@ai-ecoverse/slicc-kernel 1.152.2 → 1.154.0

package/dist/node.js

@@ -93,6 +93,202 @@ function portCdpHook(ask, gone) {
   });
 }
 
+// src/embedder-relay.ts
+function fresh2(bytes) {
+  return bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? bytes : bytes.slice();
+}
+function errorOf(err) {
+  const name2 = err?.name;
+  const message3 = err instanceof Error ? err.message : String(err);
+  return { name: typeof name2 === "string" ? name2 : "Error", message: message3 };
+}
+function embedderAsker(port) {
+  const asks = /* @__PURE__ */ new Map();
+  let next3 = 0;
+  const post = (message3, transfer = []) => port.postMessage({ embedder: message3 }, transfer);
+  const push = (asked, item) => {
+    asked.chunks.push(item);
+    asked.wake?.();
+  };
+  const reply = (id2, asked) => new ReadableStream(
+    {
+      pull: async (controller) => {
+        if (asked.chunks.length === 0) {
+          post({ id: id2, pull: true });
+          await new Promise((resolve2) => {
+            asked.wake = resolve2;
+          });
+        }
+        const item = asked.chunks.shift();
+        if (item instanceof Uint8Array) controller.enqueue(item);
+        else if (item === null || item === void 0) {
+          asks.delete(id2);
+          controller.close();
+        } else {
+          asks.delete(id2);
+          controller.error(Object.assign(new Error(item.message), { name: item.name }));
+        }
+      },
+      cancel: (reason) => {
+        asks.delete(id2);
+        post({ id: id2, cancel: String(reason ?? "closed") });
+      }
+    },
+    { highWaterMark: 0 }
+  );
+  const sendBody = async (id2, asked) => {
+    const got = await asked.body.read().catch(() => ({ done: true, value: void 0 }));
+    if (got.done) post({ id: id2, bodyEnd: true });
+    else {
+      const bytes = fresh2(got.value);
+      post({ id: id2, body: bytes }, [bytes.buffer]);
+    }
+  };
+  const hookFor = (client, kinds) => ({
+    kinds,
+    handle: async (request) => {
+      const id2 = ++next3;
+      const asked = {
+        ready: Promise.withResolvers(),
+        chunks: [],
+        wake: void 0,
+        body: request.body.getReader(),
+        progress: request.progress
+      };
+      asks.set(id2, asked);
+      const cancel = () => {
+        asks.delete(id2);
+        post({
+          id: id2,
+          cancel: String(request.signal.reason?.message ?? "closed")
+        });
+        asked.ready.reject(request.signal.reason);
+        push(asked, { name: "AbortError", message: "cancelled" });
+      };
+      request.signal.addEventListener("abort", cancel, { once: true });
+      const { kind, options, stamp } = request;
+      post({ ask: { id: id2, client, kind, options, stamp } });
+      await asked.ready.promise;
+      return reply(id2, asked);
+    }
+  });
+  const answer2 = (message3) => {
+    const asked = asks.get(message3.id);
+    if (!asked) return;
+    if ("ready" in message3) asked.ready.resolve();
+    else if ("chunk" in message3) push(asked, message3.chunk);
+    else if ("done" in message3) push(asked, null);
+    else if ("error" in message3) {
+      asked.ready.reject(
+        Object.assign(new Error(message3.error.message), { name: message3.error.name })
+      );
+      asks.delete(message3.id);
+      void asked.body.cancel(message3.error.message).catch(() => void 0);
+      push(asked, message3.error);
+    } else if ("progress" in message3) asked.progress(message3.progress);
+    else void sendBody(message3.id, asked);
+  };
+  return { hookFor, answer: answer2 };
+}
+function bytesOf(reply) {
+  if (reply instanceof ReadableStream) return reply;
+  const bytes = typeof reply === "string" ? new TextEncoder().encode(reply) : reply instanceof Uint8Array ? reply : new Uint8Array(0);
+  return new ReadableStream({
+    start(controller) {
+      if (bytes.length > 0) controller.enqueue(bytes);
+      controller.close();
+    }
+  });
+}
+function bodyStream(id2, state, post) {
+  return new ReadableStream(
+    {
+      pull: async (controller) => {
+        if (state.body.length === 0) post({ id: id2, bodyPull: true });
+        while (state.body.length === 0 && !state.abort.signal.aborted) {
+          await new Promise((resolve2) => {
+            state.wakeBody = resolve2;
+          });
+        }
+        const next3 = state.body.shift();
+        if (next3) controller.enqueue(next3);
+        else controller.close();
+      }
+    },
+    { highWaterMark: 0 }
+  );
+}
+function embedderAnswerer(port, hookFor) {
+  const running = /* @__PURE__ */ new Map();
+  const post = (message3, transfer = []) => port.postMessage({ embedderReply: message3 }, transfer);
+  const fail3 = (id2, err) => {
+    running.delete(id2);
+    post({ id: id2, error: errorOf(err) });
+  };
+  const start2 = async (ask) => {
+    const state = { abort: new AbortController(), body: [], wakeBody: void 0 };
+    running.set(ask.id, state);
+    try {
+      const hook = hookFor(ask.client);
+      if (!hook || !Object.hasOwn(hook.kinds, ask.kind))
+        throw Object.assign(new Error(`this page does not answer ${ask.kind}`), {
+          name: "NotSupportedError"
+        });
+      const reply = await hook.handle({
+        kind: ask.kind,
+        options: ask.options,
+        body: bodyStream(ask.id, state, post),
+        stamp: ask.stamp,
+        signal: state.abort.signal,
+        progress: (line) => post({ id: ask.id, progress: String(line) })
+      });
+      state.reader = bytesOf(reply).getReader();
+      post({ id: ask.id, ready: true });
+    } catch (err) {
+      fail3(ask.id, err);
+    }
+  };
+  const pull = async (id2, state) => {
+    try {
+      const got = await state.reader.read();
+      if (got.done) {
+        running.delete(id2);
+        post({ id: id2, done: true });
+        return;
+      }
+      const bytes = fresh2(got.value);
+      post({ id: id2, chunk: bytes }, [bytes.buffer]);
+    } catch (err) {
+      fail3(id2, err);
+    }
+  };
+  const step2 = (message3) => {
+    const state = running.get(message3.id);
+    if (!state) return;
+    if ("body" in message3) state.body.push(message3.body);
+    else if ("bodyEnd" in message3) state.body.push(null);
+    else if ("pull" in message3) void pull(message3.id, state);
+    else {
+      running.delete(message3.id);
+      state.abort.abort(new DOMException(message3.cancel, "AbortError"));
+      void state.reader?.cancel(message3.cancel).catch(() => void 0);
+    }
+    state.wakeBody?.();
+  };
+  return {
+    handle(data) {
+      const message3 = data?.embedder;
+      if (!message3) return false;
+      if ("ask" in message3) void start2(message3.ask);
+      else step2(message3);
+      return true;
+    }
+  };
+}
+function embedderReplyOf(data) {
+  return data?.embedderReply;
+}
+
 // src/facade/port.ts
 var FACADE_GONE = "the facade host is gone";
 function serveFacadePort(port, hook, { name: name2, stamp }, onDone) {
@@ -1082,6 +1278,7 @@ function kernelFdKind(file) {
   if (file.tty) return "tty";
   if (file.sealed) return "sealed";
   if (file.clipboard) return "clipboard";
+  if (file.embedder) return "embedder";
   return file.seek ? "file" : "stream";
 }
 var FdTable = class _FdTable {
@@ -3365,7 +3562,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.152.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.154.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -4210,9 +4407,9 @@ var Crontabs = class {
     const json5 = JSON.stringify({ v: TAGS_VERSION, ...kept });
     if (json5 === await fs.readFile(TAGS_PATH).catch(() => "")) return;
     const owner = owners ? { uid: 0, gid: 0, mode: 384 } : void 0;
-    const fresh2 = `${TAGS_PATH}.${crypto.randomUUID()}.new`;
-    await fs.writeFile(fresh2, json5, owner);
-    await fs.rename(fresh2, TAGS_PATH);
+    const fresh3 = `${TAGS_PATH}.${crypto.randomUUID()}.new`;
+    await fs.writeFile(fresh3, json5, owner);
+    await fs.rename(fresh3, TAGS_PATH);
   }
   async install(path, target, text, caller) {
     if (text.length > CRONTAB_MAX) return { error: "crontab: the table is too long" };
@@ -4226,11 +4423,11 @@ var Crontabs = class {
       await fs.mkdir(SPOOL_DIR, { recursive: true });
       if (owners) await fs.chown?.(SPOOL_DIR, { uid: 0, gid: 0, mode: 448, follow: false });
     }
-    const fresh2 = `${SPOOL_DIR}/.${target.name}.${crypto.randomUUID()}.new`;
+    const fresh3 = `${SPOOL_DIR}/.${target.name}.${crypto.randomUUID()}.new`;
     const owner = owners ? { uid: target.uid, gid: target.gid, mode: 384 } : void 0;
     await this.retag(path, text, caller);
-    await fs.writeFile(fresh2, text, owner);
-    await fs.rename(fresh2, path);
+    await fs.writeFile(fresh3, text, owner);
+    await fs.rename(fresh3, path);
     return { text: "" };
   }
 };
@@ -4519,15 +4716,15 @@ var UnlinkedKeeper = class {
     const releases = [];
     const take = async () => {
       for (; ; ) {
-        const fresh2 = [...this.heldWithin(target).keys()].filter((path) => !paths.includes(path));
-        if (fresh2.length === 0) return;
-        fresh2.sort();
-        if (paths.some((path) => path > fresh2[0])) {
+        const fresh3 = [...this.heldWithin(target).keys()].filter((path) => !paths.includes(path));
+        if (fresh3.length === 0) return;
+        fresh3.sort();
+        if (paths.some((path) => path > fresh3[0])) {
           for (const release of releases.splice(0)) release();
-          fresh2.push(...paths.splice(0));
-          fresh2.sort();
+          fresh3.push(...paths.splice(0));
+          fresh3.sort();
         }
-        for (const path of fresh2) {
+        for (const path of fresh3) {
           paths.push(path);
           releases.push(await this.gate.acquire(path));
         }
@@ -4862,10 +5059,10 @@ var CronService = class {
     const text = JSON.stringify(stamp);
     const old = await fs.readFile(STAMP_PATH).catch(() => void 0);
     if (old === text || old === void 0 && text === EMPTY_STAMP) return;
-    const fresh2 = `${STAMP_PATH}.new`;
+    const fresh3 = `${STAMP_PATH}.new`;
     const owner = owners ? { uid: 0, gid: 0, mode: 384 } : void 0;
-    await fs.writeFile(fresh2, text, owner);
-    await fs.rename(fresh2, STAMP_PATH);
+    await fs.writeFile(fresh3, text, owner);
+    await fs.rename(fresh3, STAMP_PATH);
   }
   async load() {
     const { fs } = this.host;
@@ -6301,13 +6498,13 @@ function materializer(fs, listedAbsent) {
   };
 }
 function withEtcFiles(fs, files) {
-  const bytesOf4 = (path) => {
+  const bytesOf5 = (path) => {
     const text = files.get(path)?.();
     return text === void 0 ? void 0 : new TextEncoder().encode(text);
   };
   const absent2 = (path) => fs.lstat(path).then(() => false, missing2);
   const follow2 = linkFollower(fs, files);
-  const listedAbsent = async (path) => files.has(path) && await absent2(path) ? bytesOf4(path) : void 0;
+  const listedAbsent = async (path) => files.has(path) && await absent2(path) ? bytesOf5(path) : void 0;
   const fallback = (path, make) => async (err) => {
     const at = missing2(err) ? await follow2(path) : void 0;
     const bytes = at === void 0 ? void 0 : await listedAbsent(at);
@@ -6380,10 +6577,10 @@ var FreshModules = class {
     this.fresh.set(key, { umask: mask, pid, added: 0, setup: mask !== DEFAULT_UMASK });
   }
   forget(pid) {
-    for (const [path, fresh2] of this.fresh) if (fresh2.pid === pid) this.fresh.delete(path);
+    for (const [path, fresh3] of this.fresh) if (fresh3.pid === pid) this.fresh.delete(path);
   }
-  drop(fresh2) {
-    for (const [key, note] of [...this.fresh]) if (note === fresh2) this.fresh.delete(key);
+  drop(fresh3) {
+    for (const [key, note] of [...this.fresh]) if (note === fresh3) this.fresh.delete(key);
   }
   moved(from, to) {
     const source = normalizePath(from);
@@ -6392,10 +6589,10 @@ var FreshModules = class {
     for (const key of [...this.fresh.keys()]) {
       if (key === target || within3(key, target)) this.fresh.delete(key);
     }
-    for (const [key, fresh2] of [...this.fresh]) {
+    for (const [key, fresh3] of [...this.fresh]) {
       if (key !== source && !within3(key, source)) continue;
       this.fresh.delete(key);
-      this.fresh.set(target + key.slice(source.length), fresh2);
+      this.fresh.set(target + key.slice(source.length), fresh3);
     }
   }
   wrap(fs) {
@@ -6405,15 +6602,15 @@ var FreshModules = class {
     };
     const decide = async (given, known) => {
       const path = normalizePath(given);
-      const fresh2 = this.fresh.get(path);
-      if (!fresh2) return;
+      const fresh3 = this.fresh.get(path);
+      if (!fresh3) return;
       const bytes = known && known.length >= MAGIC.length ? known : await head(path);
-      const want = isModule(bytes) ? 73 & ~fresh2.umask : 0;
-      fresh2.setup = false;
-      if (want === fresh2.added) return;
+      const want = isModule(bytes) ? 73 & ~fresh3.umask : 0;
+      fresh3.setup = false;
+      if (want === fresh3.added) return;
       const mode = (await fs.stat(path)).mode & 4095;
-      await fs.chmod(path, mode & ~fresh2.added | want);
-      fresh2.added = want;
+      await fs.chmod(path, mode & ~fresh3.added | want);
+      fresh3.added = want;
     };
     const overrides = {
       writeFile: async (path, content, owner) => {
@@ -6426,9 +6623,9 @@ var FreshModules = class {
         }
       },
       chmod: async (path, mode) => {
-        const fresh2 = this.fresh.get(normalizePath(path));
-        if (fresh2?.setup && (mode & 4095) === (438 & ~fresh2.umask)) fresh2.setup = false;
-        else if (fresh2) this.drop(fresh2);
+        const fresh3 = this.fresh.get(normalizePath(path));
+        if (fresh3?.setup && (mode & 4095) === (438 & ~fresh3.umask)) fresh3.setup = false;
+        else if (fresh3) this.drop(fresh3);
         await fs.chmod(path, mode);
       },
       rm: async (path, options) => {
@@ -6445,8 +6642,8 @@ var FreshModules = class {
       link: async (from, to, follow2) => {
         await fs.link(from, to, follow2);
         const source = follow2 && fs.realpath ? await fs.realpath(from, true).catch(() => from) : from;
-        const fresh2 = this.fresh.get(normalizePath(source));
-        if (fresh2) this.fresh.set(normalizePath(to), fresh2);
+        const fresh3 = this.fresh.get(normalizePath(source));
+        if (fresh3) this.fresh.set(normalizePath(to), fresh3);
       }
     };
     const ranged2 = rangedOps(fs);
@@ -7150,7 +7347,7 @@ var FsWatchers = class {
     };
     const content = (run2, types) => async (...args) => {
       const at = normalizePath(args[0]);
-      const fresh2 = this.covers(at) && !await fs.exists(at).catch(() => true);
+      const fresh3 = this.covers(at) && !await fs.exists(at).catch(() => true);
       let done4 = false;
       try {
         await run2(...args);
@@ -7159,11 +7356,11 @@ var FsWatchers = class {
         const real = await realOf(at);
         const paths = real === at ? [at] : [at, real];
         this.report(paths);
-        if (done4) for (const type of types(fresh2, args)) this.emit(type, paths);
+        if (done4) for (const type of types(fresh3, args)) this.emit(type, paths);
       }
     };
-    const written2 = (fresh2) => fresh2 ? ["rename", "change"] : ["change"];
-    const overwritten = (fresh2, args) => fresh2 || args[1].length === 0 ? written2(fresh2) : ["change", "change"];
+    const written2 = (fresh3) => fresh3 ? ["rename", "change"] : ["change"];
+    const overwritten = (fresh3, args) => fresh3 || args[1].length === 0 ? written2(fresh3) : ["change", "change"];
     const reshaping = (run2) => async (...args) => {
       this.reshaped();
       try {
@@ -7190,14 +7387,14 @@ var FsWatchers = class {
             if (created4.length > 0 || !await fs.exists(ancestor)) created4.push(ancestor);
           }
         }
-        const fresh2 = !options?.recursive || this.typed.size > 0 && !await fs.exists(path);
+        const fresh3 = !options?.recursive || this.typed.size > 0 && !await fs.exists(path);
         let done4 = false;
         try {
           await fs.mkdir(path, options);
           done4 = true;
         } finally {
           this.report([...created4, path]);
-          if (done4) this.emit("rename", fresh2 ? [...created4, path] : created4);
+          if (done4) this.emit("rename", fresh3 ? [...created4, path] : created4);
         }
       },
       rm: reshaping(after(fs.rm.bind(fs), (path) => [path], "rename")),
@@ -7653,6 +7850,416 @@ var ClipboardBroker = class {
   }
 };
 
+// src/kernel/embedder.ts
+var EMBEDDER_PATH = "/dev/embedder";
+var EMBEDDER_HEADER_MAX = 64 * 1024;
+var EMBEDDER_WINDOW = 1024 * 1024;
+var EMBEDDER_BUDGET = 256 * 1024 * 1024;
+var EMBEDDER_PER_PROCESS = 16;
+var EMBEDDER_PROGRESS_PER_SECOND = 4;
+var KIND = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/;
+var NL = 10;
+var READY2 = { readable: true, writable: true, hangup: false };
+function lineOf2(err) {
+  const text = err instanceof Error ? err.message : String(err);
+  return (text.split("\n")[0] ?? "").slice(0, 200);
+}
+var ERRNOS = {
+  NotAllowedError: "EACCES",
+  AbortError: "EACCES",
+  NotSupportedError: "ENOTSUP",
+  NotFoundError: "ENOENT"
+};
+function embedderFailure(err) {
+  if (err instanceof KernelError) return err;
+  const name2 = err?.name;
+  return new KernelError(ERRNOS[String(name2)] ?? "EIO", lineOf2(err));
+}
+function headerOf(bytes) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new KernelError("EINVAL", "the request header is not JSON");
+  }
+  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2))
+    throw new KernelError("EINVAL", "the request header is not an object");
+  const { kind, ...options } = parsed2;
+  if (typeof kind !== "string" || kind.length > 64 || !KIND.test(kind))
+    throw new KernelError("EINVAL", "the request has no valid kind");
+  return { kind, options };
+}
+function joined2(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a);
+  out.set(b, a.length);
+  return out;
+}
+function aborted(signal) {
+  if (!signal) return void 0;
+  return new Promise((_, reject) => {
+    const stop = () => reject(new KernelError("EINTR"));
+    if (signal.aborted) stop();
+    else signal.addEventListener("abort", stop, { once: true });
+  });
+}
+async function interruptible2(work, signal) {
+  const stop = aborted(signal);
+  if (!stop) return work;
+  stop.catch(() => void 0);
+  return Promise.race([work, stop]);
+}
+var Budget2 = class {
+  used = 0;
+  limit;
+  constructor(limit) {
+    this.limit = limit;
+  }
+  take(n) {
+    if (this.used + n > this.limit) return false;
+    this.used += n;
+    return true;
+  }
+  give(n) {
+    this.used = Math.max(0, this.used - n);
+  }
+};
+var BodyPipe = class {
+  queue = [];
+  size = 0;
+  ended = false;
+  wake;
+  room;
+  stream;
+  constructor() {
+    this.stream = new ReadableStream(
+      {
+        pull: async (controller) => {
+          while (this.queue.length === 0 && !this.ended) {
+            await new Promise((resolve2) => {
+              this.wake = resolve2;
+            });
+          }
+          const next3 = this.queue.shift();
+          if (next3) {
+            this.size -= next3.length;
+            this.room?.();
+            controller.enqueue(next3);
+          } else controller.close();
+        }
+      },
+      { highWaterMark: 0 }
+    );
+  }
+  get full() {
+    return this.size >= EMBEDDER_WINDOW;
+  }
+  push(bytes) {
+    if (bytes.length === 0) return;
+    this.queue.push(bytes.slice());
+    this.size += bytes.length;
+    this.wake?.();
+  }
+  waitRoom() {
+    return new Promise((resolve2) => {
+      this.room = resolve2;
+    });
+  }
+  end() {
+    this.ended = true;
+    this.wake?.();
+    this.room?.();
+  }
+};
+function replyStream(reply) {
+  if (reply instanceof ReadableStream) return reply;
+  const bytes = typeof reply === "string" ? new TextEncoder().encode(reply) : reply instanceof Uint8Array ? reply : new Uint8Array(0);
+  return new ReadableStream({
+    start(controller) {
+      if (bytes.length > 0) controller.enqueue(bytes);
+      controller.close();
+    }
+  });
+}
+var Throttle = class {
+  window = 0;
+  count = 0;
+  allow(now) {
+    if (now - this.window >= 1e3) {
+      this.window = now;
+      this.count = 0;
+    }
+    this.count += 1;
+    return this.count <= EMBEDDER_PROGRESS_PER_SECOND;
+  }
+};
+var EmbedderChannel = class {
+  access;
+  owner;
+  caller;
+  broker;
+  header = new Uint8Array(0);
+  body;
+  reply;
+  replied;
+  rest;
+  done = false;
+  failure;
+  reported = false;
+  abort = new AbortController();
+  closed = false;
+  throttle = new Throttle();
+  constructor(broker, access2, caller) {
+    this.broker = broker;
+    this.access = access2;
+    this.caller = caller;
+    this.owner = caller.pid;
+  }
+  get dispatched() {
+    return this.body !== void 0;
+  }
+  fail(err) {
+    this.failure ??= embedderFailure(err);
+    return this.failure;
+  }
+  report(err) {
+    this.reported = true;
+    return this.fail(err);
+  }
+  async dispatch(bytes) {
+    const { kind, options } = headerOf(bytes);
+    const stamp = await this.broker.admit(kind, this.caller);
+    const hook = this.broker.hookFor(this.caller.client);
+    const body = new BodyPipe();
+    this.body = body;
+    const caller = this.caller;
+    const progress = (line) => {
+      if (this.throttle.allow(Date.now())) caller.progress(lineOf2(line));
+    };
+    const asked = Promise.resolve().then(
+      () => hook.handle({
+        kind,
+        options,
+        body: body.stream,
+        stamp,
+        signal: this.abort.signal,
+        progress
+      })
+    ).then((reply) => replyStream(reply).getReader());
+    this.replied = asked.catch((err) => {
+      body.end();
+      throw this.fail(err);
+    });
+    this.replied.catch(() => void 0);
+  }
+  async write(bytes, signal) {
+    if (this.access === "read") throw new KernelError("EBADF");
+    if (this.failure) throw this.report(this.failure);
+    if (this.reply || this.done) throw new KernelError("EBADF");
+    if (this.body) return this.writeBody(bytes, signal);
+    const at = bytes.indexOf(NL);
+    const head = at < 0 ? bytes : bytes.subarray(0, at);
+    if (this.header.length + head.length > EMBEDDER_HEADER_MAX)
+      throw this.report(new KernelError("EINVAL", "the request header is too long"));
+    this.header = joined2(this.header, head);
+    if (at < 0) return bytes.length;
+    try {
+      await this.dispatch(this.header);
+    } catch (err) {
+      throw this.report(err);
+    }
+    this.body?.push(bytes.subarray(at + 1));
+    return bytes.length;
+  }
+  async writeBody(bytes, signal) {
+    const body = this.body;
+    while (body.full && !this.failure) {
+      await interruptible2(body.waitRoom(), signal).catch((err) => {
+        this.cancel("interrupted");
+        throw err;
+      });
+    }
+    if (this.failure) throw this.report(this.failure);
+    body.push(bytes);
+    return bytes.length;
+  }
+  async readerOf(signal) {
+    if (this.reply) return this.reply;
+    if (!this.body) {
+      try {
+        await this.dispatch(this.header);
+      } catch (err) {
+        throw this.fail(err);
+      }
+    }
+    this.body?.end();
+    this.reply = await interruptible2(
+      this.replied,
+      signal
+    );
+    return this.reply;
+  }
+  async read(max, signal) {
+    if (this.access === "write") throw new KernelError("EBADF");
+    if (this.failure) throw this.report(this.failure);
+    if (this.done || max <= 0) return new Uint8Array(0);
+    try {
+      return await this.next(max, signal);
+    } catch (err) {
+      if (err instanceof KernelError && err.code === "EINTR") {
+        this.cancel("interrupted");
+        throw err;
+      }
+      throw this.report(err);
+    }
+  }
+  async next(max, signal) {
+    const reader = await this.readerOf(signal);
+    let chunk2 = this.rest;
+    this.rest = void 0;
+    if (!chunk2) {
+      const got = await interruptible2(reader.read(), signal);
+      if (got.done) {
+        this.done = true;
+        return new Uint8Array(0);
+      }
+      chunk2 = got.value;
+    }
+    if (chunk2.length > max) this.rest = chunk2.subarray(max);
+    return chunk2.subarray(0, max);
+  }
+  poll() {
+    return this.body?.full ? { ...READY2, writable: false } : READY2;
+  }
+  cancel(reason) {
+    if (this.abort.signal.aborted) return;
+    this.abort.abort(new DOMException(reason, "AbortError"));
+    this.body?.end();
+    void this.reply?.cancel(reason).catch(() => void 0);
+  }
+  async close() {
+    if (this.closed) return;
+    const signal = this.caller.closing();
+    this.closed = true;
+    try {
+      if (this.access === "read") return;
+      if (this.failure) {
+        if (this.reported) return;
+        throw this.report(this.failure);
+      }
+      if (this.access === "both" && this.dispatched) return;
+      if (!this.dispatched && this.header.length === 0) return;
+      await this.drain(signal);
+    } finally {
+      if (!this.done) this.cancel("closed");
+      this.broker.release(this);
+    }
+  }
+  async drain(signal) {
+    try {
+      const reader = await this.readerOf(signal);
+      for (; ; ) {
+        const got = await interruptible2(reader.read(), signal);
+        if (got.done) break;
+      }
+      this.done = true;
+    } catch (err) {
+      if (err instanceof KernelError && err.code === "EINTR") this.cancel("interrupted");
+      throw this.fail(err);
+    }
+  }
+};
+var EmbedderBroker = class {
+  users;
+  lookup;
+  hooks = /* @__PURE__ */ new Map();
+  budget;
+  open = /* @__PURE__ */ new Map();
+  tagsOf;
+  constructor(users, lookup4, tagsOf = () => void 0, budget = EMBEDDER_BUDGET) {
+    this.users = users;
+    this.tagsOf = tagsOf;
+    this.lookup = lookup4;
+    this.budget = new Budget2(budget);
+  }
+  register(client, hook) {
+    if (!hook) return () => void 0;
+    this.hooks.set(client, hook);
+    return () => {
+      if (this.hooks.get(client) === hook) this.hooks.delete(client);
+    };
+  }
+  hookFor(client) {
+    return this.hooks.get(client);
+  }
+  async allowed(policy, caller) {
+    if (caller.euid === 0 || caller.euid === caller.sessionUid) return true;
+    if (policy.group !== void 0) {
+      const gid = await this.lookup.groupId(policy.group);
+      if (gid !== void 0 && (caller.egid === gid || caller.groups.includes(gid))) return true;
+    }
+    for (const user of policy.users ?? []) {
+      const uid = typeof user === "number" ? user : await this.lookup.userId(user);
+      if (uid === caller.euid) return true;
+    }
+    return false;
+  }
+  async admit(kind, caller) {
+    const hook = this.hooks.get(caller.client);
+    if (!hook) throw new KernelError("ENOTSUP", "no page answers requests for this session");
+    const policy = Object.hasOwn(hook.kinds, kind) ? hook.kinds[kind] : void 0;
+    if (!policy) throw new KernelError("ENOTSUP", `this embedder does not answer ${kind}`);
+    if (this.users !== "off" && !await this.allowed(policy, caller))
+      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
+    const tags = caller.tags;
+    return {
+      pid: caller.shownPid,
+      uid: caller.euid,
+      gid: caller.egid,
+      groups: [...caller.groups],
+      users: this.users,
+      kind,
+      ...tags?.length ? { tag: tags[0], tags: [...tags] } : {}
+    };
+  }
+  channel(access2, caller) {
+    const mine = this.open.get(caller.pid) ?? /* @__PURE__ */ new Set();
+    if (mine.size >= EMBEDDER_PER_PROCESS)
+      throw new KernelError("EMFILE", `at most ${EMBEDDER_PER_PROCESS} requests per process`);
+    if (!this.budget.take(2 * EMBEDDER_WINDOW))
+      throw new KernelError("EAGAIN", "the embedder request budget is spent");
+    const channel = new EmbedderChannel(this, access2, caller);
+    mine.add(channel);
+    this.open.set(caller.pid, mine);
+    return new OpenFile({
+      read: channel.read.bind(channel),
+      write: (bytes, signal) => channel.write(bytes, signal),
+      poll: () => channel.poll(),
+      close: () => channel.close(),
+      embedder: channel
+    });
+  }
+  release(channel) {
+    const mine = this.open.get(channel.owner);
+    if (!mine?.delete(channel)) return;
+    if (mine.size === 0) this.open.delete(channel.owner);
+    this.budget.give(2 * EMBEDDER_WINDOW);
+  }
+};
+function kindsOf(hook) {
+  if (typeof hook?.handle !== "function" || typeof hook.kinds !== "object" || !hook.kinds)
+    throw new TypeError("requests needs kinds and handle");
+  return Object.fromEntries(
+    Object.entries(hook.kinds).map(([kind, policy]) => [
+      kind,
+      {
+        ...policy?.group !== void 0 ? { group: String(policy.group) } : {},
+        ...policy?.users ? { users: [...policy.users] } : {}
+      }
+    ])
+  );
+}
+
 // src/kernel/exec-ticket.ts
 var TICKET_ENV = "SLICC_SEALED_TICKET";
 var TICKET_TTL_MS = 3e4;
@@ -8221,9 +8828,9 @@ var HeldPaths = class extends Map {
     return false;
   }
   keep(path, file) {
-    const fresh2 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
-    for (const id2 of fresh2) this.keptHandles.set(id2, file);
-    this.uses.set(file, Math.max(fresh2.length, 1));
+    const fresh3 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
+    for (const id2 of fresh3) this.keptHandles.set(id2, file);
+    this.uses.set(file, Math.max(fresh3.length, 1));
     this.unlinked.set(path, file);
   }
   unkeep(path, file) {
@@ -9419,8 +10026,8 @@ var MountFs = class _MountFs {
     }
     this.writable(mount, real);
     const { uid, gid, mode } = change;
-    const fresh2 = change.kind === "new" && { uid, gid, mode };
-    const set3 = fresh2 ? await this.driverOwner(found, real, fresh2, false) : change;
+    const fresh3 = change.kind === "new" && { uid, gid, mode };
+    const set3 = fresh3 ? await this.driverOwner(found, real, fresh3, false) : change;
     this.table.forget(mount, real);
     const attrs = Object.entries({ uid: set3.uid, gid: set3.gid, mode: set3.mode });
     await mount.conn.call({
@@ -9692,10 +10299,10 @@ async function runMkdir(entry, path, req) {
   const plain3 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh2 = plain3 !== void 0 && !await fs.exists(path);
+  const fresh3 = plain3 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh2) await fs.chmod(path, plain3);
+  if (fresh3) await fs.chmod(path, plain3);
   return done;
 }
 async function shownAs(entry, path, st) {
@@ -10699,9 +11306,9 @@ var Pages = class {
       const page = (start2 + at) / PAGE;
       if (this.pages.has(page)) continue;
       const part = bytes.subarray(at, Math.min(at + PAGE, bytes.length));
-      const fresh2 = this.take(part.length);
-      fresh2.set(part);
-      this.pages.set(page, fresh2);
+      const fresh3 = this.take(part.length);
+      fresh3.set(part);
+      this.pages.set(page, fresh3);
     }
   }
   read(at, length2) {
@@ -12820,6 +13427,7 @@ var TLS_SERVER_REQUEST_CERT = 1;
 var TLS_SERVER_REQUIRE_CERT = 2;
 var TLS_SERVER_SELECT = 4;
 var TLS_HANDSHAKE_SELECT = 2;
+var TLS_KEYLOG = 8;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -12887,6 +13495,9 @@ var TlsEngine = class {
     if (!ptr) throw this.error(this.m._tls_last_error(), "server certificate");
     return new TlsLeaf(this, this.m, ptr);
   }
+  get keylogs() {
+    return typeof this.m._tls_keylog === "function";
+  }
   get serverSelect() {
     return typeof this.m._tls_server_select === "function";
   }
@@ -12917,9 +13528,11 @@ var TlsEngine = class {
       this.m._free(ptr);
     }
   }
-  intoScratch(fn) {
+  intoScratch(fn, secret = false) {
     const n = fn(this.scratch, SCRATCH);
-    return n > 0 ? this.taken(n) : n;
+    const out = n > 0 ? this.taken(n) : n;
+    if (secret && n > 0) this.m.HEAPU8.fill(0, this.scratch, this.scratch + n);
+    return out;
   }
   get sessionControls() {
     return typeof this.m._tls_client_cert === "function";
@@ -12963,18 +13576,18 @@ var TlsEngine = class {
   chainFlags(store, chain2, hostname) {
     const verify = this.m._tls_chain_verify;
     if (!verify || chain2.length === 0) return void 0;
-    const joined4 = new Uint8Array(chain2.reduce((n, c) => n + c.length, 0));
+    const joined5 = new Uint8Array(chain2.reduce((n, c) => n + c.length, 0));
     let at = 0;
     for (const der2 of chain2) {
-      joined4.set(der2, at);
+      joined5.set(der2, at);
       at += der2.length;
     }
     const name2 = this.put(new TextEncoder().encode(hostname));
     try {
-      return this.withBytes(joined4, (p) => {
+      return this.withBytes(joined5, (p) => {
         const out = this.scratch;
         this.m.HEAPU8.fill(255, out, out + 4);
-        const ret = verify(store.ptr, p, joined4.length, name2, out);
+        const ret = verify(store.ptr, p, joined5.length, name2, out);
         const flags2 = new DataView(this.m.HEAPU8.buffer, out, 4).getUint32(0, true);
         if (ret === 0) return flags2 === 0 ? 0 : void 0;
         return ret === 1 && flags2 !== 0 ? flags2 : void 0;
@@ -13130,6 +13743,14 @@ var TlsSession = class {
   get version() {
     return this.c._tls_version(this.ptr);
   }
+  keylog() {
+    const drain2 = this.m._tls_keylog;
+    const out = this.engine.intoScratch((p, max) => drain2(this.ptr, p, max), true);
+    if (!(out instanceof Uint8Array)) return [];
+    const text = new TextDecoder().decode(out);
+    out.fill(0);
+    return text.split("\n").filter((line) => line.length > 0);
+  }
   get sni() {
     const out = this.engine.intoScratch(
       (p, max) => this.m._tls_sni(this.ptr, p, max)
@@ -14650,7 +15271,7 @@ function isIP(name2) {
   return ipv4Bytes(name2) !== void 0 || name2.includes(":") && ipv6Groups(name2) !== void 0;
 }
 function clientFlags(o) {
-  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0);
+  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0) | (o.keylog ? TLS_KEYLOG : 0);
 }
 function openSession(o) {
   return o.engine.clientSession(o.store, o.servername, o.alpn, clientFlags(o));
@@ -14765,7 +15386,8 @@ async function infoOf(o, session) {
     peerCertificates: chain2,
     ...controlsOf(o, session, protocol, chain2, shape),
     verified: verdictOf(o, session),
-    handshakeAt: Date.now()
+    handshakeAt: Date.now(),
+    ...o.keylog ? { keylog: session.keylog() } : {}
   };
 }
 var FATAL_ALERT = -30592;
@@ -14885,7 +15507,7 @@ async function serverHandshake(conn, session, inbox, hooks) {
     }
   }
 }
-async function tlsServer(conn, session, clientCerts, select) {
+async function tlsServer(conn, session, clientCerts, select, keylog = false) {
   let first;
   const watched = {
     ...conn,
@@ -14908,7 +15530,8 @@ async function tlsServer(conn, session, clientCerts, select) {
       servername: session.sni,
       authorized: clientCerts && chain2.length > 0 && code === void 0,
       ...clientCerts && chain2.length > 0 && code ? { authorizationError: code } : {},
-      peerCertificates: chain2
+      peerCertificates: chain2,
+      ...keylog ? { keylog: session.keylog() } : {}
     };
     return { conn: plaintext(conn, session, inbox), info };
   } catch (err) {
@@ -15708,6 +16331,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
     ...file.tty ? { tty: file.tty } : {},
     identity: file.identity ?? file,
     ...file.clipboard ? { clipboard: file.clipboard } : {},
+    ...file.embedder ? { embedder: file.embedder } : {},
     ...file.write ? {
       write: async (bytes, signal) => {
         await turn(signal);
@@ -15764,7 +16388,8 @@ function scrubStdio(fds, scrubber) {
   const stdio = stdioFiles(fds);
   for (const fd of fds.numbers()) {
     const original = fds.get(fd);
-    if (!stdio.has(original) && !original.file.tty && !original.file.clipboard) continue;
+    const named = original.file.tty || original.file.clipboard || original.file.embedder;
+    if (!stdio.has(original) && !named) continue;
     const known = wrapped.get(original);
     const flags2 = fds.statusFlags(fd);
     const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
@@ -15777,9 +16402,9 @@ function scrubStdio(fds, scrubber) {
 // src/kernel/net/sealed-scrubs.ts
 function addTo(tree2, host, secrets) {
   const entry = tree2.get(host) ?? { secrets: [], version: 0, scrubber: void 0 };
-  const fresh2 = secrets.filter((s) => !entry.secrets.some((e) => e.value === s.value));
-  if (fresh2.length === 0) return;
-  entry.secrets = [...entry.secrets, ...fresh2];
+  const fresh3 = secrets.filter((s) => !entry.secrets.some((e) => e.value === s.value));
+  if (fresh3.length === 0) return;
+  entry.secrets = [...entry.secrets, ...fresh3];
   entry.version += 1;
   entry.scrubber = void 0;
   tree2.set(host, entry);
@@ -15993,13 +16618,13 @@ function serialized(reply) {
     const text = JSON.stringify(reply);
     plain3 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
-    return JSON.stringify(errorReply("EIO", lineOf2(err)));
+    return JSON.stringify(errorReply("EIO", lineOf3(err)));
   }
   if (!isRecord(plain3)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
   const { v: _, ...rest2 } = plain3;
   return JSON.stringify({ v: 1, ...rest2 });
 }
-function lineOf2(err) {
+function lineOf3(err) {
   const text = err instanceof Error ? err.message : String(err);
   return (text.split("\n")[0] ?? "").slice(0, 200);
 }
@@ -16050,7 +16675,7 @@ var SealedChannel = class {
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
       (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf2(err))
+      (err) => errorReply("EIO", lineOf3(err))
     );
     const reply = await Promise.race([asked, stopped]);
     if (!signal.aborted) return reply;
@@ -17167,13 +17792,13 @@ var PgServer = class {
       at += whole;
     }
     this.buffer = data.slice(at);
-    const joined4 = new Uint8Array(out.reduce((n, b) => n + b.length, 0));
+    const joined5 = new Uint8Array(out.reduce((n, b) => n + b.length, 0));
     let to = 0;
     for (const b of out) {
-      joined4.set(b, to);
+      joined5.set(b, to);
       to += b.length;
     }
-    return joined4;
+    return joined5;
   }
 };
 function frame3(type, body) {
@@ -17396,7 +18021,7 @@ function latin12(bytes) {
   for (const b of bytes) out += String.fromCharCode(b);
   return out;
 }
-function bytesOf(text) {
+function bytesOf2(text) {
   const out = new Uint8Array(text.length);
   for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i);
   return out;
@@ -17515,12 +18140,12 @@ var SessionWriter = class {
     if (this.failed !== void 0) throw this.failed;
     if (this.mode === "pass") return this.conn.write(bytes);
     clearTimeout(this.timer);
-    const joined4 = new Uint8Array(this.buffer.length + bytes.length);
-    joined4.set(this.buffer);
-    joined4.set(bytes, this.buffer.length);
+    const joined5 = new Uint8Array(this.buffer.length + bytes.length);
+    joined5.set(this.buffer);
+    joined5.set(bytes, this.buffer.length);
     this.buffer.fill(0);
-    this.buffer = joined4;
-    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
+    this.buffer = joined5;
+    if (this.mode === "sniff") this.mode = modeOf(latin12(joined5.subarray(0, 8))) ?? "sniff";
     if (this.mode === "pg" && !this.sawPg) {
       this.sawPg = true;
       if (!this.s.verified) void this.proof("pg");
@@ -17548,7 +18173,7 @@ var SessionWriter = class {
       const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
       all.fill(0);
       if ("values" in out && out.values) this.remember(out.values);
-      const line = bytesOf(`${out.line}\r
+      const line = bytesOf2(`${out.line}\r
 `);
       try {
         await writeAll3(this.conn, line);
@@ -17605,7 +18230,7 @@ var SessionWriter = class {
       latin12(all.subarray(0, end)),
       (position, placeholders, head2) => this.ask("http1", position, { placeholders, head: head2 })
     ).catch(() => void 0);
-    const head = done4 ? bytesOf(done4.head) : all.subarray(0, end);
+    const head = done4 ? bytesOf2(done4.head) : all.subarray(0, end);
     if (done4) this.remember(done4.values);
     try {
       await writeAll3(this.conn, head);
@@ -17668,7 +18293,7 @@ var ScrubReader = class {
       const before = this.current();
       const out = this.through(got);
       if (before.length === 0 && out !== void 0) return out;
-      if (before.length > 0) return joined2(before, out);
+      if (before.length > 0) return joined3(before, out);
     }
   }
   through(got) {
@@ -17684,7 +18309,7 @@ var ScrubReader = class {
     return out.length > 0 ? out : void 0;
   }
 };
-function joined2(a, b) {
+function joined3(a, b) {
   if (!b) return a;
   const out = new Uint8Array(a.length + b.length);
   out.set(a);
@@ -17799,7 +18424,8 @@ function sessionOf(info, servername) {
     } : {},
     servername,
     peerCertificates: info.peerCertificates.map(encode),
-    ...controls(info)
+    ...controls(info),
+    ...info.keylog ? { keylog: info.keylog } : {}
   };
 }
 function controls(info) {
@@ -17941,11 +18567,14 @@ async function prepareWith(support, req, servername, cert) {
     insecure: req.insecure === true,
     ...req.sni === false ? { sni: false } : {},
     ...req.checkHostname === false ? { checkHostname: false } : {},
+    ...req.keylog === true ? { keylog: true } : {},
     clientCertificate: cert !== void 0,
     bundled: own === void 0
   };
   let session;
   try {
+    if (req.keylog === true && !engine.keylogs)
+      throw new KernelError("ENOTSUP", "the installed tls engine has no key log");
     const controls2 = req.sni === false || req.checkHostname === false || cert !== void 0;
     if (controls2 && !engine.sessionControls) {
       throw new KernelError("ENOTSUP", "the installed tls engine has no client certificates");
@@ -17993,7 +18622,7 @@ function secure(prepared, seal) {
     try {
       const made2 = await tlsClient(raw2, prepared.options);
       const engine = prepared.options.engine;
-      const session = sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
+      const session = prepared.options.keylog ? void 0 : sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
       if (!session) return made2;
       made2.info.substitutes = substitutes(session);
       if (made2.info.substitutes && session.verified)
@@ -18106,25 +18735,31 @@ function certFlags(req) {
   if (!req.requestCert) return 0;
   return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
 }
-function flagsOf(req) {
-  if (!req.select) return certFlags(req);
+var CERT_FLAGS = TLS_SERVER_REQUEST_CERT | TLS_SERVER_REQUIRE_CERT;
+function selectFlag(req) {
+  if (!req.select) return 0;
   if (req.alpn && req.alpn.length > 0)
     throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS: alpn with select");
-  return certFlags(req) | TLS_SERVER_SELECT;
+  return TLS_SERVER_SELECT;
+}
+function flagsOf(req) {
+  return certFlags(req) | selectFlag(req) | (req.keylog ? TLS_KEYLOG : 0);
 }
-async function engineOf(proc, select) {
+async function engineOf(proc, { select, keylog }) {
   const engine = await supportOf(proc.net).engine();
   if (!engine.serverSessions)
     throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
+  if (keylog && !engine.keylogs)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no key log");
   if (select && !engine.serverSelect)
     throw new KernelError("ENOTSUP", "the installed tls engine has no server selection");
   return engine;
 }
-async function importedLeaf(proc, own, select) {
+async function importedLeaf(proc, own, needs = {}) {
   const cert = certBytes(own);
   let engine;
   try {
-    engine = await engineOf(proc, select);
+    engine = await engineOf(proc, needs);
   } catch (err) {
     wipe(cert);
     throw err;
@@ -18154,12 +18789,12 @@ async function serverOf(proc, req) {
   delete req.cert;
   if (!own && !req.select)
     throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
-  const { engine, leaf } = own ? await importedLeaf(proc, own, req.select) : { engine: await engineOf(proc, true), leaf: void 0 };
+  const { engine, leaf } = own ? await importedLeaf(proc, own, req) : { engine: await engineOf(proc, { ...req, select: true }), leaf: void 0 };
   let mine;
   try {
     mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
     const flags2 = flagsOf(req);
-    const store = mine ?? (flags2 & ~TLS_SERVER_SELECT ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
+    const store = mine ?? (flags2 & CERT_FLAGS ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
       leaf,
@@ -18193,7 +18828,8 @@ function servedOf(info) {
     authorized: info.authorized,
     ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
     peerCertificates: info.peerCertificates.map(encode),
-    cipher: info.cipher
+    cipher: info.cipher,
+    ...info.keylog ? { keylog: info.keylog } : {}
   };
 }
 var selections = /* @__PURE__ */ new WeakMap();
@@ -18216,13 +18852,14 @@ async function serveSecure(proc, socket, req) {
   const { engine, leaf, alpn, store, flags: flags2 } = server;
   const limit = handshakeSignal(proc, server.timeoutMs);
   const { pausedAt, select } = pausing(limit.signal);
-  const certs = (flags2 & ~TLS_SERVER_SELECT) !== 0;
+  const certs = (flags2 & CERT_FLAGS) !== 0;
   const run2 = socket.secureLink(
     (raw2) => tlsServer(
       raw2,
       engine.serverSession(leaf, alpn, store, flags2),
       certs,
-      flags2 & TLS_SERVER_SELECT ? select : void 0
+      flags2 & TLS_SERVER_SELECT ? select : void 0,
+      (flags2 & TLS_KEYLOG) !== 0
     ),
     limit.signal,
     (reason) => !shared && reason === timedOut
@@ -18592,7 +19229,7 @@ async function connect(req, proc) {
     dialing?.catch(() => void 0);
     throw new KernelError("EINPROGRESS");
   }
-  if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
+  if (dialing !== void 0) await interruptible3(dialing, proc.blocking());
   return ok3();
 }
 async function bindUnixDgram(proc, socket, addr) {
@@ -18657,7 +19294,7 @@ async function unixDatagram(req, dgram, proc) {
 function domainOf(socket) {
   return socket instanceof UnixDgram ? "unix" : "inet";
 }
-function interruptible2(dialing, signal) {
+function interruptible3(dialing, signal) {
   return new Promise((resolve2, reject) => {
     const abort = () => reject(new KernelError("EINTR"));
     signal.addEventListener("abort", abort, { once: true });
@@ -18692,7 +19329,7 @@ var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
 ]);
 var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
 function sessionControls(req) {
-  return req.sni === false || req.checkHostname === false || req.clientCert !== void 0;
+  return req.sni === false || req.checkHostname === false || req.clientCert !== void 0 || req.keylog === true;
 }
 function wantsKernel(req) {
   if (req.path === "kernel") return true;
@@ -19661,7 +20298,7 @@ var ProcessWatches = class {
 };
 
 // src/kernel/process.ts
-function aborted(signal) {
+function aborted2(signal) {
   return new Promise((_, reject) => {
     signal.addEventListener("abort", () => reject(new KernelError("EINTR")), { once: true });
   });
@@ -19751,6 +20388,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-open-sealed",
   "fd-open-clipboard",
   "fd-clipboard-abort",
+  "fd-open-embedder",
   "tty-get",
   "tty-set",
   "tty-winsz",
@@ -20304,6 +20942,7 @@ var WasmProcess = class {
     if (!read) throw new KernelError(req.peek && file.read ? "EOPNOTSUPP" : "EBADF");
     if (file.tty) this.checkForeground(file.tty);
     if (file.clipboard) return this.readClipboard(file.clipboard, req, cancelled);
+    if (file.embedder) return this.readEmbedder(file, req, cancelled);
     if (file instanceof EventFd && req.max < EventFd.SIZE) throw new KernelError("EINVAL");
     if (req.max <= 0) return new Uint8Array(0);
     if (file instanceof KernelSocket && file.unconnected) throw new KernelError("ENOTCONN");
@@ -20324,6 +20963,81 @@ var WasmProcess = class {
       throw err;
     }
   }
+  async readEmbedder(file, req, cancelled) {
+    const channel = file.embedder;
+    if (req.max <= 0) return new Uint8Array(0);
+    channel.caller = await this.embedderCaller();
+    try {
+      return await channel.read(Math.min(req.max, MAX_READ), this.blockingSignal(cancelled));
+    } catch (err) {
+      await this.deviceComplaint(EMBEDDER_PATH, err);
+      throw err;
+    }
+  }
+  async writeEmbedder(file, body, nonblock, cancelled) {
+    const channel = file.embedder;
+    channel.caller = await this.embedderCaller();
+    const write = file.write;
+    if (!pollFile(file).writable && nonblock) throw new KernelError("EAGAIN");
+    try {
+      return await write.call(file, body, this.blockingSignal(cancelled));
+    } catch (err) {
+      await this.deviceComplaint(EMBEDDER_PATH, err);
+      throw err;
+    }
+  }
+  async deviceComplaint(path, err) {
+    const name2 = this.options.clipboardName;
+    if (name2 === void 0 || !(err instanceof KernelError) || err.detail === void 0) return;
+    if (err.code === "EINTR") return;
+    await this.complainLine(`${name2}: ${path}: ${clipboardLine(err.detail)}`);
+  }
+  async complainLine(line) {
+    const stderr = this.fds.has(2) ? this.fds.get(2).file : void 0;
+    if (!stderr?.write || stderr.clipboard || stderr.embedder || stderr.sealed) return;
+    const timeout = new Promise((r) => setTimeout(() => r(0), 1e3));
+    await Promise.race([
+      stderr.write(new TextEncoder().encode(`${line}
+`), AbortSignal.timeout(1e3)).catch(() => 0),
+      timeout
+    ]);
+  }
+  async embedderCaller() {
+    const shown = await this.options.identity?.();
+    const session = this.options.embedderSession?.() ?? { client: 0, uid: 0 };
+    const name2 = this.options.clipboardName ?? this.options.embedderName ?? "program";
+    return {
+      pid: this.pid,
+      shownPid: shown?.pid ?? this.pid,
+      euid: this.cred.euid,
+      egid: this.cred.egid,
+      groups: [...this.cred.groups],
+      sessionUid: session.uid,
+      client: session.client,
+      tags: this.options.embedder?.tagsOf(this.pid),
+      progress: (line) => void this.complainLine(`${name2}: ${line}`),
+      closing: () => AbortSignal.any([this.interrupt.signal, this.gone.signal])
+    };
+  }
+  async closeFd(fd) {
+    this.options.locks?.closed(this.pid, fd);
+    await this.dropRecordLocks(fd);
+    const closing2 = this.fds.get(fd).file;
+    const channel = closing2.clipboard;
+    if (channel) channel.stamp = await this.clipboardStamp();
+    if (closing2.embedder) closing2.embedder.caller = await this.embedderCaller();
+    await Promise.resolve(this.fds.close(fd)).catch(async (err) => {
+      if (channel) await this.clipboardComplaint(err);
+      if (closing2.embedder) await this.deviceComplaint(EMBEDDER_PATH, err);
+      throw err;
+    });
+  }
+  async openEmbedder(flags2) {
+    const broker = this.options.embedder;
+    if (!broker) throw new KernelError("ENOENT");
+    const file = broker.channel(openAccess(flags2), await this.embedderCaller());
+    return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
+  }
   async complain(line) {
     const stderr = this.fds.has(2) ? this.fds.get(2).file : void 0;
     if (!stderr?.write || stderr.sealed || stderr.clipboard) return false;
@@ -20354,6 +21068,7 @@ var WasmProcess = class {
     const file = this.fds.get(fd).file;
     if (file.sealed) return file.sealed.send(body, await this.sealedCaller(), this.gone.signal);
     if (!file.write) throw new KernelError("EBADF");
+    if (file.embedder) return this.writeEmbedder(file, body, nonblock, cancelled);
     if (!pollFile(file).writable) {
       if (nonblock) throw new KernelError("EAGAIN");
       return file.write(body, this.blockingSignal(cancelled));
@@ -20401,11 +21116,11 @@ var WasmProcess = class {
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
           const marks = this.options.owners || plain3 !== void 0;
-          const fresh2 = marks && !await present3(fs, path, true);
+          const fresh3 = marks && !await present3(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2 && plain3 !== void 0) await fs.chmod?.(path, plain3);
-          else if (fresh2) {
+          if (fresh3 && plain3 !== void 0) await fs.chmod?.(path, plain3);
+          else if (fresh3) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
         });
@@ -20623,17 +21338,9 @@ var WasmProcess = class {
           kind: "json",
           json: await this.write(req.fd, req.body, req.nonblock, cancelled)
         };
-      case "fd-close": {
-        this.options.locks?.closed(this.pid, req.fd);
-        await this.dropRecordLocks(req.fd);
-        const channel = this.fds.get(req.fd).file.clipboard;
-        if (channel) channel.stamp = await this.clipboardStamp();
-        await Promise.resolve(this.fds.close(req.fd)).catch(async (err) => {
-          if (channel) await this.clipboardComplaint(err);
-          throw err;
-        });
+      case "fd-close":
+        await this.closeFd(req.fd);
         return { ok: true, kind: "void" };
-      }
       case "fd-pipe": {
         const pipe = openPipe();
         const read = this.fds.install(pipe.read, 3);
@@ -20693,6 +21400,8 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: this.openSealed(req.flags) };
       case "fd-open-clipboard":
         return { ok: true, kind: "json", json: await this.openClipboard(req.flags) };
+      case "fd-open-embedder":
+        return { ok: true, kind: "json", json: await this.openEmbedder(req.flags) };
       case "fd-clipboard-abort": {
         const file = this.fds.get(req.fd);
         file.file.clipboard?.abort();
@@ -21187,7 +21896,7 @@ var WasmProcess = class {
       else {
         const { source, target, type, flags: flags2, data } = req;
         const signal = this.blockingSignal(cancelled);
-        await Promise.race([mount({ source, target, type, flags: flags2, data }, signal), aborted(signal)]);
+        await Promise.race([mount({ source, target, type, flags: flags2, data }, signal), aborted2(signal)]);
       }
     } catch (err) {
       const code = err?.code;
@@ -21197,7 +21906,7 @@ var WasmProcess = class {
     return { ok: true, kind: "void" };
   }
   pause(cancelled) {
-    return aborted(this.blockingSignal(cancelled));
+    return aborted2(this.blockingSignal(cancelled));
   }
   alarm;
   dlLog = [];
@@ -21747,6 +22456,15 @@ function linksOf(opts) {
 function clipboardName(opts) {
   return opts.program.abi === "js" ? {} : { clipboardName: opts.argv0 };
 }
+function embedderOptions(opts) {
+  if (!opts.embedder) return {};
+  return {
+    embedder: opts.embedder.broker,
+    embedderSession: opts.embedder.session,
+    embedderName: opts.argv0,
+    ...clipboardName(opts)
+  };
+}
 function processOptions(opts, header5, hooks, created4) {
   return {
     ...inherited(opts),
@@ -21754,6 +22472,7 @@ function processOptions(opts, header5, hooks, created4) {
     ...opts.sealed ? { sealed: opts.sealed } : {},
     ...opts.outputFilter ? { outputFilter: opts.outputFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
+    ...embedderOptions(opts),
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.source ? { source: opts.source } : {},
     noLinks: opts.noLinks,
@@ -24502,9 +25221,9 @@ var OpfsFs = class {
     this.lookups++;
     if (split2(path).length === 0) return this.root;
     const cached = this.files.get(path);
-    const fresh2 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
-    if (cached && !fresh2) this.files.delete(path);
-    if (cached && fresh2) {
+    const fresh3 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
+    if (cached && !fresh3) this.files.delete(path);
+    if (cached && fresh3) {
       if (this.glanced(cached)) return this.remember(path, cached);
       try {
         await this.glance(cached);
@@ -24722,8 +25441,8 @@ var OpfsFs = class {
   glanced(handle) {
     if (this.exact > 0) return void 0;
     const seen = this.glances.get(handle);
-    const fresh2 = seen && seen.changes === this.changes && this.recent(seen, GLANCE_LOOKUPS);
-    return fresh2 ? seen.file : void 0;
+    const fresh3 = seen && seen.changes === this.changes && this.recent(seen, GLANCE_LOOKUPS);
+    return fresh3 ? seen.file : void 0;
   }
   async glance(handle) {
     const at = performance.now();
@@ -24913,13 +25632,13 @@ var OpfsFs = class {
   async keptFor(path) {
     const at = normalizePath(path);
     const cached = this.files.get(at);
-    const fresh2 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
-    const [target, existed] = fresh2 ? [at, true] : await this.writeTarget(path);
+    const fresh3 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
+    const [target, existed] = fresh3 ? [at, true] : await this.writeTarget(path);
     if (!existed) return [void 0, target, false];
     this.refuse(target);
     const [entry] = await this.meta.get([target]);
     if (entry?.fifo || entry?.socket) throw fsError("ENXIO", path);
-    const kept = fresh2 ? cached : this.files.get(target);
+    const kept = fresh3 ? cached : this.files.get(target);
     const usable2 = kept && performance.now() - (this.found.get(kept) ?? -CHECK_MS) < CHECK_MS;
     return [usable2 ? kept : void 0, target, true];
   }
@@ -26634,14 +27353,14 @@ var RESTORE_AGAIN_MS = 3e4;
 function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
   const handles = /* @__PURE__ */ new Map();
   let nextFh = 0;
-  const fresh2 = (remote) => {
+  const fresh3 = (remote) => {
     if (remote.client.token === remote.token && !remote.client.gone) return remote;
     throw fsError2("ESTALE", "the folder was granted again, so this open file is gone");
   };
   const live = (fh) => {
     const remote = handles.get(fh);
     if (!remote) throw fsError2("EBADF", `handle ${fh}`);
-    return fresh2(remote);
+    return fresh3(remote);
   };
   const call = (op, body = {}) => current().call(op, body);
   const same2 = (was, mode, seen) => seen?.mode === (mode | 128) && (was.ino !== void 0 && seen.ino !== void 0 ? seen.ino === was.ino : seen.size === was.size && seen.mtime === was.mtime);
@@ -26723,7 +27442,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
       if (!remote) throw fsError2("EBADF", `handle ${fh}`);
       handles.delete(fh);
       try {
-        await fresh2(remote).client.call("release", { fh: remote.fh }, true);
+        await fresh3(remote).client.call("release", { fh: remote.fh }, true);
       } finally {
         if (remote.restore) await settle(current(), remote.restore);
       }
@@ -27087,7 +27806,7 @@ var PortTransport = class {
     }).finally(() => this.fail("the folder's watch ended"));
   }
 };
-var errorOf = (err) => ({
+var errorOf2 = (err) => ({
   code: typeof codeOf7(err) === "string" ? codeOf7(err) : "EIO",
   message: err?.message ?? String(err)
 });
@@ -27137,7 +27856,7 @@ function serveHostfsPort(port, transport) {
         );
         send2({ id: id2, end: true });
       } catch (err) {
-        send2({ id: id2, error: errorOf(err) });
+        send2({ id: id2, error: errorOf2(err) });
       } finally {
         watches.delete(id2);
       }
@@ -27165,7 +27884,7 @@ function serveHostfsPort(port, transport) {
       if (op !== "call") throw fsError2("EINVAL", `unknown hostfs port op ${op}`);
       send2({ id: id2, result: await answer2(data.name, data.body) });
     } catch (err) {
-      send2({ id: id2, error: errorOf(err) });
+      send2({ id: id2, error: errorOf2(err) });
     }
   };
   const stop = () => {
@@ -27798,7 +28517,7 @@ function homeModeOf(mode) {
   }
   return mode;
 }
-function joined3(name2, rows) {
+function joined4(name2, rows) {
   let changed = false;
   for (const g of rows) {
     if (g.members.includes(name2)) continue;
@@ -27985,7 +28704,7 @@ var UserDb = class {
           await this.provision(found, this.umaskFor(options), shared);
           await this.stampHome(found, shared, homeMode);
         }
-        if (joined3(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
+        if (joined4(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
         remember();
         return this.account(found, groups);
       }
@@ -27994,10 +28713,10 @@ var UserDb = class {
       if (groups.some((r) => r.name === name2)) throw fsError("EEXIST", `group ${name2} exists`);
       const uid = freeId(users, groups);
       const row = { name: name2, uid, gid: uid, gecos: name2, home, shell: "/bin/bash" };
-      joined3(name2, extra);
+      joined4(name2, extra);
       group.push({ name: name2, gid: uid, members: [] });
       passwd.push(row);
-      const fresh2 = !await this.fs.exists(home);
+      const fresh3 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
         await this.provision(row, this.umaskFor(options), shared);
@@ -28005,7 +28724,7 @@ var UserDb = class {
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
-        if (fresh2) await this.fs.rm(home, { recursive: true, force: true });
+        if (fresh3) await this.fs.rm(home, { recursive: true, force: true });
         throw err;
       }
       remember();
@@ -28383,12 +29102,12 @@ ${lines2}
     const timer = setTimeout(() => control.abort("expired"), timeout);
     const withdraw = () => control.abort("withdrawn");
     requester.addEventListener("abort", withdraw, { once: true });
-    const aborted2 = new Promise(
+    const aborted3 = new Promise(
       (resolve2) => control.signal.addEventListener("abort", () => resolve2("aborted"), { once: true })
     );
     try {
       const answered = Promise.resolve().then(() => approve(req, { signal: control.signal })).catch(() => "deny");
-      const answer2 = await Promise.race([answered, aborted2]);
+      const answer2 = await Promise.race([answered, aborted3]);
       if (answer2 === "aborted" || control.signal.aborted) {
         return control.signal.reason === "expired" ? failed2("ETIMEDOUT", "sudo: the request expired") : failed2("EINTR", "sudo: the request was withdrawn");
       }
@@ -28514,6 +29233,7 @@ var SUDO_SOURCE = [
 ].join("\n");
 
 // src/launcher.ts
+var NO_SESSION = { client: -1, uid: -1 };
 var MODULE_URLS = 16;
 function dataModuleUrl(source) {
   const bytes = new TextEncoder().encode(source);
@@ -28772,6 +29492,7 @@ var Launcher = class {
   described = /* @__PURE__ */ new Map();
   creds = /* @__PURE__ */ new Map();
   tags = /* @__PURE__ */ new Map();
+  sessions = /* @__PURE__ */ new Map();
   tagBases = /* @__PURE__ */ new Map();
   links = /* @__PURE__ */ new Map();
   freshModules = new FreshModules();
@@ -28832,6 +29553,7 @@ var Launcher = class {
   sealed;
   scrubs = /* @__PURE__ */ new Map();
   clipboard;
+  embedder;
   rootFs;
   fileWatches;
   nextPid = 1e3;
@@ -28853,14 +29575,14 @@ var Launcher = class {
       void 0,
       (pid) => this.tagsOf(pid)
     );
+    this.embedder = this.embedderBroker(options.embedder);
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
       void 0,
       (pid) => this.tagsOf(pid)
     );
-    this.sealed.tickets.normalise = (path) => physicalPathAsync(this.base, path);
-    this.sealed.userOf = async (uid) => (await this.users.lookup(uid))?.name;
+    this.wireSealed();
     if (this.owners) options.fs.trackOwners?.();
     this.watchers.tap((paths) => {
       this.changes.publish(...paths);
@@ -29921,6 +30643,8 @@ var Launcher = class {
   }
   marks(pid, req) {
     if (req.tags?.length) this.tags.set(pid, req.tags);
+    const session = req.session ?? this.sessions.get(req.ppid ?? -1);
+    if (session) this.sessions.set(pid, session);
     if (req.tags?.length) this.tagBases.set(pid, req.tagBase ?? req.tags.length);
     if (req.links !== void 0) this.links.set(pid, req.links);
   }
@@ -30000,6 +30724,7 @@ var Launcher = class {
       sealed: this.sealed,
       ...scrubs ? { outputFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
+      embedder: { broker: this.embedder, session: () => this.sessionOf(pid) },
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
       changes: this.changes.sab,
@@ -30128,6 +30853,7 @@ var Launcher = class {
     this.childTimes.delete(pid);
     this.creds.delete(pid);
     this.tags.delete(pid);
+    this.sessions.delete(pid);
     this.tagBases.delete(pid);
     this.links.delete(pid);
     this.granted.delete(pid);
@@ -30173,8 +30899,8 @@ var Launcher = class {
     this.sampledAt = Math.max(this.sampledAt, now);
     this.load = this.load.map((avg, i) => {
       const window = LOAD_WINDOWS_MS[i];
-      const fresh2 = 1 - Math.exp(-LOAD_SAMPLE_MS / window);
-      return avg * Math.exp(-elapsed / window) + running * fresh2;
+      const fresh3 = 1 - Math.exp(-LOAD_SAMPLE_MS / window);
+      return avg * Math.exp(-elapsed / window) + running * fresh3;
     });
   }
   idleSince;
@@ -30404,7 +31130,7 @@ var Launcher = class {
   forker(ppid, parent) {
     const { exec: _exec, pgid: _pgid, group: _group, pid: _pid, scrub: _scrub, ...image } = parent;
     return async (state, given) => {
-      const fresh2 = (fds, quietOom) => this.start({
+      const fresh3 = (fds, quietOom) => this.start({
         ...image,
         quietOom,
         cwd: state.cwd ?? parent.cwd,
@@ -30420,7 +31146,7 @@ var Launcher = class {
         tagBase: this.tagBases.get(ppid),
         links: this.links.get(ppid)
       });
-      return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh2));
+      return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh3));
     };
   }
   keySignal(tty, fallback, sig, send2) {
@@ -30456,6 +31182,25 @@ var Launcher = class {
   credOf(pid) {
     return this.creds.get(pid)?.() ?? copyCred(ROOT);
   }
+  wireSealed() {
+    this.sealed.tickets.normalise = (path) => physicalPathAsync(this.base, path);
+    this.sealed.userOf = async (uid) => (await this.users.lookup(uid))?.name;
+  }
+  embedderBroker(hook) {
+    const broker = new EmbedderBroker(
+      this.usersMode,
+      {
+        groupId: async (name2) => (await this.users.groups()).find((g) => g.name === name2)?.gid,
+        userId: async (name2) => (await this.users.lookup(name2))?.uid
+      },
+      (pid) => this.tagsOf(pid)
+    );
+    broker.register(0, hook);
+    return broker;
+  }
+  sessionOf(pid) {
+    return this.sessions.get(pid) ?? NO_SESSION;
+  }
   tagOf(pid) {
     return this.tags.get(pid)?.[0];
   }
@@ -30727,8 +31472,8 @@ var Launcher = class {
     for (const [path, mode] of layout) {
       if (isProtected(this.prefixes, normalizePath(path))) continue;
       const real = await this.realLayoutPath(path);
-      const fresh2 = real !== void 0 && !await this.base.hasOwner?.(real);
-      if (fresh2) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
+      const fresh3 = real !== void 0 && !await this.base.hasOwner?.(real);
+      if (fresh3) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
     }
   }
   async realLayoutPath(given) {
@@ -30901,9 +31646,10 @@ var Launcher = class {
     if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
     return found;
   }
-  identity(account, given) {
+  identity(account, given, session = 0) {
     return {
       ...given,
+      session: { client: session, uid: account.uid },
       cred: credOf(account),
       ...account.umask !== void 0 ? { umask: account.umask } : {}
     };
@@ -31090,7 +31836,7 @@ var Launcher = class {
       cwd,
       fds,
       report,
-      ...this.identity(account, tagged)
+      ...this.identity(account, tagged, options.session)
     });
     leader = handle.pid;
     void handle.exited.then(() => tty.hangup());
@@ -31147,7 +31893,7 @@ var Launcher = class {
       fds,
       report,
       ...group,
-      ...this.identity(account, tagged)
+      ...this.identity(account, tagged, options.session)
     });
     options.onStarted?.(handle.pid);
     const status = await handle.exited;
@@ -31590,7 +32336,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS3 } = {})
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 12];
+var PROTOCOL = [1, 13];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -31757,14 +32503,15 @@ async function runAs(l, self, requested) {
 function clientCred(self) {
   return self ? credOf(self) : copyCred(ROOT);
 }
-async function runTagged(l, self, options, tag) {
+async function runTagged(l, self, options, tag, session = -1) {
   tagOption(options.tag);
   const tags = withTag(withTag(void 0, tag), options.tag);
   return {
     user: await runAs(l, self, options.user),
     tag,
     tags,
-    tagBase: tag === void 0 ? 0 : 1
+    tagBase: tag === void 0 ? 0 : 1,
+    session
   };
 }
 function processes(l, self) {
@@ -31845,10 +32592,12 @@ function facadeRegistry(send2, gone) {
     }
   };
 }
-function hostRegistries(send2, gone) {
+function hostRegistries(send2, gone, port) {
   const cdps = cdpRegistry(send2, gone);
   const facades = facadeRegistry(send2, gone);
+  const requests = requestBinding(send2, port);
   return {
+    requests,
     answer(l, req) {
       if (req.op === "serve-cdp") return cdps.serve(l, req);
       if (req.op === "unserve-cdp") return cdps.drop(req.registration);
@@ -31856,6 +32605,7 @@ function hostRegistries(send2, gone) {
       return facades.drop(req.registration);
     },
     close() {
+      requests.close();
       cdps.close();
       facades.close();
     }
@@ -31890,6 +32640,28 @@ var TRAITS_WATCH = -1;
 function traitsWatch(launcher, transport, send2) {
   return launcher.onTraits(() => send2({ traits: transport.traits }));
 }
+function requestBinding(send2, port) {
+  const asker = embedderAsker({ postMessage: (m, t) => send2(m, t) });
+  let unbind;
+  port.addEventListener("message", (event) => {
+    const reply = embedderReplyOf(event.data);
+    if (reply) asker.answer(reply);
+  });
+  return {
+    async accept(host, hello) {
+      if (!hello.requests) return void 0;
+      if (!host.attachRequests || host.session === void 0)
+        return "EPERM: this port may not answer requests";
+      const launcher = await host.launcher();
+      unbind = launcher.embedder.register(
+        host.session,
+        asker.hookFor(host.session, hello.requests)
+      );
+      return void 0;
+    },
+    close: () => unbind?.()
+  };
+}
 function serveClient(port, host) {
   let state = "new";
   let self;
@@ -31904,7 +32676,7 @@ function serveClient(port, host) {
     if (state !== "closed") port.postMessage(message3, transfer);
   };
   const reply = (id2, body, transfer) => send2({ id: id2, ...body }, transfer);
-  const hosts = hostRegistries(send2, ended.promise);
+  const hosts = hostRegistries(send2, ended.promise, port);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
     send2({ bye });
@@ -31921,7 +32693,7 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused3 = versionError(message3.protocol);
+    const refused3 = versionError(message3.protocol) ?? await hosts.requests.accept(host, message3);
     if (refused3) {
       send2({ hello: { protocol: PROTOCOL, error: refused3 } });
       detach();
@@ -31946,7 +32718,7 @@ function serveClient(port, host) {
   async function terminal(req, l) {
     const session = await l.openTerminal(req.argv, {
       ...req.options,
-      ...await runTagged(l, self, req.options, host.tag),
+      ...await runTagged(l, self, req.options, host.tag, host.session),
       onData: (bytes) => reply(req.id, { fd: 1, bytes: bytes.slice() })
     });
     if (state === "closed") {
@@ -31969,7 +32741,7 @@ function serveClient(port, host) {
     let leader;
     const result = await l.run(req.argv, {
       ...req.options,
-      ...await runTagged(l, self, req.options, host.tag),
+      ...await runTagged(l, self, req.options, host.tag, host.session),
       collect: false,
       onStdout: out(1),
       onStderr: out(2),
@@ -32149,11 +32921,11 @@ function guarded2(check, signal) {
   signal.throwIfAborted();
   let stop = () => {
   };
-  const aborted2 = new Promise((_, reject) => {
+  const aborted3 = new Promise((_, reject) => {
     stop = () => reject(signal.reason);
     signal.addEventListener("abort", stop, { once: true });
   });
-  return Promise.race([check, aborted2]).finally(() => signal.removeEventListener("abort", stop));
+  return Promise.race([check, aborted3]).finally(() => signal.removeEventListener("abort", stop));
 }
 var loopbackStore = new AsyncLocalStorage();
 var subscribed = false;
@@ -32268,7 +33040,7 @@ function valid(name2) {
   }
 }
 var CHUNK4 = 1024 * 1024;
-function bytesOf2(data) {
+function bytesOf3(data) {
   if (typeof data === "string") return new TextEncoder().encode(data);
   if (data instanceof Blob) return data.arrayBuffer().then((buffer) => new Uint8Array(buffer));
   if (ArrayBuffer.isView(data)) {
@@ -32348,7 +33120,7 @@ var MemoryFile = class {
     const next3 = keepExistingData ? new Chunks([...this.data.blobs], this.data.size) : new Chunks();
     let position = 0;
     const put = async (data) => {
-      const bytes = await bytesOf2(data);
+      const bytes = await bytesOf3(data);
       await next3.write(position, bytes);
       position += bytes.length;
     };
@@ -32480,11 +33252,11 @@ function abortable(work, signal) {
   if (signal.aborted) return Promise.reject(signal.reason);
   let stop = () => {
   };
-  const aborted2 = new Promise((_, reject) => {
+  const aborted3 = new Promise((_, reject) => {
     stop = () => reject(signal.reason);
     signal.addEventListener("abort", stop, { once: true });
   });
-  return Promise.race([work, aborted2]).finally(() => signal.removeEventListener("abort", stop));
+  return Promise.race([work, aborted3]).finally(() => signal.removeEventListener("abort", stop));
 }
 function probe(secure2, host, port, ms, signal) {
   return new Promise((resolve2) => {
@@ -32843,10 +33615,10 @@ var ByteSource = class {
   async more() {
     const { done: done4, value: value2 } = await this.reader.read();
     if (done4) return false;
-    const joined4 = new Uint8Array(this.buffered.length + value2.length);
-    joined4.set(this.buffered);
-    joined4.set(value2, this.buffered.length);
-    this.buffered = joined4;
+    const joined5 = new Uint8Array(this.buffered.length + value2.length);
+    joined5.set(this.buffered);
+    joined5.set(value2, this.buffered.length);
+    this.buffered = joined5;
     return true;
   }
   async until(marker) {
@@ -33013,7 +33785,7 @@ var KernelCallError = class extends Error {
   }
 };
 var encoder12 = new TextEncoder();
-var bytesOf3 = (data) => typeof data === "string" ? encoder12.encode(data) : data;
+var bytesOf4 = (data) => typeof data === "string" ? encoder12.encode(data) : data;
 var UNAVAILABLE = {
   manualRedirects: false,
   encodedBodies: false,
@@ -33097,7 +33869,9 @@ var Channel = class {
   call(call) {
     return this.request(call).done;
   }
+  requests;
   receive(data) {
+    if (this.requests?.handle(data)) return;
     if (data.traits && data.id === void 0) {
       if (this.remote) this.remote.traits = data.traits;
       for (const listener of [...this.traitsListeners]) listener(data.traits);
@@ -33220,7 +33994,7 @@ async function spawnOn(channel, argv, opts) {
   });
   const started = Promise.withResolvers();
   let endedBy;
-  const options = { ...rest2, ...stdin !== void 0 ? { stdin: bytesOf3(stdin) } : {} };
+  const options = { ...rest2, ...stdin !== void 0 ? { stdin: bytesOf4(stdin) } : {} };
   const { done: done4 } = channel.request(
     { op: "spawn", argv, options },
     {
@@ -33303,7 +34077,7 @@ async function terminalOn(channel, argv, opts) {
       listener = next3;
       if (next3) for (const bytes of backlog.splice(0)) next3(bytes);
     },
-    write: (data) => send2({ action: "write", bytes: bytesOf3(data) }),
+    write: (data) => send2({ action: "write", bytes: bytesOf4(data) }),
     resize: (cols, rows) => send2({ action: "resize", cols, rows }),
     signal: (name2) => send2({ action: "signal", signal: name2 }),
     close: () => send2({ action: "close" })
@@ -33365,8 +34139,10 @@ function since(channel, minor, what, run2) {
   }
   return run2();
 }
-async function greet(channel, lock, timeoutMs) {
-  channel.post({ hello: { protocol: PROTOCOL, ...lock ? { lock } : {} } });
+async function greet(channel, lock, timeoutMs, requests) {
+  channel.post({
+    hello: { protocol: PROTOCOL, ...lock ? { lock } : {}, ...requests ? { requests } : {} }
+  });
   const timer = setTimeout(
     () => channel.end(
       new KernelGoneError(`no slicc-kernel answered on this port within ${timeoutMs} ms`)
@@ -33391,7 +34167,14 @@ async function attachKernel(port, options = {}) {
   const locks = options.locks === null ? void 0 : options.locks ?? locksOf();
   const own = await holdLock(locks);
   const channel = new Channel(port, own.release);
-  const hello = await greet(channel, own.name, options.timeoutMs ?? 1e4);
+  const requests = options.requests;
+  if (requests) channel.requests = embedderAnswerer(port, () => requests);
+  const hello = await greet(
+    channel,
+    own.name,
+    options.timeoutMs ?? 1e4,
+    requests ? kindsOf(requests) : void 0
+  );
   channel.protocol = hello.protocol;
   if (hello.lock && locks) void locks.request(hello.lock, () => channel.end(new KernelGoneError()));
   const transport = new RemoteTransport(
@@ -33605,6 +34388,31 @@ function cacheDirOf(dir) {
   }
   return dir;
 }
+var nodeSessions = 0;
+function nodeClient(launcher, clients, { user, tag, requests }) {
+  tagOption(tag);
+  const { port1, port2 } = new MessageChannel2();
+  const session = ++nodeSessions;
+  const served2 = serveClient(port1, {
+    launcher: async () => launcher,
+    signal: signalNumber,
+    session,
+    ...requests === "attach" ? { attachRequests: true } : {},
+    ...user !== void 0 ? { user } : {},
+    ...tag !== void 0 ? { tag } : {}
+  });
+  clients.add(served2);
+  const unbind = requests && requests !== "attach" ? launcher.embedder.register(session, checkedRequests(requests)) : void 0;
+  void served2.closed.then(() => {
+    clients.delete(served2);
+    unbind?.();
+  });
+  return port2;
+}
+function checkedRequests(hook) {
+  const kinds = kindsOf(hook);
+  return { kinds, handle: (request) => hook.handle(request) };
+}
 async function createNodeKernel(options = {}) {
   const root = options.root ?? memoryRoot();
   const fs = new OpfsFs(root, void 0, void 0, { ranged: isMemoryRoot(root) });
@@ -33645,6 +34453,7 @@ async function createNodeKernel(options = {}) {
     ...options.protect ? { protect: options.protect } : {},
     ...options.sealed ? { sealed: options.sealed } : {},
     ...options.clipboard ? { clipboard: options.clipboard } : {},
+    ...options.requests ? { embedder: checkedRequests(options.requests) } : {},
     ...options.approve ? { approve: options.approve } : {},
     ...options.wasmMemories ? { wasmMemories: options.wasmMemories } : {},
     cron: { lock: cronLock(root), ...options.cron?.clock ? { clock: options.cron.clock } : {} }
@@ -33735,22 +34544,13 @@ async function createNodeKernel(options = {}) {
       addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
       removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
     },
-    async connect({ user, tag } = {}) {
+    async connect(connectOptions = {}) {
       if (terminated) throw new Error(TERMINATED);
-      tagOption(tag);
+      const { user } = connectOptions;
       if (user !== void 0 && !await guard2(() => launcher.users.lookup(user))) {
         throw fsError("ENOENT", `no user ${String(user)}`);
       }
-      const { port1, port2 } = new MessageChannel2();
-      const served2 = serveClient(port1, {
-        launcher: async () => launcher,
-        signal: signalNumber,
-        ...user !== void 0 ? { user } : {},
-        ...tag !== void 0 ? { tag } : {}
-      });
-      clients.add(served2);
-      void served2.closed.then(() => clients.delete(served2));
-      return port2;
+      return nodeClient(launcher, clients, connectOptions);
     },
     terminate() {
       terminated = true;