@ai-ecoverse/slicc-kernel 1.168.1 → 1.169.0

package/README.md

@@ -35,7 +35,7 @@ TypeScript declarations ship in `dist/types/`, and each entry (`.`, `./node`, `.
 | `worker` | `new URL('./kernel-worker.js', import.meta.url)` | the kernel worker script |
 | `network` | none | `{ transport, uplink, doh }`: how programs reach the outside world (see [Network](#network), [Uplink](#uplink) and [DNS](#dns)) |
 | `requestDirectory` | none | `() => Promise<FileSystemDirectoryHandle>`, typically `showDirectoryPicker`: how an `fsa` mount gets its folder (see [Removable media](#removable-media-fsa)) |
-| `hostfs` | none | `(source, { readonly }) => Promise<{ url, token, capabilities? } \| { port, token?, capabilities? }>`: a grant for a `hostfs` mount from the local proxy, or a `MessagePort` the page serves the folder on (see [Host folders](#host-folders-hostfs)) |
+| `hostfs` | none | `(source, { readonly }) => Promise<{ url, token, capabilities? } \| { port, token?, capabilities? }>`: a grant for a `hostfs` mount from a host that serves the folder over HTTP, or a `MessagePort` the page serves the folder on (see [Host folders](#host-folders-hostfs)) |
 | `onMountPending` | none | `({ target, source, insert }) => void`: an `fsa` mount needs a folder; call `insert()` from a user gesture |
 | `processMounts` | `true` | whether programs may call `mount(2)` and `umount2(2)`: `false`, or `(req) => boolean \| Promise<boolean>` to decide each call (see [Mounting from a program](#mounting-from-a-program)) |
 | `hostname` | `'slicc'` | the kernel's node name (see [Node name](#node-name)) |
@@ -635,9 +635,8 @@ WASIX programs get `AF_INET`/`AF_INET6` `SOCK_DGRAM` sockets, and `AF_UNIX` ones
 - **Streamed request bodies** ([#238](https://github.com/ai-ecoverse/slicc-kernel/issues/238)): a request comes with its body whole, as `body` (a `Uint8Array`), unless the transport sets `traits.streamingBodies`. Then a body the kernel doesn't hold whole comes as `bodyStream`, an async iterable of `Uint8Array`, never together with `body`. That's an upload through the proxy (`Content-Length` or chunked, curl's `-T`, git's push) and a JS program's `fetch` with a stream body. The kernel reads from the program only as fast as the transport pulls, applies no `maxRequestBody` and reserves no memory for it. A transport with a limit of its own rejects with `status: 413`. When the transport answers before it has read the whole body, the proxy closes the program's connection after the response, since the rest of the body is still on it. A transport without the trait keeps getting whole bodies, capped at its `maxRequestBody`, so existing transports need no change. A transport that wraps another (a router, an injector, a logger) and passes on the inner `traits` must forward `bodyStream`, or not claim `streamingBodies`: a wrapper that rebuilds the request from `url`, `method`, `headers`, `body` and `signal` would drop a streamed upload and still answer. `nodeTransport()` streams (undici's `fetch` with `duplex: 'half'`). `fetchTransport({ streamingBodies: true })` turns it on for a page that knows its targets speak HTTP/2 or later, since Chrome streams a `fetch` upload only there, so it's off by default. The trait is also how an embedder's own transport, such as the `slicc` CLI link's exit, takes streamed uploads; across the page and the kernel's worker, and to attached clients, the body is pulled one chunk at a time. `fetchTransport()` is the plain `fetch` of the page, bound by CORS; its `hint` option is appended to the message of a request it could not make, so a program's 502 can name a way around CORS (`registry.npmjs.org` and jsDelivr allow it); an embedder with a way around CORS passes its own. A response body that delivers no data for `bodyIdleMs` (default 5 minutes; `0` or `Infinity` turns it off) fails with `ETIMEDOUT` instead of waiting forever, which matters because Chrome under heavy load can stop handing a page the rest of a body. A slow body that keeps delivering is never cut off.
 - **Traits of the embedder's own:** `traits` may carry more fields than the kernel reads. The kernel keeps them, and attached clients get them as they are (`client.transport.traits`, `onTraits`). In TypeScript, `NetworkTraits` types its own fields and leaves any other as `unknown`. One is typed: `exit`, the default exit an embedder routes through, `{ kind, caps }` (`NetworkExit`). `kind` is `'local'`, `'remote'` or `'tailnet'` (or another string), `caps` lists what the exit carries (`['net', 'http', 'ws']`), and further fields are `unknown`. When traits change later, call `kernel.updateTransportTraits()`.
 - **Redirect hops** ([#302](https://github.com/ai-ecoverse/slicc-kernel/issues/302)): a transport that follows redirects but can see them (a browser extension's `webRequest.onBeforeRedirect` can) sets `traits.redirectHops` and answers `redirects: [{ status, url, headers }]`, one entry per 3xx it followed, in order (`NetworkRedirectHop`). The kernel then treats it as one that does not follow. Programs get each 3xx as it was answered: through the proxy, curl, requests and `hf` see the real redirect, `X-Repo-Commit` and `ETag` included, and `ctx.fetch` with `redirect: 'manual'` answers it. The rest of the chain is held for the process that asked, at most 30 s and 8 chains per process (64 in all), with the final body unread. A follow-up from that process, with the method the redirect leads to and the same `Range`, `If-None-Match`, `If-Modified-Since`, `If-Range` and `Accept-Encoding` (and an `Authorization` if the first had one), is answered from it without a second request; any other request goes to the transport. A chain that expires or is pushed out is cancelled, and so is one whose follow-up arrives and does not match. After a redirect to another origin the follow-up is expected without `Authorization`, which HTTP clients drop when they follow one; a `Location` matches without its `#fragment`. The page's own `fetch` cannot show a redirect, so `fetchTransport()` in a page stays a transport that follows, and `redirect: 'manual'` fails there as before. `fetchTransport({ redirect: 'manual' })` hands redirects back unfollowed where the platform's `fetch` shows them (Node; a browser answers an opaque status 0), and `nodeTransport()` does so. A kernel socket also records who connected it (`SO_PEERCRED`): the connecting process's pid, uid and gid on the accepting side, and the listener's on the connecting side, kept when the socket passes to another process. The proxy uses this to keep each process's held chains its own.
-- **WebSockets:** a `GET` with `Upgrade: websocket`, in absolute form or inside a tunnel, is bridged to the transport's optional `websocket({ url, protocols, headers, signal })`. It answers `{ protocol, buffered, send(data), messages, close(code, reason), closed }`, with `messages` an async iterable of strings and `Uint8Array`s and `closed` resolving with `{ code, reason }`; a transport that has it says so with `traits.websocket`. The program gets `101 Switching Protocols` with the far end's protocol, then its frames go out as messages and the far end's come back as frames. Pings are answered by the proxy, and close codes pass both ways (a code that may not go on the wire becomes 1000 or 1011). A message over 64 MiB, or more than 16 MiB of payload from the far end waiting for the program, closes with 1009. The proxy stops reading the program while 1 MiB of its messages wait to be sent. A refused connection is `502` with the reason. A transport without WebSockets answers `501` with a message naming the option below, and the kernel logs a warning once, so a program never hangs. `fetchTransport({ webSocket: true })` opens them with the page's `WebSocket` (or pass a constructor); they are off by default because a browser WebSocket carries the user's cookies for the target site, which `fetch` here never sends (`credentials: 'omit'`), so a program could reach a site as the user. A page also cannot send headers on a WebSocket, and an `https:` page cannot open `ws:` to anything but loopback, which is a `502` that says so. `nodeTransport()` has WebSockets on (Node keeps no cookies) and sends the request's headers. An open fails as soon as Node's `WebSocket` reports an error, also on Node 22, which never follows the error with a close. A transport's `websocket()` may reject with an `Error` whose `code` is an errno, and the kernel hands that on to the program. Node's `WebSocket` doesn't say why an open failed, so when one fails, `nodeTransport()` finds out: it looks up the host's name (`EAI_NONAME` when that fails), then makes one TCP connection to the target, or a TLS one for `wss:`, for at most 3 s, and closes it at once. A refusal there is `ECONNREFUSED`, an unreachable host `EHOSTUNREACH` or `ENETUNREACH`, no answer `ETIMEDOUT`, and a TLS failure (a bad certificate) or a server that takes the connection but refused the upgrade `EPROTO`. A server that refused the upgrade therefore sees a second connection. The diagnosis never runs when an open succeeds, and never in a page (`fetchTransport()`), whose failed opens stay `ECONNREFUSED`. The credential-free path for a page is the coming slicc-node relay (`localProxyTransport()`, phase 2 of [#204](https://github.com/ai-ecoverse/slicc-kernel/issues/204)), which has no WebSockets yet. After the program sends its close frame, data the far end sends before its own close still reaches the program, and the far end's close frame follows once it has drained, as RFC 6455 §5.5.1 has it; a far end that doesn't close within 5 s gets the program's own close echoed back ([#1471](https://github.com/ai-ecoverse/slicc-kernel/issues/1471)). The same holds when the kernel runs in a worker and the page's transport carries the socket ([#1506](https://github.com/ai-ecoverse/slicc-kernel/issues/1506)).
-- **`localProxyTransport({ url, key })`** sends every request to a local proxy on loopback, such as [slicc-node](https://github.com/ai-ecoverse/slicc-node) or slicc-swift, which fetches it without CORS. Redirects reach the program unfollowed, with every `Set-Cookie`; bodies arrive decoded. `probeLocalProxy({ url, key })` resolves with the proxy's capabilities, or `null` when it is gone or refuses the key, so a page can fall back to `fetchTransport()`. `checkLocalProxy({ url, key })` says why: it resolves with `{ state }`, which is `ready` (with `probe`), `blocked` (the user denied Chrome's Local Network Access permission, `loopback-network`), `unreachable` (nothing answered; its `permission` is `granted`, `prompt` or `unknown`, and with `prompt` the page cannot tell a dismissed prompt from a proxy that is not running, since Chrome asks only once it has a connection), `refused` (with `status` and `error`, such as a stale key) or `incompatible`. The permission is not consulted when the page itself is on loopback. Both take a `fetch` option, and the transport `maxRequestBody` (default 64 MiB) and `bodyIdleMs` like `fetchTransport`.
-- **The host machine** is `host.slicc.internal` (`SLICC_HOST_LOOPBACK`), as `host.docker.internal` is in Docker, while `localhost` and `127.0.0.1` stay the kernel's own loopback. The proxy forwards `http(s)://host.slicc.internal:<port>/…` to the transport as `http(s)://127.0.0.1:<port>/…`, so it reaches the real machine's loopback through the local proxy or Node's `fetch` (through the page's own `fetch`, a request needs CORS from that server and Chrome's Local Network Access permission); other loopback addresses are still refused. This is HTTP and HTTPS through the proxy only: `/etc/hosts` and WASIX name resolution give the name `10.0.2.2`, QEMU's address for its host, so a program that connects a socket to it directly fails with `ENETUNREACH` instead of reaching the kernel's loopback.
+- **WebSockets:** a `GET` with `Upgrade: websocket`, in absolute form or inside a tunnel, is bridged to the transport's optional `websocket({ url, protocols, headers, signal })`. It answers `{ protocol, buffered, send(data), messages, close(code, reason), closed }`, with `messages` an async iterable of strings and `Uint8Array`s and `closed` resolving with `{ code, reason }`; a transport that has it says so with `traits.websocket`. The program gets `101 Switching Protocols` with the far end's protocol, then its frames go out as messages and the far end's come back as frames. Pings are answered by the proxy, and close codes pass both ways (a code that may not go on the wire becomes 1000 or 1011). A message over 64 MiB, or more than 16 MiB of payload from the far end waiting for the program, closes with 1009. The proxy stops reading the program while 1 MiB of its messages wait to be sent. A refused connection is `502` with the reason. A transport without WebSockets answers `501` with a message naming the option below, and the kernel logs a warning once, so a program never hangs. `fetchTransport({ webSocket: true })` opens them with the page's `WebSocket` (or pass a constructor); they are off by default because a browser WebSocket carries the user's cookies for the target site, which `fetch` here never sends (`credentials: 'omit'`), so a program could reach a site as the user. A page also cannot send headers on a WebSocket, and an `https:` page cannot open `ws:` to anything but loopback, which is a `502` that says so. `nodeTransport()` has WebSockets on (Node keeps no cookies) and sends the request's headers. An open fails as soon as Node's `WebSocket` reports an error, also on Node 22, which never follows the error with a close. A transport's `websocket()` may reject with an `Error` whose `code` is an errno, and the kernel hands that on to the program. Node's `WebSocket` doesn't say why an open failed, so when one fails, `nodeTransport()` finds out: it looks up the host's name (`EAI_NONAME` when that fails), then makes one TCP connection to the target, or a TLS one for `wss:`, for at most 3 s, and closes it at once. A refusal there is `ECONNREFUSED`, an unreachable host `EHOSTUNREACH` or `ENETUNREACH`, no answer `ETIMEDOUT`, and a TLS failure (a bad certificate) or a server that takes the connection but refused the upgrade `EPROTO`. A server that refused the upgrade therefore sees a second connection. The diagnosis never runs when an open succeeds, and never in a page (`fetchTransport()`), whose failed opens stay `ECONNREFUSED`. The credential-free path for a page is a transport that opens them outside the page, such as one over a linked slicc CLI (`npx sliccy@next`). After the program sends its close frame, data the far end sends before its own close still reaches the program, and the far end's close frame follows once it has drained, as RFC 6455 §5.5.1 has it; a far end that doesn't close within 5 s gets the program's own close echoed back ([#1471](https://github.com/ai-ecoverse/slicc-kernel/issues/1471)). The same holds when the kernel runs in a worker and the page's transport carries the socket ([#1506](https://github.com/ai-ecoverse/slicc-kernel/issues/1506)).
+- **The host machine** is `host.slicc.internal` (`SLICC_HOST_LOOPBACK`), as `host.docker.internal` is in Docker, while `localhost` and `127.0.0.1` stay the kernel's own loopback. The proxy forwards `http(s)://host.slicc.internal:<port>/…` to the transport as `http(s)://127.0.0.1:<port>/…`, so it reaches the real machine's loopback through Node's `fetch` or a transport that runs on that machine (through the page's own `fetch`, a request needs CORS from that server and Chrome's Local Network Access permission); other loopback addresses are still refused. This is HTTP and HTTPS through the proxy only: `/etc/hosts` and WASIX name resolution give the name `10.0.2.2`, QEMU's address for its host, so a program that connects a socket to it directly fails with `ENETUNREACH` instead of reaching the kernel's loopback.
 - **Without a transport**, every request is answered `502` with `slicc-kernel: no network transport (createKernel({ network: { transport } }))`.
 
 **`AF_UNIX` datagram sockets** ([#891](https://github.com/ai-ecoverse/slicc-kernel/issues/891)), for syslog-style logging and `sd_notify`-style readiness:
@@ -733,13 +732,13 @@ In the browser, the page serves the uplink to the kernel worker over the same po
 
 ### Browser automation (CDP)
 
-Programs drive a browser with the Chrome DevTools Protocol over a WebSocket, whichever host actually has the browser: slicc-extension's `chrome.debugger`, slicc-node's or slicc-swift's CDP proxy, or a test harness. The kernel relays; it does not launch a browser.
+Programs drive a browser with the Chrome DevTools Protocol over a WebSocket, whichever host actually has the browser: slicc-extension's `chrome.debugger`, a linked slicc CLI (`npx sliccy@next`), or a test harness. The kernel relays; it does not launch a browser.
 
 - **Programs** find the endpoint in `SLICC_CDP_URL`, `ws://127.0.0.1:9222/devtools/browser/<id>`, where `<id>` is random for each kernel boot. `http://127.0.0.1:9222/json/version` answers `{ "Browser", "Protocol-Version", "webSocketDebuggerUrl" }` with the same URL (carrying the request's query), and `/json/list` (or `/json`) lists the host's targets, without per-target sockets. Every other path is `404`. The listener starts on the first connection, on the kernel's loopback; a program that binds `9222` first keeps it.
 - **Sessions** are Chrome's flattened ones: `Target.attachToTarget` with `flatten: true`, then commands with a top-level `sessionId`. Messages pass unchanged, as text frames up to 256 MiB (a larger one closes the socket with `1009`). Each program WebSocket gets a host connection of its own: closing the socket (or exiting) closes it, which detaches its sessions, and a host that closes is passed on as a close frame (`1011` with its reason). The kernel then waits up to a second for the program's close frame before it hangs up, as RFC 6455 has it, so a program that answers the close can still report the code. `terminate()` closes them all.
 - **Runtime**: a program adds `runtime=<name>` to the query of the URL it opens, and the kernel gives it to the host; the kernel does not interpret it.
 - **No host**: `/json/*` and the WebSocket handshake answer `503` with `slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)`, and a host that refuses (an unknown runtime, say) gives `502` with its message.
-- **Kernel-only**: port `9222` is reserved (a program's `bind()` to it fails with `EADDRINUSE`, so none can squat it) and takes connections only from programs in the kernel. `kernel.dial`, a client's `dial` and `loopbackFetch` (and so `9222.kernel.localhost` and slicc-node's tunnel) are refused with `ECONNREFUSED`, since the facade drives the user's real browser.
+- **Kernel-only**: port `9222` is reserved (a program's `bind()` to it fails with `EADDRINUSE`, so none can squat it) and takes connections only from programs in the kernel. `kernel.dial`, a client's `dial` and `loopbackFetch` (and so `9222.kernel.localhost`) are refused with `ECONNREFUSED`, since the facade drives the user's real browser.
 
 An embedder offers a browser with the `cdp` option of `createKernel` or `createNodeKernel`, or from an attached client with `client.serveCdp(hook, { runtime })`:
 
@@ -782,16 +781,6 @@ interface ConnectorStamp { pid: number; ppid: number; uid: number; gid: number;
 - **Handing a connection on hands over the identity:** a facade connection that a process passes to another (a fork, an exec, an inherited descriptor) still speaks as the process that connected, as on Linux. So a privileged process should not pass one to a less trusted one.
 - **Reserved:** a facade's port is reserved from the start. A program's `bind()` to it fails with `EADDRINUSE`, so no program can squat it and impersonate the page, and ephemeral ports skip it. Port 9222 is reserved the same way. Like 9222, a facade's port is kernel-only: the page's `kernel.dial`, a client's `dial` and `loopbackFetch` (and so `<port>.kernel.localhost`) are refused with `ECONNREFUSED`.
 
-### Local proxy protocol
-
-The page and the proxy speak raw mode of SLICC's `/api/fetch-proxy`. Every request is one `POST {url}/api/fetch-proxy` with `credentials: 'omit'`:
-
-- `X-Bridge-Token: <key>`, the per-process proxy key. It travels only in this header, never in a URL.
-- `X-Slicc-Raw-Request: <json>`, the head to send upstream: `{ "url", "method", "headers": [[name, value], …] }`, with the headers in order and repeats kept apart. Characters past U+007E are `\u`-escaped so the value is a valid header.
-- The request body, if any, as the hop's body.
-
-The proxy answers `200` with `Content-Type: application/vnd.slicc.raw-fetch`: a big-endian `u32` length, that many bytes of UTF-8 JSON `{ "status", "statusText", "headers": [[name, value], …], "url" }`, then the upstream body until the end of the hop. Any other answer is a refusal with a JSON `{ "error" }` body and `X-Proxy-Error: 1`; programs see its status (`400` malformed head, `403` wrong origin or key, `413` body too large, `502` upstream unreachable). A probe is a `POST` with the key and `X-Slicc-Raw-Probe: 1` instead of a head; it is answered with JSON `{ "rawFetch": 1, "requestBodyStreaming", "maxRequestBodyBytes" }` and fetches nothing. A proxy that tunnels to the kernel for `<port>.kernel.localhost` adds `"kernelTunnel"` and `"kernelPort"`, and one that serves a `/cdp` endpoint adds `"cdp"` (a version, e.g. `1`). `checkLocalProxy` and `probeLocalProxy` pass these on when they are numbers. The server side (origin allowlist, CORS, the Private Network Access preflight) is specified in [slicc-node's README](https://github.com/ai-ecoverse/slicc-node#protocol).
-
 ## Filesystem
 
 `/` is the OPFS root. Each process mounts the top-level directories that exist when it starts (plus `/usr` and `/bin`), so files in them are shared by all processes and visible through the OPFS API as soon as the process that wrote them has closed them; `run` resolves only after that. `createKernel` creates `/tmp` and `/home` in OPFS, so they are shared too. Files directly in `/`, and directories created there after a process started, are OPFS as well, the same for Emscripten and WASI programs; only `/dev` and `/proc` live in each process's memory. A program's `mkdir` (WASI `path_create_directory`, Emscripten's `mkdir`) is exclusive, as on Linux: it fails with `EEXIST` when the name exists, and of several processes or threads making one name at once exactly one succeeds, so a directory works as a lock. Under a missing directory it fails with `ENOENT`, as on Linux (`mkdir -p` and `os.makedirs` make the parents in the program); a JS program's `ctx.fs.mkdir` makes parents itself. The kernel makes the system `PNPM_HOME` (`/usr/local/share/pnpm`, or the embedder's) when it starts, since pnpm makes only its `bin` directory there. A full origin storage (`QuotaExceededError`, which also comes early in a browser's private or off-the-record contexts, whatever `navigator.storage.estimate()` says) is `ENOSPC`, never retried. A read that meets `NotFoundError` while a writer outside the kernel swaps the file in with `createWritable` (and a `stat`, `lstat` or `utimes` that meets it) looks the name up again, up to three times, before it fails ([#1075](https://github.com/ai-ecoverse/slicc-kernel/issues/1075)), so a program whose package is overwritten in place keeps starting. An OPFS or IndexedDB failure that has no POSIX counterpart is `EIO`; its message names the DOM error and the operation (`lookup`, `read`, `write`, `commit` or `sidecar`), and the kernel worker logs the first of each kind to its console. File contents are buffered per open file and written back on close, `fsync` and exit, so a refused write (`ENOSPC`, `EIO`) surfaces at that close or `fsync`, and a program that ignores close errors doesn't see it (`echo x > f` can exit 0 with `f` empty, as with any buffered write-back). A write-back error a close has already reported to a WASI program isn't raised again when it exits, so the program keeps its own exit status. Metadata operations (`mkdir`, `rename`, `rm`, …) go straight to OPFS. The kernel worker is the only writer.
@@ -844,7 +833,7 @@ Directories are renamed with `FileSystemHandle.move()` where available, else by
 
 `/dev/shm` is a tmpfs the kernel mounts at boot (source `shm`), mode `1777` and owned by root, so with `users` the sticky bit keeps one user from removing or renaming another's file there (`EPERM`). It's in `/proc/mounts`, but not in `kernel.mounts()`, which lists the mounts a caller made. Every process sees the same files, Emscripten (whose glue otherwise keeps a private `/dev/shm` in memory), WASI and JS programs alike, and they last until the kernel terminates, which is what musl's `shm_open` and `sem_open` need.
 
-- **Built in:** `tmpfs`, which lives in memory until unmounted, in 1 MiB chunks; `fsa`, a folder the user picks (see [Removable media](#removable-media-fsa)); and `hostfs`, a folder the local proxy exports (see [Host folders](#host-folders-hostfs)).
+- **Built in:** `tmpfs`, which lives in memory until unmounted, in 1 MiB chunks; `fsa`, a folder the user picks (see [Removable media](#removable-media-fsa)); and `hostfs`, a folder the host exports (see [Host folders](#host-folders-hostfs)).
 - **Package drivers:** a package declares a type in `"slicc": { "filesystems": { "<type>": { "module": "<file>" } } }`, and the kernel starts that module in a worker of its own for each mount. The module is a single self-contained file: it can't import bare specifiers.
   - Its default export receives `{ fetch }`, the kernel's network transport. It returns `{ handlers, capabilities }`.
   - Its worker gets a JS program's lockdown before the module loads: its own `fetch`, `WebSocket`, storage and workers are `undefined`, and a worker where one cannot be removed does not start the driver.
@@ -887,7 +876,7 @@ Directories are renamed with `FileSystemHandle.move()` where available, else by
 - **Rules on a mount:**
   - a rename across mounts is `EXDEV`, so `mv` copies;
   - a symlink on the root file system that leads onto a mount, such as `~/proj` → `/mnt/drive/proj`, or a chain from a mount to the root and back, is followed onto the mount by every operation, in every runtime: reads, writes, `stat`, listings, `mkdir`, removals, renames, `chmod`, `chown` and times. Removing the link itself removes the link. Before [#547](https://github.com/ai-ecoverse/slicc-kernel/issues/547) was fixed, the kernel resolved such a link against the directory under the mount point for JS and WASI programs, the embedder's `fs` and attached clients (Emscripten programs weren't affected): reads failed with `ENOENT`, and writes went into that hidden directory, which shows again once the mount is gone;
-  - a hard link (`link()`, `linkat()`, Python's `os.link`, `ctx.fs.link`) works within a mount whose driver offers `links`, as `tmpfs` does: both names are one file with one inode, `st_nlink` counts them, and the data goes with the last name and the last open descriptor. Across mounts it's `EXDEV`. It's `EPERM` on the root file system (OPFS or memory), on `fsa` folders, on `hostfs` until slicc-node offers links, and for directories; on the root the names are checked first, as Linux does: a missing source (or, when following, a dangling one) or target directory is `ENOENT`, a target directory that isn't one is `ENOTDIR`, and a taken name is `EEXIST`. `link()` links a symlink itself and `linkat(…, AT_SYMLINK_FOLLOW)` links its target, as on Linux. Descriptors the kernel holds (JS programs' files, and a WASI program's files once it forks or spawns with them) share one cache for all names of a file, so a write through one name is read at once through another, also after either name is removed or replaced while open; `link()` writes the source's pending changes back first. Within one WASI program, its own descriptors of a file's names share one buffer too. Once it starts a subprocess, the files it had open are kernel descriptors, and a later open of one of them, under that name or another (same inode), goes through the kernel and shares their cache; between programs, a WASI program's own descriptors see the other names' writes at open, as for one name across processes. A WASI program that removes or renames over the name it has open, while another link remains, keeps writing to the file through its descriptor, and the other names see those writes; `linkat(…, AT_SYMLINK_FOLLOW)` writes back the program's pending changes to the symlink's target first. `st_nlink` leaves out the names the kernel keeps in `.slicc-unlinked` for open descriptors, so `fstat` on a descriptor whose name was removed counts the names left: 0 once the last one is gone. A change of mode, owner, times or size through one name, or a new or removed name, also drops the attributes the kernel has cached for the file's other names (same inode, or, when the changed name's inode isn't cached, every file with more than one link), so on a mount with an `attrTtl` they show the change at once. So it works for WASI, WASIX and JS programs, and for Emscripten programs built with a `__syscall_linkat` import (wasm-coreutils and wasm-tar from the next homescoop builds), which get `EMLINK` where the others get `EPERM` because the file system has no hard links (the root, `fsa`, `hostfs`), as Emscripten itself answers. Older Emscripten builds (wasm-coreutils 9.12.0-5's `ln`, wasm-tar 1.35.0-5) answer `EMLINK` from their own C library, which never asks the kernel, but they see links other programs made: their open descriptors of one file's names share one buffer, and one that removes the name it has open while another link remains keeps writing to the file;
+  - a hard link (`link()`, `linkat()`, Python's `os.link`, `ctx.fs.link`) works within a mount whose driver offers `links`, as `tmpfs` does: both names are one file with one inode, `st_nlink` counts them, and the data goes with the last name and the last open descriptor. Across mounts it's `EXDEV`. It's `EPERM` on the root file system (OPFS or memory), on `fsa` folders, on `hostfs`, whose protocol has no links, and for directories; on the root the names are checked first, as Linux does: a missing source (or, when following, a dangling one) or target directory is `ENOENT`, a target directory that isn't one is `ENOTDIR`, and a taken name is `EEXIST`. `link()` links a symlink itself and `linkat(…, AT_SYMLINK_FOLLOW)` links its target, as on Linux. Descriptors the kernel holds (JS programs' files, and a WASI program's files once it forks or spawns with them) share one cache for all names of a file, so a write through one name is read at once through another, also after either name is removed or replaced while open; `link()` writes the source's pending changes back first. Within one WASI program, its own descriptors of a file's names share one buffer too. Once it starts a subprocess, the files it had open are kernel descriptors, and a later open of one of them, under that name or another (same inode), goes through the kernel and shares their cache; between programs, a WASI program's own descriptors see the other names' writes at open, as for one name across processes. A WASI program that removes or renames over the name it has open, while another link remains, keeps writing to the file through its descriptor, and the other names see those writes; `linkat(…, AT_SYMLINK_FOLLOW)` writes back the program's pending changes to the symlink's target first. `st_nlink` leaves out the names the kernel keeps in `.slicc-unlinked` for open descriptors, so `fstat` on a descriptor whose name was removed counts the names left: 0 once the last one is gone. A change of mode, owner, times or size through one name, or a new or removed name, also drops the attributes the kernel has cached for the file's other names (same inode, or, when the changed name's inode isn't cached, every file with more than one link), so on a mount with an `attrTtl` they show the change at once. So it works for WASI, WASIX and JS programs, and for Emscripten programs built with a `__syscall_linkat` import (wasm-coreutils and wasm-tar from the next homescoop builds), which get `EMLINK` where the others get `EPERM` because the file system has no hard links (the root, `fsa`, `hostfs`), as Emscripten itself answers. Older Emscripten builds (wasm-coreutils 9.12.0-5's `ln`, wasm-tar 1.35.0-5) answer `EMLINK` from their own C library, which never asks the kernel, but they see links other programs made: their open descriptors of one file's names share one buffer, and one that removes the name it has open while another link remains keeps writing to the file;
   - `df` reports each mount from its driver's `statfs`;
   - each mount has its own device number;
   - without `chmod` support, `chmod` succeeds and changes nothing;
@@ -927,15 +916,15 @@ An `fsa` mount is a drive for a local folder, from the File System Access API, a
 
 ### Host folders: `hostfs`
 
-A `hostfs` mount is a folder exported by the local proxy ([slicc-node](https://github.com/ai-ecoverse/slicc-node) or slicc-swift), with no picker and no permission prompt. The protocol is specified in [slicc-node#13](https://github.com/ai-ecoverse/slicc-node/issues/13).
+A `hostfs` mount is a folder the host exports, such as a linked slicc CLI's `--mount` folder (`npx sliccy@next`), with no picker and no permission prompt. The protocol is specified in [slicc-node#13](https://github.com/ai-ecoverse/slicc-node/issues/13); slicc-node itself is retired, and its repository is archived.
 
-- **Grants:** `kernel.mount({ type: 'hostfs', source: 'project', target: '/mnt/project' })` asks the page's `hostfs(source, { readonly })` hook for a grant. The page holds the proxy key and asks the proxy (`POST /api/hostfs/grant`) for a token scoped to that one folder. The kernel sees only `{ url, token }`, never the proxy key, and the token never appears in mount options or `/proc/mounts`. When the proxy refuses a token, the kernel asks the hook once for a new one.
-- **Options:** `ro` mounts read-only, and `maxfile` caps file size as on any mount. There is no other size limit: reads and writes go in `maxIo` pieces (16 MiB unless the proxy says otherwise), so a file of any size the host can hold works. A proxy that advertises `ranges` in its grant (slicc-node 2.4, slicc-swift 1.4) makes the mount ranged, so programs read and write its files in pages and truncate through `setattr` `size`. With an older proxy files go whole, and a truncate on a ranged mount whose proxy was replaced by an older one is done by rewriting the file.
+- **Grants:** `kernel.mount({ type: 'hostfs', source: 'project', target: '/mnt/project' })` asks the page's `hostfs(source, { readonly })` hook for a grant. Over HTTP, the page holds the host's key and asks the host (`POST /api/hostfs/grant`) for a token scoped to that one folder. The kernel sees only `{ url, token }`, never the key, and the token never appears in mount options or `/proc/mounts`. When the host refuses a token, the kernel asks the hook once for a new one.
+- **Options:** `ro` mounts read-only, and `maxfile` caps file size as on any mount. There is no other size limit: reads and writes go in `maxIo` pieces (16 MiB unless the host says otherwise), so a file of any size the host can hold works. A host that advertises `ranges` in its grant makes the mount ranged, so programs read and write its files in pages and truncate through `setattr` `size`. Without it files go whole, and a truncate on a ranged mount whose host was replaced by one without `ranges` is done by rewriting the file.
 - **Changes on the host** arrive as invalidations on a watch stream (`POST /api/hostfs/watch`), so an edit made outside shows up on the next access without a remount.
 - **Writes when the link drops:** after a mount's link drops, a write that returned success may not be on the host unless the program fsyncs or checks close, as on Linux with NFS: the shell ignores a redirection's close error ([#1062](https://github.com/ai-ecoverse/slicc-kernel/issues/1062)). How soon a write notices the loss is bounded: a folder that goes silent behind a live link fails the pending call after 20 s (see **Hanging folders** below), a port that dies fails it after 10 s without a ping answer, and a link that reports itself down (`ENOTCONN`) fails it at once. In every case the mount is then `nomedium` until it reconnects (see **Proxy loss** below), and until then each operation fails at once with `ENOMEDIUM`. A shell loop that keeps writing after a failed write (`for …; do echo …; done > file`) keeps running through its failing writes and exits non-zero at the end, as on Linux; stop at the first failed write (`echo … || exit 1`) to end at once ([#1077](https://github.com/ai-ecoverse/slicc-kernel/issues/1077)).
 - **Proxy loss:** when the watch stream ends, or is silent for 45 s, the kernel reconnects once at once. If that fails, the mount is `nomedium`, as with [removable media](#removable-media-fsa): operations fail with `ENOMEDIUM` (`ENODEV` for WASI), and the kernel keeps reconnecting with backoff (1 s to 30 s), so the folder comes back by itself when the proxy does. A mount made while the proxy is down starts as `nomedium`, and so does one whose grant or first watch takes more than 15 s; it comes up by itself when they arrive.
 - **Consistency:** a file that changes on the host while a program reads it fails with `ESTALE`, and the kernel restarts the whole read (up to 3 times) instead of stitching two versions together. On a ranged mount an open file keeps the version it was opened at (its ETag) until it writes, also when it is handed to a child process: a page fetched after the host changed the file fails the program's read with `ESTALE` ("Stale file handle") instead of mixing versions. A file deleted on the host while a program holds it open fails the next read that goes to the host with `ENOENT`, not with NFS's `ESTALE`.
-- **Over a port:** the hook may answer `{ port, token?, capabilities? }` instead, for a folder that doesn't come from slicc-node over HTTP: for example, a linked `slicc` CLI's export, which the page reaches over its own link. The page implements a `HostfsTransport` for the folder (`capabilities`, `token`, `maxIo`, `call(op, body)`, `read(fh, offset, size, ifMatch?)`, `write(fh, offset, bytes)`, `watch(signal, onEvent, onOpen)`, with slicc-node's ops and answers) and serves it with `serveHostfsPort(port, transport)`, exported from both entries, which returns a function that stops serving and closes the port.
+- **Over a port:** the hook may answer `{ port, token?, capabilities? }` instead, for a folder that doesn't come over HTTP: for example, a linked slicc CLI's export, which the page reaches over its own link. The page implements a `HostfsTransport` for the folder (`capabilities`, `token`, `maxIo`, `call(op, body)`, `read(fh, offset, size, ifMatch?)`, `write(fh, offset, bytes)`, `watch(signal, onEvent, onOpen)`, with the protocol's ops and answers) and serves it with `serveHostfsPort(port, transport)`, exported from both entries, which returns a function that stops serving and closes the port.
   - **Slow links:** each read or write message carries up to `maxIo` bytes and has to finish within the 20 s call bound, so a page that serves a folder over a slow or remote link sets `capabilities.maxIo` to fit it: 4 MiB over 1 Mbit/s takes about 32 s and would fail every time, while 512 KiB takes about 4 s.
   - The kernel moves the port into its worker with the grant. Calls, reads and writes are request and reply messages there, and the watch is a stream of messages that the kernel ends by aborting.
   - Errors keep their `code`. A transport that throws `ENOTCONN` (its link is down) makes the mount `nomedium` and reconnecting, as a lost proxy does: the kernel asks the hook again, and the page answers with a new port.
@@ -943,7 +932,7 @@ A `hostfs` mount is a folder exported by the local proxy ([slicc-node](https://g
   - **Hanging folders:** every request to a `hostfs` folder, over a port or over HTTP, gets 20 s: each call, and each read or write of up to `maxIo` bytes. The mount tells the kernel the folder's own `maxIo` (at most 16 MiB), so one file operation never puts more than that on the folder at once. One that takes longer fails with `ENOTCONN`, so the mount goes `nomedium` and reconnects by itself, instead of the driver watchdog (30 s) marking the mount `failed` until a remount. The timeout also retires that connection: its requests in flight are aborted (HTTP) or failed (a port), nothing more is sent on it, its open files are `ESTALE`, and a file whose open answers late is released on the folder. Over a port, the kernel keeps the port for another second for cleanup (a temporary write permission it added to open a read-only file is put back; over HTTP, where a request can still be running on the host after the restore, 30 s later the kernel checks it once more, and if a late chmod still left the same file (same inode, or same size and mtime) with just that bit added, it puts the mode back again), then tells `serveHostfsPort` it is going (`bye`, which Chrome can't signal by itself). The server then releases every file it opened through that port, including one whose open lands later. A request the host already received may still finish there: an operation that timed out may have happened, so check before retrying it (a retried `mkdir` or create can fail with `EEXIST`, a retried `rename` or `unlink` with `ENOENT`). The kernel itself retries only reads and whole-file rewrites after `ESTALE`, never an exclusive create.
   - A read reply sends a copy of the transport's bytes, so a transport may return a view into storage it keeps (a cache, a pooled or shared buffer).
   - `token` names the connection (a link id, say); without one, every port gets its own name. It doesn't decide whether open files survive a reconnect: a file a program holds open is opened again by path on the new connection, with the ETag it had (`ifMatch`). It goes on if the file is unchanged on the host, and fails with `ESTALE` if the host changed it meanwhile. Files opened through a port that is gone are `ESTALE` until they are opened again.
-- **Node:** a page's requests carry its `Origin`, and slicc-node grants a token to that origin only. Node's `fetch` sends none, so a Node embedder passes `createNodeKernel` the origin its `hostfs` hook asked for the grant with, as `hostfsOrigin`, and the kernel adds it to every hostfs request. Without it the mount stays `nomedium`. `hostfsFetch(url, init)` replaces the `fetch` those requests use (for an agent or a test proxy), and gets the `Origin` too when both are given.
+- **Node:** a page's requests carry its `Origin`, and a host may grant a token to that origin only. Node's `fetch` sends none, so a Node embedder passes `createNodeKernel` the origin its `hostfs` hook asked for the grant with, as `hostfsOrigin`, and the kernel adds it to every hostfs request. Without it the mount stays `nomedium`. `hostfsFetch(url, init)` replaces the `fetch` those requests use (for an agent or a test proxy), and gets the `Origin` too when both are given.
 
 ### Mounting from a program
 
@@ -1202,7 +1191,7 @@ printf '{"kind":"open.url","url":"%s"}\n' "$url" | cat > /dev/embedder
   - **Revoking:** a result is kept until the file changes, so when `lookup`'s answers change (an updated hash list, a package revoked or reinstalled), call `await kernel.integrity.revoke(path?)` (on the page and in Node). It drops what the kernel verified for that path, or for everything under it when it's a directory (its real path and the name a link reached it by both count), or for every path without one, and rebuilds the command catalog from the manifests as checked again. A load that was under way when `revoke` was called keeps nothing. It takes effect at the next start: running processes keep what they loaded. `path` must be absolute; without `integrity` it does nothing.
   - **Where `lookup` gets its hashes:** from a source independent of the installed files, such as the per-file hashes the embedder derives from the published package tarball when it builds its catalog. Hashes read back from the installed files prove nothing.
   - **Links out of the paths:** a file reached through a protected path but whose real path lies outside every path (a symlink at or below a protected path, or one of its directories, pointing elsewhere, a command of the catalog included) is still checked, under the last protected name on the way: the kernel asks `lookup(name)` for the bytes of the real file, `unknown` applies when it has no hash, and `onDenial` reports the name as `path`. Writes outside the paths aren't counted, so such a result isn't cached: the file is hashed again at every start.
-  - **Sources a program reads itself** ([#454](https://github.com/ai-ecoverse/slicc-kernel/issues/454)): a runtime that loads code on its own is checked too, when a process reads the file through the kernel. That covers jsh's and slicc-node's modules and the `package.json` files whose `main`/`exports` they follow, python's `.py`, `.pyc`, `.pth` and zip imports, `dlopen`'s side modules, and a script's interpreter reading the script after its exec check (a file swapped in between is refused then).
+  - **Sources a program reads itself** ([#454](https://github.com/ai-ecoverse/slicc-kernel/issues/454)): a runtime that loads code on its own is checked too, when a process reads the file through the kernel. That covers jsh's modules and the `package.json` files whose `main`/`exports` they follow, python's `.py`, `.pyc`, `.pth` and zip imports, `dlopen`'s side modules, and a script's interpreter reading the script after its exec check (a file swapped in between is refused then).
     - **Which files:** those under a path whose name ends in one of `integrity.sources`, plus every regular file with an execute bit (a `#!` script without a suffix, a sourced script). The default is `['.js', '.mjs', '.cjs', '.json', '.py', '.pyc', '.pth', '.zip', '.so', '.wasm', '.sh']`. An embedder can replace the list, and `sources: []` turns these checks off and leaves only the ones above. Data files aren't checked, since a package can hold files no `lookup` knows (lock files, caches), which `unknown: 'deny'` would make unreadable.
     - **Where:** a whole-file read (a JS program's `ctx.fs.readFile` and `ctx.sync.fs.readFile`, a `.json` included, and the dynamic linker's) gets exactly the bytes that were hashed. An open (WASI and Emscripten programs, so ranged reads too) is checked when the file is opened. The result is cached per real path and version, as for programs, so an unchanged file costs a version check: OPFS's own `lastModified` and size, plus one metadata read.
     - **Refused:** a read or an open fails with `EACCES`, and `onDenial` gets `{ op: 'read-integrity', … }`. A file with no known hash is reported once as `read-unverified`.
@@ -1313,7 +1302,7 @@ The kernel is ported from SLICC's `packages/webapp/src/kernel/` with the browser
 - `src/realm/`: the synchronous bridge (`SharedArrayBuffer` + `Atomics.wait`) and the live Emscripten filesystem on top of it. When a program's file call gets no answer, the bridge treats it like an NFS mount (#990). A read-only call (`read`, `pread`, `stat`, `lstat`, `readdir`, `readlink`, `exists`, `access`, `statfs`) fails with `EIO` once nothing has come back for 25 s; the clock starts again with every chunk of a long answer, so a slow transfer that keeps answering never fails (the host keeps a long answer for 30 s after each chunk it hands over, not after the first), and a late answer is dropped, which is harmless because the call changed nothing. A call that changes the file system (writes, `rename`, `unlink`, `mkdir`, creates, `chmod`, holds…) waits for its answer like a hard mount, however long the backend is gone, so it never returns an error for an effect that lands later. Only a signal that ends the process (`SIGKILL`) or the kernel shutting down ends that wait. JavaScript programs' synchronous `ctx.sync.fs` calls get the same treatment on their own lane (#1033): a read-only call (`readFile`, `stat`, `lstat`, `readdir`, `readlink`, `exists`, `statfs`) throws `EIO` after 25 s without an answer, and every other call, as well as descriptor calls such as a read from a pipe or a terminal, waits for its answer.
 - `src/fs/`: the OPFS filesystem and the virtual command directories.
 - `src/launcher.ts`, `src/commands.ts`, `src/serve.ts`, `src/index.ts`, `src/users.ts`: command resolution, the kernel worker protocol, the page API and the user database; `src/node.ts`, `src/node-process-worker.ts` and `src/node/` the headless Node entry. An embedder that uses `Launcher` directly, without `createKernel`, calls `await launcher.prepare()` first: it creates `/tmp` and `/home` and writes the CA certificate.
-- `src/kernel/net/`: the proxy, HTTP/1.1, TLS termination and the local CA, and the bridge to the page's transport; `src/transport.ts` and `src/local-proxy-transport.ts` are the page side.
+- `src/kernel/net/`: the proxy, HTTP/1.1, TLS termination and the local CA, and the bridge to the page's transport; `src/transport.ts` is the page side.
 - `src/cdp/`: the CDP facade on `127.0.0.1:9222`, its WebSocket framing, the registry of hosts and the `MessagePort` bridge to them.
 - `src/cron/`: the cron service (`service.ts`), the schedule and table parsers, the clock, and the `crontab` command with the kernel side of `ctx.crontab`. An embedder that uses `Launcher` directly passes `cron: { lock }` to share the firing lock among the kernels on one root; the default, `slicc-kernel-cron`, is one lock for the whole origin.
 

package/dist/index.js

@@ -217,14 +217,14 @@ function bodyOf(source, head, method) {
   }
   return counted(source, size);
 }
-function stream(chunks3, socket, signal) {
+function stream(chunks2, socket, signal) {
   return new ReadableStream({
     start(controller) {
       signal?.addEventListener("abort", () => controller.error(signal.reason), { once: true });
     },
     async pull(controller) {
       try {
-        const next = await chunks3.next();
+        const next = await chunks2.next();
         if (next.done) {
           controller.close();
           socket.close();
@@ -274,9 +274,9 @@ async function loopbackFetch(dial, input, options) {
       if (!raw) throw errorWithCode("ECONNRESET: the connection closed before a response");
       head = parseHead(raw);
     } while (head.status >= 100 && head.status < 200);
-    const chunks3 = bodyOf(source, head, request.method);
-    if (!chunks3) socket.close();
-    return new Response(chunks3 ? stream(chunks3, socket, options.signal) : null, {
+    const chunks2 = bodyOf(source, head, request.method);
+    if (!chunks2) socket.close();
+    return new Response(chunks2 ? stream(chunks2, socket, options.signal) : null, {
       status: head.status,
       statusText: head.statusText,
       headers: head.headers
@@ -1063,7 +1063,7 @@ function sendableClose(code) {
 function blockedReason(url, e) {
   const name = e?.name;
   if (name === "SecurityError" && url.startsWith("ws:")) {
-    return `${url}: ws:// is blocked from an https page; use wss:// or slicc-node`;
+    return `${url}: ws:// is blocked from an https page; use wss://, or link a slicc CLI (npx sliccy@next)`;
   }
   return `${url}: ${e instanceof Error ? e.message : String(e)}`;
 }
@@ -1186,7 +1186,7 @@ function requestBody(request) {
   return request.body ? { body: request.body } : {};
 }
 function fetchTransport(options = {}) {
-  const send2 = options.fetch ?? globalThis.fetch.bind(globalThis);
+  const send = options.fetch ?? globalThis.fetch.bind(globalThis);
   const Socket = options.webSocket === true ? globalThis.WebSocket : options.webSocket || void 0;
   const headers = options.webSocketHeaders === true;
   const redirect = options.redirect ?? "follow";
@@ -1203,7 +1203,7 @@ function fetchTransport(options = {}) {
     async fetch(request) {
       let response;
       try {
-        response = await send2(request.url, {
+        response = await send(request.url, {
           method: request.method,
           headers: joinHeaders(request.headers),
           ...requestBody(request),
@@ -1700,10 +1700,10 @@ async function holdLock(locks) {
   await granted.promise;
   return { name, release: () => held.resolve() };
 }
-function concat(chunks3) {
-  const out = new Uint8Array(chunks3.reduce((n, c) => n + c.length, 0));
+function concat(chunks2) {
+  const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let at = 0;
-  for (const chunk of chunks3) {
+  for (const chunk of chunks2) {
     out.set(chunk, at);
     at += chunk.length;
   }
@@ -1753,8 +1753,8 @@ var Channel = class {
   }
   request(call, handlers = {}) {
     const id = ++this.nextId;
-    const { failure: failure3 } = this;
-    if (failure3) return { id, done: Promise.reject(failure3) };
+    const { failure: failure2 } = this;
+    if (failure2) return { id, done: Promise.reject(failure2) };
     const done = new Promise((resolve, reject) => {
       this.pending.set(id, { resolve, reject, ...handlers });
       this.port.postMessage({ ...call, id });
@@ -1919,10 +1919,10 @@ function endedOf(done, signal) {
 }
 async function runOn(channel, argv, opts) {
   const { onStdout, onStderr, ...rest } = opts;
-  const chunks3 = { 1: [], 2: [] };
+  const chunks2 = { 1: [], 2: [] };
   const live = { 1: new TextDecoder(), 2: new TextDecoder() };
   const tee = (fd, on) => (bytes) => {
-    chunks3[fd].push(bytes);
+    chunks2[fd].push(bytes);
     on?.(live[fd].decode(bytes, { stream: true }));
   };
   const child = await spawnOn(channel, argv, {
@@ -1931,7 +1931,7 @@ async function runOn(channel, argv, opts) {
     onStderr: tee(2, onStderr)
   });
   const { status, signal } = await child.ended;
-  const text = (fd) => new TextDecoder().decode(concat(chunks3[fd]));
+  const text = (fd) => new TextDecoder().decode(concat(chunks2[fd]));
   return {
     pid: child.pid,
     status,
@@ -1960,7 +1960,7 @@ async function terminalOn(channel, argv, opts) {
   );
   done.catch(started.reject);
   const pid = await started.promise;
-  const send2 = (action) => void channel.call({ op: "terminal", terminal: id, ...action }).catch(() => void 0);
+  const send = (action) => void channel.call({ op: "terminal", terminal: id, ...action }).catch(() => void 0);
   return {
     pid,
     exited: done,
@@ -1972,10 +1972,10 @@ async function terminalOn(channel, argv, opts) {
       listener = next;
       if (next) for (const bytes of backlog.splice(0)) next(bytes);
     },
-    write: (data) => send2({ action: "write", bytes: bytesOf2(data) }),
-    resize: (cols, rows) => send2({ action: "resize", cols, rows }),
-    signal: (name) => send2({ action: "signal", signal: name }),
-    close: () => send2({ action: "close" })
+    write: (data) => send({ action: "write", bytes: bytesOf2(data) }),
+    resize: (cols, rows) => send({ action: "resize", cols, rows }),
+    signal: (name) => send({ action: "signal", signal: name }),
+    close: () => send({ action: "close" })
   };
 }
 function fsOn(channel) {
@@ -2111,187 +2111,6 @@ async function attachKernel(port, options = {}) {
   };
 }
 
-// src/local-proxy-transport.ts
-var PATH = "/api/fetch-proxy";
-var RAW_CONTENT_TYPE = "application/vnd.slicc.raw-fetch";
-var MAX_HEAD = 1024 * 1024;
-var MAX_REQUEST_BODY2 = 64 * 1024 * 1024;
-var PERMISSIONS = ["loopback-network", "local-network-access"];
-var LOOPBACK_PAGE = /^(127\.\d+\.\d+\.\d+|localhost|\[::1\])$/;
-var failure2 = (message, status = 502) => Object.assign(new Error(`local proxy: ${message}`), { status });
-function encodeHead(url, method, headers) {
-  return JSON.stringify({ url, method, headers }).replace(
-    /[\u007f-￿]/g,
-    (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`
-  );
-}
-function hopHeaders(options, extra) {
-  return new Headers({ "X-Bridge-Token": options.key, ...extra });
-}
-function send(options) {
-  return options.fetch ?? globalThis.fetch.bind(globalThis);
-}
-async function refusalMessage(response) {
-  const text = await response.text().catch(() => "");
-  try {
-    const parsed = JSON.parse(text);
-    if (typeof parsed.error === "string") return parsed.error;
-  } catch {
-  }
-  return text || response.statusText || `answered ${response.status}`;
-}
-async function refusal(response) {
-  return failure2(await refusalMessage(response), response.ok ? 502 : response.status);
-}
-async function permission(permissions) {
-  if (!permissions) return "unknown";
-  for (const name of PERMISSIONS) {
-    try {
-      return (await permissions.query({ name })).state;
-    } catch {
-    }
-  }
-  return "unknown";
-}
-function isHead(value) {
-  const head = value;
-  return !!head && typeof head.status === "number" && typeof head.statusText === "string" && Array.isArray(head.headers) && head.headers.every(
-    (pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string"
-  );
-}
-function concat2(a, b) {
-  const out = new Uint8Array(a.byteLength + b.byteLength);
-  out.set(a);
-  out.set(b, a.byteLength);
-  return out;
-}
-async function readHead(reader, idleMs) {
-  let buffer = new Uint8Array(0);
-  for (; ; ) {
-    if (buffer.byteLength >= 4) {
-      const length = new DataView(buffer.buffer, buffer.byteOffset, 4).getUint32(0);
-      if (length > MAX_HEAD) throw failure2(`response head of ${length} bytes`);
-      if (buffer.byteLength >= 4 + length) {
-        let head;
-        try {
-          head = JSON.parse(new TextDecoder().decode(buffer.subarray(4, 4 + length)));
-        } catch {
-        }
-        if (!isHead(head)) throw failure2("malformed response head");
-        return { head, rest: buffer.subarray(4 + length) };
-      }
-    }
-    const next = await readWithin(reader, idleMs);
-    if (next.done) throw failure2("closed before the response head");
-    buffer = concat2(buffer, next.value);
-  }
-}
-async function* chunks2(rest, reader, idleMs) {
-  try {
-    if (rest.byteLength > 0) yield rest;
-    for (let next = await readWithin(reader, idleMs); !next.done; next = await readWithin(reader, idleMs)) {
-      if (next.value.byteLength > 0) yield next.value;
-    }
-  } finally {
-    await reader.cancel().catch(() => void 0);
-  }
-}
-async function checkLocalProxy(options) {
-  const onLoopback = LOOPBACK_PAGE.test(globalThis.location?.hostname ?? "");
-  const permissions = onLoopback ? void 0 : options.permissions ?? globalThis.navigator?.permissions;
-  if (await permission(permissions) === "denied") return { state: "blocked" };
-  let response;
-  try {
-    response = await send(options)(new URL(PATH, options.url), {
-      method: "POST",
-      headers: hopHeaders(options, { "X-Slicc-Raw-Probe": "1" }),
-      credentials: "omit",
-      mode: "cors"
-    });
-  } catch {
-    const now = await permission(permissions);
-    if (now === "denied") return { state: "blocked" };
-    return {
-      state: "unreachable",
-      permission: now === "granted" || now === "prompt" ? now : "unknown"
-    };
-  }
-  if (!response.ok) {
-    return { state: "refused", status: response.status, error: await refusalMessage(response) };
-  }
-  const reply = await response.json().catch(() => null);
-  if (!reply || typeof reply.rawFetch !== "number" || reply.rawFetch < 1 || typeof reply.requestBodyStreaming !== "boolean" || typeof reply.maxRequestBodyBytes !== "number") {
-    return { state: "incompatible" };
-  }
-  return {
-    state: "ready",
-    probe: {
-      rawFetch: reply.rawFetch,
-      requestBodyStreaming: reply.requestBodyStreaming,
-      maxRequestBodyBytes: reply.maxRequestBodyBytes,
-      ...typeof reply.kernelTunnel === "number" ? { kernelTunnel: reply.kernelTunnel } : {},
-      ...typeof reply.kernelPort === "number" ? { kernelPort: reply.kernelPort } : {},
-      ...typeof reply.cdp === "number" ? { cdp: reply.cdp } : {}
-    }
-  };
-}
-async function probeLocalProxy(options) {
-  const status = await checkLocalProxy(options);
-  return status.state === "ready" ? status.probe : null;
-}
-function localProxyTransport(options) {
-  const endpoint = new URL(PATH, options.url);
-  return {
-    traits: {
-      manualRedirects: true,
-      encodedBodies: false,
-      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY2
-    },
-    async fetch(request) {
-      let response;
-      try {
-        response = await send(options)(endpoint, {
-          method: "POST",
-          headers: hopHeaders(options, {
-            "X-Slicc-Raw-Request": encodeHead(request.url, request.method, request.headers)
-          }),
-          ...request.body ? { body: request.body } : {},
-          signal: request.signal,
-          credentials: "omit",
-          mode: "cors"
-        });
-      } catch (e) {
-        if (request.signal.aborted) throw e;
-        throw failure2(`${endpoint.origin} is unreachable or refuses this origin`);
-      }
-      const type = response.headers.get("content-type") ?? "";
-      if (response.status !== 200 || !type.startsWith(RAW_CONTENT_TYPE) || !response.body) {
-        throw await refusal(response);
-      }
-      const reader = response.body.getReader();
-      const idleMs = options.bodyIdleMs ?? BODY_IDLE_MS;
-      let framed;
-      try {
-        framed = await readHead(reader, idleMs);
-      } catch (e) {
-        await reader.cancel().catch(() => void 0);
-        throw e;
-      }
-      const body = chunks2(framed.rest, reader, idleMs);
-      return {
-        status: framed.head.status,
-        statusText: framed.head.statusText,
-        headers: framed.head.headers,
-        body,
-        cancel: async () => {
-          await body.return(void 0);
-          await reader.cancel().catch(() => void 0);
-        }
-      };
-    }
-  };
-}
-
 // src/mount/driver.ts
 function fsError2(code, message = code) {
   return Object.assign(new Error(message), { code });
@@ -2313,7 +2132,7 @@ function serveHostfsPort(port, transport) {
     });
     handles.clear();
   };
-  const send2 = (reply, transfer = []) => port.postMessage(reply, transfer);
+  const send = (reply, transfer = []) => port.postMessage(reply, transfer);
   const pending = /* @__PURE__ */ new Set();
   const track = (work) => {
     pending.add(work);
@@ -2333,7 +2152,7 @@ function serveHostfsPort(port, transport) {
     data
   }) => {
     const { id, op } = data;
-    if (op === "ping") return send2({ id, pong: true });
+    if (op === "ping") return send({ id, pong: true });
     if (op === "bye") return stop();
     if (op === "cleanup")
       return void Promise.allSettled([...pending]).then(() => answer(data.name, data.body)).catch(() => {
@@ -2345,12 +2164,12 @@ function serveHostfsPort(port, transport) {
       try {
         await transport.watch(
           stop2.signal,
-          (event) => send2({ id, event }),
-          () => send2({ id, open: true })
+          (event) => send({ id, event }),
+          () => send({ id, open: true })
         );
-        send2({ id, end: true });
+        send({ id, end: true });
       } catch (err) {
-        send2({ id, error: errorOf2(err) });
+        send({ id, error: errorOf2(err) });
       } finally {
         watches.delete(id);
       }
@@ -2367,18 +2186,18 @@ function serveHostfsPort(port, transport) {
           )
         );
         const bytes = read.slice();
-        return send2({ id, bytes }, [bytes.buffer]);
+        return send({ id, bytes }, [bytes.buffer]);
       }
       if (op === "write") {
         await track(
           transport.write(data.fh, data.offset, data.bytes)
         );
-        return send2({ id });
+        return send({ id });
       }
       if (op !== "call") throw fsError2("EINVAL", `unknown hostfs port op ${op}`);
-      send2({ id, result: await answer(data.name, data.body) });
+      send({ id, result: await answer(data.name, data.body) });
     } catch (err) {
-      send2({ id, error: errorOf2(err) });
+      send({ id, error: errorOf2(err) });
     }
   };
   const stop = () => {
@@ -2662,7 +2481,7 @@ async function createKernel(options = {}) {
   const worker = new Worker(url, { type: "module", name: "slicc-kernel" });
   const pending = /* @__PURE__ */ new Map();
   let nextId = 0;
-  let failure3;
+  let failure2;
   const dials = dialer((req) => call(req));
   const files = fileWatches(
     (req) => request(req),
@@ -2679,7 +2498,7 @@ async function createKernel(options = {}) {
     facades.close();
     sealed.close();
     approvals.close();
-    failure3 = error;
+    failure2 = error;
     bridge?.close();
     uplinks?.close();
     for (const call2 of pending.values()) call2.reject(error);
@@ -2739,7 +2558,7 @@ async function createKernel(options = {}) {
   });
   function request(req, handlers = {}) {
     const id = ++nextId;
-    if (failure3) return { id, done: Promise.reject(failure3) };
+    if (failure2) return { id, done: Promise.reject(failure2) };
     const done = new Promise((resolve, reject) => {
       pending.set(id, { resolve, reject, ...handlers });
       worker.postMessage({ ...req, id });
@@ -2761,7 +2580,7 @@ async function createKernel(options = {}) {
     );
     done.catch(started.reject);
     const pid = await started.promise;
-    const send2 = (action) => void call({ op: "terminal", terminal: id, ...action }).catch(() => void 0);
+    const send = (action) => void call({ op: "terminal", terminal: id, ...action }).catch(() => void 0);
     return {
       pid,
       exited: quiet(done.then((r) => endedOf2(r).status)),
@@ -2773,13 +2592,13 @@ async function createKernel(options = {}) {
         listener = next;
         if (next) for (const bytes of backlog.splice(0)) next(bytes);
       },
-      write: (data) => send2({
+      write: (data) => send({
         action: "write",
         bytes: typeof data === "string" ? new TextEncoder().encode(data) : data
       }),
-      resize: (cols, rows) => send2({ action: "resize", cols, rows }),
-      signal: (name) => send2({ action: "signal", signal: name }),
-      close: () => send2({ action: "close" })
+      resize: (cols, rows) => send({ action: "resize", cols, rows }),
+      signal: (name) => send({ action: "signal", signal: name }),
+      close: () => send({ action: "close" })
     };
   }
   const { dial } = dials;
@@ -2822,11 +2641,8 @@ export {
   KernelCallError,
   KernelGoneError,
   attachKernel,
-  checkLocalProxy,
   createKernel,
   fetchTransport,
-  localProxyTransport,
-  probeLocalProxy,
   serveHostfsPort
 };
 //# sourceMappingURL=index.js.map