@ai-ecoverse/slicc-kernel 1.167.3 → 1.168.0

package/dist/kernel-worker.js

@@ -1753,9 +1753,11 @@ var OpfsFs = class {
       this.channel.onmessage = ({ data }) => {
         const { paths, trees, outside } = noticeOf(data);
         for (const path of [...paths, ...trees]) this.forget(normalizePath(path));
-        const tell = () => remote?.emit({ paths, trees });
-        if (!outside) tell();
-        else void this.noticed(paths.map(normalizePath), Date.now()).finally(tell);
+        if (!outside) remote?.emit({ paths, trees });
+        else
+          void this.noticed(paths.map(normalizePath), Date.now()).finally(
+            () => remote?.emit({ paths, trees, outside: true })
+          );
       };
       this.channel.unref?.();
     }
@@ -2121,6 +2123,9 @@ var OpfsFs = class {
       this.exact--;
     }
   }
+  refresh(trees) {
+    for (const tree2 of trees) this.forget(normalizePath(tree2));
+  }
   forget(path) {
     this.changes++;
     this.dirs.deleteTree(path);
@@ -2838,6 +2843,10 @@ var OpfsFs = class {
     const children3 = /* @__PURE__ */ new Map();
     this.others++;
     for await (const child of handle.values()) children3.set(child.name, child);
+    if (this.absent.size > 0) {
+      const base = found.path === "/" ? "" : found.path;
+      for (const name2 of children3.keys()) this.absent.delete(`${base}/${name2}`);
+    }
     for (const link2 of await this.meta.links(found.path)) {
       const name2 = baseOf(link2.path);
       if (!children3.has(name2)) children3.set(name2, link2);
@@ -5271,28 +5280,39 @@ async function stickyEntry(g, op, path, dir) {
   if (sticky(g.cred, perm, (await ancestryOf(g.fs, entry)).at(-1))) return;
   if (await present(g.fs, entry, false)) deny(g, op, path, "EPERM");
 }
+async function unwritable(g, op, path, dir) {
+  if (dir.denied === void 0) return false;
+  if (dir.link) {
+    deny(g, op, dir.denied);
+    return false;
+  }
+  const perm = dir.denied === dir.path ? dir.perm : void 0;
+  if (perm && !await present(g.fs, dir.path, true)) return false;
+  if (perm && permits(g.cred, perm, X_OK)) return true;
+  deny(g, op, path);
+  return false;
+}
 async function inParent(g, op, path, old = false) {
   await fence(g, op, path);
-  if (old === "replaced") {
-    const dir2 = await need(g, op, parentOf4(path), W_OK | X_OK, DIR, path);
-    return dir2.denied === void 0 ? stickyEntry(g, op, path, dir2) : void 0;
-  }
-  if (!old) return void await need(g, op, parentOf4(path), W_OK | X_OK, DIR, path);
   const dir = await access(g.fs, g.cred, parentOf4(path), W_OK | X_OK, linked(g, DIR));
+  if (old !== true) {
+    if (await unwritable(g, op, path, dir)) deny(g, op, path);
+    else if (old === "replaced" && dir.denied === void 0) await stickyEntry(g, op, path, dir);
+    return;
+  }
   if (dir.denied === void 0) return stickyEntry(g, op, path, dir);
   if (dir.link) return deny(g, op, dir.denied);
   const lookup2 = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
   if (!lookup2 || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
 }
-async function makeIn(g, op, path) {
+async function makeIn(g, op, path, parents = true) {
   for (let dir = parentOf4(path); ; dir = parentOf4(dir)) {
     const walked = await access(g.fs, g.cred, dir, W_OK | X_OK, linked(g, DIR));
-    if (walked.link) return deny(g, op, walked.denied);
-    if (walked.denied !== void 0) {
+    if (await unwritable(g, op, path, walked)) {
       if (!await present(g.fs, path, true)) deny(g, op, path);
       return;
     }
-    if (!walked.missing || dir === "/") return;
+    if (!parents || !walked.missing || dir === "/") return;
   }
 }
 async function tree(g, op, dir, perm) {
@@ -7583,14 +7603,14 @@ var UserDb = class {
     this.fs = fs;
     this.owners = owners;
   }
-  async stampHome(row, shared, homeMode) {
+  async stampHome(row, shared2, homeMode) {
     const home = this.fs.resolvePath("/", row.home);
     if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
     if (!await this.realDir(home)) return;
-    const gid = shared?.gid ?? row.gid;
+    const gid = shared2?.gid ?? row.gid;
     await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
     const scoop = row.name.startsWith("scoop-");
-    await this.fs.chmod(home, homeMode ?? (shared ? 1512 : scoop ? 488 : 448));
+    await this.fs.chmod(home, homeMode ?? (shared2 ? 1512 : scoop ? 488 : 448));
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
@@ -7627,9 +7647,9 @@ var UserDb = class {
     const [passwd, group] = await this.texts();
     return { passwd: parsePasswd(passwd), group: parseGroup(group) };
   }
-  async provision(row, umask, shared) {
-    const dirs = 511 & ~umask | (shared ? 1024 : 0);
-    const gid = shared?.gid ?? row.gid;
+  async provision(row, umask, shared2) {
+    const dirs = 511 & ~umask | (shared2 ? 1024 : 0);
+    const gid = shared2?.gid ?? row.gid;
     const owner = this.owners ? { uid: row.uid, gid } : void 0;
     const made2 = owner ? { recursive: true, owner: { ...owner, mode: dirs, parents: dirs } } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
@@ -7733,7 +7753,7 @@ var UserDb = class {
       const users = parsed(passwd);
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
-      const shared = homeGroupOf(groups, options.homeGroup);
+      const shared2 = homeGroupOf(groups, options.homeGroup);
       const homeMode = homeModeOf(options.homeMode);
       if (found) {
         const more = groupsOf(groups, options.groups ?? []);
@@ -7741,8 +7761,8 @@ var UserDb = class {
           throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
         }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
-          await this.provision(found, this.umaskFor(options), shared);
-          await this.stampHome(found, shared, homeMode);
+          await this.provision(found, this.umaskFor(options), shared2);
+          await this.stampHome(found, shared2, homeMode);
         }
         if (joined(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
         remember();
@@ -7759,8 +7779,8 @@ var UserDb = class {
       const fresh3 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
-        await this.provision(row, this.umaskFor(options), shared);
-        await this.stampHome(row, shared, homeMode);
+        await this.provision(row, this.umaskFor(options), shared2);
+        await this.stampHome(row, shared2, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -7809,10 +7829,10 @@ var UserDb = class {
       );
       for (const r of parsed(keptGroups)) r.members = r.members.filter((m) => m !== name2);
       const home = this.fs.resolvePath("/", row.home);
-      const shared = parsed(passwd).some(
+      const shared2 = parsed(passwd).some(
         (r) => r !== row && this.fs.resolvePath("/", r.home) === home
       );
-      const removeHome = !options.keepHome && !shared && HOME_DIR.test(home) && await this.fs.exists(home);
+      const removeHome = !options.keepHome && !shared2 && HOME_DIR.test(home) && await this.fs.exists(home);
       const staged = `/home/.${name2}.removed-${Date.now()}`;
       await this.commit(
         formatPasswd(passwd.filter((r) => r !== row)),
@@ -8477,7 +8497,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.167.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.168.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -8560,8 +8580,8 @@ function abiOf(raw2, fallback) {
   const abi = raw2 ?? fallback;
   return abi === "emscripten" || abi === "wasi" || abi === "js" ? abi : void 0;
 }
-function commandOf(pkg, name2, raw2, packageAbi, shared) {
-  const withEnv = envFields({ ...shared, ...envOf(pkg, raw2.env) });
+function commandOf(pkg, name2, raw2, packageAbi, shared2) {
+  const withEnv = envFields({ ...shared2, ...envOf(pkg, raw2.env) });
   const script = inside(pkg, raw2.script);
   if (script) {
     return { name: name2, abi: packageAbi, glue: script, wasm: script, argv0: name2, script, ...withEnv };
@@ -8611,13 +8631,13 @@ function commandsOf(pkg, manifest) {
   const packageAbi = abiOf(slicc.abi, "emscripten");
   const entries = slicc.commands;
   if (!packageAbi || !entries || typeof entries !== "object") return [];
-  const shared = envOf(pkg, slicc.env);
+  const shared2 = envOf(pkg, slicc.env);
   const out = [];
   for (const [name2, raw2] of Object.entries(entries)) {
     if (!commandName(name2) || !raw2 || typeof raw2 !== "object") {
       continue;
     }
-    const command = commandOf(pkg, name2, raw2, packageAbi, shared);
+    const command = commandOf(pkg, name2, raw2, packageAbi, shared2);
     if (command) out.push(command);
   }
   return out;
@@ -9778,8 +9798,8 @@ var UnlinkedKeeper = class {
         void peers.ask(tab, { kept: { items: [], paths } }, PEER_RM_MS);
       throw fsError("EBUSY", `${target}: open in another tab that did not answer`);
     }
-    const { whole, sends, shared } = await this.setAside(target, asked);
-    return { whole, undoing: (op) => this.undoing(op, peers, sends, heard, shared) };
+    const { whole, sends, shared: shared2 } = await this.setAside(target, asked);
+    return { whole, undoing: (op) => this.undoing(op, peers, sends, heard, shared2) };
   }
   async setAside(target, asked) {
     const mine = this.heldWithin(target);
@@ -9787,25 +9807,25 @@ var UnlinkedKeeper = class {
     for (const { holders } of asked)
       for (const { path } of holders) tabsOf.set(path, (tabsOf.get(path) ?? 0) + 1);
     const done5 = /* @__PURE__ */ new Map();
-    const shared = [];
+    const shared2 = [];
     const sends = [];
     for (const { tab, holders, paths } of asked) {
       const items = [];
       for (const holder of holders) {
         if (!done5.has(holder.path)) {
           const many = mine.has(holder.path) || (tabsOf.get(holder.path) ?? 0) > 1;
-          done5.set(holder.path, await this.asideOne(holder, many, mine, shared));
+          done5.set(holder.path, await this.asideOne(holder, many, mine, shared2));
         }
         items.push({ path: holder.path, hidden: done5.get(holder.path), fid: holder.fid });
       }
       sends.push({ tab, items, paths });
     }
-    return { whole: done5.get(target) !== void 0, sends, shared };
+    return { whole: done5.get(target) !== void 0, sends, shared: shared2 };
   }
-  async asideOne(holder, many, mine, shared) {
+  async asideOne(holder, many, mine, shared2) {
     if (!many) return this.asideFor(holder.path, holder.instance);
     const one = await this.sharedAside(holder.path, mine);
-    if (one) shared.push(one);
+    if (one) shared2.push(one);
     return one?.hidden;
   }
   async sharedAside(path, mine) {
@@ -9850,16 +9870,16 @@ var UnlinkedKeeper = class {
   sharedLocks() {
     return this.locks;
   }
-  async undoing(op, peers, sends, heard, shared = []) {
+  async undoing(op, peers, sends, heard, shared2 = []) {
     let failed3;
     let out;
     try {
       out = await op();
     } catch (err) {
       failed3 = err ?? new Error("failed");
-      await this.rollBackAsides(sends, shared);
+      await this.rollBackAsides(sends, shared2);
     }
-    const hiddenShared = new Set(shared.map((one) => one.hidden));
+    const hiddenShared = new Set(shared2.map((one) => one.hidden));
     const answers2 = sends.map(({ tab, items, paths }) => {
       const keeps = items.some((item) => item.hidden && hiddenShared.has(item.hidden));
       return {
@@ -9870,7 +9890,7 @@ var UnlinkedKeeper = class {
     await Promise.all(
       answers2.map(({ told }, i) => heard[i] ? Promise.race([told, delay(PEER_RM_MS)]) : void 0)
     );
-    for (const one of shared) {
+    for (const one of shared2) {
       const waits = answers2.filter(
         ({ keeps }, i) => keeps && sends[i]?.items.some((item) => item.hidden === one.hidden)
       );
@@ -9880,7 +9900,7 @@ var UnlinkedKeeper = class {
     if (failed3 !== void 0) throw failed3;
     return out;
   }
-  async rollBackAsides(sends, shared) {
+  async rollBackAsides(sends, shared2) {
     const back = /* @__PURE__ */ new Map();
     for (const item of sends.flatMap((send2) => send2.items)) {
       const { hidden, path } = item;
@@ -9888,7 +9908,7 @@ var UnlinkedKeeper = class {
       if (!back.has(hidden)) back.set(hidden, await this.moveBack(hidden, path));
       if (back.get(hidden)) item.hidden = void 0;
     }
-    for (const { hidden, path, local: local2, file } of shared) {
+    for (const { hidden, path, local: local2, file } of shared2) {
       if (!back.get(hidden) || !file) continue;
       for (const holder of local2) {
         holder.unkeep(path, file);
@@ -13129,8 +13149,8 @@ var CwdTable = class {
     this.inodeOf = inodeOf2;
   }
   async hold(path, from) {
-    const shared = from === void 0 ? void 0 : this.held.get(from);
-    if (shared && shared.path === path) return this.share(from);
+    const shared2 = from === void 0 ? void 0 : this.held.get(from);
+    if (shared2 && shared2.path === path) return this.share(from);
     const ino = await this.inodeOf(path).catch(() => void 0);
     const slot2 = this.free.pop() ?? (this.next < UNTRACKED ? this.next++ : UNTRACKED);
     if (slot2 === UNTRACKED) return slot2;
@@ -15134,7 +15154,7 @@ async function guard(g, path, req, cwd) {
       return { path: w };
     }
     case "mkdir": {
-      await makeIn(g, op, path);
+      await makeIn(g, op, path, !req.exclusive);
       return { path: await walkSafe(g, path, false) };
     }
     case "create":
@@ -17494,13 +17514,13 @@ async function flock(req, ctx) {
   if (!FLOCK_KINDS.has(req.kind)) throw new KernelError("EINVAL");
   const { key, owner } = await flockOf(req.fd);
   const granted2 = req.kind !== "unlock";
-  const shared = locks.shared?.() === true;
-  if (shared && !granted2) await ctx.settle?.(req.fd, false);
+  const shared2 = locks.shared?.() === true;
+  if (shared2 && !granted2) await ctx.settle?.(req.fd, false);
   if (req.kind !== "unlock" && req.wait)
     await locks.flocks.wait(key, owner, req.kind, ctx.blocking);
   else if (!await locks.flocks.set(key, owner, req.kind)) throw new KernelError("EAGAIN");
-  if (shared && granted2) await grantedAcross(ctx, req.fd);
-  return shared ? json3(true) : done3;
+  if (shared2 && granted2) await grantedAcross(ctx, req.fd);
+  return shared2 ? json3(true) : done3;
 }
 async function grantedAcross(ctx, fd) {
   ctx.locks?.fresh?.();
@@ -17528,15 +17548,15 @@ async function recordLock2(req, ctx) {
     return json3({ kind: held.kind, pid: held.owner, start: held.start, len });
   }
   const granted2 = req.kind !== "unlock";
-  const shared = locks.shared?.() === true;
-  const fd = shared ? req.fd : void 0;
+  const shared2 = locks.shared?.() === true;
+  const fd = shared2 ? req.fd : void 0;
   if (!granted2 && fd !== void 0) await ctx.settle?.(fd, false);
   if (req.kind !== "unlock" && req.wait)
     await locks.wait(key, owner, req.kind, range2, ctx.blocking);
   else if (!await locks.set(key, owner, req.kind, range2.start, range2.end))
     throw new KernelError("EAGAIN");
-  if (granted2 && shared) await grantedAcross(ctx, fd);
-  return shared ? json3(true) : done3;
+  if (granted2 && shared2) await grantedAcross(ctx, fd);
+  return shared2 ? json3(true) : done3;
 }
 
 // src/kernel/net/loopback-transport.ts
@@ -23776,9 +23796,9 @@ function pausing(signal) {
   return { pausedAt, select };
 }
 async function serveSecure(proc, socket, req) {
-  const shared = req.listener?.serving;
-  if (req.listener && !shared) throw new KernelError("EINVAL", "the listener has no tls");
-  const server = shared ?? await serverOf(proc, req);
+  const shared2 = req.listener?.serving;
+  if (req.listener && !shared2) throw new KernelError("EINVAL", "the listener has no tls");
+  const server = shared2 ?? await serverOf(proc, req);
   const { engine, leaf, alpn, store, flags: flags2 } = server;
   const limit = handshakeSignal(proc, server.timeoutMs);
   const { pausedAt, select } = pausing(limit.signal);
@@ -23792,12 +23812,12 @@ async function serveSecure(proc, socket, req) {
       (flags2 & TLS_KEYLOG) !== 0
     ),
     limit.signal,
-    (reason) => !shared && reason === timedOut
+    (reason) => !shared2 && reason === timedOut
   ).finally(() => {
     limit.done();
     selections.delete(socket);
     socket.pending = void 0;
-    if (!shared) server.release();
+    if (!shared2) server.release();
   });
   run2.catch(() => void 0);
   const first = await Promise.race([run2, pausedAt.then((pause2) => ({ pause: pause2 }))]);
@@ -29032,6 +29052,39 @@ var RenameLog = class {
   }
 };
 
+// src/kernel/replacing.ts
+var REPLACING_LOCK = "slicc-kernel-replacing:v1:";
+function replacingLocks(scope = globalThis) {
+  const locks = scope.navigator?.locks;
+  return typeof locks?.request === "function" ? locks : void 0;
+}
+function replacingLock(metadata, root) {
+  return `${REPLACING_LOCK}${metadata}:${root}`;
+}
+function shared(locks, names2, run2, waited) {
+  const [name2, ...rest2] = names2;
+  if (name2 === void 0) return run2(waited);
+  const next3 = (after) => shared(locks, rest2, run2, after);
+  return locks.request(
+    name2,
+    { mode: "shared", ifAvailable: true },
+    (lock) => lock ? next3(waited) : locks.request(name2, { mode: "shared" }, () => next3(true))
+  );
+}
+var PackageLocks = class {
+  locks;
+  metadata;
+  constructor(metadata, locks = replacingLocks()) {
+    this.metadata = metadata;
+    this.locks = locks;
+  }
+  loading(roots, run2) {
+    if (!this.locks || roots.length === 0) return run2(false);
+    const names2 = roots.map((root) => replacingLock(this.metadata, root));
+    return shared(this.locks, names2, run2, false);
+  }
+};
+
 // src/kernel/settling.ts
 var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-list",
@@ -31282,6 +31335,7 @@ var COMMAND2 = /^\/(?:usr\/)?bin\/([^/]+)$/;
 var SHIM_MARKER = /^\/\/ pnpm-wasm-shim=(\{.*\})$/gm;
 var SHIM_MAX = 64 * 1024;
 var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
+var NODE_MODULES = /\/node_modules(?:\/|$)/;
 var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 var WASM_MAGIC = [0, 97, 115, 109];
 var SHEBANG_MAX = 256;
@@ -31349,6 +31403,21 @@ function packageRootOf(path, roots) {
   }
   return void 0;
 }
+function planFiles(planned) {
+  const { target } = planned;
+  const files = [
+    target.glue,
+    target.wasm,
+    target.imports,
+    target.copy,
+    ...(target.variants ?? []).map((variant) => variant.wasm),
+    ...planned.sources ?? []
+  ];
+  return files.filter((file) => file !== void 0);
+}
+function sameList(a, b) {
+  return a.length === b.length && a.every((item, i) => item === b[i]);
+}
 function modulePath(glue) {
   return glue.endsWith(".js") ? `${glue.slice(0, -3)}.wasm` : `${glue}.wasm`;
 }
@@ -31522,6 +31591,7 @@ var Launcher = class {
   sudoer;
   jobs = new JobTable();
   locks;
+  packageLocks;
   fifos = new FifoTable();
   memories;
   sems = new SemTable();
@@ -31594,6 +31664,7 @@ var Launcher = class {
     this.memories = memoriesOf(options.wasmMemories);
     this.rootFs = options.fs;
     this.locks = kernelLocks(options.fs.rootName, this.flushingPeers(options.fs));
+    this.packageLocks = new PackageLocks(options.packageLocks ?? META_DB);
     this.dac = this.usersMode === "off" ? void 0 : new Dac(this.usersMode, options.onDenial);
     if (this.dac) this.wireDac(this.dac);
     this.clipboard = new ClipboardBroker(
@@ -31687,15 +31758,7 @@ var Launcher = class {
     this.nodes.keepsOnDisk = true;
     this.openFiles.add(this.nodes);
     options.fs.onPeer?.(() => this.flushOpen());
-    options.fs.remoteChanges?.((change) => {
-      this.held.doubt(change.paths, change.moved?.to);
-      if (change.moved) this.moved(change.moved.from, change.moved.to);
-      this.changes.flush();
-      this.cwds.touched(change.paths, change.trees);
-      this.rewritten(change.paths, change.trees);
-      this.watchers.heard(change.content ? "change" : "rename", change.paths);
-      this.watchers.heard("rename", change.trees ?? []);
-    });
+    options.fs.remoteChanges?.((change) => this.remoteChanged(change));
     const holders = [this.held, this.openFiles];
     options.fs.heldBy?.(
       (dir) => holders.flatMap((set3) => [...set3].flatMap((holder) => [...holder.held()])).filter((p) => p.startsWith(`${dir}/`) && this.mounts.locate(p) === void 0)
@@ -31905,6 +31968,26 @@ var Launcher = class {
     }
     return trusted;
   }
+  remoteChanged(change) {
+    this.held.doubt(change.paths, change.moved?.to);
+    if (change.moved) this.moved(change.moved.from, change.moved.to);
+    this.changes.flush();
+    this.cwds.touched(change.paths, change.trees);
+    this.rewritten(change.paths, change.trees);
+    this.watchers.heard(change.content ? "change" : "rename", change.paths);
+    this.watchers.heard("rename", change.trees ?? []);
+    if (change.outside && this.catalogChanged([...change.paths, ...change.trees ?? []])) {
+      this.resetCatalogs();
+    }
+  }
+  catalogChanged(paths) {
+    const roots = [this.modulesDir, this.pnpmHome, ...this.appended].map(normalizePath);
+    return paths.map(normalizePath).some(
+      (at) => at === "/" || NODE_MODULES.test(at) || roots.some(
+        (root) => at === root || at.startsWith(`${root}/`) || root.startsWith(`${at}/`)
+      )
+    );
+  }
   resetCatalogs() {
     this.catalogs.clear();
     this.ownCatalogs.clear();
@@ -32305,7 +32388,11 @@ var Launcher = class {
       secrets.push({ name: name2, value: value2, placeholder });
     }
     const scrub = scrubberOf(secrets);
-    return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {} };
+    const recheck = async (next3) => {
+      const same3 = sameList(planFiles(next3), planFiles(planned)) && sameList(await this.interpreterChain(next3, booked.cwd, scope), interpreters) && (this.usersMode === "enforce" && await this.trustedFiles(next3, req.file, booked.cwd, scope)) === trusted;
+      if (!same3) throw new SpawnError("EACCES");
+    };
+    return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {}, recheck };
   }
   async interpreterChain(planned, cwd, scope) {
     const out = [];
@@ -32590,25 +32677,16 @@ var Launcher = class {
   async launch(asked, req) {
     const cwd = await physicalPathAsync(this.base, req.cwd);
     const seen = { ...req.env, HOSTNAME: this.hostname, cwd };
-    const env = { ...expandDefaults(asked.target.env, seen), ...req.env };
-    for (const key of asked.target.unset ?? []) delete env[key];
-    delete env[TICKET_ENV];
-    const own = env.HOSTNAME;
-    if (asked.target.abi === "wasi") env.HOSTNAME = this.hostname;
-    const planned = chosen2(asked, env);
-    const { target, args } = planned;
-    let program;
-    let exeId;
     await this.pnpmReady();
+    let loaded;
     try {
-      const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tags?.[0] };
-      if (this.integrity) await this.checkedSources(planned, caller);
-      [program, exeId] = await this.loaded(target, env, caller);
-      if (readsEtcHostname(program)) setOrDrop(env, "HOSTNAME", own);
+      loaded = await this.loadedUnder(asked, (planned2) => this.loadPlanned(planned2, req, seen));
     } catch (err) {
       await req.fds.closeAll();
       throw err;
     }
+    const { planned, env, program, exeId } = loaded;
+    const { target, args } = planned;
     const done5 = this.heldUrl(program);
     try {
       const cwdSlot = await this.cwds.hold(cwd, req.cwdFrom);
@@ -32636,6 +32714,52 @@ var Launcher = class {
       throw err;
     }
   }
+  async loadPlanned(asked, req, seen) {
+    const env = { ...expandDefaults(asked.target.env, seen), ...req.env };
+    for (const key of asked.target.unset ?? []) delete env[key];
+    delete env[TICKET_ENV];
+    const own = env.HOSTNAME;
+    if (asked.target.abi === "wasi") env.HOSTNAME = this.hostname;
+    const planned = chosen2(asked, env);
+    const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tags?.[0] };
+    if (this.integrity) await this.checkedSources(planned, caller);
+    const [program, exeId] = await this.loaded(planned.target, env, caller);
+    if (readsEtcHostname(program)) setOrDrop(env, "HOSTNAME", own);
+    return { planned, env, program, exeId };
+  }
+  packageRoots(planned) {
+    const packages2 = [this.modulesDir, ...this.appended];
+    const roots = /* @__PURE__ */ new Set();
+    for (const file of planFiles(planned)) {
+      if (!file.startsWith("/")) continue;
+      const at = normalizePath(file);
+      const root = PACKAGE_ROOT.exec(at)?.[1] ?? packageRootOf(at, packages2);
+      if (root !== void 0 && root !== at) roots.add(root);
+    }
+    return [...roots].sort();
+  }
+  async loadedUnder(asked, load) {
+    const { replan, recheck } = asked;
+    let planned = asked;
+    let roots = this.packageRoots(planned);
+    let stale = false;
+    for (; ; ) {
+      const held = roots;
+      const done5 = await this.packageLocks.loading(held, async (waited) => {
+        if (!waited && !stale) return { value: await load(planned) };
+        this.rootFs.refresh?.(held);
+        this.resetCatalogs();
+        if (replan) planned = await replan() ?? planned;
+        await recheck?.(planned);
+        const now = this.packageRoots(planned);
+        if (now.every((root) => held.includes(root))) return { value: await load(planned) };
+        roots = [.../* @__PURE__ */ new Set([...held, ...now])].sort();
+        stale = true;
+        return void 0;
+      });
+      if (done5) return done5.value;
+    }
+  }
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
@@ -33064,7 +33188,7 @@ var Launcher = class {
       const scope = grant ? "" : await this.scopeOf(cred.euid);
       const file = booked === void 0 ? req.file : await this.ticketFile(req, fds);
       const planned = await this.checkedPlan({ ...req, file }, { ppid, cred, scope }, fds);
-      const redeemed = await this.redeemed(
+      const { recheck, ...redeemed } = await this.redeemed(
         { ...req, file },
         { ppid, cred, scope, booked },
         planned,
@@ -33072,7 +33196,9 @@ var Launcher = class {
       );
       const exec = req.exec ? { exec: true } : {};
       const deciding = req.exec ? void 0 : this.undecided(ppid);
-      const handle = await this.launch(planned, {
+      const replan = () => this.planOrSearch({ ...req, file }, { ppid, cred, scope });
+      const again = { ...planned, replan, recheck };
+      const handle = await this.launch(again, {
         ...deciding ? { decided: deciding.promise } : {},
         cwd: req.cwd,
         cwdFrom: inheritedCwd(req.chdir, this.cwdSlots.get(ppid)),
@@ -33966,9 +34092,13 @@ var Launcher = class {
     const file = await this.execFile(argv[0] ?? "", cwd, this.execGuard(credOf(account), 0, tag));
     if (!await this.base.exists(cwd))
       await this.stackFor(tags, base).fs.mkdir(cwd, { recursive: true });
-    const planned = await this.plan(file, argv, cwd, scope);
-    await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, planned);
-    return { cwd, file, planned };
+    const plan = async () => {
+      const found = await this.plan(file, argv, cwd, scope);
+      await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, found);
+      return found;
+    };
+    const planned = await plan();
+    return { cwd, file, planned: planned && { ...planned, replan: plan } };
   }
   async openTerminal(argv, options) {
     const tagged = tagsOption(options);
@@ -34692,6 +34822,7 @@ function serveKernel(port, deps) {
       await fs.reconcile();
       const started = new Launcher({
         fs,
+        ...name2 ? { packageLocks: name2 } : {},
         ...workers(deps),
         ...req.modules ? { modules: req.modules } : {},
         ...req.commands ? { commands: req.commands } : {},