (req.shellGrants !== true && !isStrings(req.names)) return false;
   return isStrings(req.argv) && typeof req.path === "string" && typeof req.cwd === "string";
 }
-function errorReply(code, message3) {
+function errorReply2(code, message3) {
   return { v: 1, error: { code, message: message3 } };
 }
 function isRecord(value2) {
@@ -24895,9 +25359,9 @@ function serialized(reply) {
     const text = JSON.stringify(reply);
     plain3 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
-    return JSON.stringify(errorReply("EIO", lineOf2(err)));
+    return JSON.stringify(errorReply2("EIO", lineOf2(err)));
   }
-  if (!isRecord(plain3)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
+  if (!isRecord(plain3)) return JSON.stringify(errorReply2("EIO", "the vault gave no reply"));
   const { v: _, ...rest2 } = plain3;
   return JSON.stringify({ v: 1, ...rest2 });
 }
@@ -24945,18 +25409,18 @@ var SealedChannel = class {
   }
   async answer(req, signal) {
     const hook = this.broker.hook;
-    if (!hook) return errorReply("ENOTCONN", "no vault is connected");
+    if (!hook) return errorReply2("ENOTCONN", "no vault is connected");
     const stopped = new Promise((resolve2) => {
       signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
-      (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf2(err))
+      (reply2) => isRecord(reply2) ? reply2 : errorReply2("EIO", "the vault gave no reply"),
+      (err) => errorReply2("EIO", lineOf2(err))
     );
     const reply = await Promise.race([asked, stopped]);
     if (!signal.aborted) return reply;
-    return signal.reason === "timeout" ? errorReply("ETIMEDOUT", "the vault did not answer within 10 s") : void 0;
+    return signal.reason === "timeout" ? errorReply2("ETIMEDOUT", "the vault did not answer within 10 s") : void 0;
   }
   drop() {
     this.reply?.fill(0);
@@ -27302,6 +27766,10 @@ function blobModuleUrl(source) {
   const url = URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
   return { url, revoke: () => URL.revokeObjectURL(url) };
 }
+function describe(req, tty) {
+  const exe = req.exe === void 0 ? {} : { exe: req.exe };
+  return { argv: [req.argv0, ...req.args], tty, started: Date.now(), ...exe };
+}
 function linksOf2(req) {
   return req.links === void 0 ? {} : { links: req.links };
 }
@@ -27323,6 +27791,7 @@ var LAYOUT = [
   ["/etc", 493],
   [PASSWD, 420],
   [GROUP, 420],
+  [RESOLV_CONF_PATH, 420],
   ["/usr", 493],
   ["/usr/local", 493]
 ];
@@ -27665,6 +28134,10 @@ var Launcher = class {
       roots: packageTlsRoots(this.verifiedFs(options.fs), this.modulesDir),
       ca: this.ca
     });
+    enableDnsStub(
+      this.net,
+      kernelDnsStub(this.resolver, this.transport, options.uplink, options.doh)
+    );
     enableCdp(this.net, this.cdp);
     this.facades.enable(this.net);
     const fs = this.commandFs(this.base);
@@ -27752,10 +28225,10 @@ var Launcher = class {
       ready: () => this.fstab,
       lookup: (name2) => this.users.lookup(name2),
       watch: async (paths, notify) => {
-        const local = this.watchers.watch(paths, { recursive: true }, () => notify());
+        const local2 = this.watchers.watch(paths, { recursive: true }, () => notify());
         const remote = await this.watchFiles(paths, notify);
         return () => {
-          local();
+          local2();
           remote();
         };
       },
@@ -27941,7 +28414,7 @@ var Launcher = class {
         abi: "wasi",
         glue,
         wasm: glue,
-        argv0: baseName2(argv0 || file).replace(/\.wasm$/, ""),
+        argv0,
         ...asked
       };
     }
@@ -28483,7 +28956,18 @@ var Launcher = class {
       const handle = await this.admitted(
         program.abi !== "js",
         req.fds,
-        (fds, quietOom) => this.start({ ...req, fds, quietOom, cwd, program, argv0: target.argv0, args, env, cwdSlot })
+        (fds, quietOom) => this.start({
+          ...req,
+          fds,
+          quietOom,
+          cwd,
+          program,
+          argv0: target.argv0,
+          exe: target.copy ?? target.glue,
+          args,
+          env,
+          cwdSlot
+        })
       ).finally(() => this.cwds.release(cwdSlot));
       void handle.exited.finally(done5);
       return handle;
@@ -28675,11 +29159,7 @@ var Launcher = class {
     if (req.pgid !== void 0) this.jobs.join(pid, req.pgid);
     if (req.group === "lead") this.jobs.lead(pid);
     if (req.group === "session") this.jobs.setsid(pid);
-    this.described.set(pid, {
-      argv: [req.argv0, ...req.args],
-      tty: terminal?.name ?? null,
-      started: Date.now()
-    });
+    this.described.set(pid, describe(req, terminal?.name ?? null));
     handle.onState(
       (state) => state === "stopped" ? this.stopped.add(pid) : this.stopped.delete(pid)
     );
@@ -29287,6 +29767,19 @@ var Launcher = class {
   inUse(path) {
     return [...this.openFiles].some((nodes) => nodes.holds(path)) || heldUnder(this.held, path);
   }
+  async resolvConf() {
+    if (isProtected(this.prefixes, RESOLV_CONF_PATH)) return;
+    try {
+      const there = await this.base.lstat(RESOLV_CONF_PATH).then(
+        () => true,
+        () => false
+      );
+      if (there) return;
+      await this.base.writeFile(RESOLV_CONF_PATH, RESOLV_CONF);
+    } catch {
+      return;
+    }
+  }
   async stampLayout() {
     const layout = [
       ...LAYOUT,
@@ -29422,6 +29915,7 @@ var Launcher = class {
     await this.mountShm();
     await this.pnpmReady();
     await this.users.ensure();
+    await this.resolvConf();
     if (this.owners) await this.stampLayout();
     if (this.owners) await this.sudoer.provision();
     await writeCaFile(this.base, this.ca).catch(() => void 0);
@@ -29660,12 +30154,12 @@ var Launcher = class {
     const out = [];
     const err = [];
     const keep2 = options.collect !== false;
-    const collect = (chunks, tee) => (bytes) => {
+    const collect2 = (chunks, tee) => (bytes) => {
       if (keep2) chunks.push(bytes);
       tee?.(bytes);
     };
-    const stdout = collect(out, options.onStdout);
-    const stderr = collect(err, options.onStderr);
+    const stdout = collect2(out, options.onStdout);
+    const stderr = collect2(err, options.onStderr);
     const report = (message3) => stderr(encoder10.encode(`${message3}
 `));
     if (!planned) {
@@ -30083,7 +30577,14 @@ function facadesOption(req, port) {
 function remotes(port, req) {
   return {
     ...req.transport ? { transport: new RemoteTransport(port, req.transport) } : {},
-    ...req.uplink ? { uplink: new RemoteUplink(port, req.uplink.traits, req.uplink.routes) } : {}
+    ...req.uplink ? {
+      uplink: new RemoteUplink(
+        port,
+        req.uplink.traits,
+        req.uplink.routes,
+        req.uplink.nameserver
+      )
+    } : {}
   };
 }
 function dial(l, req) {
@@ -30181,6 +30682,7 @@ function hostOptions(req, port, sealed, clipboard, lookup2) {
   return {
     cron: { lock: `slicc-kernel-cron:${req.metadata ?? META_DB}` },
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
+    ...req.doh !== void 0 ? { doh: req.doh } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
     ...req.protect ? { protect: hostProtect(req.protect, lookup2) } : {},