@ai-ecoverse/slicc-kernel 1.179.0 → 1.181.0

package/dist/node.js

@@ -2751,6 +2751,82 @@ var KERNEL_SIGINFO = Object.freeze({
   status: 0
 });
 
+// src/kernel/trace.ts
+var TRACE_LIMIT = 4096;
+var TRACE_LIMIT_MAX = 65536;
+function traceLimit(value2) {
+  if (value2 === void 0) return TRACE_LIMIT;
+  if (!Number.isInteger(value2) || value2 < 1 || value2 > TRACE_LIMIT_MAX) {
+    throw Object.assign(new Error(`a trace limit is an integer from 1 to ${TRACE_LIMIT_MAX}`), {
+      code: "EINVAL"
+    });
+  }
+  return value2;
+}
+var TraceHub = class {
+  subs = /* @__PURE__ */ new Set();
+  seq = 0;
+  get idle() {
+    return this.subs.size === 0;
+  }
+  subscribe(tag, viewer, deliver, limit = TRACE_LIMIT) {
+    const sub = {
+      tag,
+      viewer: copyCred(viewer),
+      limit,
+      queue: [],
+      dropped: 0,
+      waiting: false,
+      scheduled: false,
+      deliver
+    };
+    this.subs.add(sub);
+    return {
+      ack: () => {
+        sub.waiting = false;
+        this.schedule(sub);
+      },
+      close: () => {
+        this.subs.delete(sub);
+        sub.queue = [];
+      }
+    };
+  }
+  wants(tags, cred) {
+    if (!tags?.length || this.subs.size === 0) return false;
+    for (const sub of this.subs) if (this.matches(sub, tags, cred)) return true;
+    return false;
+  }
+  publish(tags, cred, draft) {
+    if (!tags?.length) return;
+    let event;
+    for (const sub of this.subs) {
+      if (!this.matches(sub, tags, cred)) continue;
+      event ??= { ...draft, seq: ++this.seq };
+      if (sub.queue.length >= sub.limit) sub.dropped++;
+      else sub.queue.push(event);
+      this.schedule(sub);
+    }
+  }
+  matches(sub, tags, cred) {
+    return tags.includes(sub.tag) && maySee(sub.viewer, cred);
+  }
+  schedule(sub) {
+    if (sub.scheduled || sub.waiting) return;
+    if (sub.queue.length === 0 && sub.dropped === 0) return;
+    sub.scheduled = true;
+    queueMicrotask(() => {
+      sub.scheduled = false;
+      if (!this.subs.has(sub)) return;
+      const batch = { events: sub.queue, dropped: sub.dropped };
+      sub.queue = [];
+      sub.dropped = 0;
+      sub.waiting = true;
+      sub.deliver(batch);
+    });
+  }
+};
+
 // src/kernel/net/http1.ts
 var HttpError = class extends Error {
   status;
@@ -3711,7 +3787,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.179.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.181.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -4576,27 +4652,27 @@ function hashId(text) {
   return hex4(a) + hex4(b);
 }
 function split(text, count2) {
-  const words2 = [];
+  const words3 = [];
   let rest2 = text;
   for (let i = 0; i < count2; i++) {
     const match = /^(\S+)\s+/.exec(rest2);
     if (!match) return void 0;
-    words2.push(match[1]);
+    words3.push(match[1]);
     rest2 = rest2.slice(match[0].length);
   }
-  return [words2, rest2.trim()];
+  return [words3, rest2.trim()];
 }
 function jobOf(content, pending, ctx, env) {
   const fields = content.startsWith("@") ? 1 : 5;
   const parts2 = split(content, fields + (ctx.system ? 1 : 0));
   if (!parts2 || parts2[1] === "") throw new Error("no command");
-  const [words2, command] = parts2;
-  const schedule = words2.slice(0, fields).join(" ");
+  const [words3, command] = parts2;
+  const schedule = words3.slice(0, fields).join(" ");
   const when = parseWhen(schedule);
   const zone = env.CRON_TZ;
   if (zone && !when.reboot && canonicalZone(zone) === void 0)
     throw new Error(`CRON_TZ: unknown time zone "${zone}"`);
-  const user = ctx.system ? words2[fields] : void 0;
+  const user = ctx.system ? words3[fields] : void 0;
   if (user !== void 0 && !USER_NAME.test(user)) throw new Error(`bad user name ${user}`);
   if (pending !== void 0 && !JOB_NAME.test(pending))
     throw new Error(`bad job name "${pending}"`);
@@ -8298,9 +8374,11 @@ var SpawnError = class extends Error {
 };
 var ChangedError = class extends SpawnError {
   notice;
-  constructor(notice) {
+  file;
+  constructor(notice, file) {
     super("EPERM");
     this.notice = notice;
+    this.file = file;
   }
 };
 function interrupted(signal) {
@@ -15377,21 +15455,21 @@ function unescaped(double) {
 }
 function splitWords(text) {
   const piece = /'([^']*)'|"((?:[^"\\]|\\[\s\S])*)"|\\([\s\S])|([^\s'"\\]+)|(\s+)/y;
-  const words2 = [];
+  const words3 = [];
   let word;
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
     const [, single, double, escaped, plain3, space] = m;
     if (space !== void 0) {
-      if (word !== void 0) words2.push(word);
+      if (word !== void 0) words3.push(word);
       word = void 0;
       continue;
     }
     word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain3));
   }
-  if (word !== void 0) words2.push(word);
-  return words2;
+  if (word !== void 0) words3.push(word);
+  return words3;
 }
 function quoteWord(word) {
   const text = hasControl(word) ? withoutControl(word) : word;
@@ -15412,14 +15490,14 @@ function addPlain(word, plain3) {
 }
 function splitPatterns(text) {
   const piece = /'([^']*)'|"((?:[^"\\]|\\[\s\S])*)"|\\([\s\S])|([^\s'"\\]+)|(\s+)/y;
-  const words2 = [];
+  const words3 = [];
   let word;
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
     const [, single, double, escaped, plain3, space] = m;
     if (space !== void 0) {
-      if (word !== void 0) words2.push(word);
+      if (word !== void 0) words3.push(word);
       word = void 0;
       continue;
     }
@@ -15427,8 +15505,8 @@ function splitPatterns(text) {
     if (plain3 !== void 0) addPlain(word, plain3);
     else addPart(word, single ?? (double !== void 0 ? unescaped(double) : escaped));
   }
-  if (word !== void 0) words2.push(word);
-  return words2;
+  if (word !== void 0) words3.push(word);
+  return words3;
 }
 var literal = (pattern) => pattern.map((p) => p ?? "*").join("");
 var isAny = (pattern) => pattern?.length === 1 && pattern[0] === null;
@@ -15501,14 +15579,14 @@ function whoError(who) {
   return `expected a user name, %group or ALL first, not ${shown(who)}`;
 }
 function cwdOf(word) {
-  const words2 = splitWords(word);
-  const path = words2?.length === 1 ? words2[0] : "";
+  const words3 = splitWords(word);
+  const path = words3?.length === 1 ? words3[0] : "";
   return path.startsWith("/") ? normalizePath(path) : "";
 }
 function commandOf2(text, after) {
-  const words2 = splitPatterns(text);
-  if (words2 === void 0) return "a quote in the command is not closed, or it ends in a \\";
-  const [first, ...args] = words2;
+  const words3 = splitPatterns(text);
+  if (words3 === void 0) return "a quote in the command is not closed, or it ends in a \\";
+  const [first, ...args] = words3;
   const path = first ? literal(first) : "";
   if (path === "") return `expected a command after ${after}`;
   if (!path.startsWith("/")) return `expected an absolute command path, not ${shown(path)}`;
@@ -16198,6 +16276,9 @@ function recordable(cwd, argv) {
 function changedText(file) {
   return `sudo: ${file} changed since it was approved`;
 }
+function requestedText(file) {
+  return `sudo: ${file} changed since it was requested`;
+}
 function changedFile(approved, now) {
   const files = /* @__PURE__ */ new Set([...Object.keys(approved), ...Object.keys(now)]);
   return [...files].find((file) => approved[file] !== now[file]);
@@ -16205,6 +16286,67 @@ function changedFile(approved, now) {
 function pinned(rule, bound3) {
   return rule.sha256 === void 0 || changedFile(rule.sha256, bound3) === void 0;
 }
+var REPLAY_ID = /^[!-~]{1,256}$/;
+var REPLAY_TAGS_MAX = 64;
+var REPLAY_ARGV_MAX = 4096;
+var REPLAY_BYTES_MAX = 1024 * 1024;
+var NOT_A_REQUEST = "sudo: that isn't a sudo request this kernel can run";
+function strings(value2, max) {
+  return Array.isArray(value2) && value2.length <= max && value2.every((s) => typeof s === "string");
+}
+function words(value2) {
+  if (!strings(value2, REPLAY_ARGV_MAX) || value2.length === 0) return false;
+  const bytes = value2.reduce((n, s) => n + s.length + 1, 0);
+  return bytes <= REPLAY_BYTES_MAX && !value2.some((s) => s.includes("\0"));
+}
+function filesOf(value2) {
+  if (value2 === void 0) return {};
+  if (!Array.isArray(value2) || value2.length > OPERANDS_MAX) return void 0;
+  const files = {};
+  for (const file of value2) {
+    const { path, sha256: hex4 } = file ?? {};
+    if (typeof path !== "string" || typeof hex4 !== "string") return void 0;
+    files[path] = hex4;
+  }
+  return files;
+}
+function flagsOf(value2) {
+  if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) return void 0;
+  const entries = Object.entries(value2);
+  if (entries.length > ROOT_ONLY_MAX || entries.some(([, v]) => typeof v !== "boolean")) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
+function replayOf(value2) {
+  if (typeof value2 !== "object" || value2 === null) return failed2("EINVAL", NOT_A_REQUEST);
+  const r = value2;
+  if (r.validate === true) return failed2("EINVAL", "sudo: a sudo -v request runs no command");
+  if (r.stdin === "pipe" || r.stdin === "file") {
+    return failed2("EINVAL", `sudo: the request read a ${r.stdin}, and that input is gone`);
+  }
+  const { id: id2, user, uid, target, argv, path, cwd, stdin, tag, tags } = r;
+  const rootOnly2 = flagsOf(r.rootOnly);
+  const bound3 = filesOf(r.userWritable);
+  const named = (s) => typeof s === "string" && s !== "";
+  const absolute2 = (s) => typeof s === "string" && s.startsWith("/") && s.length <= PATH_MAX && !s.includes("\0");
+  const valid2 = typeof id2 === "string" && REPLAY_ID.test(id2) && named(user) && named(target) && Number.isInteger(uid) && uid >= 0 && words(argv) && absolute2(path) && absolute2(cwd) && (stdin === "tty" || stdin === "none") && (tag === void 0 || typeof tag === "string") && (tags === void 0 || strings(tags, REPLAY_TAGS_MAX)) && rootOnly2 !== void 0 && bound3 !== void 0;
+  if (!valid2) return failed2("EINVAL", NOT_A_REQUEST);
+  const all = tags ?? (tag === void 0 ? [] : [tag]);
+  return {
+    id: id2,
+    user,
+    uid,
+    target,
+    argv,
+    path,
+    cwd,
+    stdin,
+    rootOnly: rootOnly2,
+    bound: bound3,
+    tags: [...new Set(all)]
+  };
+}
 var VISUDO_FILES_MAX = 64;
 var VISUDO_TEXT_MAX = 1024 * 1024;
 function visudoCall(req) {
@@ -16606,6 +16748,61 @@ var Sudo = class {
     if (parsed2.validate) return this.validate(session, root, mine, call.cwd);
     return this.command(session, root, mine, call);
   }
+  async replay(value2) {
+    const r = replayOf(value2);
+    if ("error" in r) return r;
+    if (this.o.mode !== "enforce") {
+      return failed2("EINVAL", `sudo: users are '${this.o.mode}', so no request needed approval`);
+    }
+    const self = await this.o.users.lookup(r.user);
+    if (!self) return failed2("ENOENT", `sudo: unknown user ${r.user}`);
+    if (self.uid !== r.uid) return failed2("EPERM", `sudo: ${self.name} is no longer uid ${r.uid}`);
+    const target = await this.lookup(r.target);
+    if (!target) return failed2("ENOENT", `sudo: unknown user ${r.target}`);
+    const cred = credOf(self);
+    const [word = "", ...args] = r.argv;
+    const argv = [r.path, ...args];
+    if (!await this.mayAsk(self, target, r, argv)) {
+      const quoted = argv.map(quoteWord).join(" ");
+      return failed2(
+        "EACCES",
+        `sudo: ${self.name} may no longer ask to run ${quoted} as ${target.name}`
+      );
+    }
+    if (await this.canonical(r.cwd) !== r.cwd) {
+      return failed2("EACCES", `sudo: ${r.cwd} changed since it was requested`);
+    }
+    if (!await this.reachable(cred, r.cwd)) {
+      return failed2(
+        "EACCES",
+        `sudo: cannot run in ${r.cwd}: it isn't a directory ${self.name} can enter`
+      );
+    }
+    const path = await this.locate(word, r.cwd);
+    if (!path) return failed2("ENOENT", `sudo: ${word}: command not found`);
+    if (path !== r.path) return failed2("EPERM", `sudo: ${word} now runs ${path}, not ${r.path}`);
+    const bound3 = await this.bound(path, r.cwd);
+    if (!bound3) return failed2("ENOENT", `sudo: ${word}: command not found`);
+    const changed = changedFile(r.bound, bound3);
+    if (changed !== void 0) return failed2("EPERM", requestedText(changed));
+    const now = await this.rootOnly(r.cwd, args);
+    const flipped = Object.keys(r.rootOnly).find((at) => r.rootOnly[at] && now[at] !== true);
+    if (flipped !== void 0) return failed2("EPERM", `sudo: ${flipped} is no longer root-only`);
+    const { grant } = this.grant(self, target, cred, r.argv, path, r.cwd, void 0, bound3);
+    (this.o.warn ?? console.warn)(
+      `sudo: ${self.name} : TTY=unknown ; PWD=${quoteWord(r.cwd)} ; USER=${target.name} ; REPLAY=${r.id} ; COMMAND=${argv.map(quoteWord).join(" ")}`
+    );
+    return { grant, caller: self, target, tags: r.tags };
+  }
+  async mayAsk(self, target, r, argv) {
+    if (self.uid === 0) return true;
+    const cred = credOf(self);
+    const { rules } = await this.policyRules({ cred, pid: 0, stdin: r.stdin });
+    const applies = await this.applies(self, cred);
+    return rules.some(
+      (rule) => applies(rule.who) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === r.cwd) && stdinMatches(rule, r.stdin) && commandMatches(rule.cmnd, argv) && pinned(rule, r.bound)
+    );
+  }
   async command(s, root, mine, call) {
     const { caller, self, target, parsed: parsed2 } = s;
     const { cred } = caller;
@@ -16785,8 +16982,8 @@ ${lines2}
       const st = await fs.lstat(path).catch(() => void 0);
       if (st && !await this.trusted(path)) return false;
       const old = st ? await fs.readFile(path) : "";
-      const words2 = recordedCommand(argv);
-      const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Stdin none ${sha256Text(bound3)}Cmnd ${words2}
+      const words3 = recordedCommand(argv);
+      const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Stdin none ${sha256Text(bound3)}Cmnd ${words3}
 `;
       const text = old === "" || old.endsWith("\n") ? `${old}${line}` : `${old}
 ${line}`;
@@ -18091,8 +18288,8 @@ function ipv6(host) {
   const head = groups(halves[0]);
   const back = halves.length === 2 ? groups(halves[1]) : [];
   if (![...head, ...back].every((g) => /^[0-9A-Fa-f]{1,4}$/.test(g))) return void 0;
-  const words2 = [...head, ...back].map((g) => Number.parseInt(g, 16));
-  const missing6 = 8 - words2.length - tail2.length;
+  const words3 = [...head, ...back].map((g) => Number.parseInt(g, 16));
+  const missing6 = 8 - words3.length - tail2.length;
   if (halves.length === 2 ? missing6 < 1 : missing6 !== 0) return void 0;
   const all = [
     ...head.map((g) => Number.parseInt(g, 16)),
@@ -21576,7 +21773,7 @@ function selectFlag(req) {
     throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS: alpn with select");
   return TLS_SERVER_SELECT;
 }
-function flagsOf(req) {
+function flagsOf2(req) {
   return certFlags(req) | selectFlag(req) | (req.keylog ? TLS_KEYLOG : 0);
 }
 async function engineOf(proc, { select, keylog }) {
@@ -21627,7 +21824,7 @@ async function serverOf(proc, req) {
   let mine;
   try {
     mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
-    const flags2 = flagsOf(req);
+    const flags2 = flagsOf2(req);
     const store = mine ?? (flags2 & CERT_FLAGS ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
@@ -23516,7 +23713,7 @@ var WRITE_ACCESS = 3;
 var KEYBOARD = /* @__PURE__ */ new Set([SIG.INT, SIG.QUIT, SIG.TSTP]);
 var STUCK_ESCAPES = /* @__PURE__ */ new Set([SIG.INT, SIG.TERM, SIG.QUIT, SIG.HUP]);
 var DEFAULT_UMASK2 = 18;
-function words(value2) {
+function words2(value2) {
   if (!Array.isArray(value2) || !value2.every((w) => typeof w === "string")) {
     throw new KernelError("EINVAL");
   }
@@ -24969,7 +25166,7 @@ var WasmProcess = class {
     if (!sudo) throw new KernelError("ENOSYS");
     const call = {
       op: "proc-sudo",
-      args: words(req.args),
+      args: words2(req.args),
       cwd: typeof req.cwd === "string" && req.cwd.startsWith("/") ? req.cwd : "/",
       ...typeof req.term === "string" ? { term: req.term } : {}
     };
@@ -25973,6 +26170,9 @@ var JobTable = class {
   idOf(pid) {
     return this.members.get(pid)?.shownAs ?? pid;
   }
+  execParentOf(pid) {
+    return this.members.get(pid)?.execParent;
+  }
   byId(id2) {
     for (const member of this.members.values()) if (member.shownAs === id2) return member;
     return this.member(id2);
@@ -28255,8 +28455,8 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
 function noticeOf(data) {
   if (Array.isArray(data)) return { paths: data.filter((p) => typeof p === "string"), trees: [] };
   const notice = data ?? {};
-  const strings = (list) => Array.isArray(list) ? list.filter((p) => typeof p === "string") : [];
-  return { paths: strings(notice.paths), trees: strings(notice.trees), outside: true };
+  const strings2 = (list) => Array.isArray(list) ? list.filter((p) => typeof p === "string") : [];
+  return { paths: strings2(notice.paths), trees: strings2(notice.trees), outside: true };
 }
 
 // src/fs/opfs.ts
@@ -32569,7 +32769,40 @@ function describe(req, tty) {
 }
 function refuseChanged(approved, now) {
   const changed = changedFile(approved, now);
-  if (changed !== void 0) throw new ChangedError(changedText(changed));
+  if (changed !== void 0) throw new ChangedError(changedText(changed), changed);
+}
+var O_WRONLY2 = 1;
+var OUTPUT_MODE = 384;
+var ERRNO_TEXT = {
+  EACCES: "Permission denied",
+  EISDIR: "Is a directory",
+  ENOENT: "No such file or directory",
+  ENOTDIR: "Not a directory",
+  EROFS: "Read-only file system"
+};
+function sudoFailure(errno3, message3) {
+  return Object.assign(new Error(message3), { code: errno3 });
+}
+function sudoCause(err) {
+  const code = codeOf8(err);
+  if (typeof code !== "string") throw err;
+  return code;
+}
+function requested(err) {
+  if (err instanceof ChangedError) throw sudoFailure(err.code, requestedText(err.file));
+  throw err;
+}
+var MAX_SPAWN_TAGS = 8;
+function tagList(value2) {
+  if (!Array.isArray(value2)) {
+    tagOption(value2);
+    return value2 === void 0 ? [] : [value2];
+  }
+  if (value2.length > MAX_SPAWN_TAGS) {
+    throw new TypeError(`a spawn adds at most ${MAX_SPAWN_TAGS} tags`);
+  }
+  for (const each of value2) tagOption(each ?? 0);
+  return value2;
 }
 function linksOf2(req) {
   return req.links === void 0 ? {} : { links: req.links };
@@ -32695,27 +32928,27 @@ function appendedRoots(given) {
   }
   return [...roots];
 }
-function plainEnv(words2) {
-  const next3 = words2[1];
-  if (baseName2(words2[0] ?? "") !== "env" || next3 === void 0) return false;
+function plainEnv(words3) {
+  const next3 = words3[1];
+  if (baseName2(words3[0] ?? "") !== "env" || next3 === void 0) return false;
   return next3 === "-S" || !next3.startsWith("-") && !next3.includes("=");
 }
-function shebangCommand(words2) {
-  if (!plainEnv(words2)) {
-    const arg2 = words2.slice(1).join(" ");
-    return { interp: words2[0], args: arg2 ? [arg2] : [] };
+function shebangCommand(words3) {
+  if (!plainEnv(words3)) {
+    const arg2 = words3.slice(1).join(" ");
+    return { interp: words3[0], args: arg2 ? [arg2] : [] };
   }
-  const split3 = words2[1] === "-S";
-  const [interp, ...rest2] = words2.slice(split3 ? 2 : 1);
+  const split3 = words3[1] === "-S";
+  const [interp, ...rest2] = words3.slice(split3 ? 2 : 1);
   const arg = rest2.join(" ");
   return { interp, args: split3 ? rest2 : arg ? [arg] : [] };
 }
 function interpreter(head) {
-  const words2 = shebang(head);
-  if (!words2) return "node";
-  if (baseName2(words2[0]) === "env") words2.shift();
-  if (words2[0] === "-S") words2.shift();
-  return baseName2(words2[0] ?? "");
+  const words3 = shebang(head);
+  if (!words3) return "node";
+  if (baseName2(words3[0]) === "env") words3.shift();
+  if (words3[0] === "-S") words3.shift();
+  return baseName2(words3[0] ?? "");
 }
 function expandDefaults(defaults2, env) {
   const out = {};
@@ -33490,9 +33723,9 @@ var Launcher = class {
     const head = await this.head(script);
     if (!head) return void 0;
     const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(scope), script);
-    const words2 = shebang(head) ?? (binfmt ? [binfmt] : void 0);
-    if (!words2) return void 0;
-    const { interp, args } = shebangCommand(words2);
+    const words3 = shebang(head) ?? (binfmt ? [binfmt] : void 0);
+    if (!words3) return void 0;
+    const { interp, args } = shebangCommand(words3);
     const passed = [...args, command ? script : file, ...argv.slice(1)];
     if (!interp) return void 0;
     const found = await this.resolve(interp, interp, cwd, scope);
@@ -33723,7 +33956,7 @@ var Launcher = class {
     const hex4 = pinned2[real];
     if (hex4 !== void 0) return { [real]: hex4 };
     if (await this.sudoer.trusted(real)) return {};
-    throw new ChangedError(changedText(real));
+    throw new ChangedError(changedText(real), real);
   }
   async pinnedBytes(pin, bytes) {
     const [real = ""] = Object.keys(pin);
@@ -34002,6 +34235,10 @@ var Launcher = class {
   }
   async launch(asked, req) {
     const cwd = await physicalPathAsync(this.base, req.cwd);
+    if (req.exactCwd && cwd !== req.cwd) {
+      await req.fds.closeAll();
+      throw sudoFailure("EACCES", `sudo: ${req.cwd} changed since it was requested`);
+    }
     const seen = { ...req.env, HOSTNAME: this.hostname, cwd };
     await this.pnpmReady();
     let loaded;
@@ -34180,10 +34417,12 @@ var Launcher = class {
       });
       const fit = await (handle.ready ?? true);
       if (fit) {
+        this.traceAdmitted(handle.pid, true);
         await fds.closeAll();
         return handle;
       }
       await handle.exited;
+      this.traceAdmitted(handle.pid, false);
       await this.memories.refused().catch(async (err) => {
         await fds.closeAll();
         throw err;
@@ -34314,10 +34553,12 @@ var Launcher = class {
     if (req.group === "lead") this.jobs.lead(pid);
     if (req.group === "session") this.jobs.setsid(pid);
     this.described.set(pid, describe(req, terminal?.name ?? null));
+    this.traceStarted(pid, req);
     handle.onState(
       (state) => state === "stopped" ? this.stopped.add(pid) : this.stopped.delete(pid)
     );
-    void handle.exited.then(() => {
+    void handle.exited.then((status) => {
+      this.traceEnded(pid, handle, status);
       this.cwds.release(this.cwdSlots.get(pid));
       this.cwdSlots.delete(pid);
       this.cwdPaths.delete(pid);
@@ -34432,6 +34673,71 @@ var Launcher = class {
   imageTimes = /* @__PURE__ */ new Map();
   childTimes = /* @__PURE__ */ new Map();
   stopped = /* @__PURE__ */ new Set();
+  traces = new TraceHub();
+  traceHeld = /* @__PURE__ */ new Map();
+  replacedImages = /* @__PURE__ */ new Set();
+  traceStarted(pid, req) {
+    const replaces = req.exec ? req.ppid : void 0;
+    if (req.quietOom) this.traceHeld.set(pid, { replaces, events: [] });
+    else if (replaces !== void 0) this.replacedImages.add(replaces);
+    this.traceEmit(pid, () => {
+      const { pid: shown2, ppid } = this.identityOf(pid);
+      const described2 = this.described.get(pid);
+      const { argv, started, tty: _tty, exeId: _exeId, ...exe } = described2;
+      return {
+        type: req.fork ? "fork" : "exec",
+        pid: shown2,
+        ppid,
+        pgid: this.jobs.pgidOf(pid),
+        argv: [...argv],
+        ...exe,
+        uid: this.credOf(pid).euid,
+        at: started,
+        ...req.exec ? { replaced: true } : {}
+      };
+    });
+  }
+  traceEnded(pid, handle, status) {
+    if (this.replacedImages.delete(pid)) return;
+    this.traceEmit(pid, () => ({
+      type: "exit",
+      pid: this.jobs.idOf(pid),
+      status,
+      ...signalField(handle.termsig()),
+      ...this.chainTimes(pid),
+      at: Date.now()
+    }));
+  }
+  traceEmit(pid, build) {
+    if (this.traces.idle) return;
+    const tags = this.tagsOf(pid);
+    const cred = this.credOf(pid);
+    if (!this.traces.wants(tags, cred)) return;
+    const held = this.traceHeld.get(pid);
+    if (held) held.events.push({ tags, cred: copyCred(cred), draft: build() });
+    else this.traces.publish(tags, cred, build());
+  }
+  traceAdmitted(pid, fit) {
+    const held = this.traceHeld.get(pid);
+    if (!held) return;
+    this.traceHeld.delete(pid);
+    if (!fit) return;
+    if (held.replaces !== void 0) this.replacedImages.add(held.replaces);
+    for (const { tags, cred, draft } of held.events) this.traces.publish(tags, cred, draft);
+  }
+  chainTimes(pid) {
+    let utime = 0;
+    let stime = 0;
+    let timed2 = false;
+    for (let at = pid; at !== void 0; at = this.jobs.execParentOf(at)) {
+      const t = this.timesAt(at);
+      if (!t) continue;
+      timed2 = true;
+      utime += t.utime;
+      stime += t.stime;
+    }
+    return timed2 ? { utime, stime } : {};
+  }
   stateOf(pid) {
     if (!this.processes.has(pid)) return "Z";
     return this.stopped.has(pid) ? "T" : "S";
@@ -35628,6 +35934,96 @@ var Launcher = class {
     const signal = handle.termsig();
     return { status, ...signal ? { signal } : {}, stdout: concat7(out), stderr: concat7(err) };
   }
+  async sudoRun(replay, options = {}) {
+    const added = tagList(options.tag);
+    const replayed = await this.sudoer.replay(replay);
+    if ("error" in replayed) throw sudoFailure(replayed.errno, replayed.error);
+    const { grant, caller, target } = replayed;
+    let tags = withTag(void 0, options.base);
+    for (const tag of [...replayed.tags, ...added]) tags = withTag(tags, tag);
+    const tagged = { tags, tagBase: options.base === void 0 ? 0 : 1 };
+    await this.swaps.settled();
+    this.resetCatalogs();
+    const req = { file: grant.file, argv: grant.argv, env: grant.env, cwd: grant.cwd };
+    const ctx = { ppid: 0, cred: grant.cred, scope: "" };
+    const planned = await this.planOne(req, ctx).catch((err2) => {
+      const code = sudoCause(err2);
+      const word = grant.argv[0] ?? grant.file;
+      if (code === "ENOENT") throw sudoFailure(code, `sudo: ${word}: command not found`);
+      throw sudoFailure(code, `sudo: ${grant.file}: ${ERRNO_TEXT[code] ?? code}`);
+    });
+    const pin = await this.unchanged(planned, grant.file, grant.cwd, grant).catch(requested);
+    const fds = await this.sudoOutputs(options, caller, this.stackFor(tags, tagged.tagBase));
+    const err = fds.get(2).file;
+    const report = (message3) => void Promise.resolve(err.write?.(encoder10.encode(`${message3}
+`))).catch(() => void 0);
+    const replan = () => this.planOne(req, ctx);
+    if (!await this.grantedCwd(grant.caller, grant.cwd)) {
+      await fds.closeAll();
+      throw sudoFailure("EACCES", `sudo: ${grant.cwd} changed since it was requested`);
+    }
+    const handle = await this.launch(
+      { ...planned, replan },
+      {
+        ...pin,
+        env: grant.env,
+        cwd: grant.cwd,
+        fds,
+        report,
+        ...this.identity(target, tagged, options.session),
+        ...caller.umask !== void 0 ? { umask: caller.umask } : {},
+        links: grant.cred.euid,
+        exactCwd: true
+      }
+    ).catch(requested);
+    const ended = handle.exited.then((status) => {
+      const signal = handle.termsig();
+      return { status, ...signal ? { signal } : {} };
+    });
+    return { pid: handle.pid, ended };
+  }
+  async sudoOutputs(options, caller, stack) {
+    const fds = new FdTable();
+    const opened2 = /* @__PURE__ */ new Map();
+    fds.installAt(0, deviceFile("null"));
+    try {
+      fds.installAt(1, await this.sudoOutput(options.stdout, caller, stack, opened2));
+      fds.installAt(2, await this.sudoOutput(options.stderr, caller, stack, opened2));
+    } catch (err) {
+      await fds.closeAll();
+      throw err;
+    }
+    return fds;
+  }
+  async sudoOutput(path, caller, stack, opened2) {
+    if (path === void 0) return deviceFile("null");
+    if (typeof path !== "string" || !path.startsWith("/")) {
+      throw sudoFailure("EINVAL", `sudo: ${String(path)} is not an absolute path`);
+    }
+    const cred = credOf(caller);
+    const walked = await walk(this.fs, cred, normalizePath(path), true, caller.uid);
+    const real = walked.path;
+    const same2 = opened2.get(real);
+    if (same2) return same2.retain();
+    try {
+      if (walked.denied !== void 0) throw fsError("EACCES", path);
+      await writable({ ...this.execGuard(cred, 0), links: caller.uid }, "open", real);
+      const owner = { uid: caller.uid, gid: caller.gid, mode: OUTPUT_MODE };
+      await stack.noLinks.writeFile(real, new Uint8Array(0), owner);
+    } catch (err) {
+      const code = sudoCause(err);
+      throw sudoFailure(code, `sudo: ${path}: ${ERRNO_TEXT[code] ?? code}`);
+    }
+    const file = vfsFile(stack.fs, { path: real, flags: O_WRONLY2, position: 0 }, stack.nodes);
+    const again = await walk(this.fs, cred, real, true, caller.uid);
+    const st = await stack.noLinks.lstat(real).catch(() => void 0);
+    if (again.path !== real || again.denied !== void 0 || !st?.isFile) {
+      await file.release();
+      throw sudoFailure("EACCES", `sudo: ${path} changed while it was opened`);
+    }
+    opened2.set(real, file);
+    return file;
+  }
 };
 function cronLocks() {
   return globalThis.navigator?.locks;
@@ -36112,7 +36508,7 @@ function serveTransport(peer, transport, {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 14];
+var PROTOCOL = [1, 16];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -36268,9 +36664,9 @@ async function accountOf(l, user) {
   if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
   return found;
 }
-async function runAs(l, self, requested) {
-  if (requested === void 0) return self;
-  const target = await accountOf(l, requested);
+async function runAs(l, self, requested2) {
+  if (requested2 === void 0) return self;
+  const target = await accountOf(l, requested2);
   if (self.uid !== 0 && target.uid !== self.uid) {
     throw fsError("EPERM", `${self.name} may not run as ${target.name}`);
   }
@@ -36280,8 +36676,8 @@ function clientCred(self) {
   return self ? credOf(self) : copyCred(ROOT);
 }
 async function runTagged(l, self, options, tag, session = -1) {
-  tagOption(options.tag);
-  const tags = withTag(withTag(void 0, tag), options.tag);
+  let tags = withTag(void 0, tag);
+  for (const added of tagList(options.tag)) tags = withTag(tags, added);
   return {
     user: await runAs(l, self, options.user),
     tag,
@@ -36412,6 +36808,34 @@ async function watchOp(l, req, watches, send2, g) {
   watches.set(req.id, unwatch);
   return { result: req.id };
 }
+function traceRegistry(send2) {
+  const traces = /* @__PURE__ */ new Map();
+  return {
+    answer(l, self, req) {
+      if (req.op === "untrace") {
+        traces.get(req.trace)?.close();
+        return { result: traces.delete(req.trace) };
+      }
+      if (typeof req.tag !== "string" || req.tag === "") {
+        throw fsError("EINVAL", "trace: a tag is a non-empty string");
+      }
+      const limit = traceLimit(req.limit);
+      const id2 = req.id;
+      const deliver = ({ events, dropped: dropped2 }) => send2({ trace: id2, events, ...dropped2 > 0 ? { dropped: dropped2 } : {} });
+      traces.set(id2, l.traces.subscribe(req.tag, credOf(self), deliver, limit));
+      return { result: id2 };
+    },
+    ack(data) {
+      if (typeof data.traceAck !== "number") return false;
+      traces.get(data.traceAck)?.ack();
+      return true;
+    },
+    close() {
+      for (const trace of traces.values()) trace.close();
+      traces.clear();
+    }
+  };
+}
 var TRAITS_WATCH = -1;
 function traitsWatch(launcher, transport, send2) {
   return launcher.onTraits(() => send2({ traits: transport.traits }));
@@ -36438,6 +36862,35 @@ function requestBinding(send2, port) {
     close: () => unbind?.()
   };
 }
+async function sudoRunAs(l, self, host, req, reply) {
+  if (self.uid !== 0) throw sudoFailure("EPERM", "sudo: only a root client may run a sudo request");
+  const { stdout, stderr, tag } = req.options;
+  const running = await l.sudoRun(req.replay, {
+    stdout,
+    stderr,
+    tag,
+    base: host.tag,
+    session: host.session
+  });
+  reply(req.id, { started: running.pid });
+  const { status, signal } = await running.ended;
+  return { result: status, ...signalField(signal) };
+}
+function answered(pending, req, reply, detach) {
+  pending.then(
+    ({ result, signal, transfer }) => {
+      reply(req.id, { result, ...signal ? { signal } : {} }, transfer);
+      if (req.op === "detach") detach(req.kill === true);
+    },
+    (err) => {
+      const code = err?.code;
+      reply(req.id, {
+        error: err instanceof Error ? err.message : String(err),
+        ...typeof code === "string" ? { code } : {}
+      });
+    }
+  );
+}
 function serveClient(port, host) {
   let state = "new";
   let self;
@@ -36453,6 +36906,7 @@ function serveClient(port, host) {
   };
   const reply = (id2, body, transfer) => send2({ id: id2, ...body }, transfer);
   const hosts = hostRegistries(send2, ended.promise, port);
+  const traces = traceRegistry(send2);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
     send2({ bye });
@@ -36460,6 +36914,7 @@ function serveClient(port, host) {
     net?.close();
     for (const unwatch of watches.values()) unwatch();
     watches.clear();
+    traces.close();
     hosts.close();
     for (const session of terminals.values()) session.close();
     terminals.clear();
@@ -36567,6 +37022,11 @@ function serveClient(port, host) {
       case "serve-facade":
       case "unserve-facade":
         return { result: hosts.answer(l, req) };
+      case "trace":
+      case "untrace":
+        return traces.answer(l, self, req);
+      case "sudo-run":
+        return sudoRunAs(l, self, host, req, reply);
       case "detach":
         return { result: true };
       default:
@@ -36590,20 +37050,9 @@ function serveClient(port, host) {
       net?.answer(data);
       return;
     }
+    if (traces.ack(data)) return;
     const req = data;
-    handle(req).then(
-      ({ result, signal, transfer }) => {
-        reply(req.id, { result, ...signal ? { signal } : {} }, transfer);
-        if (req.op === "detach") detach(req.kill === true);
-      },
-      (err) => {
-        const code = err?.code;
-        reply(req.id, {
-          error: err instanceof Error ? err.message : String(err),
-          ...typeof code === "string" ? { code } : {}
-        });
-      }
-    );
+    answered(handle(req), req, reply, detach);
   });
   port.addEventListener("close", () => detach());
   port.start?.();
@@ -36683,16 +37132,16 @@ function placeOf(address) {
   const kind = isIP3(plain3);
   if (kind === 4) return ipv4Place(plain3);
   if (kind !== 6) return void 0;
-  const words2 = hextets2(plain3);
-  const embedded2 = words2.slice(0, 5).every((w) => w === 0) && (words2[5] === 65535 || words2[5] === 0);
-  if (embedded2 && (words2[5] === 65535 || words2[6] !== 0)) return ipv4Place(ipv4Of(words2));
-  if (words2.slice(0, 7).every((w) => w === 0) && (words2[7] ?? 0) <= 1) return "loopback";
-  if (((words2[0] ?? 0) & 65472) === 65152) return "link-local";
-  if (words2.join(":") === METADATA_V6) return "link-local";
+  const words3 = hextets2(plain3);
+  const embedded2 = words3.slice(0, 5).every((w) => w === 0) && (words3[5] === 65535 || words3[5] === 0);
+  if (embedded2 && (words3[5] === 65535 || words3[6] !== 0)) return ipv4Place(ipv4Of(words3));
+  if (words3.slice(0, 7).every((w) => w === 0) && (words3[7] ?? 0) <= 1) return "loopback";
+  if (((words3[0] ?? 0) & 65472) === 65152) return "link-local";
+  if (words3.join(":") === METADATA_V6) return "link-local";
   return void 0;
 }
-function ipv4Of(words2) {
-  const [high = 0, low = 0] = words2.slice(6);
+function ipv4Of(words3) {
+  const [high = 0, low = 0] = words3.slice(6);
   return [high >> 8, high & 255, low >> 8, low & 255].join(".");
 }
 function hextets2(address) {
@@ -37532,6 +37981,7 @@ var Channel = class {
   failure;
   pending = /* @__PURE__ */ new Map();
   watching = /* @__PURE__ */ new Map();
+  tracing = /* @__PURE__ */ new Map();
   cdpHooks = /* @__PURE__ */ new Map();
   cdpOpen = /* @__PURE__ */ new Set();
   facadeHooks = /* @__PURE__ */ new Map();
@@ -37599,6 +38049,10 @@ var Channel = class {
       this.watching.get(data.watch)?.(data.change);
       return;
     }
+    if (data.trace !== void 0 && data.id === void 0) {
+      this.traced(data.trace, data.events ?? [], data.dropped ?? 0);
+      return;
+    }
     if (data.bye !== void 0) {
       this.end(new KernelGoneError(data.bye));
       return;
@@ -37627,6 +38081,23 @@ var Channel = class {
     if (reply.error !== void 0) call.reject(new KernelCallError(reply.error, reply.code));
     else call.resolve(reply.result);
   }
+  traced(trace, events, dropped2) {
+    const listener = this.tracing.get(trace);
+    if (!listener) return;
+    const ack = () => {
+      if (this.tracing.has(trace)) this.post({ traceAck: trace });
+    };
+    let consumed;
+    try {
+      consumed = listener({ events, dropped: dropped2 });
+    } finally {
+      if (typeof consumed?.then === "function") {
+        void Promise.resolve(consumed).then(ack, ack);
+      } else {
+        ack();
+      }
+    }
+  }
   openCdp({ cdpOpen: { registration, ...request }, port }) {
     const hook = registration === void 0 ? void 0 : this.cdpHooks.get(registration);
     if (!hook || this.failure) {
@@ -37689,6 +38160,29 @@ async function serveCdpOn(channel, hook, options) {
     }
   };
 }
+async function traceOn(channel, tag, onEvents, options) {
+  if (typeof onEvents !== "function") throw new TypeError("trace: onEvents must be a function");
+  await since(channel, 15, "trace", async () => {
+  });
+  const { id: id2, done: done4 } = channel.request({
+    op: "trace",
+    tag,
+    ...options.limit !== void 0 ? { limit: options.limit } : {}
+  });
+  channel.tracing.set(id2, onEvents);
+  try {
+    await done4;
+  } catch (error) {
+    channel.tracing.delete(id2);
+    throw error;
+  }
+  return {
+    close: () => {
+      if (!channel.tracing.delete(id2)) return;
+      void channel.call({ op: "untrace", trace: id2 }).catch(() => void 0);
+    }
+  };
+}
 async function dialOn(channel, { port, host }) {
   const req = { op: "dial", port, ...host ? { host } : {} };
   return dialStream(await since(channel, 4, "dial", () => channel.call(req)));
@@ -37702,6 +38196,8 @@ async function spawnOn(channel, argv, opts) {
   });
   if (opts.tag !== void 0) await since(channel, 12, "a tag per spawn", async () => {
   });
+  if (Array.isArray(opts.tag)) await since(channel, 15, "several tags per spawn", async () => {
+  });
   if (opts.cwdMissing === "error") await since(channel, 14, "cwdMissing: 'error'", async () => {
   });
   const started = Promise.withResolvers();
@@ -37726,6 +38222,19 @@ async function spawnOn(channel, argv, opts) {
     signal: async (name2 = "SIGTERM") => void await channel.call({ op: "kill", pid: -pgid, signal: name2 })
   };
 }
+async function sudoRunOn(channel, replay, { stdout, stderr, tag }) {
+  await since(channel, 16, "sudoRun", async () => {
+  });
+  const started = Promise.withResolvers();
+  let endedBy;
+  const { done: done4 } = channel.request(
+    { op: "sudo-run", replay, options: { stdout, stderr, tag } },
+    { started: started.resolve, ended: (signal) => endedBy = signal }
+  );
+  done4.catch(started.reject);
+  const pid = await started.promise;
+  return { pid, pgid: pid, ended: endedOf(done4, () => endedBy) };
+}
 function endedOf(done4, signal) {
   return quiet(
     done4.then((status) => {
@@ -37763,6 +38272,10 @@ async function terminalOn(channel, argv, opts) {
   });
   if (opts.tag !== void 0) await since(channel, 12, "a tag per terminal", async () => {
   });
+  if (Array.isArray(opts.tag)) {
+    await since(channel, 15, "several tags per terminal", async () => {
+    });
+  }
   if (opts.cwdMissing === "error") await since(channel, 14, "cwdMissing: 'error'", async () => {
   });
   let listener = onData ?? null;
@@ -37922,6 +38435,8 @@ async function attachKernel(port, options = {}) {
       channel.traitsListeners.add(listener);
       return () => channel.traitsListeners.delete(listener);
     },
+    trace: (tag, onEvents, options2 = {}) => traceOn(channel, tag, onEvents, options2),
+    sudoRun: (replay, options2 = {}) => sudoRunOn(channel, replay, options2),
     async close(o = {}) {
       if (channel.failure) return;
       await channel.call({ op: "detach", ...o.kill ? { kill: true } : {} }).catch(() => void 0);
@@ -38236,6 +38751,30 @@ function checkedRequests(hook) {
   const kinds = kindsOf(hook);
   return { kinds, handle: (request) => hook.handle(request) };
 }
+function nodeAccounts(launcher, guard2) {
+  return {
+    users: {
+      mode: launcher.usersMode,
+      add: (user) => guard2(() => launcher.users.add(user)),
+      remove: (name2, options) => guard2(() => launcher.users.remove(name2, options)),
+      list: () => guard2(() => launcher.users.list())
+    },
+    groups: {
+      list: () => guard2(() => launcher.users.groups()),
+      add: (name2, options) => guard2(() => launcher.users.addGroup(name2, options?.gid)),
+      addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
+      removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
+    }
+  };
+}
+async function nodeSudoRun(launcher, guard2, replay, options) {
+  const running = await guard2(() => launcher.sudoRun(replay, options));
+  const ended = guard2(async () => {
+    const { status, signal } = await running.ended;
+    return { status, ...signalField(signal) };
+  });
+  return { pid: running.pid, pgid: running.pid, ended: quiet(ended) };
+}
 async function createNodeKernel(options = {}) {
   const hooks = sealedHooks(options.sealed);
   const timeZone = systemTimeZone(options.timeZone, clockZone(options.cron?.clock));
@@ -38364,18 +38903,8 @@ async function createNodeKernel(options = {}) {
     mounts: async () => launcher.mounts.listed(),
     setRoutes: (routes) => guard2(async () => launcher.setRoutes(routes)),
     updateTransportTraits: () => guard2(async () => launcher.updateTransportTraits()),
-    users: {
-      mode: launcher.usersMode,
-      add: (user) => guard2(() => launcher.users.add(user)),
-      remove: (name2, options2) => guard2(() => launcher.users.remove(name2, options2)),
-      list: () => guard2(() => launcher.users.list())
-    },
-    groups: {
-      list: () => guard2(() => launcher.users.groups()),
-      add: (name2, options2) => guard2(() => launcher.users.addGroup(name2, options2?.gid)),
-      addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
-      removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
-    },
+    ...nodeAccounts(launcher, guard2),
+    sudoRun: (replay, sudoOptions = {}) => nodeSudoRun(launcher, guard2, replay, sudoOptions),
     async connect(connectOptions = {}) {
       if (terminated) throw new Error(TERMINATED);
       const { user } = connectOptions;