@ai-ecoverse/slicc-kernel 1.167.3 → 1.168.0

package/dist/node.js

@@ -800,28 +800,39 @@ async function stickyEntry(g, op, path, dir) {
   if (sticky(g.cred, perm, (await ancestryOf(g.fs, entry)).at(-1))) return;
   if (await present(g.fs, entry, false)) deny(g, op, path, "EPERM");
 }
+async function unwritable(g, op, path, dir) {
+  if (dir.denied === void 0) return false;
+  if (dir.link) {
+    deny(g, op, dir.denied);
+    return false;
+  }
+  const perm = dir.denied === dir.path ? dir.perm : void 0;
+  if (perm && !await present(g.fs, dir.path, true)) return false;
+  if (perm && permits(g.cred, perm, X_OK)) return true;
+  deny(g, op, path);
+  return false;
+}
 async function inParent(g, op, path, old = false) {
   await fence(g, op, path);
-  if (old === "replaced") {
-    const dir2 = await need(g, op, parentOf(path), W_OK | X_OK, DIR, path);
-    return dir2.denied === void 0 ? stickyEntry(g, op, path, dir2) : void 0;
-  }
-  if (!old) return void await need(g, op, parentOf(path), W_OK | X_OK, DIR, path);
   const dir = await access(g.fs, g.cred, parentOf(path), W_OK | X_OK, linked(g, DIR));
+  if (old !== true) {
+    if (await unwritable(g, op, path, dir)) deny(g, op, path);
+    else if (old === "replaced" && dir.denied === void 0) await stickyEntry(g, op, path, dir);
+    return;
+  }
   if (dir.denied === void 0) return stickyEntry(g, op, path, dir);
   if (dir.link) return deny(g, op, dir.denied);
   const lookup4 = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
   if (!lookup4 || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
 }
-async function makeIn(g, op, path) {
+async function makeIn(g, op, path, parents = true) {
   for (let dir = parentOf(path); ; dir = parentOf(dir)) {
     const walked = await access(g.fs, g.cred, dir, W_OK | X_OK, linked(g, DIR));
-    if (walked.link) return deny(g, op, walked.denied);
-    if (walked.denied !== void 0) {
+    if (await unwritable(g, op, path, walked)) {
       if (!await present(g.fs, path, true)) deny(g, op, path);
       return;
     }
-    if (!walked.missing || dir === "/") return;
+    if (!parents || !walked.missing || dir === "/") return;
   }
 }
 async function tree(g, op, dir, perm) {
@@ -3684,7 +3695,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.167.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.168.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -3767,8 +3778,8 @@ function abiOf(raw2, fallback) {
   const abi = raw2 ?? fallback;
   return abi === "emscripten" || abi === "wasi" || abi === "js" ? abi : void 0;
 }
-function commandOf(pkg, name2, raw2, packageAbi, shared) {
-  const withEnv = envFields({ ...shared, ...envOf(pkg, raw2.env) });
+function commandOf(pkg, name2, raw2, packageAbi, shared2) {
+  const withEnv = envFields({ ...shared2, ...envOf(pkg, raw2.env) });
   const script = inside(pkg, raw2.script);
   if (script) {
     return { name: name2, abi: packageAbi, glue: script, wasm: script, argv0: name2, script, ...withEnv };
@@ -3818,13 +3829,13 @@ function commandsOf(pkg, manifest) {
   const packageAbi = abiOf(slicc.abi, "emscripten");
   const entries = slicc.commands;
   if (!packageAbi || !entries || typeof entries !== "object") return [];
-  const shared = envOf(pkg, slicc.env);
+  const shared2 = envOf(pkg, slicc.env);
   const out = [];
   for (const [name2, raw2] of Object.entries(entries)) {
     if (!commandName(name2) || !raw2 || typeof raw2 !== "object") {
       continue;
     }
-    const command = commandOf(pkg, name2, raw2, packageAbi, shared);
+    const command = commandOf(pkg, name2, raw2, packageAbi, shared2);
     if (command) out.push(command);
   }
   return out;
@@ -4998,8 +5009,8 @@ var UnlinkedKeeper = class {
         void peers.ask(tab, { kept: { items: [], paths } }, PEER_RM_MS);
       throw fsError("EBUSY", `${target}: open in another tab that did not answer`);
     }
-    const { whole, sends, shared } = await this.setAside(target, asked);
-    return { whole, undoing: (op) => this.undoing(op, peers, sends, heard, shared) };
+    const { whole, sends, shared: shared2 } = await this.setAside(target, asked);
+    return { whole, undoing: (op) => this.undoing(op, peers, sends, heard, shared2) };
   }
   async setAside(target, asked) {
     const mine = this.heldWithin(target);
@@ -5007,25 +5018,25 @@ var UnlinkedKeeper = class {
     for (const { holders } of asked)
       for (const { path } of holders) tabsOf.set(path, (tabsOf.get(path) ?? 0) + 1);
     const done4 = /* @__PURE__ */ new Map();
-    const shared = [];
+    const shared2 = [];
     const sends = [];
     for (const { tab, holders, paths } of asked) {
       const items = [];
       for (const holder of holders) {
         if (!done4.has(holder.path)) {
           const many = mine.has(holder.path) || (tabsOf.get(holder.path) ?? 0) > 1;
-          done4.set(holder.path, await this.asideOne(holder, many, mine, shared));
+          done4.set(holder.path, await this.asideOne(holder, many, mine, shared2));
         }
         items.push({ path: holder.path, hidden: done4.get(holder.path), fid: holder.fid });
       }
       sends.push({ tab, items, paths });
     }
-    return { whole: done4.get(target) !== void 0, sends, shared };
+    return { whole: done4.get(target) !== void 0, sends, shared: shared2 };
   }
-  async asideOne(holder, many, mine, shared) {
+  async asideOne(holder, many, mine, shared2) {
     if (!many) return this.asideFor(holder.path, holder.instance);
     const one = await this.sharedAside(holder.path, mine);
-    if (one) shared.push(one);
+    if (one) shared2.push(one);
     return one?.hidden;
   }
   async sharedAside(path, mine) {
@@ -5070,16 +5081,16 @@ var UnlinkedKeeper = class {
   sharedLocks() {
     return this.locks;
   }
-  async undoing(op, peers, sends, heard, shared = []) {
+  async undoing(op, peers, sends, heard, shared2 = []) {
     let failed3;
     let out;
     try {
       out = await op();
     } catch (err) {
       failed3 = err ?? new Error("failed");
-      await this.rollBackAsides(sends, shared);
+      await this.rollBackAsides(sends, shared2);
     }
-    const hiddenShared = new Set(shared.map((one) => one.hidden));
+    const hiddenShared = new Set(shared2.map((one) => one.hidden));
     const answers2 = sends.map(({ tab, items, paths }) => {
       const keeps = items.some((item) => item.hidden && hiddenShared.has(item.hidden));
       return {
@@ -5090,7 +5101,7 @@ var UnlinkedKeeper = class {
     await Promise.all(
       answers2.map(({ told }, i) => heard[i] ? Promise.race([told, delay(PEER_RM_MS)]) : void 0)
     );
-    for (const one of shared) {
+    for (const one of shared2) {
       const waits = answers2.filter(
         ({ keeps }, i) => keeps && sends[i]?.items.some((item) => item.hidden === one.hidden)
       );
@@ -5100,7 +5111,7 @@ var UnlinkedKeeper = class {
     if (failed3 !== void 0) throw failed3;
     return out;
   }
-  async rollBackAsides(sends, shared) {
+  async rollBackAsides(sends, shared2) {
     const back = /* @__PURE__ */ new Map();
     for (const item of sends.flatMap((send2) => send2.items)) {
       const { hidden, path } = item;
@@ -5108,7 +5119,7 @@ var UnlinkedKeeper = class {
       if (!back.has(hidden)) back.set(hidden, await this.moveBack(hidden, path));
       if (back.get(hidden)) item.hidden = void 0;
     }
-    for (const { hidden, path, local: local2, file } of shared) {
+    for (const { hidden, path, local: local2, file } of shared2) {
       if (!back.get(hidden) || !file) continue;
       for (const holder of local2) {
         holder.unkeep(path, file);
@@ -7464,6 +7475,142 @@ var Integrity = class {
   }
 };
 
+// src/fs/path-map.ts
+function parentOf4(path) {
+  if (path === "/" || path === "") return void 0;
+  const at = path.lastIndexOf("/");
+  return at <= 0 ? "/" : path.slice(0, at);
+}
+var PathMap = class {
+  values = /* @__PURE__ */ new Map();
+  children = /* @__PURE__ */ new Map();
+  get size() {
+    return this.values.size;
+  }
+  has(path) {
+    return this.values.has(path);
+  }
+  get(path) {
+    return this.values.get(path);
+  }
+  keys() {
+    return this.values.keys();
+  }
+  set(path, value2) {
+    if (!this.values.has(path)) this.link(path);
+    this.values.set(path, value2);
+    return this;
+  }
+  delete(path) {
+    if (!this.values.delete(path)) return false;
+    this.prune(path);
+    return true;
+  }
+  subtree(root) {
+    const out = [];
+    const stack = [root];
+    for (let path = stack.pop(); path !== void 0; path = stack.pop()) {
+      if (this.values.has(path)) out.push(path);
+      const below = this.children.get(path);
+      if (below) for (const child of below) stack.push(child);
+    }
+    return out;
+  }
+  entries() {
+    return this.values.entries();
+  }
+  deleteTree(root) {
+    const stack = [root];
+    for (let path = stack.pop(); path !== void 0; path = stack.pop()) {
+      this.values.delete(path);
+      const below = this.children.get(path);
+      if (below) for (const child of below) stack.push(child);
+      this.children.delete(path);
+    }
+    this.prune(root);
+  }
+  clear() {
+    this.values.clear();
+    this.children.clear();
+  }
+  link(path) {
+    for (let child = path, parent = parentOf4(path); parent !== void 0; ) {
+      const set3 = this.children.get(parent);
+      if (set3?.has(child)) return;
+      if (set3) set3.add(child);
+      else this.children.set(parent, /* @__PURE__ */ new Set([child]));
+      child = parent;
+      parent = parentOf4(parent);
+    }
+  }
+  prune(path) {
+    for (let child = path, parent = parentOf4(path); parent !== void 0; ) {
+      if (this.values.has(child) || this.children.has(child)) return;
+      const set3 = this.children.get(parent);
+      set3?.delete(child);
+      if (set3 && set3.size > 0) return;
+      this.children.delete(parent);
+      child = parent;
+      parent = parentOf4(parent);
+    }
+  }
+};
+
+// src/fs/meta.ts
+var META_DB = "slicc-kernel";
+function parentOf5(path) {
+  return path.slice(0, path.lastIndexOf("/")) || "/";
+}
+function moved(entry, path) {
+  return entry.link === void 0 ? { ...entry, path } : { ...entry, path, dir: parentOf5(path) };
+}
+function under2(path, root) {
+  return path === root || path.startsWith(`${root}/`);
+}
+var MemoryMeta = class {
+  entries = new PathMap();
+  async get(paths) {
+    return paths.map((path) => this.entries.get(path));
+  }
+  async fresh(paths) {
+    return this.get(paths);
+  }
+  async update(path, change) {
+    this.set(path, change(this.entries.get(path)));
+  }
+  set(path, entry) {
+    if (entry) this.entries.set(path, entry);
+    else this.entries.delete(path);
+  }
+  async move(from, to, root, left) {
+    await this.remove([to]);
+    const carried = this.entries.subtree(from).map((path) => this.entries.get(path));
+    for (const entry of carried) this.entries.delete(entry.path);
+    for (const entry of carried) {
+      const path = to + entry.path.slice(from.length);
+      if (path !== to) this.entries.set(path, moved(entry, path));
+    }
+    this.entries.set(to, moved(root(carried.find((entry) => entry.path === from)), to));
+    if (left) this.entries.set(from, left);
+  }
+  async remove(paths, left) {
+    for (const path of paths) this.entries.deleteTree(path);
+    if (left) this.entries.set(left.path, left);
+  }
+  absent(path) {
+    return !this.entries.has(path);
+  }
+  async links(dir) {
+    return [...this.entries.entries()].map(([, e]) => e).filter((entry) => entry.dir === dir);
+  }
+  async under(path) {
+    return [...this.entries.entries()].map(([, e]) => e).filter((entry) => under2(entry.path, path));
+  }
+  async all() {
+    return [...this.entries.entries()].map(([, e]) => e);
+  }
+};
+
 // src/fs/physical-path.ts
 var MAX_HOPS3 = 40;
 function start(path) {
@@ -7515,11 +7662,11 @@ async function physicalPathAsync(fs, path) {
 var WATCH_NOTES_LIMIT = 1e3;
 var baseOf2 = (path) => path.slice(path.lastIndexOf("/") + 1);
 var WATCH_BATCH_LIMIT = 1e3;
-var under2 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
-var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var under3 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
+var parentOf6 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 function touches(watcher, changed) {
   return watcher.paths.some(
-    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf4(changed) === watched)
+    (watched) => changed === watched || under3(watched, changed) || (watcher.recursive ? under3(changed, watched) : parentOf6(changed) === watched)
   );
 }
 var REALS_KEPT = 4096;
@@ -7542,13 +7689,13 @@ function route(watch, type, path, seq2) {
   for (const root of watch.roots) if (routed(watch, root, type, path, seq2)) return;
 }
 function routed(watch, root, type, path, seq2) {
-  if (path === root || type === "rename" && root !== "/" && under2(root, path)) {
+  if (path === root || type === "rename" && root !== "/" && under3(root, path)) {
     noted(watch, { type, filename: watch.names.get(root) ?? baseOf2(root), seq: seq2 });
     if (type === "rename") noted(watch, { ended: true, seq: seq2 });
     return true;
   }
-  if (parentOf4(path) === root) noted(watch, { type, filename: baseOf2(path), seq: seq2 });
-  else if (watch.recursive && under2(path, root)) {
+  if (parentOf6(path) === root) noted(watch, { type, filename: baseOf2(path), seq: seq2 });
+  else if (watch.recursive && under3(path, root)) {
     noted(watch, { type, filename: path.slice(root === "/" ? 1 : root.length + 1), seq: seq2 });
   } else return false;
   return true;
@@ -7632,7 +7779,7 @@ var FsWatchers = class {
   covers(path) {
     for (const watch of this.typed) {
       for (const root of watch.roots) {
-        if (path === root || parentOf4(path) === root || watch.recursive && under2(path, root))
+        if (path === root || parentOf6(path) === root || watch.recursive && under3(path, root))
           return true;
       }
     }
@@ -7689,7 +7836,7 @@ var FsWatchers = class {
       const at = normalizePath(path);
       const seq2 = ++this.seq;
       for (const watch of [...this.typed]) {
-        if (type === "rename" && watch.roots.some((root) => at === root || under2(root, at)))
+        if (type === "rename" && watch.roots.some((root) => at === root || under3(root, at)))
           continue;
         if (type === "change" && watch.directory && watch.roots.includes(at)) continue;
         route(watch, type, at, seq2);
@@ -8921,7 +9068,7 @@ var FifoTable = class {
 // src/kernel/held-cwd.ts
 var CWD_SLOTS = 1024;
 var UNTRACKED = CWD_SLOTS - 1;
-var under3 = (path, changed) => changed === "/" || path === changed || path.startsWith(`${changed}/`);
+var under4 = (path, changed) => changed === "/" || path === changed || path.startsWith(`${changed}/`);
 var CwdTable = class {
   sab = new SharedArrayBuffer(CWD_SLOTS * 4);
   view = new Int32Array(this.sab);
@@ -8934,8 +9081,8 @@ var CwdTable = class {
     this.inodeOf = inodeOf2;
   }
   async hold(path, from) {
-    const shared = from === void 0 ? void 0 : this.held.get(from);
-    if (shared && shared.path === path) return this.share(from);
+    const shared2 = from === void 0 ? void 0 : this.held.get(from);
+    if (shared2 && shared2.path === path) return this.share(from);
     const ino = await this.inodeOf(path).catch(() => void 0);
     const slot2 = this.free.pop() ?? (this.next < UNTRACKED ? this.next++ : UNTRACKED);
     if (slot2 === UNTRACKED) return slot2;
@@ -8969,7 +9116,7 @@ var CwdTable = class {
     if (this.held.size === 0) return;
     for (const [slot2, held] of this.held) {
       if (held.dead) continue;
-      if (paths.some((p) => under3(held.path, p)) || trees.some((t) => under3(held.path, t))) {
+      if (paths.some((p) => under4(held.path, p)) || trees.some((t) => under4(held.path, t))) {
         Atomics.add(this.view, slot2, 1);
       }
     }
@@ -9427,7 +9574,7 @@ var HeldPaths = class extends Map {
     return this.revoked.has(path);
   }
 };
-var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf7 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var readonly = (mount) => mount.caps.readonly === true || mount.options.ro !== void 0;
 function inodeless(mount, attr2) {
   if (attr2.ino !== void 0) return false;
@@ -9727,7 +9874,7 @@ var MountTable = class {
     for (const [key, cached] of [...mount.attrs])
       if (within5(key, path) || linked2(cached.value)) mount.attrs.delete(key);
     mount.lists.delete(path);
-    mount.lists.delete(parentOf5(path));
+    mount.lists.delete(parentOf7(path));
     for (const [key, cached] of [...mount.lists])
       if (within5(key, path) || cached.value.some((e) => linked2(e.attr))) mount.lists.delete(key);
   }
@@ -9848,7 +9995,7 @@ var MountFs = class _MountFs {
     const real = normalizePath(path);
     if (this.at(real)) return real;
     try {
-      await this.base.stat(parentOf5(real));
+      await this.base.stat(parentOf7(real));
       return real;
     } catch (err) {
       const moved2 = redirectOf(err);
@@ -9890,7 +10037,7 @@ var MountFs = class _MountFs {
     if (this.rejectLinks) throw errnoError("ELOOP", path);
     if (hops >= MAX_LINKS5) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
-    return this.follow(this.base.resolvePath(parentOf5(real), target), hops + 1, create);
+    return this.follow(this.base.resolvePath(parentOf7(real), target), hops + 1, create);
   }
   async open(mount, rel2, write, owner, create = write) {
     return await mount.conn.call({
@@ -9906,8 +10053,8 @@ var MountFs = class _MountFs {
   async driverOwner(found, real, owner, directory) {
     const { mount, rel: rel2 } = found;
     if (!owner || !mount.owners || !mount.caps.owners) return void 0;
-    const dir = parentOf5(real);
-    const above = statOf2(await this.table.getattr(mount, dir, parentOf5(rel2)), dir, mount);
+    const dir = parentOf7(real);
+    const above = statOf2(await this.table.getattr(mount, dir, parentOf7(rel2)), dir, mount);
     const setgid = (above.mode & S_ISGID3) !== 0;
     let mode = owner.mode;
     if (directory && setgid) mode = (mode ?? 493) | S_ISGID3;
@@ -10426,7 +10573,7 @@ var MountFs = class _MountFs {
   }
   async named(path) {
     const at = normalizePath(path);
-    return joinName(await realDir(this, parentOf5(at)), at.slice(at.lastIndexOf("/") + 1));
+    return joinName(await realDir(this, parentOf7(at)), at.slice(at.lastIndexOf("/") + 1));
   }
   async link(source, target, follow2 = false) {
     const from = follow2 ? await realTarget(this, normalizePath(source)) : await this.named(source);
@@ -10956,7 +11103,7 @@ async function guard(g, path, req, cwd) {
       return { path: w };
     }
     case "mkdir": {
-      await makeIn(g, op, path);
+      await makeIn(g, op, path, !req.exclusive);
       return { path: await walkSafe(g, path, false) };
     }
     case "create":
@@ -13316,13 +13463,13 @@ async function flock(req, ctx) {
   if (!FLOCK_KINDS.has(req.kind)) throw new KernelError("EINVAL");
   const { key, owner } = await flockOf(req.fd);
   const granted2 = req.kind !== "unlock";
-  const shared = locks.shared?.() === true;
-  if (shared && !granted2) await ctx.settle?.(req.fd, false);
+  const shared2 = locks.shared?.() === true;
+  if (shared2 && !granted2) await ctx.settle?.(req.fd, false);
   if (req.kind !== "unlock" && req.wait)
     await locks.flocks.wait(key, owner, req.kind, ctx.blocking);
   else if (!await locks.flocks.set(key, owner, req.kind)) throw new KernelError("EAGAIN");
-  if (shared && granted2) await grantedAcross(ctx, req.fd);
-  return shared ? json3(true) : done2;
+  if (shared2 && granted2) await grantedAcross(ctx, req.fd);
+  return shared2 ? json3(true) : done2;
 }
 async function grantedAcross(ctx, fd) {
   ctx.locks?.fresh?.();
@@ -13350,15 +13497,15 @@ async function recordLock2(req, ctx) {
     return json3({ kind: held.kind, pid: held.owner, start: held.start, len });
   }
   const granted2 = req.kind !== "unlock";
-  const shared = locks.shared?.() === true;
-  const fd = shared ? req.fd : void 0;
+  const shared2 = locks.shared?.() === true;
+  const fd = shared2 ? req.fd : void 0;
   if (!granted2 && fd !== void 0) await ctx.settle?.(fd, false);
   if (req.kind !== "unlock" && req.wait)
     await locks.wait(key, owner, req.kind, range2, ctx.blocking);
   else if (!await locks.set(key, owner, req.kind, range2.start, range2.end))
     throw new KernelError("EAGAIN");
-  if (granted2 && shared) await grantedAcross(ctx, fd);
-  return shared ? json3(true) : done2;
+  if (granted2 && shared2) await grantedAcross(ctx, fd);
+  return shared2 ? json3(true) : done2;
 }
 
 // src/kernel/net/loopback-transport.ts
@@ -19438,9 +19585,9 @@ function pausing(signal) {
   return { pausedAt, select };
 }
 async function serveSecure(proc, socket, req) {
-  const shared = req.listener?.serving;
-  if (req.listener && !shared) throw new KernelError("EINVAL", "the listener has no tls");
-  const server = shared ?? await serverOf(proc, req);
+  const shared2 = req.listener?.serving;
+  if (req.listener && !shared2) throw new KernelError("EINVAL", "the listener has no tls");
+  const server = shared2 ?? await serverOf(proc, req);
   const { engine, leaf, alpn, store, flags: flags2 } = server;
   const limit = handshakeSignal(proc, server.timeoutMs);
   const { pausedAt, select } = pausing(limit.signal);
@@ -19454,12 +19601,12 @@ async function serveSecure(proc, socket, req) {
       (flags2 & TLS_KEYLOG) !== 0
     ),
     limit.signal,
-    (reason) => !shared && reason === timedOut
+    (reason) => !shared2 && reason === timedOut
   ).finally(() => {
     limit.done();
     selections.delete(socket);
     socket.pending = void 0;
-    if (!shared) server.release();
+    if (!shared2) server.release();
   });
   run2.catch(() => void 0);
   const first = await Promise.race([run2, pausedAt.then((pause2) => ({ pause: pause2 }))]);
@@ -21075,7 +21222,7 @@ function isWatchSyscall(req) {
   return WATCHING.has(req.op);
 }
 var WATCHES_MAX = 8192;
-var parentOf6 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf8 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 function visibleTo(watch, root, visible) {
   return {
     close: () => watch.close(),
@@ -21086,7 +21233,7 @@ function visibleTo(watch, root, visible) {
         notes.map(async (note) => {
           if (!("filename" in note) || !note.filename.includes("/")) return true;
           const at = watch.root?.() ?? root;
-          const dir = parentOf6(`${at === "/" ? "" : at}/${note.filename}`);
+          const dir = parentOf8(`${at === "/" ? "" : at}/${note.filename}`);
           if (!seen.has(dir)) seen.set(dir, visible(dir));
           return seen.get(dir);
         })
@@ -25129,6 +25276,39 @@ var RenameLog = class {
   }
 };
 
+// src/kernel/replacing.ts
+var REPLACING_LOCK = "slicc-kernel-replacing:v1:";
+function replacingLocks(scope = globalThis) {
+  const locks = scope.navigator?.locks;
+  return typeof locks?.request === "function" ? locks : void 0;
+}
+function replacingLock(metadata, root) {
+  return `${REPLACING_LOCK}${metadata}:${root}`;
+}
+function shared(locks, names2, run2, waited) {
+  const [name2, ...rest2] = names2;
+  if (name2 === void 0) return run2(waited);
+  const next3 = (after) => shared(locks, rest2, run2, after);
+  return locks.request(
+    name2,
+    { mode: "shared", ifAvailable: true },
+    (lock) => lock ? next3(waited) : locks.request(name2, { mode: "shared" }, () => next3(true))
+  );
+}
+var PackageLocks = class {
+  locks;
+  metadata;
+  constructor(metadata, locks = replacingLocks()) {
+    this.metadata = metadata;
+    this.locks = locks;
+  }
+  loading(roots, run2) {
+    if (!this.locks || roots.length === 0) return run2(false);
+    const names2 = roots.map((root) => replacingLock(this.metadata, root));
+    return shared(this.locks, names2, run2, false);
+  }
+};
+
 // src/kernel/settling.ts
 var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-list",
@@ -25425,141 +25605,6 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   return { invalidate: (paths) => reply({ invalidate: paths }) };
 }
 
-// src/fs/path-map.ts
-function parentOf7(path) {
-  if (path === "/" || path === "") return void 0;
-  const at = path.lastIndexOf("/");
-  return at <= 0 ? "/" : path.slice(0, at);
-}
-var PathMap = class {
-  values = /* @__PURE__ */ new Map();
-  children = /* @__PURE__ */ new Map();
-  get size() {
-    return this.values.size;
-  }
-  has(path) {
-    return this.values.has(path);
-  }
-  get(path) {
-    return this.values.get(path);
-  }
-  keys() {
-    return this.values.keys();
-  }
-  set(path, value2) {
-    if (!this.values.has(path)) this.link(path);
-    this.values.set(path, value2);
-    return this;
-  }
-  delete(path) {
-    if (!this.values.delete(path)) return false;
-    this.prune(path);
-    return true;
-  }
-  subtree(root) {
-    const out = [];
-    const stack = [root];
-    for (let path = stack.pop(); path !== void 0; path = stack.pop()) {
-      if (this.values.has(path)) out.push(path);
-      const below = this.children.get(path);
-      if (below) for (const child of below) stack.push(child);
-    }
-    return out;
-  }
-  entries() {
-    return this.values.entries();
-  }
-  deleteTree(root) {
-    const stack = [root];
-    for (let path = stack.pop(); path !== void 0; path = stack.pop()) {
-      this.values.delete(path);
-      const below = this.children.get(path);
-      if (below) for (const child of below) stack.push(child);
-      this.children.delete(path);
-    }
-    this.prune(root);
-  }
-  clear() {
-    this.values.clear();
-    this.children.clear();
-  }
-  link(path) {
-    for (let child = path, parent = parentOf7(path); parent !== void 0; ) {
-      const set3 = this.children.get(parent);
-      if (set3?.has(child)) return;
-      if (set3) set3.add(child);
-      else this.children.set(parent, /* @__PURE__ */ new Set([child]));
-      child = parent;
-      parent = parentOf7(parent);
-    }
-  }
-  prune(path) {
-    for (let child = path, parent = parentOf7(path); parent !== void 0; ) {
-      if (this.values.has(child) || this.children.has(child)) return;
-      const set3 = this.children.get(parent);
-      set3?.delete(child);
-      if (set3 && set3.size > 0) return;
-      this.children.delete(parent);
-      child = parent;
-      parent = parentOf7(parent);
-    }
-  }
-};
-
-// src/fs/meta.ts
-function parentOf8(path) {
-  return path.slice(0, path.lastIndexOf("/")) || "/";
-}
-function moved(entry, path) {
-  return entry.link === void 0 ? { ...entry, path } : { ...entry, path, dir: parentOf8(path) };
-}
-function under4(path, root) {
-  return path === root || path.startsWith(`${root}/`);
-}
-var MemoryMeta = class {
-  entries = new PathMap();
-  async get(paths) {
-    return paths.map((path) => this.entries.get(path));
-  }
-  async fresh(paths) {
-    return this.get(paths);
-  }
-  async update(path, change) {
-    this.set(path, change(this.entries.get(path)));
-  }
-  set(path, entry) {
-    if (entry) this.entries.set(path, entry);
-    else this.entries.delete(path);
-  }
-  async move(from, to, root, left) {
-    await this.remove([to]);
-    const carried = this.entries.subtree(from).map((path) => this.entries.get(path));
-    for (const entry of carried) this.entries.delete(entry.path);
-    for (const entry of carried) {
-      const path = to + entry.path.slice(from.length);
-      if (path !== to) this.entries.set(path, moved(entry, path));
-    }
-    this.entries.set(to, moved(root(carried.find((entry) => entry.path === from)), to));
-    if (left) this.entries.set(from, left);
-  }
-  async remove(paths, left) {
-    for (const path of paths) this.entries.deleteTree(path);
-    if (left) this.entries.set(left.path, left);
-  }
-  absent(path) {
-    return !this.entries.has(path);
-  }
-  async links(dir) {
-    return [...this.entries.entries()].map(([, e]) => e).filter((entry) => entry.dir === dir);
-  }
-  async under(path) {
-    return [...this.entries.entries()].map(([, e]) => e).filter((entry) => under4(entry.path, path));
-  }
-  async all() {
-    return [...this.entries.entries()].map(([, e]) => e);
-  }
-};
-
 // src/fs/notice.ts
 function noticeOf(data) {
   if (Array.isArray(data)) return { paths: data.filter((p) => typeof p === "string"), trees: [] };
@@ -25868,9 +25913,11 @@ var OpfsFs = class {
       this.channel.onmessage = ({ data }) => {
         const { paths, trees, outside } = noticeOf(data);
         for (const path of [...paths, ...trees]) this.forget(normalizePath(path));
-        const tell = () => remote?.emit({ paths, trees });
-        if (!outside) tell();
-        else void this.noticed(paths.map(normalizePath), Date.now()).finally(tell);
+        if (!outside) remote?.emit({ paths, trees });
+        else
+          void this.noticed(paths.map(normalizePath), Date.now()).finally(
+            () => remote?.emit({ paths, trees, outside: true })
+          );
       };
       this.channel.unref?.();
     }
@@ -26236,6 +26283,9 @@ var OpfsFs = class {
       this.exact--;
     }
   }
+  refresh(trees) {
+    for (const tree2 of trees) this.forget(normalizePath(tree2));
+  }
   forget(path) {
     this.changes++;
     this.dirs.deleteTree(path);
@@ -26953,6 +27003,10 @@ var OpfsFs = class {
     const children3 = /* @__PURE__ */ new Map();
     this.others++;
     for await (const child of handle.values()) children3.set(child.name, child);
+    if (this.absent.size > 0) {
+      const base = found.path === "/" ? "" : found.path;
+      for (const name2 of children3.keys()) this.absent.delete(`${base}/${name2}`);
+    }
     for (const link2 of await this.meta.links(found.path)) {
       const name2 = baseOf3(link2.path);
       if (!children3.has(name2)) children3.set(name2, link2);
@@ -29671,14 +29725,14 @@ var UserDb = class {
     this.fs = fs;
     this.owners = owners;
   }
-  async stampHome(row, shared, homeMode) {
+  async stampHome(row, shared2, homeMode) {
     const home = this.fs.resolvePath("/", row.home);
     if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
     if (!await this.realDir(home)) return;
-    const gid = shared?.gid ?? row.gid;
+    const gid = shared2?.gid ?? row.gid;
     await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
     const scoop = row.name.startsWith("scoop-");
-    await this.fs.chmod(home, homeMode ?? (shared ? 1512 : scoop ? 488 : 448));
+    await this.fs.chmod(home, homeMode ?? (shared2 ? 1512 : scoop ? 488 : 448));
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
@@ -29715,9 +29769,9 @@ var UserDb = class {
     const [passwd, group] = await this.texts();
     return { passwd: parsePasswd(passwd), group: parseGroup(group) };
   }
-  async provision(row, umask, shared) {
-    const dirs = 511 & ~umask | (shared ? 1024 : 0);
-    const gid = shared?.gid ?? row.gid;
+  async provision(row, umask, shared2) {
+    const dirs = 511 & ~umask | (shared2 ? 1024 : 0);
+    const gid = shared2?.gid ?? row.gid;
     const owner = this.owners ? { uid: row.uid, gid } : void 0;
     const made2 = owner ? { recursive: true, owner: { ...owner, mode: dirs, parents: dirs } } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
@@ -29821,7 +29875,7 @@ var UserDb = class {
       const users = parsed(passwd);
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
-      const shared = homeGroupOf(groups, options.homeGroup);
+      const shared2 = homeGroupOf(groups, options.homeGroup);
       const homeMode = homeModeOf(options.homeMode);
       if (found) {
         const more = groupsOf(groups, options.groups ?? []);
@@ -29829,8 +29883,8 @@ var UserDb = class {
           throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
         }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
-          await this.provision(found, this.umaskFor(options), shared);
-          await this.stampHome(found, shared, homeMode);
+          await this.provision(found, this.umaskFor(options), shared2);
+          await this.stampHome(found, shared2, homeMode);
         }
         if (joined4(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
         remember();
@@ -29847,8 +29901,8 @@ var UserDb = class {
       const fresh3 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
-        await this.provision(row, this.umaskFor(options), shared);
-        await this.stampHome(row, shared, homeMode);
+        await this.provision(row, this.umaskFor(options), shared2);
+        await this.stampHome(row, shared2, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -29897,10 +29951,10 @@ var UserDb = class {
       );
       for (const r of parsed(keptGroups)) r.members = r.members.filter((m) => m !== name2);
       const home = this.fs.resolvePath("/", row.home);
-      const shared = parsed(passwd).some(
+      const shared2 = parsed(passwd).some(
         (r) => r !== row && this.fs.resolvePath("/", r.home) === home
       );
-      const removeHome = !options.keepHome && !shared && HOME_DIR.test(home) && await this.fs.exists(home);
+      const removeHome = !options.keepHome && !shared2 && HOME_DIR.test(home) && await this.fs.exists(home);
       const staged = `/home/.${name2}.removed-${Date.now()}`;
       await this.commit(
         formatPasswd(passwd.filter((r) => r !== row)),
@@ -30389,6 +30443,7 @@ var COMMAND2 = /^\/(?:usr\/)?bin\/([^/]+)$/;
 var SHIM_MARKER = /^\/\/ pnpm-wasm-shim=(\{.*\})$/gm;
 var SHIM_MAX = 64 * 1024;
 var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
+var NODE_MODULES = /\/node_modules(?:\/|$)/;
 var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 var WASM_MAGIC = [0, 97, 115, 109];
 var SHEBANG_MAX = 256;
@@ -30456,6 +30511,21 @@ function packageRootOf(path, roots) {
   }
   return void 0;
 }
+function planFiles(planned) {
+  const { target } = planned;
+  const files = [
+    target.glue,
+    target.wasm,
+    target.imports,
+    target.copy,
+    ...(target.variants ?? []).map((variant) => variant.wasm),
+    ...planned.sources ?? []
+  ];
+  return files.filter((file) => file !== void 0);
+}
+function sameList(a, b) {
+  return a.length === b.length && a.every((item, i) => item === b[i]);
+}
 function modulePath(glue) {
   return glue.endsWith(".js") ? `${glue.slice(0, -3)}.wasm` : `${glue}.wasm`;
 }
@@ -30629,6 +30699,7 @@ var Launcher = class {
   sudoer;
   jobs = new JobTable();
   locks;
+  packageLocks;
   fifos = new FifoTable();
   memories;
   sems = new SemTable();
@@ -30701,6 +30772,7 @@ var Launcher = class {
     this.memories = memoriesOf(options.wasmMemories);
     this.rootFs = options.fs;
     this.locks = kernelLocks(options.fs.rootName, this.flushingPeers(options.fs));
+    this.packageLocks = new PackageLocks(options.packageLocks ?? META_DB);
     this.dac = this.usersMode === "off" ? void 0 : new Dac(this.usersMode, options.onDenial);
     if (this.dac) this.wireDac(this.dac);
     this.clipboard = new ClipboardBroker(
@@ -30794,15 +30866,7 @@ var Launcher = class {
     this.nodes.keepsOnDisk = true;
     this.openFiles.add(this.nodes);
     options.fs.onPeer?.(() => this.flushOpen());
-    options.fs.remoteChanges?.((change) => {
-      this.held.doubt(change.paths, change.moved?.to);
-      if (change.moved) this.moved(change.moved.from, change.moved.to);
-      this.changes.flush();
-      this.cwds.touched(change.paths, change.trees);
-      this.rewritten(change.paths, change.trees);
-      this.watchers.heard(change.content ? "change" : "rename", change.paths);
-      this.watchers.heard("rename", change.trees ?? []);
-    });
+    options.fs.remoteChanges?.((change) => this.remoteChanged(change));
     const holders = [this.held, this.openFiles];
     options.fs.heldBy?.(
       (dir) => holders.flatMap((set3) => [...set3].flatMap((holder) => [...holder.held()])).filter((p) => p.startsWith(`${dir}/`) && this.mounts.locate(p) === void 0)
@@ -31012,6 +31076,26 @@ var Launcher = class {
     }
     return trusted;
   }
+  remoteChanged(change) {
+    this.held.doubt(change.paths, change.moved?.to);
+    if (change.moved) this.moved(change.moved.from, change.moved.to);
+    this.changes.flush();
+    this.cwds.touched(change.paths, change.trees);
+    this.rewritten(change.paths, change.trees);
+    this.watchers.heard(change.content ? "change" : "rename", change.paths);
+    this.watchers.heard("rename", change.trees ?? []);
+    if (change.outside && this.catalogChanged([...change.paths, ...change.trees ?? []])) {
+      this.resetCatalogs();
+    }
+  }
+  catalogChanged(paths) {
+    const roots = [this.modulesDir, this.pnpmHome, ...this.appended].map(normalizePath);
+    return paths.map(normalizePath).some(
+      (at) => at === "/" || NODE_MODULES.test(at) || roots.some(
+        (root) => at === root || at.startsWith(`${root}/`) || root.startsWith(`${at}/`)
+      )
+    );
+  }
   resetCatalogs() {
     this.catalogs.clear();
     this.ownCatalogs.clear();
@@ -31412,7 +31496,11 @@ var Launcher = class {
       secrets.push({ name: name2, value: value2, placeholder });
     }
     const scrub = scrubberOf(secrets);
-    return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {} };
+    const recheck = async (next3) => {
+      const same2 = sameList(planFiles(next3), planFiles(planned)) && sameList(await this.interpreterChain(next3, booked.cwd, scope), interpreters) && (this.usersMode === "enforce" && await this.trustedFiles(next3, req.file, booked.cwd, scope)) === trusted;
+      if (!same2) throw new SpawnError("EACCES");
+    };
+    return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {}, recheck };
   }
   async interpreterChain(planned, cwd, scope) {
     const out = [];
@@ -31697,25 +31785,16 @@ var Launcher = class {
   async launch(asked, req) {
     const cwd = await physicalPathAsync(this.base, req.cwd);
     const seen = { ...req.env, HOSTNAME: this.hostname, cwd };
-    const env = { ...expandDefaults(asked.target.env, seen), ...req.env };
-    for (const key of asked.target.unset ?? []) delete env[key];
-    delete env[TICKET_ENV];
-    const own = env.HOSTNAME;
-    if (asked.target.abi === "wasi") env.HOSTNAME = this.hostname;
-    const planned = chosen2(asked, env);
-    const { target, args } = planned;
-    let program;
-    let exeId;
     await this.pnpmReady();
+    let loaded;
     try {
-      const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tags?.[0] };
-      if (this.integrity) await this.checkedSources(planned, caller);
-      [program, exeId] = await this.loaded(target, env, caller);
-      if (readsEtcHostname(program)) setOrDrop(env, "HOSTNAME", own);
+      loaded = await this.loadedUnder(asked, (planned2) => this.loadPlanned(planned2, req, seen));
     } catch (err) {
       await req.fds.closeAll();
       throw err;
     }
+    const { planned, env, program, exeId } = loaded;
+    const { target, args } = planned;
     const done4 = this.heldUrl(program);
     try {
       const cwdSlot = await this.cwds.hold(cwd, req.cwdFrom);
@@ -31743,6 +31822,52 @@ var Launcher = class {
       throw err;
     }
   }
+  async loadPlanned(asked, req, seen) {
+    const env = { ...expandDefaults(asked.target.env, seen), ...req.env };
+    for (const key of asked.target.unset ?? []) delete env[key];
+    delete env[TICKET_ENV];
+    const own = env.HOSTNAME;
+    if (asked.target.abi === "wasi") env.HOSTNAME = this.hostname;
+    const planned = chosen2(asked, env);
+    const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tags?.[0] };
+    if (this.integrity) await this.checkedSources(planned, caller);
+    const [program, exeId] = await this.loaded(planned.target, env, caller);
+    if (readsEtcHostname(program)) setOrDrop(env, "HOSTNAME", own);
+    return { planned, env, program, exeId };
+  }
+  packageRoots(planned) {
+    const packages2 = [this.modulesDir, ...this.appended];
+    const roots = /* @__PURE__ */ new Set();
+    for (const file of planFiles(planned)) {
+      if (!file.startsWith("/")) continue;
+      const at = normalizePath(file);
+      const root = PACKAGE_ROOT.exec(at)?.[1] ?? packageRootOf(at, packages2);
+      if (root !== void 0 && root !== at) roots.add(root);
+    }
+    return [...roots].sort();
+  }
+  async loadedUnder(asked, load) {
+    const { replan, recheck } = asked;
+    let planned = asked;
+    let roots = this.packageRoots(planned);
+    let stale = false;
+    for (; ; ) {
+      const held = roots;
+      const done4 = await this.packageLocks.loading(held, async (waited) => {
+        if (!waited && !stale) return { value: await load(planned) };
+        this.rootFs.refresh?.(held);
+        this.resetCatalogs();
+        if (replan) planned = await replan() ?? planned;
+        await recheck?.(planned);
+        const now = this.packageRoots(planned);
+        if (now.every((root) => held.includes(root))) return { value: await load(planned) };
+        roots = [.../* @__PURE__ */ new Set([...held, ...now])].sort();
+        stale = true;
+        return void 0;
+      });
+      if (done4) return done4.value;
+    }
+  }
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
@@ -32171,7 +32296,7 @@ var Launcher = class {
       const scope = grant ? "" : await this.scopeOf(cred.euid);
       const file = booked === void 0 ? req.file : await this.ticketFile(req, fds);
       const planned = await this.checkedPlan({ ...req, file }, { ppid, cred, scope }, fds);
-      const redeemed = await this.redeemed(
+      const { recheck, ...redeemed } = await this.redeemed(
         { ...req, file },
         { ppid, cred, scope, booked },
         planned,
@@ -32179,7 +32304,9 @@ var Launcher = class {
       );
       const exec = req.exec ? { exec: true } : {};
       const deciding = req.exec ? void 0 : this.undecided(ppid);
-      const handle = await this.launch(planned, {
+      const replan = () => this.planOrSearch({ ...req, file }, { ppid, cred, scope });
+      const again = { ...planned, replan, recheck };
+      const handle = await this.launch(again, {
         ...deciding ? { decided: deciding.promise } : {},
         cwd: req.cwd,
         cwdFrom: inheritedCwd(req.chdir, this.cwdSlots.get(ppid)),
@@ -33073,9 +33200,13 @@ var Launcher = class {
     const file = await this.execFile(argv[0] ?? "", cwd, this.execGuard(credOf(account), 0, tag));
     if (!await this.base.exists(cwd))
       await this.stackFor(tags, base).fs.mkdir(cwd, { recursive: true });
-    const planned = await this.plan(file, argv, cwd, scope);
-    await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, planned);
-    return { cwd, file, planned };
+    const plan = async () => {
+      const found = await this.plan(file, argv, cwd, scope);
+      await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, found);
+      return found;
+    };
+    const planned = await plan();
+    return { cwd, file, planned: planned && { ...planned, replan: plan } };
   }
   async openTerminal(argv, options) {
     const tagged = tagsOption(options);