@ai-ecoverse/slicc-kernel 1.170.3 → 1.171.0

package/dist/kernel-worker.js

@@ -7310,6 +7310,19 @@ function uploadsFor(peer) {
   });
   return { of, answer: (call) => pulls.get(call.nid)?.(call) };
 }
+function headOf(nid, response) {
+  return {
+    net: "head",
+    nid,
+    ...response.url !== void 0 ? { url: response.url } : {},
+    ...response.redirected !== void 0 ? { redirected: response.redirected } : {},
+    ...response.redirects ? { redirects: response.redirects } : {},
+    ...response.opaqueRedirect ? { opaqueRedirect: true } : {},
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  };
+}
 function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {}) {
   const open2 = /* @__PURE__ */ new Map();
   const fail2 = (nid, e) => {
@@ -7335,6 +7348,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         method: call.method,
         headers: call.headers,
         ...call.streamed ? { bodyStream: uploads.of(call.nid, abort.signal) } : call.body ? { body: call.body } : {},
+        ...call.redirect !== void 0 ? { redirect: call.redirect } : {},
         signal: abort.signal
       });
       if (!open2.has(call.nid)) {
@@ -7342,15 +7356,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         return;
       }
       open2.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
-      peer.postMessage({
-        net: "head",
-        nid: call.nid,
-        ...response.redirected ? { url: response.url, redirected: true } : {},
-        ...response.redirects ? { redirects: response.redirects } : {},
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers
-      });
+      peer.postMessage(headOf(call.nid, response));
     } catch (e) {
       fail2(call.nid, e);
     }
@@ -8206,9 +8212,9 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused3 = versionError(message3.protocol) ?? await hosts.requests.accept(host, message3);
-    if (refused3) {
-      send2({ hello: { protocol: PROTOCOL, error: refused3 } });
+    const refused4 = versionError(message3.protocol) ?? await hosts.requests.accept(host, message3);
+    if (refused4) {
+      send2({ hello: { protocol: PROTOCOL, error: refused4 } });
       detach();
       return;
     }
@@ -8498,7 +8504,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.170.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.171.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -8790,10 +8796,10 @@ async function tierPackages(fs, physical, roots, bins, kernel, global) {
       const own = commandsOf(pkg, manifest);
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
-      const refused3 = engineRefusal(manifest, kernel);
+      const refused4 = engineRefusal(manifest, kernel);
       const name2 = pkg.slice(root.length + 1);
       const dependency = direct?.has(name2) === false;
-      const marks = { ...refused3 ? { refused: refused3 } : {}, ...dependency ? { dependency } : {} };
+      const marks = { ...refused4 ? { refused: refused4 } : {}, ...dependency ? { dependency } : {} };
       out.push({
         name: name2,
         pkg,
@@ -8825,7 +8831,7 @@ function winners(tier) {
   }
   return out;
 }
-async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused3, global = /* @__PURE__ */ new Set()) {
+async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused4, global = /* @__PURE__ */ new Set()) {
   const found = /* @__PURE__ */ new Map();
   const physical = physicalResolver(fs);
   const tiers = (typeof modules === "string" ? [modules] : modules).map(
@@ -8839,7 +8845,7 @@ async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, ke
   const dependencies = [];
   for (const [index, roots] of tiers.entries()) {
     const tier = await tierPackages(fs, physical, roots, index >= binsFrom, kernel, global);
-    if (refused3) refused3.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
+    if (refused4) refused4.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
     await take(tier.filter((entry) => !entry.dependency));
     dependencies.push(tier.filter((entry) => entry.dependency));
   }
@@ -10392,6 +10398,78 @@ var CronService = class {
   }
 };
 
+// src/kernel/net/placeholder-floor.ts
+var PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/;
+var ESCAPE = /%([0-9a-f]{2})/gi;
+var BASIC = /\bbasic\b(.*)/is;
+var PERCENT_LAYERS = 8;
+var BASE64_GROUP = 4;
+var PLACEHOLDER_REFUSED = "refused: this request has a sealed placeholder in its URL, a header or a Basic credential, and nothing fills it, so it was not sent";
+var PlaceholderRefused = class extends Error {
+  status = 403;
+  code = "EACCES";
+  constructor() {
+    super(PLACEHOLDER_REFUSED);
+  }
+};
+function carries(text) {
+  let layer = text;
+  for (let i = 0; i < PERCENT_LAYERS; i++) {
+    if (PLACEHOLDER.test(layer)) return true;
+    const next3 = layer.replace(
+      ESCAPE,
+      (_, hex4) => String.fromCharCode(Number.parseInt(hex4, 16))
+    );
+    if (next3 === layer) return false;
+    layer = next3;
+  }
+  return PLACEHOLDER.test(layer);
+}
+function basicCarries(value2) {
+  const credential = BASIC.exec(value2)?.[1];
+  if (credential === void 0) return false;
+  const letters = credential.replace(/[^A-Za-z0-9+/_-]/g, "").replaceAll("-", "+").replaceAll("_", "/");
+  for (let shift = 0; shift < BASE64_GROUP; shift++) {
+    const part = letters.slice(shift);
+    const whole = part.length % BASE64_GROUP === 1 ? part.slice(0, -1) : part;
+    if (carries(atob(whole))) return true;
+  }
+  return false;
+}
+function headersCarry(headers) {
+  return headers.some(
+    ([name2, value2]) => carries(name2.toLowerCase()) || carries(value2) || basicCarries(value2)
+  );
+}
+function urlCarries(url) {
+  return carries(url) || URL.canParse(url) && carries(new URL(url).href);
+}
+function refuse(request3) {
+  if (urlCarries(request3.url) || headersCarry(request3.headers)) throw new PlaceholderRefused();
+}
+function refuseSocket(request3) {
+  refuse(request3);
+  if (request3.protocols.some(carries)) throw new PlaceholderRefused();
+}
+function placeholderFloor(inner) {
+  const open2 = inner.websocket?.bind(inner);
+  return {
+    get traits() {
+      return inner.traits;
+    },
+    ...open2 ? {
+      websocket: async (request3) => {
+        refuseSocket(request3);
+        return open2(request3);
+      }
+    } : {},
+    async fetch(request3, owner) {
+      refuse(request3);
+      return inner.fetch(request3, owner);
+    }
+  };
+}
+
 // src/kernel/net/proxy-service.ts
 var SEND_BUFFER2 = 1024 * 1024;
 var TLS_HANDSHAKE = 22;
@@ -10840,8 +10918,8 @@ var RealmProxy = class {
   }
   async connect(conn, incoming, req, idle2) {
     const target = tunnelTarget(req);
-    const refused3 = target.port === 443 ? await this.tunnelReady(target) : void 0;
-    if (refused3) throw refused3;
+    const refused4 = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused4) throw refused4;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
       const first = await incoming.peek(this.stop.signal);
@@ -10898,7 +10976,8 @@ var RealmProxy = class {
       });
     } catch (e) {
       waiting.abort();
-      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+      const status = e instanceof PlaceholderRefused ? e.status : 502;
+      throw new HttpError(status, e instanceof Error ? e.message : String(e));
     }
     ctx.idle.ms = Number.POSITIVE_INFINITY;
     try {
@@ -11112,7 +11191,7 @@ async function relay(socket, conn) {
 // src/fs/attest.ts
 var ATTEST_MAX = 1024 * 1024;
 var UNOWNED = 1e3;
-function refuse(code, path, why) {
+function refuse2(code, path, why) {
   throw Object.assign(new Error(`attest ${path}: ${why}`), { code });
 }
 function chainOf(path) {
@@ -11154,11 +11233,11 @@ async function trustedParents(fs, path, o) {
   const parents = [];
   for (const dir of chainOf(path).slice(0, -1)) {
     const st = await fs.lstat(dir);
-    if (st.isSymbolicLink) refuse("EACCES", path, `${dir} is a symlink`);
-    if (!st.isDirectory) refuse("ENOTDIR", path, `${dir} is not a directory`);
+    if (st.isSymbolicLink) refuse2("EACCES", path, `${dir} is a symlink`);
+    if (!st.isDirectory) refuse2("ENOTDIR", path, `${dir} is not a directory`);
     const perm = owned(dir, st);
     if (o.users !== "off" && (perm.uid !== 0 || (perm.mode & 18) !== 0)) {
-      refuse("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
+      refuse2("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
     }
     parents.push(perm);
   }
@@ -11166,27 +11245,27 @@ async function trustedParents(fs, path, o) {
 }
 async function attest(fs, asked, o) {
   if (typeof asked !== "string" || !asked.startsWith("/")) {
-    refuse("EINVAL", String(asked), "not an absolute path");
+    refuse2("EINVAL", String(asked), "not an absolute path");
   }
   const path = normalizePath(asked);
   const mount = o.mounts.find((target) => {
     const at = normalizePath(target);
     return at === "/" || under2(path, at);
   });
-  if (mount !== void 0) refuse("EACCES", path, `under the mount ${mount}`);
+  if (mount !== void 0) refuse2("EACCES", path, `under the mount ${mount}`);
   const parents = await trustedParents(fs, path, o);
   for (let tries = 0; ; tries++) {
     const before = await fs.lstat(path);
-    if (before.isSymbolicLink) refuse("EACCES", path, "is a symlink");
+    if (before.isSymbolicLink) refuse2("EACCES", path, "is a symlink");
     if (!before.isFile)
-      refuse(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
-    if (before.size > ATTEST_MAX) refuse("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
+      refuse2(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
+    if (before.size > ATTEST_MAX) refuse2("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
       return attested(path, after, bytes, await sha2562(bytes), o, parents);
     }
-    if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
+    if (tries >= 1) refuse2("EAGAIN", path, "changed while it was read");
   }
 }
 var WATCH_DEBOUNCE_MS = 50;
@@ -13345,8 +13424,8 @@ var DriverConnection = class _DriverConnection {
     } finally {
       clearTimeout(timer);
     }
-    const refused3 = driverVersionError(hello.protocol);
-    if (refused3) throw errnoError("EPROTO", refused3);
+    const refused4 = driverVersionError(hello.protocol);
+    if (refused4) throw errnoError("EPROTO", refused4);
     if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
     return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options);
   }
@@ -15370,8 +15449,8 @@ async function guarded(entry, path, req) {
     return { paths };
   } catch (err) {
     const refusal2 = err.code === "EACCES";
-    const refused3 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
-    return { refused: refused3 };
+    const refused4 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
+    return { refused: refused4 };
   }
 }
 async function copyOp(entry, path, req) {
@@ -15567,13 +15646,13 @@ async function created2(entry, req) {
   return seen === void 0 ? looked : json2({ ...looked.json, seen });
 }
 var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
-async function rmPermitted(entry, path, req, refused3) {
+async function rmPermitted(entry, path, req, refused4) {
   const st = await entry.fs.lstat(path).catch(() => void 0);
-  if (!st?.isDirectory) return refused3;
+  if (!st?.isDirectory) return refused4;
   const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
   if ("refused" in unlisted) return unlisted.refused;
   const names2 = await entry.fs.readdir(path).catch(() => void 0);
-  if (!names2) return refused3;
+  if (!names2) return refused4;
   let first;
   for (const name2 of names2) {
     const child = await dispatchOne(entry, {
@@ -15624,14 +15703,14 @@ async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
   if (!named && !CREATIONS.has(req.op)) return void 0;
   const target = named ? entry.fs.resolvePath(entry.cwd, req.arg2 ?? "") : path;
-  const refused3 = devCreation(target, entry.cred?.());
-  if (!refused3) return void 0;
+  const refused4 = devCreation(target, entry.cred?.());
+  if (!refused4) return void 0;
   const there = await entry.fs.lstat(target).then(
     () => true,
     () => false
   );
   if (there) return void 0;
-  return { ok: false, errno: refused3, message: `${target}: no new names in /dev or /proc` };
+  return { ok: false, errno: refused4, message: `${target}: no new names in /dev or /proc` };
 }
 var MISS_OPS = /* @__PURE__ */ new Set(["stat", "lstat"]);
 async function linkFree(fs, path) {
@@ -15754,7 +15833,7 @@ function encodeSabResult(result) {
           message: result.message,
           ...result.direct ? { direct: true } : {},
           ...result.dev !== void 0 ? { dev: result.dev } : {},
-          ...result.detail === "transport" ? { detail: result.detail } : {}
+          ...result.detail ? { detail: result.detail } : {}
         })
       )
     };
@@ -17734,8 +17813,8 @@ var KernelLoopback = class {
       );
     } catch (err) {
       socket.close();
-      const refused3 = err instanceof KernelError && err.code === "ECONNREFUSED";
-      throw refused3 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+      const refused4 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused4 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
     }
     signal.addEventListener("abort", () => socket.close(), { once: true });
     return socket;
@@ -19216,22 +19295,28 @@ var HttpHandles = class {
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
       entry.upload?.cancel();
-      const text = message2(e);
-      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
-      const status = e.status;
-      if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
-        const code = codeOf2(e);
-        const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
-        const failed3 = e.detail === "transport";
-        return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
-      }
-      entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
-      return this.headOf(handle, req.url, {
-        status,
-        statusText: "",
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      });
+      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: message2(e) };
+      return this.failure(handle, req, e, entry);
+    }
+  }
+  failure(handle, req, e, entry) {
+    const text = message2(e);
+    if (e instanceof PlaceholderRefused) {
+      return { ok: false, errno: e.code, message: text, detail: "placeholder" };
     }
+    const status = e.status;
+    if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
+      const code = codeOf2(e);
+      const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
+      const failed3 = e.detail === "transport";
+      return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
+    }
+    entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
+    return this.headOf(handle, req.url, {
+      status,
+      statusText: "",
+      headers: [["content-type", "text/plain; charset=utf-8"]]
+    });
   }
   headOf(handle, url, response) {
     const { status, statusText, headers } = response;
@@ -22442,7 +22527,7 @@ var HEAD_MAX = 16 * 1024;
 var ANY_PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/g;
 var REQUEST_LINE2 = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.[01]$/;
 var HEADER_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*?)[ \t]*$/;
-var BASIC = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
+var BASIC2 = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
 var encoder8 = new TextEncoder();
 function binary(text) {
   let out = "";
@@ -22458,7 +22543,7 @@ function sniffHttp1(start2) {
   return "no";
 }
 function basicOf(value2) {
-  const m = BASIC.exec(value2);
+  const m = BASIC2.exec(value2);
   if (!m) return void 0;
   try {
     return { scheme: m[1], decoded: atob(m[2]) };
@@ -28956,6 +29041,234 @@ function enableDnsStub(net, stub) {
   });
 }
 
+// src/kernel/net/remote-transport.ts
+var TransportError = class extends Error {
+  status;
+  code;
+  detail;
+  constructor(message3, status, code, detail) {
+    super(message3);
+    this.status = status;
+    this.code = code;
+    this.detail = detail === "transport" ? detail : void 0;
+  }
+};
+function unfollowed2(redirect) {
+  return redirect !== void 0 && redirect !== "follow";
+}
+function honors(traits, redirect) {
+  if (traits.redirectPolicy === true) return true;
+  const hops = traits.redirectHops;
+  const raw2 = traits.manualRedirects === true && (hops === void 0 || hops === false);
+  return redirect === "manual" && raw2;
+}
+function refused3(message3) {
+  return new TransportError(message3, 502, void 0, "transport");
+}
+var RemoteTransport = class {
+  traits;
+  port;
+  waiting = /* @__PURE__ */ new Map();
+  nextId = 0;
+  sockets = /* @__PURE__ */ new Map();
+  uploads = /* @__PURE__ */ new Map();
+  failure;
+  constructor(port, traits) {
+    this.port = port;
+    this.traits = traits;
+  }
+  receive(reply) {
+    if (reply.net === "body-pull") {
+      void this.pull(reply.nid);
+      return;
+    }
+    const socket = this.sockets.get(reply.nid);
+    if (socket && this.toSocket(reply, socket)) return;
+    const waiter = this.waiting.get(reply.nid);
+    if (!waiter) return;
+    this.waiting.delete(reply.nid);
+    if (reply.net === "error") {
+      waiter.reject(new TransportError(reply.message, reply.status, reply.code, reply.detail));
+    } else waiter.resolve(reply);
+  }
+  toSocket(reply, socket) {
+    if (reply.net === "ws-message") socket.queue.push(reply.data);
+    else if (reply.net === "ws-acked") socket.acked(reply.n);
+    else if (reply.net === "ws-closed") {
+      this.sockets.delete(reply.nid);
+      socket.queue.end({ code: reply.code, reason: reply.reason });
+    } else return false;
+    return true;
+  }
+  async pull(nid) {
+    const upload = this.uploads.get(nid);
+    if (!upload) {
+      this.port.postMessage({ net: "body-error", nid, message: "the request body is gone" });
+      return;
+    }
+    try {
+      const next3 = await upload.next();
+      if (next3.done) {
+        this.uploads.delete(nid);
+        this.port.postMessage({ net: "body-end", nid });
+      } else this.port.postMessage({ net: "body-chunk", nid, bytes: next3.value });
+    } catch (e) {
+      this.uploads.delete(nid);
+      this.port.postMessage({
+        net: "body-error",
+        nid,
+        message: e instanceof Error ? e.message : String(e)
+      });
+    }
+  }
+  dropUpload(nid) {
+    const upload = this.uploads.get(nid);
+    this.uploads.delete(nid);
+    void upload?.return?.().catch(() => void 0);
+  }
+  fail(error) {
+    this.failure = error;
+    for (const nid of [...this.uploads.keys()]) this.dropUpload(nid);
+    for (const waiter of this.waiting.values()) waiter.reject(error);
+    this.waiting.clear();
+    for (const socket of this.sockets.values())
+      socket.queue.end({ code: 1011, reason: error.message });
+    this.sockets.clear();
+  }
+  ask(call) {
+    if (this.failure) return Promise.reject(this.failure);
+    return new Promise((resolve2, reject) => {
+      this.waiting.set(call.nid, { resolve: resolve2, reject });
+      this.port.postMessage(call);
+    });
+  }
+  cancel(nid) {
+    const waiter = this.waiting.get(nid);
+    this.waiting.delete(nid);
+    waiter?.reject(new TransportError("the request was cancelled"));
+    this.port.postMessage({ net: "cancel", nid });
+  }
+  async fetch(request3) {
+    const nid = ++this.nextId;
+    const { signal, redirect } = request3;
+    signal.throwIfAborted();
+    if (unfollowed2(redirect) && !honors(this.traits, redirect)) {
+      throw refused3(`this transport cannot honor redirect: ${redirect}`);
+    }
+    let finished = false;
+    const abort = () => {
+      finished = true;
+      this.dropUpload(nid);
+      this.cancel(nid);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    const finish = () => {
+      this.dropUpload(nid);
+      if (finished) return;
+      finished = true;
+      signal.removeEventListener("abort", abort);
+    };
+    if (request3.bodyStream) this.uploads.set(nid, request3.bodyStream[Symbol.asyncIterator]());
+    let head;
+    try {
+      head = await this.ask({
+        net: "fetch",
+        nid,
+        url: request3.url,
+        method: request3.method,
+        headers: request3.headers,
+        ...request3.bodyStream ? { streamed: true } : request3.body ? { body: request3.body } : {},
+        ...redirect !== void 0 ? { redirect } : {}
+      });
+    } catch (e) {
+      finish();
+      throw e;
+    }
+    const { status, statusText, headers, url, redirected: redirected2, redirects, opaqueRedirect } = head;
+    const read = async () => {
+      if (finished) return void 0;
+      const reply = await this.ask({ net: "read", nid }).catch((e) => {
+        finish();
+        throw e;
+      });
+      if (reply.net === "chunk") return reply.bytes;
+      finish();
+      return void 0;
+    };
+    const cancel = async () => {
+      if (finished) return;
+      finish();
+      this.cancel(nid);
+    };
+    if (unfollowed2(redirect) && (redirected2 || redirects?.length)) {
+      await cancel();
+      throw refused3(`this transport followed a redirect despite redirect: ${redirect}`);
+    }
+    return {
+      ...url !== void 0 ? { url } : {},
+      ...redirected2 !== void 0 ? { redirected: redirected2 } : {},
+      ...redirects ? { redirects } : {},
+      ...opaqueRedirect ? { opaqueRedirect } : {},
+      status,
+      statusText,
+      headers,
+      cancel,
+      body: {
+        [Symbol.asyncIterator]: () => ({
+          next: async () => {
+            const bytes = await read();
+            return bytes ? { value: bytes, done: false } : { value: void 0, done: true };
+          },
+          return: async () => {
+            await cancel();
+            return { value: void 0, done: true };
+          }
+        })
+      }
+    };
+  }
+  async websocket(request3) {
+    const nid = ++this.nextId;
+    const { signal } = request3;
+    signal.throwIfAborted();
+    const abort = () => this.cancel(nid);
+    signal.addEventListener("abort", abort, { once: true });
+    let opened2;
+    try {
+      opened2 = await this.ask({
+        net: "ws-open",
+        nid,
+        url: request3.url,
+        protocols: request3.protocols,
+        headers: request3.headers
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
+    const queue = new MessageQueue(
+      () => close(1e3, "a message is too big"),
+      Number.POSITIVE_INFINITY,
+      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
+    );
+    let unacked = 0;
+    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
+    return {
+      protocol: opened2.protocol,
+      get buffered() {
+        return unacked;
+      },
+      send: (data) => {
+        unacked += payloadSize(data);
+        this.port.postMessage({ net: "ws-send", nid, data });
+      },
+      messages: queue,
+      close,
+      closed: queue.closed
+    };
+  }
+};
+
 // src/kernel/net/redirect-hops.ts
 var HELD_MS = 3e4;
 var HELD_MAX2 = 64;
@@ -29031,7 +29344,10 @@ function replayingHops(inner, heldMs = HELD_MS) {
       return { ...inner.traits, manualRedirects: true };
     },
     ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
-    async fetch(request3, owner = KERNEL) {
+    async fetch(request3, ...rest2) {
+      if (unfollowed2(request3.redirect)) return inner.fetch(request3, ...rest2);
+      const [caller] = rest2;
+      const owner = caller ?? KERNEL;
       const key = keyOf3(owner, request3.method, request3.url);
       const waiting = held.get(key);
       if (waiting && waiting.fingerprint === fingerprint(request3.headers)) {
@@ -29040,7 +29356,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
         return replay(waiting);
       }
       if (waiting) drop(key);
-      const response = await inner.fetch(request3);
+      const response = await inner.fetch(request3, ...rest2);
       if (!response.redirects?.length) return response;
       return replay({
         owner,
@@ -29479,9 +29795,9 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open2 = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
-    const refused3 = driverVersionError(message3.protocol);
-    if (refused3) {
-      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused3, errno: "EPROTO" } });
+    const refused4 = driverVersionError(message3.protocol);
+    if (refused4) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused4, errno: "EPROTO" } });
       return;
     }
     try {
@@ -31883,7 +32199,7 @@ var Launcher = class {
       ...options.env
     };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
-    this.transport = replayingHops(options.transport ?? missingTransport());
+    this.transport = placeholderFloor(replayingHops(options.transport ?? missingTransport()));
     this.announcedTraits = JSON.stringify(this.transport.traits);
     this.uplink = options.uplink;
     this.routes = new Routes(options.uplink?.traits.ipv6 === true);
@@ -32038,16 +32354,16 @@ var Launcher = class {
     if (!found) {
       found = this.swaps.settled().then(() => this.trustedAppended()).then(async (appended2) => {
         const tiers = await this.tiers(scope, appended2);
-        const refused3 = [];
+        const refused4 = [];
         const commands = await scanCommands(
           this.scanned,
           tiers,
           tiers.length - appended2.length,
           void 0,
-          refused3,
+          refused4,
           await this.globalRoots(scope)
         );
-        this.refusedOf.set(commands, refused3.map(refusing));
+        this.refusedOf.set(commands, refused4.map(refusing));
         return commands;
       }).then(
         (commands) => this.refusals(commands).set(SUDO_COMMAND.name, SUDO_COMMAND).set(CRONTAB_COMMAND.name, CRONTAB_COMMAND)
@@ -32253,14 +32569,14 @@ var Launcher = class {
     return await this.commandAt(path, scope) ?? await this.refusedAt(path, name2, scope);
   }
   async refusedAt(path, name2, scope) {
-    const refused3 = this.refusedOf.get(await this.commands(scope)) ?? [];
-    if (refused3.length === 0) return void 0;
+    const refused4 = this.refusedOf.get(await this.commands(scope)) ?? [];
+    if (refused4.length === 0) return void 0;
     const st = await this.base.stat(path).catch(() => void 0);
     if (!st?.isFile) return void 0;
     const real = await physicalPathAsync(this.base, path).catch(() => path);
     const same3 = async (own) => own === path || await physicalPathAsync(this.base, own).catch(() => own) === real;
     const owners = [];
-    for (const c of refused3) {
+    for (const c of refused4) {
       const origin = c.origin;
       for (const own of [origin.glue, origin.wasm, ...origin.variants ?? []]) {
         if (!await same3(own)) continue;
@@ -32270,11 +32586,11 @@ var Launcher = class {
     }
     const stem = name2.replace(/\.wasm$/, "");
     const named = owners.find((c) => c.name === name2) ?? owners.find((c) => c.name === stem);
-    return named ?? owners[0] ?? await this.refusedCopy(real, name2, refused3);
+    return named ?? owners[0] ?? await this.refusedCopy(real, name2, refused4);
   }
-  async refusedCopy(real, name2, refused3) {
+  async refusedCopy(real, name2, refused4) {
     const dir = real.slice(0, real.lastIndexOf("/"));
-    for (const c of refused3) {
+    for (const c of refused4) {
       const origin = c.origin;
       if (origin.abi !== "emscripten" || origin.script || c.name !== name2) continue;
       const own = await physicalPathAsync(this.base, origin.glue).catch(() => origin.glue);
@@ -32482,12 +32798,12 @@ var Launcher = class {
     return void 0;
   }
   async planOne(req, { ppid, cred, scope }, catalogOnly = false) {
-    const refused3 = (err) => {
+    const refused4 = (err) => {
       throw codeOf8(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
-    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
+    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused4);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0, catalogOnly);
-    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
+    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused4);
     if (planned) return planned;
     throw new SpawnError(catalogOnly ? "ENOENT" : await this.unrunnable(file, req.cwd, scope));
   }
@@ -34467,212 +34783,6 @@ function integrityAsker(port) {
   return { lookup: lookup2, answer: answer2 };
 }
 
-// src/kernel/net/remote-transport.ts
-var TransportError = class extends Error {
-  status;
-  code;
-  detail;
-  constructor(message3, status, code, detail) {
-    super(message3);
-    this.status = status;
-    this.code = code;
-    this.detail = detail === "transport" ? detail : void 0;
-  }
-};
-var RemoteTransport = class {
-  traits;
-  port;
-  waiting = /* @__PURE__ */ new Map();
-  nextId = 0;
-  sockets = /* @__PURE__ */ new Map();
-  uploads = /* @__PURE__ */ new Map();
-  failure;
-  constructor(port, traits) {
-    this.port = port;
-    this.traits = traits;
-  }
-  receive(reply) {
-    if (reply.net === "body-pull") {
-      void this.pull(reply.nid);
-      return;
-    }
-    const socket = this.sockets.get(reply.nid);
-    if (socket && this.toSocket(reply, socket)) return;
-    const waiter = this.waiting.get(reply.nid);
-    if (!waiter) return;
-    this.waiting.delete(reply.nid);
-    if (reply.net === "error") {
-      waiter.reject(new TransportError(reply.message, reply.status, reply.code, reply.detail));
-    } else waiter.resolve(reply);
-  }
-  toSocket(reply, socket) {
-    if (reply.net === "ws-message") socket.queue.push(reply.data);
-    else if (reply.net === "ws-acked") socket.acked(reply.n);
-    else if (reply.net === "ws-closed") {
-      this.sockets.delete(reply.nid);
-      socket.queue.end({ code: reply.code, reason: reply.reason });
-    } else return false;
-    return true;
-  }
-  async pull(nid) {
-    const upload = this.uploads.get(nid);
-    if (!upload) {
-      this.port.postMessage({ net: "body-error", nid, message: "the request body is gone" });
-      return;
-    }
-    try {
-      const next3 = await upload.next();
-      if (next3.done) {
-        this.uploads.delete(nid);
-        this.port.postMessage({ net: "body-end", nid });
-      } else this.port.postMessage({ net: "body-chunk", nid, bytes: next3.value });
-    } catch (e) {
-      this.uploads.delete(nid);
-      this.port.postMessage({
-        net: "body-error",
-        nid,
-        message: e instanceof Error ? e.message : String(e)
-      });
-    }
-  }
-  dropUpload(nid) {
-    const upload = this.uploads.get(nid);
-    this.uploads.delete(nid);
-    void upload?.return?.().catch(() => void 0);
-  }
-  fail(error) {
-    this.failure = error;
-    for (const nid of [...this.uploads.keys()]) this.dropUpload(nid);
-    for (const waiter of this.waiting.values()) waiter.reject(error);
-    this.waiting.clear();
-    for (const socket of this.sockets.values())
-      socket.queue.end({ code: 1011, reason: error.message });
-    this.sockets.clear();
-  }
-  ask(call) {
-    if (this.failure) return Promise.reject(this.failure);
-    return new Promise((resolve2, reject) => {
-      this.waiting.set(call.nid, { resolve: resolve2, reject });
-      this.port.postMessage(call);
-    });
-  }
-  cancel(nid) {
-    const waiter = this.waiting.get(nid);
-    this.waiting.delete(nid);
-    waiter?.reject(new TransportError("the request was cancelled"));
-    this.port.postMessage({ net: "cancel", nid });
-  }
-  async fetch(request3) {
-    const nid = ++this.nextId;
-    const { signal } = request3;
-    signal.throwIfAborted();
-    let finished = false;
-    const abort = () => {
-      finished = true;
-      this.dropUpload(nid);
-      this.cancel(nid);
-    };
-    signal.addEventListener("abort", abort, { once: true });
-    const finish = () => {
-      this.dropUpload(nid);
-      if (finished) return;
-      finished = true;
-      signal.removeEventListener("abort", abort);
-    };
-    if (request3.bodyStream) this.uploads.set(nid, request3.bodyStream[Symbol.asyncIterator]());
-    let head;
-    try {
-      head = await this.ask({
-        net: "fetch",
-        nid,
-        url: request3.url,
-        method: request3.method,
-        headers: request3.headers,
-        ...request3.bodyStream ? { streamed: true } : request3.body ? { body: request3.body } : {}
-      });
-    } catch (e) {
-      finish();
-      throw e;
-    }
-    const { status, statusText, headers, url, redirected: redirected2, redirects } = head;
-    const read = async () => {
-      if (finished) return void 0;
-      const reply = await this.ask({ net: "read", nid }).catch((e) => {
-        finish();
-        throw e;
-      });
-      if (reply.net === "chunk") return reply.bytes;
-      finish();
-      return void 0;
-    };
-    const cancel = async () => {
-      if (finished) return;
-      finish();
-      this.cancel(nid);
-    };
-    return {
-      ...redirected2 ? { url, redirected: redirected2 } : {},
-      ...redirects ? { redirects } : {},
-      status,
-      statusText,
-      headers,
-      cancel,
-      body: {
-        [Symbol.asyncIterator]: () => ({
-          next: async () => {
-            const bytes = await read();
-            return bytes ? { value: bytes, done: false } : { value: void 0, done: true };
-          },
-          return: async () => {
-            await cancel();
-            return { value: void 0, done: true };
-          }
-        })
-      }
-    };
-  }
-  async websocket(request3) {
-    const nid = ++this.nextId;
-    const { signal } = request3;
-    signal.throwIfAborted();
-    const abort = () => this.cancel(nid);
-    signal.addEventListener("abort", abort, { once: true });
-    let opened2;
-    try {
-      opened2 = await this.ask({
-        net: "ws-open",
-        nid,
-        url: request3.url,
-        protocols: request3.protocols,
-        headers: request3.headers
-      });
-    } finally {
-      signal.removeEventListener("abort", abort);
-    }
-    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
-    const queue = new MessageQueue(
-      () => close(1e3, "a message is too big"),
-      Number.POSITIVE_INFINITY,
-      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
-    );
-    let unacked = 0;
-    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
-    return {
-      protocol: opened2.protocol,
-      get buffered() {
-        return unacked;
-      },
-      send: (data) => {
-        unacked += payloadSize(data);
-        this.port.postMessage({ net: "ws-send", nid, data });
-      },
-      messages: queue,
-      close,
-      closed: queue.closed
-    };
-  }
-};
-
 // src/sealed-relay.ts
 function sealedAsker(port) {
   const asks = /* @__PURE__ */ new Map();