@ai-ecoverse/slicc-kernel 1.181.0 → 1.183.0

package/dist/kernel-worker.js

@@ -652,8 +652,8 @@ function dirsChannel(metadata) {
 function noticeOf(data) {
   if (Array.isArray(data)) return { paths: data.filter((p) => typeof p === "string"), trees: [] };
   const notice = data ?? {};
-  const strings2 = (list) => Array.isArray(list) ? list.filter((p) => typeof p === "string") : [];
-  return { paths: strings2(notice.paths), trees: strings2(notice.trees), outside: true };
+  const strings3 = (list) => Array.isArray(list) ? list.filter((p) => typeof p === "string") : [];
+  return { paths: strings3(notice.paths), trees: strings3(notice.trees), outside: true };
 }
 
 // src/fs/types.ts
@@ -1427,15 +1427,15 @@ var RemoteWatch = class {
     this.channel.postMessage({ ack: seq2, from: this.tab, to: from });
   }
   hold(add, drop, wait2) {
-    const fresh3 = add.filter(
+    const fresh4 = add.filter(
       ([path, fid]) => !this.myHolds.has(path) || this.myHolds.get(path) !== fid
     );
     const gone = drop.filter((path) => this.myHolds.has(path));
     for (const path of gone) this.myHolds.delete(path);
-    for (const [path, fid] of fresh3) this.myHolds.set(path, fid);
-    if (fresh3.length === 0 && gone.length === 0 || this.peers.size === 0)
+    for (const [path, fid] of fresh4) this.myHolds.set(path, fid);
+    if (fresh4.length === 0 && gone.length === 0 || this.peers.size === 0)
       return Promise.resolve();
-    const seq2 = this.sendHolds(fresh3, gone);
+    const seq2 = this.sendHolds(fresh4, gone);
     if (!wait2) return Promise.resolve();
     const heard = new Set(
       [...this.peers].filter((peer) => this.holders.has(peer) && !this.silent.has(peer))
@@ -2121,7 +2121,7 @@ var OpfsFs = class {
     const parent = entries.at(-1);
     const setgid = ((parent?.mode ?? 0) & S_ISGID2) !== 0;
     const parentGid = (ownOf(parent) ?? inherit(entries.slice(0, -1))).gid;
-    const want = { uid: owner.uid, gid: setgid ? parentGid : owner.gid };
+    const want2 = { uid: owner.uid, gid: setgid ? parentGid : owner.gid };
     let mode = owner.mode === void 0 ? void 0 : owner.mode & PERM_MASK;
     if (directory && setgid) mode = (mode ?? 493) | S_ISGID2;
     const fields = {};
@@ -2129,7 +2129,7 @@ var OpfsFs = class {
       fields.mode = mode;
     }
     if (self) fields.heir = void 0;
-    if (ownOf(self) || !sameOwner(want, inherit(entries))) Object.assign(fields, want);
+    if (ownOf(self) || !sameOwner(want2, inherit(entries))) Object.assign(fields, want2);
     return Object.keys(fields).length > 0 ? fields : void 0;
   }
   async stampNew(path, owner, directory) {
@@ -2366,9 +2366,9 @@ var OpfsFs = class {
     this.lookups++;
     if (split(path).length === 0) return this.root;
     const cached = this.files.get(path);
-    const fresh3 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
-    if (cached && !fresh3) this.files.delete(path);
-    if (cached && fresh3) {
+    const fresh4 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
+    if (cached && !fresh4) this.files.delete(path);
+    if (cached && fresh4) {
       if (this.glanced(cached)) return this.remember(path, cached);
       try {
         await this.glance(cached);
@@ -2586,8 +2586,8 @@ var OpfsFs = class {
   glanced(handle) {
     if (this.exact > 0) return void 0;
     const seen = this.glances.get(handle);
-    const fresh3 = seen && seen.changes === this.changes && this.recent(seen, GLANCE_LOOKUPS);
-    return fresh3 ? seen.file : void 0;
+    const fresh4 = seen && seen.changes === this.changes && this.recent(seen, GLANCE_LOOKUPS);
+    return fresh4 ? seen.file : void 0;
   }
   async glance(handle) {
     const at = performance.now();
@@ -2789,13 +2789,13 @@ var OpfsFs = class {
   async keptFor(path) {
     const at = normalizePath(path);
     const cached = this.files.get(at);
-    const fresh3 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
-    const [target, existed] = fresh3 ? [at, true] : await this.writeTarget(path);
+    const fresh4 = cached && performance.now() - (this.found.get(cached) ?? -CHECK_MS) < CHECK_MS;
+    const [target, existed] = fresh4 ? [at, true] : await this.writeTarget(path);
     if (!existed) return [void 0, target, false];
     this.refuse(target);
     const [entry] = await this.meta.get([target]);
     if (entry?.fifo || entry?.socket) throw fsError("ENXIO", path);
-    const kept = fresh3 ? cached : this.files.get(target);
+    const kept = fresh4 ? cached : this.files.get(target);
     const usable3 = kept && performance.now() - (this.found.get(kept) ?? -CHECK_MS) < CHECK_MS;
     return [usable3 ? kept : void 0, target, true];
   }
@@ -4342,21 +4342,21 @@ function latin1Bytes(text) {
   return out;
 }
 function parseRequestHead(bytes) {
-  const lines2 = latin1(bytes).split(/\r?\n/);
-  while (lines2.length > 0 && lines2[0] === "") lines2.shift();
-  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines2.shift() ?? "");
+  const lines3 = latin1(bytes).split(/\r?\n/);
+  while (lines3.length > 0 && lines3[0] === "") lines3.shift();
+  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines3.shift() ?? "");
   if (!match) throw new HttpError(400, "malformed request line");
   if (match[3] !== "1") throw new HttpError(505, `HTTP/${match[3]}.${match[4]} is not supported`);
   return {
     method: match[1],
     target: match[2],
     minor: Number(match[4]),
-    headers: parseFields(lines2)
+    headers: parseFields(lines3)
   };
 }
-function parseFields(lines2) {
+function parseFields(lines3) {
   const headers = [];
-  for (const line of lines2) {
+  for (const line of lines3) {
     if (line === "") continue;
     if (line.startsWith(" ") || line.startsWith("	")) {
       throw new HttpError(400, "obsolete line folding");
@@ -4825,10 +4825,10 @@ var CdpFacade = class {
       );
       return;
     }
-    await this.write(conn, json(await this.list(runtime)));
+    await this.write(conn, json(await this.list(runtime, conn.peerStamp)));
   }
-  async list(runtime) {
-    const conn = await this.host(runtime);
+  async list(runtime, stamp) {
+    const conn = await this.host(runtime, stamp);
     try {
       const reply = await new Promise(
         (resolve2, reject) => {
@@ -4841,10 +4841,10 @@ var CdpFacade = class {
             reject(new HttpError(502, `the CDP host closed: ${reason ?? "no reason"}`));
           };
           conn.onmessage = (message3) => {
-            const parsed2 = JSON.parse(message3);
-            if (parsed2.id !== 1) return;
+            const parsed3 = JSON.parse(message3);
+            if (parsed3.id !== 1) return;
             clearTimeout(timer);
-            resolve2(parsed2);
+            resolve2(parsed3);
           };
           conn.send(JSON.stringify({ id: 1, method: "Target.getTargets" }));
         }
@@ -4863,12 +4863,15 @@ var CdpFacade = class {
       conn.close();
     }
   }
-  host(runtime) {
-    return this.options.hosts.connect(runtime ? { runtime } : {});
+  host(runtime, stamp) {
+    return this.options.hosts.connect({
+      ...runtime ? { runtime } : {},
+      ...stamp ? { stamp } : {}
+    });
   }
   async upgrade(conn, incoming, req, runtime) {
     const accept2 = await acceptKey(req.headers);
-    const host = await this.host(runtime);
+    const host = await this.host(runtime, conn.peerStamp);
     const limits = {
       max: this.options.maxMessage ?? MAX_MESSAGE,
       closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS
@@ -4948,6 +4951,7 @@ function enableCdp(net, hosts) {
   let facade;
   net.kernelOnly(CDP_PORT, true);
   net.reserve(CDP_PORT);
+  net.stampPeers(CDP_PORT);
   net.activate({ family: "inet", host: "127.0.0.1", port: CDP_PORT }, () => {
     const started = new CdpFacade({ net, hosts });
     facade = started;
@@ -4990,7 +4994,7 @@ var CdpHosts = class {
     if (!entry) throw new HttpError(503, NO_CDP_HOST);
     let conn;
     try {
-      conn = await entry.hook(request3.runtime ? { runtime: request3.runtime } : {});
+      conn = await entry.hook(hookRequest(request3));
     } catch (e) {
       throw new HttpError(502, `CDP host: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -5010,6 +5014,12 @@ var CdpHosts = class {
     for (const entry of [this.embedder, ...this.clients]) if (entry) closeAll(entry);
   }
 };
+function hookRequest({ runtime, stamp }) {
+  return {
+    ...runtime ? { runtime } : {},
+    ...stamp ? { stamp: structuredClone(stamp) } : {}
+  };
+}
 function closeAll(entry) {
   for (const conn of [...entry.open]) {
     conn.close();
@@ -5065,10 +5075,129 @@ function portCdpHook(ask, gone) {
   });
 }
 
-// src/embedder-relay.ts
+// src/devices-relay.ts
+function quiet() {
+  return void 0;
+}
+function raised(failure2) {
+  return Object.assign(new Error(failure2.message), { name: failure2.name });
+}
 function fresh2(bytes) {
   return bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? bytes : bytes.slice();
 }
+function devicesAsker(port) {
+  const remotes2 = /* @__PURE__ */ new Map();
+  let next3 = 0;
+  const post = (message3, transfer = []) => port.postMessage({ devices: message3 }, transfer);
+  const push = (remote, item) => {
+    remote.chunks.push(item);
+    remote.wake?.();
+  };
+  const streams = (id2, remote) => ({
+    readable: new ReadableStream(
+      {
+        pull: async (controller) => {
+          if (remote.chunks.length === 0) {
+            post({ id: id2, pull: true });
+            await new Promise((resolve2) => {
+              remote.wake = resolve2;
+            });
+          }
+          const item = remote.chunks.shift();
+          if (item instanceof Uint8Array) controller.enqueue(item);
+          else if (item === null || item === void 0) controller.close();
+          else controller.error(raised(item));
+        },
+        cancel: (reason) => {
+          post({ id: id2, cancel: String(reason ?? "closed") });
+        }
+      },
+      { highWaterMark: 0 }
+    ),
+    writable: new WritableStream({
+      write: (chunk2) => {
+        const seq2 = ++remote.seq;
+        const done5 = Promise.withResolvers();
+        remote.writes.set(seq2, done5);
+        const bytes = fresh2(chunk2);
+        post({ id: id2, write: bytes, seq: seq2 }, [bytes.buffer]);
+        return done5.promise;
+      },
+      abort: (reason) => {
+        post({ id: id2, cancel: String(reason ?? "closed") });
+      }
+    }),
+    control: (op, args) => {
+      const seq2 = ++remote.seq;
+      const done5 = Promise.withResolvers();
+      remote.controls.set(seq2, done5);
+      post({ id: id2, control: { seq: seq2, op, ...args ? { args } : {} } });
+      if (op === "close") void done5.promise.finally(() => remotes2.delete(id2)).catch(quiet);
+      return done5.promise;
+    }
+  });
+  const hookFor = (client) => ({
+    open: async (request3) => {
+      const id2 = ++next3;
+      const remote = {
+        opened: Promise.withResolvers(),
+        chunks: [],
+        wake: void 0,
+        writes: /* @__PURE__ */ new Map(),
+        controls: /* @__PURE__ */ new Map(),
+        seq: 0
+      };
+      remotes2.set(id2, remote);
+      const abort = () => {
+        remotes2.delete(id2);
+        post({ id: id2, cancel: "interrupted" });
+        remote.opened.reject(request3.signal.reason);
+      };
+      request3.signal.addEventListener("abort", abort, { once: true });
+      const { path, flags: flags2, stamp } = request3;
+      post({ id: id2, open: { client, path, flags: flags2, stamp } });
+      try {
+        await remote.opened.promise;
+      } finally {
+        request3.signal.removeEventListener("abort", abort);
+      }
+      return streams(id2, remote);
+    }
+  });
+  const answer2 = (message3) => {
+    const remote = remotes2.get(message3.id);
+    if (!remote) return;
+    if ("opened" in message3) remote.opened.resolve();
+    else if ("failed" in message3) {
+      remotes2.delete(message3.id);
+      remote.opened.reject(raised(message3.failed));
+    } else if ("chunk" in message3) push(remote, message3.chunk);
+    else if ("done" in message3) push(remote, null);
+    else if ("readError" in message3) push(remote, message3.readError);
+    else if ("wrote" in message3) {
+      remote.writes.get(message3.wrote)?.resolve();
+      remote.writes.delete(message3.wrote);
+    } else if ("writeError" in message3) {
+      remote.writes.get(message3.seq)?.reject(raised(message3.writeError));
+      remote.writes.delete(message3.seq);
+    } else if ("answered" in message3) {
+      remote.controls.get(message3.answered)?.resolve(message3.value);
+      remote.controls.delete(message3.answered);
+    } else {
+      remote.controls.get(message3.refused)?.reject(raised(message3.error));
+      remote.controls.delete(message3.refused);
+    }
+  };
+  return { hookFor, answer: answer2 };
+}
+function devicesReplyOf(data) {
+  return data?.devicesReply;
+}
+
+// src/embedder-relay.ts
+function fresh3(bytes) {
+  return bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? bytes : bytes.slice();
+}
 function embedderAsker(port) {
   const asks = /* @__PURE__ */ new Map();
   let next3 = 0;
@@ -5107,7 +5236,7 @@ function embedderAsker(port) {
     const got = await asked.body.read().catch(() => ({ done: true, value: void 0 }));
     if (got.done) post({ id: id2, bodyEnd: true });
     else {
-      const bytes = fresh2(got.value);
+      const bytes = fresh3(got.value);
       post({ id: id2, body: bytes }, [bytes.buffer]);
     }
   };
@@ -5278,11 +5407,11 @@ function permOf(st, link2) {
     ...link2 !== void 0 ? { link: link2 } : {}
   };
 }
-function permits(cred, perm, want, directory = true) {
+function permits(cred, perm, want2, directory = true) {
   const mode = perm.mode ?? (directory ? 493 : 420);
-  if (cred.euid === 0) return (want & X_OK) === 0 || directory || (mode & 73) !== 0;
+  if (cred.euid === 0) return (want2 & X_OK) === 0 || directory || (mode & 73) !== 0;
   const shift = cred.euid === perm.uid ? 6 : inGroup(cred, perm.gid) ? 3 : 0;
-  return (mode >> shift & want) === want;
+  return (mode >> shift & want2) === want2;
 }
 function sticky(cred, dir, entry) {
   if (cred.euid === 0 || ((dir.mode ?? 0) & S_ISVTX) === 0) return true;
@@ -5357,27 +5486,27 @@ async function present(fs, path, directory) {
   const st = await fs.lstat(path).catch(() => void 0);
   return st !== void 0 && (!directory || st.isDirectory);
 }
-async function finalOf(fs, walked, want, options) {
+async function finalOf(fs, walked, want2, options) {
   const perm = walked.perm;
   if (options.follow === false && perm.link !== void 0) {
     return [{ ...perm, mode: 511 }, false];
   }
-  if ((want & X_OK) === 0 || options.directory !== void 0) {
+  if ((want2 & X_OK) === 0 || options.directory !== void 0) {
     return [perm, options.directory !== false];
   }
   const look = options.follow === false ? fs.lstat : fs.stat;
   const st = await look.call(fs, walked.path).catch(() => void 0);
   return st ? [permOf(st), st.isDirectory] : [perm, false];
 }
-async function access(fs, cred, path, want, options = {}) {
+async function access(fs, cred, path, want2, options = {}) {
   const walked = await walk(fs, cred, path, options.follow !== false, options.links);
   if (walked.denied !== void 0) {
     if (walked.link || await present(fs, walked.denied, true)) return walked;
     return { path, perm: void 0, missing: true };
   }
   if (!walked.perm) return { ...walked, missing: true };
-  const [perm, directory] = await finalOf(fs, walked, want, options);
-  if (want === 0 || permits(cred, perm, want, directory)) return walked;
+  const [perm, directory] = await finalOf(fs, walked, want2, options);
+  if (want2 === 0 || permits(cred, perm, want2, directory)) return walked;
   if (await present(fs, walked.path, false)) return { ...walked, denied: walked.path };
   return { ...walked, missing: true };
 }
@@ -5483,11 +5612,11 @@ function ttyOpenable(g, tty) {
   if (!g || !tty.owner || permits(g.cred, tty.owner, R_OK | W_OK, false)) return;
   deny(g, "open", tty.name ?? "/dev/tty");
 }
-async function need(g, op, path, want, options = {}, shown2 = path) {
-  if (want & W_OK && shown2 === path) await fence(g, op, path);
-  const walked = await access(g.fs, g.cred, path, want, linked(g, options));
+async function need(g, op, path, want2, options = {}, shown2 = path) {
+  if (want2 & W_OK && shown2 === path) await fence(g, op, path);
+  const walked = await access(g.fs, g.cred, path, want2, linked(g, options));
   if (walked.denied !== void 0) deny(g, op, walked.link ? walked.denied : shown2);
-  else if (want & R_OK && g.fs.commandTarget) await readsAs(g, op, walked.path, shown2);
+  else if (want2 & R_OK && g.fs.commandTarget) await readsAs(g, op, walked.path, shown2);
   return walked;
 }
 async function readsAs(g, op, path, shown2) {
@@ -5636,10 +5765,10 @@ async function creatable(g, op, path) {
   const target = await need(g, op, path, 0);
   if (target.denied === void 0) await need(g, op, parentOf5(target.path), W_OK | X_OK, DIR, path);
 }
-async function openable(g, op, path, want, create) {
+async function openable(g, op, path, want2, create) {
   const st = create ? await g.fs.stat(path).catch(() => void 0) : void 0;
   if (create && !st) return creatable(g, op, path);
-  await need(g, op, path, want, { directory: st?.isDirectory ?? false });
+  await need(g, op, path, want2, { directory: st?.isDirectory ?? false });
 }
 
 // src/kernel/cred.ts
@@ -6080,8 +6209,8 @@ var FdTable = class _FdTable {
   }
   stdioTerminal() {
     for (const fd of [0, 1, 2]) {
-      const tty = this.fds.get(fd)?.file.tty;
-      if (tty) return tty;
+      const file = this.fds.get(fd)?.file;
+      if (file?.tty && !file.device) return file.tty;
     }
     return void 0;
   }
@@ -6382,13 +6511,13 @@ function addressBits(host) {
 function parsePrefix(text) {
   const parts2 = text.trim().split("/");
   if (parts2.length > 2) return void 0;
-  const [address = "", size] = parts2;
-  const parsed2 = addressBits(address);
-  if (!parsed2) return void 0;
-  const max = parsed2.v6 ? 128 : 32;
+  const [address2 = "", size] = parts2;
+  const parsed3 = addressBits(address2);
+  if (!parsed3) return void 0;
+  const max = parsed3.v6 ? 128 : 32;
   const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
   if (length2 < 0 || length2 > max) return void 0;
-  return { ...parsed2, length: length2 };
+  return { ...parsed3, length: length2 };
 }
 function within4(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
@@ -6414,10 +6543,10 @@ var Routes = class {
     this.ipv6 = ipv62;
   }
   set(table) {
-    const parsed2 = (table.prefixes ?? []).map(parsePrefix);
-    const bad = (table.prefixes ?? []).find((_, i) => !parsed2[i]);
+    const parsed3 = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed3[i]);
     if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
-    this.table = parsed2;
+    this.table = parsed3;
     this.exit = table.exit === true;
   }
   classify(host) {
@@ -6953,10 +7082,10 @@ var KernelSocket = class _KernelSocket {
       }
     };
     let made2;
-    const abandon = () => {
+    const abandon2 = () => {
       if (!keeps(signal.reason)) view2.close();
     };
-    signal.addEventListener("abort", abandon, { once: true });
+    signal.addEventListener("abort", abandon2, { once: true });
     try {
       made2 = await make(view2);
     } catch (err) {
@@ -6969,7 +7098,7 @@ var KernelSocket = class _KernelSocket {
       throw signal.aborted ? signal.reason : err;
     } finally {
       handshaking = false;
-      signal.removeEventListener("abort", abandon);
+      signal.removeEventListener("abort", abandon2);
     }
     const plain3 = uplinkLink(made2.conn, (err) => {
       this.reset = err instanceof KernelError && err.code === "EPROTO" ? err : new KernelError("ECONNRESET");
@@ -7158,6 +7287,7 @@ var LoopbackNet = class {
   reserved = /* @__PURE__ */ new Set();
   facades = /* @__PURE__ */ new Map();
   proxyStamped;
+  stamped = /* @__PURE__ */ new Set();
   nextEphemeral = EPHEMERAL_FIRST;
   route;
   origins;
@@ -7232,6 +7362,9 @@ var LoopbackNet = class {
     this.kernelOnly(port, true);
     this.facades.set(port, name2);
   }
+  stampPeers(port) {
+    this.stamped.add(port);
+  }
   stampProxy(port) {
     this.proxyStamped = port;
   }
@@ -7240,7 +7373,7 @@ var LoopbackNet = class {
   }
   stampsPeers(addr) {
     if (addr.family !== "inet" || !isLoopback(canonicalHost(addr.host))) return false;
-    return this.facades.has(addr.port) || this.proxyStamped === addr.port;
+    return this.facades.has(addr.port) || this.stamped.has(addr.port) || this.proxyStamped === addr.port;
   }
   activate(addr, start2) {
     this.activators.set(keyOf(addr), start2);
@@ -8114,7 +8247,7 @@ var UserDb = class {
       joined(name2, extra);
       group.push({ name: name2, gid: uid, members: [] });
       passwd.push(row);
-      const fresh3 = !await this.fs.exists(home);
+      const fresh4 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
         await this.provision(row, this.umaskFor(options), shared2);
@@ -8122,7 +8255,7 @@ var UserDb = class {
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
-        if (fresh3) await this.fs.rm(home, { recursive: true, force: true });
+        if (fresh4) await this.fs.rm(home, { recursive: true, force: true });
         throw err;
       }
       remember();
@@ -8206,7 +8339,7 @@ var UserDb = class {
 };
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 16];
+var PROTOCOL = [1, 18];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -8466,8 +8599,10 @@ function hostRegistries(send2, gone, port) {
   const cdps = cdpRegistry(send2, gone);
   const facades = facadeRegistry(send2, gone);
   const requests = requestBinding(send2, port);
+  const devices = deviceBinding(send2, port);
   return {
     requests,
+    devices,
     answer(l, req) {
       if (req.op === "serve-cdp") return cdps.serve(l, req);
       if (req.op === "unserve-cdp") return cdps.drop(req.registration);
@@ -8476,6 +8611,7 @@ function hostRegistries(send2, gone, port) {
     },
     close() {
       requests.close();
+      devices.close();
       cdps.close();
       facades.close();
     }
@@ -8589,6 +8725,28 @@ function answered(pending, req, reply, detach) {
     }
   );
 }
+async function helloRefused(host, hosts, message3) {
+  return versionError(message3.protocol) ?? await hosts.requests.accept(host, message3) ?? await hosts.devices.accept(host, message3);
+}
+function deviceBinding(send2, port) {
+  const asker = devicesAsker({ postMessage: (m, t) => send2(m, t) });
+  let unbind;
+  port.addEventListener("message", (event) => {
+    const reply = devicesReplyOf(event.data);
+    if (reply) asker.answer(reply);
+  });
+  return {
+    async accept(host, hello) {
+      if (!hello.devices) return void 0;
+      if (!host.attachDevices || host.session === void 0)
+        return "EPERM: this port may not answer device opens";
+      const launcher = await host.launcher();
+      unbind = launcher.devices.register(host.session, asker.hookFor(host.session));
+      return void 0;
+    },
+    close: () => unbind?.()
+  };
+}
 function serveClient(port, host) {
   let state = "new";
   let self;
@@ -8622,9 +8780,9 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused4 = versionError(message3.protocol) ?? await hosts.requests.accept(host, message3);
-    if (refused4) {
-      send2({ hello: { protocol: PROTOCOL, error: refused4 } });
+    const refused5 = await helloRefused(host, hosts, message3);
+    if (refused5) {
+      send2({ hello: { protocol: PROTOCOL, error: refused5 } });
       detach();
       return;
     }
@@ -8908,7 +9066,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.181.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.183.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9200,10 +9358,10 @@ async function tierPackages(fs, physical, roots, bins, kernel, global) {
       const own = commandsOf(pkg, manifest);
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
-      const refused4 = engineRefusal(manifest, kernel);
+      const refused5 = engineRefusal(manifest, kernel);
       const name2 = pkg.slice(root.length + 1);
       const dependency = direct?.has(name2) === false;
-      const marks = { ...refused4 ? { refused: refused4 } : {}, ...dependency ? { dependency } : {} };
+      const marks = { ...refused5 ? { refused: refused5 } : {}, ...dependency ? { dependency } : {} };
       out.push({
         name: name2,
         pkg,
@@ -9235,7 +9393,7 @@ function winners(tier) {
   }
   return out;
 }
-async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused4, global = /* @__PURE__ */ new Set()) {
+async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused5, global = /* @__PURE__ */ new Set()) {
   const found = /* @__PURE__ */ new Map();
   const physical = physicalResolver(fs);
   const tiers = (typeof modules === "string" ? [modules] : modules).map(
@@ -9249,7 +9407,7 @@ async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, ke
   const dependencies = [];
   for (const [index, roots] of tiers.entries()) {
     const tier = await tierPackages(fs, physical, roots, index >= binsFrom, kernel, global);
-    if (refused4) refused4.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
+    if (refused5) refused5.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
     await take(tier.filter((entry) => !entry.dependency));
     dependencies.push(tier.filter((entry) => entry.dependency));
   }
@@ -9853,9 +10011,9 @@ var TAGS_VERSION = 1;
 async function readTags(fs) {
   const text = await fs.readFile(TAGS_PATH).catch(() => "");
   try {
-    const parsed2 = JSON.parse(text);
-    if (!parsed2 || typeof parsed2 !== "object") return {};
-    const { v: _, ...tables } = parsed2;
+    const parsed3 = JSON.parse(text);
+    if (!parsed3 || typeof parsed3 !== "object") return {};
+    const { v: _, ...tables } = parsed3;
     return tables;
   } catch {
     return {};
@@ -9925,27 +10083,27 @@ var Crontabs = class {
     const json5 = JSON.stringify({ v: TAGS_VERSION, ...kept });
     if (json5 === await fs.readFile(TAGS_PATH).catch(() => "")) return;
     const owner = owners ? { uid: 0, gid: 0, mode: 384 } : void 0;
-    const fresh3 = `${TAGS_PATH}.${crypto.randomUUID()}.new`;
-    await fs.writeFile(fresh3, json5, owner);
-    await fs.rename(fresh3, TAGS_PATH);
+    const fresh4 = `${TAGS_PATH}.${crypto.randomUUID()}.new`;
+    await fs.writeFile(fresh4, json5, owner);
+    await fs.rename(fresh4, TAGS_PATH);
   }
   async install(path, target, text, caller) {
     if (text.length > CRONTAB_MAX) return { error: "crontab: the table is too long" };
     const { errors } = parseCrontab(text, path);
     if (errors.length > 0) {
-      const lines2 = errors.map(({ line, message: message3 }) => `"-":${line}: ${message3}`);
-      return { error: ["crontab: errors in crontab file, cannot install", ...lines2].join("\n") };
+      const lines3 = errors.map(({ line, message: message3 }) => `"-":${line}: ${message3}`);
+      return { error: ["crontab: errors in crontab file, cannot install", ...lines3].join("\n") };
     }
     const { fs, owners } = this.o;
     if (!await fs.exists(SPOOL_DIR)) {
       await fs.mkdir(SPOOL_DIR, { recursive: true });
       if (owners) await fs.chown?.(SPOOL_DIR, { uid: 0, gid: 0, mode: 448, follow: false });
     }
-    const fresh3 = `${SPOOL_DIR}/.${target.name}.${crypto.randomUUID()}.new`;
+    const fresh4 = `${SPOOL_DIR}/.${target.name}.${crypto.randomUUID()}.new`;
     const owner = owners ? { uid: target.uid, gid: target.gid, mode: 384 } : void 0;
     await this.retag(path, text, caller);
-    await fs.writeFile(fresh3, text, owner);
-    await fs.rename(fresh3, path);
+    await fs.writeFile(fresh4, text, owner);
+    await fs.rename(fresh4, path);
     return { text: "" };
   }
 };
@@ -10266,15 +10424,15 @@ var UnlinkedKeeper = class {
     const releases = [];
     const take = async () => {
       for (; ; ) {
-        const fresh3 = [...this.heldWithin(target).keys()].filter((path) => !paths.includes(path));
-        if (fresh3.length === 0) return;
-        fresh3.sort();
-        if (paths.some((path) => path > fresh3[0])) {
+        const fresh4 = [...this.heldWithin(target).keys()].filter((path) => !paths.includes(path));
+        if (fresh4.length === 0) return;
+        fresh4.sort();
+        if (paths.some((path) => path > fresh4[0])) {
           for (const release of releases.splice(0)) release();
-          fresh3.push(...paths.splice(0));
-          fresh3.sort();
+          fresh4.push(...paths.splice(0));
+          fresh4.sort();
         }
-        for (const path of fresh3) {
+        for (const path of fresh4) {
           paths.push(path);
           releases.push(await this.gate.acquire(path));
         }
@@ -10670,10 +10828,10 @@ var Output = class {
 };
 function readStamp(text) {
   try {
-    const parsed2 = JSON.parse(text ?? "");
-    const jobs = parsed2.jobs && typeof parsed2.jobs === "object" ? parsed2.jobs : {};
-    const reboot = parsed2.reboot && typeof parsed2.reboot === "object" ? parsed2.reboot : {};
-    const when = parsed2.when && typeof parsed2.when === "object" ? parsed2.when : {};
+    const parsed3 = JSON.parse(text ?? "");
+    const jobs = parsed3.jobs && typeof parsed3.jobs === "object" ? parsed3.jobs : {};
+    const reboot = parsed3.reboot && typeof parsed3.reboot === "object" ? parsed3.reboot : {};
+    const when = parsed3.when && typeof parsed3.when === "object" ? parsed3.when : {};
     return { jobs: { ...jobs }, reboot: { ...reboot }, when: { ...when } };
   } catch {
     return { jobs: {}, reboot: {}, when: {} };
@@ -10793,10 +10951,10 @@ var CronService = class {
     const text = JSON.stringify(stamp);
     const old = await fs.readFile(STAMP_PATH).catch(() => void 0);
     if (old === text || old === void 0 && text === EMPTY_STAMP) return;
-    const fresh3 = `${STAMP_PATH}.new`;
+    const fresh4 = `${STAMP_PATH}.new`;
     const owner = owners ? { uid: 0, gid: 0, mode: 384 } : void 0;
-    await fs.writeFile(fresh3, text, owner);
-    await fs.rename(fresh3, STAMP_PATH);
+    await fs.writeFile(fresh4, text, owner);
+    await fs.rename(fresh4, STAMP_PATH);
   }
   async load() {
     const { fs } = this.host;
@@ -10849,10 +11007,10 @@ var CronService = class {
     await this.once(path, text, errors);
     return table;
   }
-  async once(path, version, lines2) {
+  async once(path, version, lines3) {
     if (this.reported.get(path) === version) return;
     this.reported.set(path, version);
-    for (const line of lines2) await this.error(line);
+    for (const line of lines3) await this.error(line);
   }
   async error(line) {
     if (this.stopping.signal.aborted) return;
@@ -11086,8 +11244,8 @@ function canonicalHost2(host) {
 function localV4(a, b) {
   return a === 127 || a === 0 || a === 169 && b === 254;
 }
-function hextets(address) {
-  const [head, tail2, extra] = address.split("::");
+function hextets(address2) {
+  const [head, tail2, extra] = address2.split("::");
   if (extra !== void 0) return void 0;
   const part = (text) => text ? text.split(":").map((h) => Number.parseInt(h, 16)) : [];
   const front = part(head);
@@ -11095,8 +11253,8 @@ function hextets(address) {
   const groups = tail2 === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
   return groups.length === 8 && groups.every((g) => g >= 0 && g <= 65535) ? groups : void 0;
 }
-function localV6(address) {
-  const g = hextets(address);
+function localV6(address2) {
+  const g = hextets(address2);
   if (!g) return true;
   if ((g[0] & 65472) === 65152) return true;
   const zeroPrefix = g.slice(0, 5).every((x) => x === 0);
@@ -11469,8 +11627,8 @@ var RealmProxy = class {
   }
   async connect(conn, incoming, req, idle2) {
     const target = tunnelTarget(req);
-    const refused4 = target.port === 443 ? await this.tunnelReady(target) : void 0;
-    if (refused4) throw refused4;
+    const refused5 = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused5) throw refused5;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
       const first = await incoming.peek(this.stop.signal);
@@ -11914,15 +12072,15 @@ async function followLinks(fs, path) {
 }
 var NOBODY = { ruid: -1, euid: -1, suid: -1, rgid: -1, egid: -1, sgid: -1, groups: [] };
 var EMPTY2 = new Uint8Array(0);
-function quiet(promise) {
+function quiet2(promise) {
   return promise.catch(() => void 0);
 }
 async function readsAs2(fs, cred, target) {
-  const walked = await quiet(access(fs, cred, target, R_OK, { directory: false }));
+  const walked = await quiet2(access(fs, cred, target, R_OK, { directory: false }));
   return walked !== void 0 && walked.denied === void 0 && !walked.missing;
 }
 async function shownTarget(fs, target) {
-  const st = await quiet(fs.stat(target));
+  const st = await quiet2(fs.stat(target));
   return st?.isFile && await readsAs2(fs, NOBODY, target) ? st : void 0;
 }
 async function madeFor(owner, virtual) {
@@ -12245,10 +12403,10 @@ var FreshModules = class {
     this.fresh.set(key, { umask: mask, pid, added: 0, setup: mask !== DEFAULT_UMASK });
   }
   forget(pid) {
-    for (const [path, fresh3] of this.fresh) if (fresh3.pid === pid) this.fresh.delete(path);
+    for (const [path, fresh4] of this.fresh) if (fresh4.pid === pid) this.fresh.delete(path);
   }
-  drop(fresh3) {
-    for (const [key, note] of [...this.fresh]) if (note === fresh3) this.fresh.delete(key);
+  drop(fresh4) {
+    for (const [key, note] of [...this.fresh]) if (note === fresh4) this.fresh.delete(key);
   }
   moved(from, to) {
     const source = normalizePath(from);
@@ -12257,10 +12415,10 @@ var FreshModules = class {
     for (const key of [...this.fresh.keys()]) {
       if (key === target || within6(key, target)) this.fresh.delete(key);
     }
-    for (const [key, fresh3] of [...this.fresh]) {
+    for (const [key, fresh4] of [...this.fresh]) {
       if (key !== source && !within6(key, source)) continue;
       this.fresh.delete(key);
-      this.fresh.set(target + key.slice(source.length), fresh3);
+      this.fresh.set(target + key.slice(source.length), fresh4);
     }
   }
   wrap(fs) {
@@ -12270,15 +12428,15 @@ var FreshModules = class {
     };
     const decide = async (given, known) => {
       const path = normalizePath(given);
-      const fresh3 = this.fresh.get(path);
-      if (!fresh3) return;
+      const fresh4 = this.fresh.get(path);
+      if (!fresh4) return;
       const bytes = known && known.length >= MAGIC.length ? known : await head(path);
-      const want = isModule(bytes) ? 73 & ~fresh3.umask : 0;
-      fresh3.setup = false;
-      if (want === fresh3.added) return;
+      const want2 = isModule(bytes) ? 73 & ~fresh4.umask : 0;
+      fresh4.setup = false;
+      if (want2 === fresh4.added) return;
       const mode = (await fs.stat(path)).mode & 4095;
-      await fs.chmod(path, mode & ~fresh3.added | want);
-      fresh3.added = want;
+      await fs.chmod(path, mode & ~fresh4.added | want2);
+      fresh4.added = want2;
     };
     const overrides = {
       writeFile: async (path, content, owner) => {
@@ -12291,9 +12449,9 @@ var FreshModules = class {
         }
       },
       chmod: async (path, mode) => {
-        const fresh3 = this.fresh.get(normalizePath(path));
-        if (fresh3?.setup && (mode & 4095) === (438 & ~fresh3.umask)) fresh3.setup = false;
-        else if (fresh3) this.drop(fresh3);
+        const fresh4 = this.fresh.get(normalizePath(path));
+        if (fresh4?.setup && (mode & 4095) === (438 & ~fresh4.umask)) fresh4.setup = false;
+        else if (fresh4) this.drop(fresh4);
         await fs.chmod(path, mode);
       },
       rm: async (path, options) => {
@@ -12310,16 +12468,16 @@ var FreshModules = class {
       link: async (from, to, follow2) => {
         await fs.link(from, to, follow2);
         const source = follow2 && fs.realpath ? await fs.realpath(from, true).catch(() => from) : from;
-        const fresh3 = this.fresh.get(normalizePath(source));
-        if (fresh3) this.fresh.set(normalizePath(to), fresh3);
+        const fresh4 = this.fresh.get(normalizePath(source));
+        if (fresh4) this.fresh.set(normalizePath(to), fresh4);
       }
     };
     const { append } = fs;
     if (append) {
       overrides.append = async (path, bytes, options) => {
-        const fresh3 = this.fresh.has(normalizePath(path));
+        const fresh4 = this.fresh.has(normalizePath(path));
         const end = await append.call(fs, path, bytes, options);
-        if (fresh3 && end - bytes.length < MAGIC.length) await decide(path);
+        if (fresh4 && end - bytes.length < MAGIC.length) await decide(path);
         return end;
       };
     }
@@ -12646,7 +12804,7 @@ var FsWatchers = class {
     };
     const content = (run2, types) => async (...args) => {
       const at = normalizePath(args[0]);
-      const fresh3 = this.covers(at) && !await fs.exists(at).catch(() => true);
+      const fresh4 = this.covers(at) && !await fs.exists(at).catch(() => true);
       let done5 = false;
       try {
         await run2(...args);
@@ -12655,11 +12813,11 @@ var FsWatchers = class {
         const real = await realOf(at);
         const paths = real === at ? [at] : [at, real];
         this.report(paths);
-        if (done5) for (const type of types(fresh3, args)) this.emit(type, paths);
+        if (done5) for (const type of types(fresh4, args)) this.emit(type, paths);
       }
     };
-    const written2 = (fresh3) => fresh3 ? ["rename", "change"] : ["change"];
-    const overwritten = (fresh3, args) => fresh3 || args[1].length === 0 ? written2(fresh3) : ["change", "change"];
+    const written2 = (fresh4) => fresh4 ? ["rename", "change"] : ["change"];
+    const overwritten = (fresh4, args) => fresh4 || args[1].length === 0 ? written2(fresh4) : ["change", "change"];
     const reshaping = (run2) => async (...args) => {
       this.reshaped();
       try {
@@ -12692,14 +12850,14 @@ var FsWatchers = class {
             if (created4.length > 0 || !await fs.exists(ancestor)) created4.push(ancestor);
           }
         }
-        const fresh3 = !options?.recursive || this.typed.size > 0 && !await fs.exists(path);
+        const fresh4 = !options?.recursive || this.typed.size > 0 && !await fs.exists(path);
         let done5 = false;
         try {
           await fs.mkdir(path, options);
           done5 = true;
         } finally {
           this.report([...created4, path]);
-          if (done5) this.emit("rename", fresh3 ? [...created4, path] : created4);
+          if (done5) this.emit("rename", fresh4 ? [...created4, path] : created4);
         }
       },
       rm: reshaping(async (path, options) => {
@@ -13209,15 +13367,15 @@ function embedderFailure(err) {
   return new KernelError(ERRNOS[String(name2)] ?? "EIO", lineOf2(err));
 }
 function headerOf(bytes) {
-  let parsed2;
+  let parsed3;
   try {
-    parsed2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    parsed3 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
   } catch {
     throw new KernelError("EINVAL", "the request header is not JSON");
   }
-  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2))
+  if (typeof parsed3 !== "object" || parsed3 === null || Array.isArray(parsed3))
     throw new KernelError("EINVAL", "the request header is not an object");
-  const { kind, ...options } = parsed2;
+  const { kind, ...options } = parsed3;
   if (typeof kind !== "string" || kind.length > 64 || !KIND.test(kind))
     throw new KernelError("EINVAL", "the request has no valid kind");
   return { kind, options };
@@ -13644,6 +13802,966 @@ var EmbedderBroker = class {
   }
 };
 
+// src/kernel/serial-ioctl.ts
+var IOCTL = {
+  TCGETS: 21505,
+  TCSETS: 21506,
+  TCSETSW: 21507,
+  TCSETSF: 21508,
+  TCSBRK: 21513,
+  TCFLSH: 21515,
+  TIOCEXCL: 21516,
+  TIOCNXCL: 21517,
+  TIOCSCTTY: 21518,
+  TIOCGPGRP: 21519,
+  TIOCSPGRP: 21520,
+  TIOCOUTQ: 21521,
+  TIOCGWINSZ: 21523,
+  TIOCSWINSZ: 21524,
+  TIOCMGET: 21525,
+  TIOCMBIS: 21526,
+  TIOCMBIC: 21527,
+  TIOCMSET: 21528,
+  FIONREAD: 21531,
+  TIOCNOTTY: 21538,
+  TCSBRKP: 21541,
+  TIOCSBRK: 21543,
+  TIOCCBRK: 21544,
+  TCGETS2: 2150388778,
+  TCSETS2: 1076646955,
+  TCSETSW2: 1076646956,
+  TCSETSF2: 1076646957
+};
+var TERMIOS_GETS = /* @__PURE__ */ new Set([IOCTL.TCGETS, IOCTL.TCGETS2]);
+var TERMIOS_SETS = /* @__PURE__ */ new Set([
+  IOCTL.TCSETS,
+  IOCTL.TCSETSW,
+  IOCTL.TCSETSF,
+  IOCTL.TCSETS2,
+  IOCTL.TCSETSW2,
+  IOCTL.TCSETSF2
+]);
+var INT_OUT = /* @__PURE__ */ new Set([
+  IOCTL.TIOCMGET,
+  IOCTL.FIONREAD,
+  IOCTL.TIOCOUTQ
+]);
+var INT_IN = /* @__PURE__ */ new Set([
+  IOCTL.TIOCMBIS,
+  IOCTL.TIOCMBIC,
+  IOCTL.TIOCMSET
+]);
+var INT_ARG = /* @__PURE__ */ new Set([IOCTL.TCSBRK, IOCTL.TCSBRKP, IOCTL.TCFLSH]);
+var TIOCM = {
+  DTR: 2,
+  RTS: 4,
+  CTS: 32,
+  CD: 64,
+  RI: 128,
+  DSR: 256
+};
+var CBAUD = 4111;
+var BOTHER = 4096;
+var IBSHIFT = 16;
+var CSIZE = 48;
+var CSTOPB = 64;
+var PARENB = 256;
+var PARODD = 512;
+var CRTSCTS = 2147483648;
+var SPEEDS = [
+  0,
+  50,
+  75,
+  110,
+  134,
+  150,
+  200,
+  300,
+  600,
+  1200,
+  1800,
+  2400,
+  4800,
+  9600,
+  19200,
+  38400
+];
+var FAST = [
+  0,
+  57600,
+  115200,
+  230400,
+  460800,
+  5e5,
+  576e3,
+  921600,
+  1e6,
+  1152e3,
+  15e5,
+  2e6,
+  25e5,
+  3e6,
+  35e5,
+  4e6
+];
+function speedOf(code) {
+  if (code === BOTHER) return void 0;
+  return code & BOTHER ? FAST[code & 15] : SPEEDS[code & 15];
+}
+function speedsOf(termios, current, extended) {
+  const out = termios.c_cflag & CBAUD;
+  const ospeed = speedOf(out) ?? (extended ? (termios.c_ospeed ?? current.ospeed) >>> 0 : current.ospeed);
+  const inCode = termios.c_cflag >>> IBSHIFT & CBAUD;
+  if (inCode === 0) return { ispeed: ospeed, ospeed };
+  const ispeed = speedOf(inCode) ?? (extended ? (termios.c_ispeed ?? current.ispeed) >>> 0 : current.ispeed);
+  return { ispeed, ospeed };
+}
+function settingsOf(cflag, baudRate) {
+  return {
+    baudRate,
+    dataBits: 5 + ((cflag & CSIZE) >> 4),
+    parity: cflag & PARENB ? cflag & PARODD ? "odd" : "even" : "none",
+    stopBits: cflag & CSTOPB ? 2 : 1,
+    flowControl: cflag & CRTSCTS ? "hardware" : "none"
+  };
+}
+function sameSettings(a, b) {
+  return a.baudRate === b.baudRate && a.dataBits === b.dataBits && a.parity === b.parity && a.stopBits === b.stopBits && a.flowControl === b.flowControl;
+}
+var SERIAL_CFLAG = 13 | 48 | 128 | 1024 | 2048;
+var SERIAL_LFLAG = 16 | 32 | 512 | 2048;
+var SERIAL_OFLAG = 4;
+
+// src/kernel/tty.ts
+var ICRNL = 256;
+var IUTF8 = 16384;
+var OPOST = 1;
+var ONLCR = 4;
+var ISIG = 1;
+var ICANON = 2;
+var ECHO = 8;
+var ECHOE = 16;
+var ECHOCTL = 512;
+var NOFLSH = 128;
+var IEXTEN = 32768;
+var VINTR = 0;
+var VQUIT = 1;
+var VERASE = 2;
+var VKILL = 3;
+var VEOF = 4;
+var VSUSP = 10;
+var VWERASE = 14;
+function defaultTermios() {
+  const cCc = new Array(32).fill(0);
+  Object.assign(cCc, { [VINTR]: 3, [VQUIT]: 28, [VERASE]: 127, [VKILL]: 21 });
+  Object.assign(cCc, { [VEOF]: 4, 6: 1, 8: 17, 9: 19, [VSUSP]: 26 });
+  Object.assign(cCc, { 12: 18, 13: 15, [VWERASE]: 23, 15: 22 });
+  return {
+    c_iflag: ICRNL | 1024 | 8192 | IUTF8,
+    c_oflag: OPOST | ONLCR,
+    c_cflag: 15 | 48 | 128,
+    c_lflag: ISIG | ICANON | ECHO | ECHOE | 32 | ECHOCTL | 2048 | IEXTEN,
+    c_cc: cCc
+  };
+}
+var encoder3 = new TextEncoder();
+function isContinuation(byte) {
+  return (byte & 192) === 128;
+}
+var KernelTty = class {
+  termios = defaultTermios();
+  cols = 80;
+  rows = 24;
+  readable = [];
+  line = [];
+  waiters = [];
+  hungUp = false;
+  name;
+  owner;
+  onRead;
+  readers = 0;
+  screen;
+  signal;
+  constructor(screen, signal) {
+    this.screen = screen;
+    this.signal = signal;
+  }
+  receive(bytes) {
+    const { c_iflag, c_lflag } = this.termios;
+    if (!(c_iflag & ICRNL) && !(c_lflag & (ISIG | ICANON | ECHO))) {
+      if (bytes.length > 0) this.readable.push(bytes.slice());
+    } else for (const byte of bytes) this.key(byte);
+    this.wake();
+  }
+  resize(cols, rows) {
+    if (cols === this.cols && rows === this.rows) return;
+    this.setSize(cols, rows);
+    this.signal(SIG.WINCH);
+  }
+  hangup() {
+    this.hungUp = true;
+    this.wake();
+  }
+  signalHangup() {
+    this.signal(SIG.HUP);
+  }
+  setSize(cols, rows) {
+    this.cols = cols;
+    this.rows = rows;
+  }
+  tcgets() {
+    return { ...this.termios, c_cc: [...this.termios.c_cc] };
+  }
+  tcsets(termios, flush = false) {
+    const wasCanonical = this.canonical;
+    this.termios = { ...termios, c_cc: [...termios.c_cc] };
+    if (flush) {
+      this.line = [];
+      this.readable = [];
+    }
+    if (wasCanonical && !this.canonical && this.line.length > 0) {
+      this.readable.push(Uint8Array.from(this.line));
+      this.line = [];
+      this.wake();
+    }
+  }
+  winsize() {
+    return [this.rows, this.cols];
+  }
+  file() {
+    return new OpenFile({
+      read: (max, signal) => this.read(max, signal),
+      write: async (bytes) => {
+        if (this.hungUp) throw new KernelError("EIO");
+        this.output(bytes);
+        return bytes.length;
+      },
+      poll: () => ({
+        readable: this.readable.length > 0 || this.hungUp,
+        writable: true,
+        hangup: this.hungUp,
+        nread: this.readable.reduce((n, chunk2) => n + (chunk2?.length ?? 0), 0)
+      }),
+      changed: (signal) => this.changed(signal),
+      close: () => {
+      },
+      tty: this
+    });
+  }
+  get canonical() {
+    return (this.termios.c_lflag & ICANON) !== 0;
+  }
+  cc(slot2) {
+    return this.termios.c_cc[slot2] ?? 0;
+  }
+  key(input) {
+    const { c_iflag, c_lflag } = this.termios;
+    const byte = input === 13 && c_iflag & ICRNL ? 10 : input;
+    if (c_lflag & ISIG && this.signalKey(byte)) return;
+    if (!this.canonical) {
+      this.readable.push(Uint8Array.of(byte));
+      if (c_lflag & ECHO) this.echo(byte);
+      return;
+    }
+    this.edit(byte);
+  }
+  signalKey(byte) {
+    const sig = byte === this.cc(VINTR) ? SIG.INT : byte === this.cc(VQUIT) ? SIG.QUIT : byte === this.cc(VSUSP) ? SIG.TSTP : 0;
+    if (!sig || byte === 0) return false;
+    if (this.termios.c_lflag & ECHO) this.echo(byte);
+    if (!(this.termios.c_lflag & NOFLSH)) {
+      this.line = [];
+      this.readable = [];
+    }
+    this.signal(sig);
+    return true;
+  }
+  edit(byte) {
+    const echo = (this.termios.c_lflag & ECHO) !== 0;
+    if (byte === this.cc(VERASE) || byte === 8) {
+      this.rubOut(this.lastCharLength());
+    } else if (byte === this.cc(VKILL)) {
+      this.rubOut(this.line.length);
+    } else if (byte === this.cc(VWERASE)) {
+      this.rubOut(this.lastWordLength());
+    } else if (byte === this.cc(VEOF)) {
+      this.readable.push(this.line.length > 0 ? Uint8Array.from(this.line) : null);
+      this.line = [];
+    } else if (byte === 10) {
+      this.line.push(byte);
+      this.readable.push(Uint8Array.from(this.line));
+      this.line = [];
+      if (echo) this.output(encoder3.encode("\n"));
+    } else {
+      this.line.push(byte);
+      if (echo) this.echo(byte);
+    }
+  }
+  lastWordLength() {
+    let end = this.line.length;
+    while (end > 0 && this.line[end - 1] === 32) end--;
+    while (end > 0 && this.line[end - 1] !== 32) end--;
+    return this.line.length - end;
+  }
+  lastCharLength() {
+    const { line } = this;
+    let n = Math.min(1, line.length);
+    if (this.termios.c_iflag & IUTF8) {
+      while (n < line.length && isContinuation(line[line.length - n] ?? 0)) n++;
+    }
+    return n;
+  }
+  rubOut(n) {
+    const dropped2 = this.line.splice(this.line.length - n, n);
+    const utf83 = (this.termios.c_iflag & IUTF8) !== 0;
+    const cells = utf83 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
+    if (cells > 0 && this.termios.c_lflag & ECHO) {
+      this.output(encoder3.encode("\b \b".repeat(cells)), false);
+    }
+  }
+  echo(byte) {
+    if (byte < 32 && byte !== 10 && byte !== 9 && this.termios.c_lflag & ECHOCTL) {
+      this.output(Uint8Array.of(94, byte + 64), false);
+      return;
+    }
+    this.output(Uint8Array.of(byte));
+  }
+  output(bytes, translate2 = true) {
+    const { c_oflag } = this.termios;
+    if (!translate2 || !(c_oflag & OPOST && c_oflag & ONLCR) || !bytes.includes(10)) {
+      this.screen.write(bytes);
+      return;
+    }
+    const out = [];
+    for (const byte of bytes) {
+      if (byte === 10) out.push(13);
+      out.push(byte);
+    }
+    this.screen.write(Uint8Array.from(out));
+  }
+  get reading() {
+    return this.readers > 0;
+  }
+  async read(max, signal) {
+    this.onRead?.();
+    this.readers++;
+    try {
+      return await this.take(max, signal);
+    } finally {
+      this.readers--;
+    }
+  }
+  async take(max, signal) {
+    while (this.readable.length === 0) {
+      if (this.hungUp) return new Uint8Array(0);
+      await this.changed(signal);
+    }
+    const head = this.readable[0];
+    if (head === null) {
+      this.readable.shift();
+      return new Uint8Array(0);
+    }
+    if (head === void 0) return new Uint8Array(0);
+    const chunks = [];
+    let n = 0;
+    while (this.readable.length > 0 && n < max) {
+      const next3 = this.readable[0];
+      if (next3 === null || next3 === void 0) break;
+      const take = next3.subarray(0, max - n);
+      chunks.push(take);
+      n += take.length;
+      if (take.length < next3.length) this.readable[0] = next3.subarray(take.length);
+      else this.readable.shift();
+      if (this.canonical) break;
+    }
+    const out = new Uint8Array(n);
+    let at = 0;
+    for (const chunk2 of chunks) {
+      out.set(chunk2, at);
+      at += chunk2.length;
+    }
+    return out;
+  }
+  changed(signal) {
+    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve2, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new KernelError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve2();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve2 of waiters) resolve2();
+  }
+};
+
+// src/kernel/devices.ts
+var DEVICE_NAME = /^tty(USB|ACM)(\d{1,3})$/;
+var BY_ID = "/dev/serial/by-id";
+var LINK_NAME = /^[A-Za-z0-9._:+@=,-]{1,255}$/;
+var MAJORS = { USB: 188, ACM: 166 };
+var HIGH_WATER = 64 * 1024;
+var CLOSING_WAIT_MS = 3e4;
+var BREAK_MS = 250;
+var MAX_ID2 = 4294967294;
+var DEFAULT_SETTINGS = settingsOf(SERIAL_CFLAG, 9600);
+function refused2(code, text) {
+  return Object.assign(new Error(`${code}: ${text}`), { code });
+}
+function invalid(what) {
+  return refused2("EINVAL", what);
+}
+function nodePath(path) {
+  if (typeof path !== "string") throw invalid("path must be a string");
+  const name2 = path.startsWith("/dev/") ? path.slice(5) : path;
+  const m = DEVICE_NAME.exec(name2);
+  const minor = Number(m?.[2]);
+  if (!m || minor > 255) throw invalid(`not a serial device name: ${path}`);
+  return { path: `/dev/${name2}`, major: MAJORS[m[1]], minor };
+}
+function linkPath(link2) {
+  if (typeof link2 !== "string") throw invalid("a link must be a string");
+  const name2 = link2.startsWith(`${BY_ID}/`) ? link2.slice(BY_ID.length + 1) : link2;
+  if (!LINK_NAME.test(name2) || name2 === "." || name2 === "..")
+    throw invalid(`not a link name: ${link2}`);
+  return `${BY_ID}/${name2}`;
+}
+function modeOf(mode) {
+  if (mode === void 0) return 384;
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095)
+    throw invalid("mode must be permission bits");
+  return mode;
+}
+async function idOf(value2, find) {
+  if (value2 === void 0) return 0;
+  if (typeof value2 === "number") {
+    if (!Number.isInteger(value2) || value2 < 0 || value2 > MAX_ID2) throw invalid(`bad id ${value2}`);
+    return value2;
+  }
+  const id2 = typeof value2 === "string" ? await find(value2) : void 0;
+  if (id2 === void 0) throw invalid(`unknown owner or group ${String(value2)}`);
+  return id2;
+}
+function quiet3() {
+  return void 0;
+}
+function want(access2) {
+  return access2 === "read" ? R_OK : access2 === "write" ? W_OK : R_OK | W_OK;
+}
+function checkMeta(node, change, uid, gid, guard2) {
+  const { cred } = guard2;
+  const owner = cred.euid === 0 || cred.euid === node.uid;
+  const member = cred.egid === gid || cred.groups.includes(gid);
+  const chown2 = uid !== node.uid || gid !== node.gid;
+  const times = (change.atimeMs ?? change.mtimeMs ?? null) !== null;
+  if (change.mode !== void 0 && !owner) deny(guard2, "chmod", node.path, "EPERM");
+  if (chown2 && cred.euid !== 0 && (uid !== node.uid || !owner || !member))
+    deny(guard2, "chown", node.path, "EPERM");
+  if (times && !owner && !(change.now && permits(cred, node, W_OK, false)))
+    deny(guard2, "utimes", node.path, change.now ? "EACCES" : "EPERM");
+}
+var DeviceNodes = class {
+  hooks = /* @__PURE__ */ new Map();
+  nodes = /* @__PURE__ */ new Map();
+  links = /* @__PURE__ */ new Map();
+  lookup;
+  users;
+  next = 0;
+  constructor(users, lookup2) {
+    this.users = users;
+    this.lookup = lookup2;
+  }
+  register(client, hook) {
+    this.hooks.set(client, hook);
+    return () => {
+      if (this.hooks.get(client) !== hook) return;
+      this.hooks.delete(client);
+      for (const node of [...this.nodes.values()]) if (node.client === client) this.drop(node);
+    };
+  }
+  async add(spec, client) {
+    if (typeof spec !== "object" || spec === null) throw invalid("add needs a spec");
+    const { path, major, minor } = nodePath(spec.path);
+    const mode = modeOf(spec.mode);
+    if (spec.links !== void 0 && !Array.isArray(spec.links))
+      throw invalid("links must be a list");
+    const links = (spec.links ?? []).map(linkPath);
+    const uid = await idOf(spec.owner, (name2) => this.lookup.userId(name2));
+    const gid = await idOf(spec.group, (name2) => this.lookup.groupId(name2));
+    if (!this.hooks.has(client)) throw refused2("ENOTSUP", "this client has no devices hook");
+    if (this.nodes.has(path)) throw refused2("EEXIST", `${path} exists`);
+    const taken = links.find((l, i) => this.links.has(l) || links.indexOf(l) !== i);
+    if (taken !== void 0) throw refused2("EEXIST", `${taken} exists`);
+    const node = {
+      id: ++this.next,
+      client,
+      path,
+      uid,
+      gid,
+      mode,
+      major,
+      minor,
+      links,
+      opening: false,
+      atimeMs: Date.now(),
+      mtimeMs: Date.now(),
+      ctimeMs: Date.now()
+    };
+    this.nodes.set(path, node);
+    for (const link2 of links) this.links.set(link2, node);
+    return node.id;
+  }
+  remove(id2) {
+    const node = [...this.nodes.values()].find((n) => n.id === id2);
+    if (!node) return false;
+    this.drop(node);
+    return true;
+  }
+  drop(node) {
+    this.nodes.delete(node.path);
+    for (const link2 of node.links) this.links.delete(link2);
+    node.channel?.lost(new KernelError("EIO", `${node.path} was removed`));
+  }
+  list() {
+    return [...this.nodes.values()].sort((a, b) => a.path < b.path ? -1 : 1).map(({ path, uid, gid, mode, major, minor, links, atimeMs, mtimeMs, ctimeMs }) => ({
+      path,
+      uid,
+      gid,
+      mode,
+      major,
+      minor,
+      links: [...links],
+      atimeMs,
+      mtimeMs,
+      ctimeMs
+    }));
+  }
+  meta(path, change, guard2) {
+    const node = this.find(path);
+    if (!node) throw new KernelError("ENOENT");
+    const uid = change.uid === void 0 || change.uid === -1 ? node.uid : change.uid >>> 0;
+    const gid = change.gid === void 0 || change.gid === -1 ? node.gid : change.gid >>> 0;
+    if (guard2) checkMeta(node, change, uid, gid, guard2);
+    const now = Date.now();
+    if (change.mode !== void 0) node.mode = change.mode & 4095;
+    node.uid = uid;
+    node.gid = gid;
+    const at = (ms, kept) => ms === void 0 || ms === null ? kept : change.now ? now : ms;
+    node.atimeMs = at(change.atimeMs, node.atimeMs);
+    node.mtimeMs = at(change.mtimeMs, node.mtimeMs);
+    node.ctimeMs = now;
+    if (node.channel) node.channel.tty.owner = { uid: node.uid, gid: node.gid, mode: node.mode };
+  }
+  find(path) {
+    return this.nodes.get(path) ?? this.links.get(path);
+  }
+  openTty(path) {
+    return this.nodes.get(path)?.channel?.tty;
+  }
+  async open(path, flags2, opener) {
+    const node = this.find(path);
+    if (!node) throw new KernelError("ENOENT");
+    const access2 = (flags2 & 3) === 0 ? "read" : (flags2 & 3) === 1 ? "write" : "both";
+    if (opener.guard && !permits(opener.guard.cred, node, want(access2), false))
+      deny(opener.guard, "open", node.path);
+    if (node.channel || node.opening) throw new KernelError("EBUSY");
+    const hook = this.hooks.get(node.client);
+    node.opening = true;
+    const asked = Promise.resolve().then(
+      () => hook.open({ path: node.path, flags: flags2 & 3, stamp: opener.stamp, signal: opener.signal })
+    );
+    let streams;
+    try {
+      streams = await interruptible2(asked, opener.signal);
+    } catch (err) {
+      if (err instanceof KernelError && err.code === "EINTR") {
+        void asked.then(abandon, quiet3).finally(() => node.opening = false);
+      } else node.opening = false;
+      throw embedderFailure(err);
+    }
+    node.opening = false;
+    if (!isStreams(streams)) throw new KernelError("EIO", "the devices hook gave no streams");
+    if (this.nodes.get(node.path) !== node) {
+      void abandon(streams);
+      throw new KernelError("ENOENT");
+    }
+    const channel = new DeviceChannel(node.path, streams, node.saved, (saved) => {
+      node.saved = saved;
+      if (node.channel === channel) delete node.channel;
+    });
+    channel.tty.owner = { uid: node.uid, gid: node.gid, mode: node.mode };
+    node.channel = channel;
+    try {
+      await channel.restore();
+    } catch (err) {
+      await channel.close();
+      throw err;
+    }
+    return channel.file(access2);
+  }
+};
+function isStreams(value2) {
+  const s = value2;
+  return !!s && s.readable instanceof ReadableStream && s.writable instanceof WritableStream && typeof s.control === "function";
+}
+async function abandon(streams) {
+  if (!isStreams(streams)) return;
+  await streams.readable.cancel("closed").catch(quiet3);
+  await streams.writable.abort("closed").catch(quiet3);
+  await Promise.resolve().then(() => streams.control("close")).catch(quiet3);
+}
+function serialTermios() {
+  const base = defaultTermios();
+  return {
+    c_iflag: 0,
+    c_oflag: SERIAL_OFLAG,
+    c_cflag: SERIAL_CFLAG,
+    c_lflag: SERIAL_LFLAG,
+    c_cc: base.c_cc
+  };
+}
+function sleep(ms, signal) {
+  return interruptible2(new Promise((resolve2) => setTimeout(resolve2, ms)), signal);
+}
+var DeviceChannel = class {
+  tty;
+  path;
+  inner;
+  reader;
+  writer;
+  streams;
+  onClosed;
+  gone = Promise.withResolvers();
+  failure;
+  pending = /* @__PURE__ */ new Set();
+  queued = 0;
+  resume;
+  waiters = [];
+  closed = false;
+  ispeed = 9600;
+  ospeed = 9600;
+  dtr = true;
+  rts = true;
+  constructor(path, streams, saved, onClosed) {
+    this.path = path;
+    this.streams = streams;
+    this.onClosed = onClosed;
+    this.gone.promise.catch(quiet3);
+    this.tty = new KernelTty({ write: (bytes) => this.send(bytes) }, quiet3);
+    this.tty.name = path;
+    this.tty.setSize(0, 0);
+    this.tty.tcsets(saved?.termios ?? serialTermios());
+    if (saved) {
+      this.ispeed = saved.ispeed;
+      this.ospeed = saved.ospeed;
+      this.dtr = this.rts = saved.ospeed !== 0;
+    }
+    this.inner = this.tty.file();
+    this.reader = streams.readable.getReader();
+    this.writer = streams.writable.getWriter();
+    void this.pump();
+  }
+  file(access2) {
+    return new OpenFile({
+      ...access2 === "write" ? {} : { read: (max, signal) => this.read(max, signal) },
+      ...access2 === "read" ? {} : { write: (bytes, signal) => this.write(bytes, signal) },
+      poll: () => this.poll(),
+      changed: (signal) => this.changed(signal),
+      close: () => this.close(),
+      tty: this.tty,
+      device: this
+    });
+  }
+  lost(err) {
+    if (this.failure) return;
+    this.failure = err;
+    this.gone.reject(err);
+    this.tty.hangup();
+    this.wake();
+  }
+  control(op, args) {
+    return Promise.resolve().then(() => this.streams.control(op, args));
+  }
+  buffered() {
+    return this.inner.file.poll?.().nread ?? 0;
+  }
+  async pump() {
+    for (; ; ) {
+      while (this.buffered() >= HIGH_WATER && !this.closed && !this.failure) {
+        await new Promise((resolve2) => {
+          this.resume = resolve2;
+        });
+      }
+      if (this.closed || this.failure) return;
+      let got;
+      try {
+        got = await this.reader.read();
+      } catch (err) {
+        if (!this.closed) this.lost(new KernelError("EIO", lineOf2(err)));
+        return;
+      }
+      if (got.done) {
+        this.tty.hangup();
+        this.wake();
+        return;
+      }
+      this.tty.receive(got.value);
+      this.wake();
+    }
+  }
+  send(bytes) {
+    if (this.closed || this.failure) return;
+    const n = bytes.length;
+    this.queued += n;
+    const sent = this.writer.write(bytes.slice()).catch((err) => {
+      this.lost(new KernelError("EIO", lineOf2(err)));
+    });
+    const tracked = sent.finally(() => {
+      this.queued -= n;
+      this.pending.delete(tracked);
+      this.wake();
+    });
+    this.pending.add(tracked);
+  }
+  check() {
+    if (this.failure) throw this.failure;
+  }
+  async read(max, signal) {
+    this.check();
+    const read = this.inner.file.read;
+    const got = await read(max, signal);
+    this.resume?.();
+    this.resume = void 0;
+    if (got.length === 0) this.check();
+    return got;
+  }
+  async ready(signal) {
+    this.check();
+    try {
+      await interruptible2(Promise.race([this.writer.ready, this.gone.promise]), signal);
+    } catch (err) {
+      if (err instanceof KernelError) throw err;
+      throw new KernelError("EIO", lineOf2(err));
+    }
+  }
+  async write(bytes, signal) {
+    this.check();
+    if (!((this.writer.desiredSize ?? 0) > 0)) await this.ready(signal);
+    const write = this.inner.file.write;
+    return write(bytes, signal);
+  }
+  poll() {
+    if (this.failure)
+      return { readable: true, writable: true, hangup: true, error: true, nread: 0 };
+    const inner = this.inner.file.poll?.();
+    const writable3 = (this.writer.desiredSize ?? 0) > 0;
+    return { ...inner, writable: writable3 };
+  }
+  changed(signal) {
+    const mine = new Promise((resolve2) => this.waiters.push(resolve2));
+    const theirs = this.inner.file.changed?.(signal);
+    return interruptible2(Promise.race([mine, theirs]), signal);
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve2 of waiters) resolve2();
+  }
+  async drain(signal) {
+    while (this.pending.size > 0) {
+      this.check();
+      await interruptible2(
+        Promise.race([Promise.all([...this.pending]), this.gone.promise]),
+        signal
+      );
+    }
+    this.check();
+  }
+  async restore() {
+    const settings = this.settings();
+    if (settings.baudRate === 0)
+      return this.signals({ dataTerminalReady: false, requestToSend: false });
+    if (sameSettings(settings, DEFAULT_SETTINGS)) return;
+    try {
+      await this.control("configure", settings);
+    } catch (err) {
+      throw embedderFailure(err);
+    }
+  }
+  settings() {
+    return settingsOf(this.tty.tcgets().c_cflag, this.ospeed);
+  }
+  termios() {
+    return { ...this.tty.tcgets(), c_ispeed: this.ispeed, c_ospeed: this.ospeed };
+  }
+  async setTermios(termios, how, signal) {
+    this.check();
+    if (how.drain) await this.drain(signal);
+    const before = this.settings();
+    const old = { termios: this.tty.tcgets(), ispeed: this.ispeed, ospeed: this.ospeed };
+    const speeds = speedsOf(termios, this, how.extended === true);
+    this.tty.tcsets(termios, how.flush === true);
+    this.ispeed = speeds.ispeed;
+    this.ospeed = speeds.ospeed;
+    try {
+      if (speeds.ospeed === 0) await this.setModem(this.bits() & ~(TIOCM.DTR | TIOCM.RTS));
+      else {
+        if (!sameSettings(before, this.settings()))
+          await this.control("configure", this.settings());
+        if (old.ospeed === 0) await this.setModem(this.bits() | TIOCM.DTR | TIOCM.RTS);
+      }
+      if (how.flush) await this.control("flush", { input: true, output: false });
+    } catch (err) {
+      this.tty.tcsets(old.termios);
+      this.ispeed = old.ispeed;
+      this.ospeed = old.ospeed;
+      throw embedderFailure(err);
+    }
+  }
+  bits() {
+    return (this.dtr ? TIOCM.DTR : 0) | (this.rts ? TIOCM.RTS : 0);
+  }
+  async modem() {
+    this.check();
+    const s = await this.control("signals").catch((err) => {
+      throw embedderFailure(err);
+    });
+    return this.bits() | (s?.clearToSend ? TIOCM.CTS : 0) | (s?.dataSetReady ? TIOCM.DSR : 0) | (s?.dataCarrierDetect ? TIOCM.CD : 0) | (s?.ringIndicator ? TIOCM.RI : 0);
+  }
+  async setModem(bits2) {
+    this.check();
+    const dataTerminalReady = (bits2 & TIOCM.DTR) !== 0;
+    const requestToSend = (bits2 & TIOCM.RTS) !== 0;
+    await this.signals({ dataTerminalReady, requestToSend });
+    this.dtr = dataTerminalReady;
+    this.rts = requestToSend;
+  }
+  async signals(args) {
+    try {
+      await this.control("setSignals", args);
+    } catch (err) {
+      throw embedderFailure(err);
+    }
+  }
+  async sendBreak(ms, signal) {
+    await this.drain(signal);
+    await this.signals({ break: true });
+    try {
+      await sleep(ms, signal);
+    } finally {
+      await this.signals({ break: false });
+    }
+  }
+  async flush(input, output) {
+    this.check();
+    if (input) this.tty.tcsets(this.tty.tcgets(), true);
+    try {
+      await this.control("flush", { input, output });
+    } catch (err) {
+      throw embedderFailure(err);
+    }
+  }
+  async ioctl(request3, arg, signal) {
+    this.check();
+    switch (request3) {
+      case IOCTL.TCGETS:
+      case IOCTL.TCGETS2:
+        return this.termios();
+      case IOCTL.TCSETS:
+      case IOCTL.TCSETSW:
+      case IOCTL.TCSETSF:
+      case IOCTL.TCSETS2:
+      case IOCTL.TCSETSW2:
+      case IOCTL.TCSETSF2: {
+        const extended = request3 > 65535;
+        const kind = (request3 & 255) - (extended ? 43 : 2);
+        await this.setTermios(
+          arg,
+          { drain: kind > 0, flush: kind === 2, extended },
+          signal
+        );
+        return null;
+      }
+      case IOCTL.TIOCMGET:
+        return this.modem();
+      case IOCTL.TIOCMSET:
+        await this.setModem(Number(arg));
+        return null;
+      case IOCTL.TIOCMBIS:
+        await this.setModem(this.bits() | Number(arg));
+        return null;
+      case IOCTL.TIOCMBIC:
+        await this.setModem(this.bits() & ~Number(arg));
+        return null;
+      case IOCTL.TIOCSBRK:
+      case IOCTL.TIOCCBRK:
+        await this.signals({ break: request3 === IOCTL.TIOCSBRK });
+        return null;
+      case IOCTL.TCSBRK:
+        if (Number(arg) === 0) await this.sendBreak(BREAK_MS, signal);
+        else await this.drain(signal);
+        return null;
+      case IOCTL.TCSBRKP:
+        await this.sendBreak(Number(arg) > 0 ? Number(arg) * 100 : BREAK_MS, signal);
+        return null;
+      case IOCTL.TCFLSH: {
+        const queue = Number(arg);
+        if (queue < 0 || queue > 2) throw new KernelError("EINVAL");
+        await this.flush(queue !== 1, queue !== 0);
+        return null;
+      }
+      case IOCTL.FIONREAD:
+        return this.buffered();
+      case IOCTL.TIOCOUTQ:
+        return this.queued;
+      case IOCTL.TIOCEXCL:
+      case IOCTL.TIOCNXCL:
+        return null;
+      case IOCTL.TIOCGWINSZ: {
+        const [rows, cols] = this.tty.winsize();
+        return { rows, cols };
+      }
+      case IOCTL.TIOCSWINSZ: {
+        const size = arg;
+        this.tty.setSize(Number(size?.cols) & 65535, Number(size?.rows) & 65535);
+        return null;
+      }
+      case IOCTL.TIOCSCTTY:
+        throw new KernelError("EPERM");
+      default:
+        throw new KernelError("ENOTTY");
+    }
+  }
+  async close() {
+    if (this.closed) return;
+    try {
+      if (!this.failure) {
+        await interruptible2(this.drain(), AbortSignal.timeout(CLOSING_WAIT_MS)).catch(quiet3);
+      }
+      this.closed = true;
+      this.resume?.();
+      this.wake();
+      await this.reader.cancel("closed").catch(quiet3);
+      this.reader.releaseLock();
+      await this.writer.abort("closed").catch(quiet3);
+      this.writer.releaseLock();
+      await this.control("close").catch(quiet3);
+    } finally {
+      this.closed = true;
+      this.onClosed({ termios: this.tty.tcgets(), ispeed: this.ispeed, ospeed: this.ospeed });
+    }
+  }
+};
+
 // src/kernel/exec-ticket.ts
 var TICKET_ENV = "SLICC_SEALED_TICKET";
 var TICKET_TTL_MS = 3e4;
@@ -14016,8 +15134,8 @@ var DriverConnection = class _DriverConnection {
     } finally {
       clearTimeout(timer);
     }
-    const refused4 = driverVersionError(hello.protocol);
-    if (refused4) throw errnoError("EPROTO", refused4);
+    const refused5 = driverVersionError(hello.protocol);
+    if (refused5) throw errnoError("EPROTO", refused5);
     if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
     return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options);
   }
@@ -14063,7 +15181,7 @@ var DriverConnection = class _DriverConnection {
 var S_ISGID4 = 1024;
 var ID = /^\d{1,10}$/;
 var MASK = /^0*[0-7]{1,4}$/;
-var MAX_ID2 = 4294967294;
+var MAX_ID3 = 4294967294;
 function idOption(value2) {
   return value2 === void 0 ? 0 : Number(value2);
 }
@@ -14075,7 +15193,7 @@ function checkIds(options) {
   for (const key of ["uid", "gid"]) {
     const value2 = options[key];
     if (value2 === void 0) continue;
-    if (!ID.test(value2) || Number(value2) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value2}`);
+    if (!ID.test(value2) || Number(value2) > MAX_ID3) throw errnoError("EINVAL", `${key}=${value2}`);
   }
 }
 function checkMasks(options) {
@@ -14087,7 +15205,7 @@ function checkMasks(options) {
     }
   }
 }
-function modeOf(attr2, mount) {
+function modeOf2(attr2, mount) {
   const type = attr2.kind === "directory" ? 16384 : attr2.kind === "symlink" ? 40960 : attr2.kind === "fifo" ? 4096 : 32768;
   const fallback = type | (attr2.kind === "directory" ? 493 : attr2.kind === "symlink" ? 511 : 420);
   if (mount.caps.owners) return attr2.mode ?? fallback;
@@ -14248,9 +15366,9 @@ var HeldPaths = class extends Map {
     this.unlinked.set(path, file);
   }
   keep(path, file) {
-    const fresh3 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
-    for (const id2 of fresh3) this.keptHandles.set(id2, file);
-    this.uses.set(file, Math.max(fresh3.length, 1));
+    const fresh4 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
+    for (const id2 of fresh4) this.keptHandles.set(id2, file);
+    this.uses.set(file, Math.max(fresh4.length, 1));
     this.unlinked.set(path, file);
   }
   unkeep(path, file) {
@@ -14371,7 +15489,7 @@ function statOf2(attr2, path, mount) {
     isSymbolicLink: attr2.kind === "symlink",
     ...attr2.kind === "fifo" ? { isFifo: true } : {},
     size: attr2.size,
-    mode: modeOf(attr2, mount),
+    mode: modeOf2(attr2, mount),
     mtime,
     atime: attr2.atime === void 0 ? mtime : new Date(attr2.atime),
     ctime: mtime,
@@ -15462,8 +16580,8 @@ var MountFs = class _MountFs {
     }
     this.writable(mount, real);
     const { uid, gid, mode } = change;
-    const fresh3 = change.kind === "new" && { uid, gid, mode };
-    const set3 = fresh3 ? await this.driverOwner(found, real, fresh3, false) : change;
+    const fresh4 = change.kind === "new" && { uid, gid, mode };
+    const set3 = fresh4 ? await this.driverOwner(found, real, fresh4, false) : change;
     this.table.forget(mount, real);
     const attrs = Object.entries({ uid: set3.uid, gid: set3.gid, mode: set3.mode });
     await mount.conn.call({
@@ -15740,10 +16858,10 @@ async function runMkdir(entry, path, req) {
   const plain3 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh3 = plain3 !== void 0 && !await fs.exists(path);
+  const fresh4 = plain3 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh3) await fs.chmod(path, plain3);
+  if (fresh4) await fs.chmod(path, plain3);
   return done2;
 }
 async function shownAs(entry, path, st) {
@@ -15955,10 +17073,10 @@ async function guard(g, path, req, cwd) {
 }
 async function opening(entry, path, mode) {
   const g = guardOf(entry);
-  const want = (mode & HOLD_READ ? R_OK : 0) | (mode & HOLD_WRITE ? W_OK : 0);
+  const want2 = (mode & HOLD_READ ? R_OK : 0) | (mode & HOLD_WRITE ? W_OK : 0);
   const created4 = (mode & HOLD_CREATED) !== 0 && entry.created?.take(path) === true;
-  if (g && want !== 0 && !created4) {
-    await need(g, "open", path, want, { directory: false });
+  if (g && want2 !== 0 && !created4) {
+    await need(g, "open", path, want2, { directory: false });
   }
 }
 async function stillThere(entry, path, req) {
@@ -15982,7 +17100,7 @@ async function holdOp(entry, path, req) {
       await entry.source?.open(path, real);
       await stillThere(entry, path, req);
       if (req.nofollow && !await ownEntry(entry, path, real ?? path)) continue;
-      const fid = req.ino === void 0 ? void 0 : await idOf(entry, real ?? path);
+      const fid = req.ino === void 0 ? void 0 : await idOf2(entry, real ?? path);
       if (!r || !r.missed(path) && !r.changedSince(path, gen) && !r.inFlight?.(path))
         return json2(await heldOpen(entry, path, real, req, fid));
     }
@@ -15996,7 +17114,7 @@ async function heldOpen(entry, path, real, req, fid) {
   await entry.announceHold?.(real ?? path, fid, ((req.mode ?? 0) & HOLD_CREATED) !== 0);
   return real !== void 0 && real !== path ? { handle, real } : handle;
 }
-async function idOf(entry, path) {
+async function idOf2(entry, path) {
   return await entry.fileId?.(path)?.catch(() => void 0) ?? void 0;
 }
 async function ownEntry(entry, path, real) {
@@ -16068,8 +17186,8 @@ async function guarded(entry, path, req) {
     return { paths };
   } catch (err) {
     const refusal2 = err.code === "EACCES";
-    const refused4 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
-    return { refused: refused4 };
+    const refused5 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
+    return { refused: refused5 };
   }
 }
 async function copyOp(entry, path, req) {
@@ -16170,7 +17288,7 @@ async function bound(entry, path, handle) {
   const now = await entry.fs.stat(path).catch(() => void 0);
   if (now === void 0 && bound3.fid !== void 0 && !await entry.fs.lstat(path).catch(() => void 0))
     throw syncError("ENOENT", path);
-  const same3 = bound3.fid === void 0 ? now?.ino === bound3.ino : now?.fid === bound3.fid || await idOf(entry, path) === bound3.fid;
+  const same3 = bound3.fid === void 0 ? now?.ino === bound3.ino : now?.fid === bound3.fid || await idOf2(entry, path) === bound3.fid;
   if (same3) {
     entry.trust?.(handle, bound3.doubt);
     return;
@@ -16265,13 +17383,13 @@ async function created2(entry, req) {
   return seen === void 0 ? looked : json2({ ...looked.json, seen });
 }
 var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
-async function rmPermitted(entry, path, req, refused4) {
+async function rmPermitted(entry, path, req, refused5) {
   const st = await entry.fs.lstat(path).catch(() => void 0);
-  if (!st?.isDirectory) return refused4;
+  if (!st?.isDirectory) return refused5;
   const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
   if ("refused" in unlisted) return unlisted.refused;
   const names2 = await entry.fs.readdir(path).catch(() => void 0);
-  if (!names2) return refused4;
+  if (!names2) return refused5;
   let first;
   for (const name2 of names2) {
     const child = await dispatchOne(entry, {
@@ -16322,14 +17440,14 @@ async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
   if (!named && !CREATIONS.has(req.op)) return void 0;
   const target = named ? entry.fs.resolvePath(entry.cwd, req.arg2 ?? "") : path;
-  const refused4 = devCreation(target, entry.cred?.());
-  if (!refused4) return void 0;
+  const refused5 = devCreation(target, entry.cred?.());
+  if (!refused5) return void 0;
   const there = await entry.fs.lstat(target).then(
     () => true,
     () => false
   );
   if (there) return void 0;
-  return { ok: false, errno: refused4, message: `${target}: no new names in /dev or /proc` };
+  return { ok: false, errno: refused5, message: `${target}: no new names in /dev or /proc` };
 }
 var MISS_OPS = /* @__PURE__ */ new Set(["stat", "lstat"]);
 async function linkFree(fs, path) {
@@ -16440,13 +17558,13 @@ var SAB_DEFAULT_WINDOW_BYTES = 1024 * 1024;
 var SAB_MIN_BYTES = SAB_HEADER_BYTES + 4096;
 var SYNC_SAB_REQ_MSG = "sync-sab-req";
 var SYNC_SAB_NEXT_MSG = "sync-sab-next";
-var encoder3 = new TextEncoder();
+var encoder4 = new TextEncoder();
 var decoder2 = new TextDecoder();
 function encodeSabResult(result) {
   if (!result.ok) {
     return {
       status: SAB_STATUS_ERRNO,
-      payload: encoder3.encode(
+      payload: encoder4.encode(
         JSON.stringify({
           errno: result.errno,
           message: result.message,
@@ -16461,7 +17579,7 @@ function encodeSabResult(result) {
     case "bytes":
       return { status: SAB_STATUS_BYTES, payload: result.bytes };
     case "json":
-      return { status: SAB_STATUS_JSON, payload: encoder3.encode(JSON.stringify(result.json)) };
+      return { status: SAB_STATUS_JSON, payload: encoder4.encode(JSON.stringify(result.json)) };
     default:
       return { status: SAB_STATUS_VOID, payload: new Uint8Array(0) };
   }
@@ -16788,9 +17906,9 @@ var Pages = class {
       const page = (start2 + at) / PAGE;
       if (this.pages.has(page)) continue;
       const part = bytes.subarray(at, Math.min(at + PAGE, bytes.length));
-      const fresh3 = this.take(part.length);
-      fresh3.set(part);
-      this.pages.set(page, fresh3);
+      const fresh4 = this.take(part.length);
+      fresh4.set(part);
+      this.pages.set(page, fresh4);
     }
   }
   read(at, length2) {
@@ -17001,16 +18119,16 @@ var pinnedRoot;
 var rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
 function mountTable(mounts = []) {
   const root = pinnedRoot ?? rootKind();
-  const lines2 = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
+  const lines3 = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
   for (const m of mounts) {
     const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
     if (m.state !== "ok") options.push(m.state);
     const access2 = options.includes("ro") ? [] : ["rw"];
-    lines2.push(
+    lines3.push(
       `${field3(m.source)} ${field3(m.target)} ${m.type} ${[...access2, ...options].join(",")} 0 0`
     );
   }
-  return `${lines2.join("\n")}
+  return `${lines3.join("\n")}
 `;
 }
 
@@ -18045,7 +19163,7 @@ function recordRefusal(opening2) {
   const found = headerClass(opening2);
   return found && new KernelError("EPROTO", `${found[0]}: ${found[1]}`);
 }
-function refused2(engine, session, err, opening2) {
+function refused3(engine, session, err, opening2) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
   if (code && flags2 !== -1)
@@ -18066,7 +19184,7 @@ async function handshake(conn, o, session, inbox) {
       done5 = session.handshake();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
-      throw refused2(o.engine, session, err, inbox.opening);
+      throw refused3(o.engine, session, err, inbox.opening);
     }
     await send(conn, session);
     if (done5) return;
@@ -18517,10 +19635,10 @@ async function anchorFor(engine, chain2, host, found) {
 var FRAGMENT = 16;
 var MIN_VALUE = 8;
 var MIN_BASE64 = 8;
-var encoder4 = new TextEncoder();
+var encoder5 = new TextEncoder();
 var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function utf8(text) {
-  return encoder4.encode(text);
+  return encoder5.encode(text);
 }
 function base64(bytes, padded = true) {
   let out = "";
@@ -18594,14 +19712,73 @@ function encodings(bytes) {
   }
   return [...standard, ...standard.map(urlSafe)];
 }
-function shapes(value2) {
+function windows(length2) {
+  const out = [];
+  for (let offset = 0; offset + FRAGMENT <= length2; offset++) out.push(offset);
+  return out;
+}
+function strings(document) {
+  const out = [];
+  const stack = [document];
+  while (stack.length > 0) {
+    const item = stack.pop();
+    if (typeof item === "string") out.push(item);
+    if (typeof item !== "object" || item === null) continue;
+    for (const child of Object.values(item)) stack.push(child);
+  }
+  return out;
+}
+var DOMAIN = "(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z]{2,63}";
+var HOST = new RegExp(`^${DOMAIN}$`);
+var EMAIL = new RegExp(`^[^\\s@]+@${DOMAIN}$`);
+var URL_SHAPE = new RegExp(`^https?://${DOMAIN}(?::[0-9]{1,5})?((?:/[^/?#\\s]*)*)$`);
+var ARMOR = /^-----(?:BEGIN|END) [A-Z0-9 ]+-----$/;
+function unescaped(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+function address(leaf) {
+  if (HOST.test(leaf) || EMAIL.test(leaf)) return true;
+  const url = URL_SHAPE.exec(leaf);
+  if (!url) return false;
+  return url[1].split("/").every((segment) => utf8(segment).length < FRAGMENT || EMAIL.test(unescaped(segment)));
+}
+function lines2(leaf) {
+  if (address(leaf)) return [];
+  return leaf.split(/[\r\n"\\]/).filter((line) => utf8(line).length >= FRAGMENT && !ARMOR.test(line));
+}
+function parsed2(value2) {
+  try {
+    const document = JSON.parse(value2);
+    return typeof document === "object" && document !== null ? document : null;
+  } catch {
+    return null;
+  }
+}
+function fragments(value2) {
+  const raw2 = utf8(value2);
+  const document = parsed2(value2);
+  if (!document) return { pieces: [raw2], whole: true };
+  return { pieces: [...new Set(strings(document).flatMap(lines2))].map(utf8), whole: false };
+}
+function shapes(value2, split3 = fragments(value2)) {
   const raw2 = utf8(value2);
   const seen = /* @__PURE__ */ new Set([value2]);
   const out = [];
-  if (raw2.length < FRAGMENT) out.push({ bytes: raw2, form: "raw" });
-  for (let offset = 0; raw2.length >= FRAGMENT && offset + FRAGMENT <= raw2.length; offset++) {
-    out.push({ bytes: raw2.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
-  }
+  if (raw2.length < FRAGMENT || !split3.whole) out.push({ bytes: raw2, form: "raw" });
+  split3.pieces.forEach((bytes, piece) => {
+    for (const offset of windows(bytes.length)) {
+      out.push({
+        bytes: bytes.subarray(offset, offset + FRAGMENT),
+        form: "fragment",
+        offset,
+        piece
+      });
+    }
+  });
   const add = (text, form) => {
     if (seen.has(text)) return;
     seen.add(text);
@@ -18734,12 +19911,19 @@ function prepare(secrets, sameLength) {
   const ids = /* @__PURE__ */ new Map();
   const wrapIds = /* @__PURE__ */ new Map();
   const values = secrets.map((secret) => utf8(secret.value));
+  const splits = [];
   secrets.forEach((secret, index) => {
     if (typeof secret.value !== "string" || values[index].length < MIN_VALUE) {
       throw new RangeError(`the value of ${secret.name} is shorter than ${MIN_VALUE} bytes`);
     }
-    for (const shape of shapes(secret.value)) {
-      const source = { secret: index, form: shape.form, offset: shape.offset };
+    splits.push(fragments(secret.value));
+    for (const shape of shapes(secret.value, splits[index])) {
+      const source = {
+        secret: index,
+        form: shape.form,
+        offset: shape.offset,
+        piece: shape.piece
+      };
       register(main, sources, ids, shape.bytes, source);
       if (wrappable(shape.form)) register(wrap, wrapSources, wrapIds, shape.bytes, source);
     }
@@ -18750,7 +19934,16 @@ function prepare(secrets, sameLength) {
     utf8(secret.placeholder),
     utf8(`[redacted:${secret.name}]`)
   ]);
-  return { secrets, values, main, wrap, sources, wrapSources, replacements, sameLength };
+  return {
+    secrets,
+    splits,
+    main,
+    wrap,
+    sources,
+    wrapSources,
+    replacements,
+    sameLength
+  };
 }
 function filled(input, start2, end) {
   const out = new Uint8Array(end - start2);
@@ -18781,14 +19974,16 @@ function resolve(c, input, start2, end, source) {
       growing: false
     };
   }
-  const value2 = c.values[source.secret];
+  const split3 = c.splits[source.secret];
+  const value2 = split3.pieces[source.piece];
   let stop = end;
   let at = source.offset + FRAGMENT;
   while (stop < input.length && at < value2.length && input[stop] === value2[at]) {
     stop++;
     at++;
   }
-  const form = source.offset === 0 && at === value2.length ? "raw" : "fragment";
+  const whole = split3.whole && source.offset === 0 && at === value2.length;
+  const form = whole ? "raw" : "fragment";
   const growing = stop === input.length && at < value2.length;
   return { start: start2, end: stop, secret: source.secret, form, rank: RANK[form], growing };
 }
@@ -18942,9 +20137,9 @@ function compile(secrets, options = {}) {
 // src/kernel/scrub-file.ts
 var SCRUB_IDLE_MS = 50;
 var SCRUB_NONBLOCK_MAX = 64 * 1024;
-var encoder5 = new TextEncoder();
+var encoder6 = new TextEncoder();
 function scrubberOf(secrets, sameLength = false) {
-  const usable3 = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
+  const usable3 = secrets.filter((s) => encoder6.encode(s.value).length >= MIN_VALUE);
   return usable3.length > 0 ? compile(usable3, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
 }
 async function writeAll2(file, bytes) {
@@ -18968,7 +20163,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   let timer;
   let failed4;
   const waiters = /* @__PURE__ */ new Set();
-  const quiet2 = () => !busy && pending === 0;
+  const quiet4 = () => !busy && pending === 0;
   const wake = () => {
     for (const waiter of [...waiters]) waiter();
   };
@@ -18985,7 +20180,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
       if (failed4 === void 0) failed4 = err;
     }).finally(() => {
       pending -= 1;
-      if (quiet2()) wake();
+      if (quiet4()) wake();
     });
   };
   const settling = (signal) => new Promise((resolve2, reject) => {
@@ -19003,7 +20198,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
     signal?.addEventListener("abort", stop, { once: true });
   });
   const settled = async () => {
-    while (!quiet2()) await settling();
+    while (!quiet4()) await settling();
   };
   const changed = async (signal) => {
     const round = new AbortController();
@@ -19019,7 +20214,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   };
   const turn = async (signal) => {
     for (let waited = false; ; waited = true) {
-      if (quiet2() && (pollFile(file).writable || !file.changed)) {
+      if (quiet4() && (pollFile(file).writable || !file.changed)) {
         busy = true;
         return;
       }
@@ -19048,13 +20243,14 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
     ...bound2(file, "stat"),
     poll: () => {
       const state = pollFile(file);
-      return quiet2() ? state : { ...state, writable: false };
+      return quiet4() ? state : { ...state, writable: false };
     },
     changed,
     ...file.tty ? { tty: file.tty } : {},
     identity: file.identity ?? file,
     ...file.clipboard ? { clipboard: file.clipboard } : {},
     ...file.embedder ? { embedder: file.embedder } : {},
+    ...file.device ? { device: file.device } : {},
     ...file.write ? {
       write: async (bytes, signal) => {
         await turn(signal);
@@ -19066,7 +20262,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
           await send2(stream.push(taken), signal);
         } finally {
           busy = false;
-          if (quiet2()) wake();
+          if (quiet4()) wake();
         }
         timer = setTimeout(release, idleMs);
         return taken.length;
@@ -19125,9 +20321,9 @@ function scrubStdio(fds, scrubber) {
 // src/kernel/net/sealed-scrubs.ts
 function addTo(tree2, host, secrets) {
   const entry = tree2.get(host) ?? { secrets: [], version: 0, scrubber: void 0 };
-  const fresh3 = secrets.filter((s) => !entry.secrets.some((e) => e.value === s.value));
-  if (fresh3.length === 0) return;
-  entry.secrets = [...entry.secrets, ...fresh3];
+  const fresh4 = secrets.filter((s) => !entry.secrets.some((e) => e.value === s.value));
+  if (fresh4.length === 0) return;
+  entry.secrets = [...entry.secrets, ...fresh4];
   entry.version += 1;
   entry.scrubber = void 0;
   tree2.set(host, entry);
@@ -19290,7 +20486,7 @@ var HEADER = new RegExp(`^header:${TOKEN3}$`);
 var METHOD = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var TARGET = /^[\x21-\x7e]+$/;
 var SESSION_EXIT = /^(tailscale|device:[A-Za-z0-9._:-]+)$/;
-var HOST = /^[a-z0-9.:-]+$/;
+var HOST2 = /^[a-z0-9.:-]+$/;
 var UNSAFE = /[\r\n\0]/;
 var ANCHOR_ID = /^[A-Za-z0-9+/]{43}=$/;
 function verifiedByOk(f) {
@@ -19344,7 +20540,7 @@ function scramOk(f) {
   return texts.every((t) => typeof t === "string" && SCRAM_TEXT.test(t));
 }
 function hostOk(host) {
-  return typeof host === "string" && HOST.test(host) && boundHost(host) === host;
+  return typeof host === "string" && HOST2.test(host) && boundHost(host) === host;
 }
 function sessionAskable(f, now) {
   if (!Object.hasOwn(POSITIONS, f.protocol) || typeof f.position !== "string") return false;
@@ -19434,20 +20630,20 @@ var ASK_FIELDS = /* @__PURE__ */ new Set([
   "caller",
   "requester"
 ]);
-var encoder6 = new TextEncoder();
+var encoder7 = new TextEncoder();
 var decoder3 = new TextDecoder("utf-8", { fatal: true });
 function parseSealed(bytes) {
   try {
     if (bytes.length > SEALED_MAX_BYTES) throw new KernelError("EMSGSIZE");
-    let parsed2;
+    let parsed3;
     try {
-      parsed2 = JSON.parse(decoder3.decode(bytes));
+      parsed3 = JSON.parse(decoder3.decode(bytes));
     } catch {
       throw new KernelError("EINVAL");
     }
-    if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2))
+    if (typeof parsed3 !== "object" || parsed3 === null || Array.isArray(parsed3))
       throw new KernelError("EINVAL");
-    const req = parsed2;
+    const req = parsed3;
     if (req.v !== 1 || typeof req.op !== "string" || !SEALED_OPS.has(req.op))
       throw new KernelError("EINVAL");
     if (req.op === "materialize" && !materializable(req)) throw new KernelError("EINVAL");
@@ -19543,7 +20739,7 @@ var SealedChannel = class {
         await this.broker.tickets.record(req, reply, caller.pid);
       if (this.inflight !== flight) return;
       this.inflight = void 0;
-      if (reply) this.reply = encoder6.encode(serialized(reply));
+      if (reply) this.reply = encoder7.encode(serialized(reply));
     });
     this.inflight = flight;
     return length2;
@@ -19819,7 +21015,7 @@ function shown(text) {
   const chars = [...safe];
   return `'${chars.length > SHOWN_MAX ? `${chars.slice(0, SHOWN_MAX - 1).join("")}\u2026` : safe}'`;
 }
-function unescaped(double) {
+function unescaped2(double) {
   return double.replace(/\\(["\\$`])/g, "$1");
 }
 function splitWords(text) {
@@ -19835,7 +21031,7 @@ function splitWords(text) {
       word = void 0;
       continue;
     }
-    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain3));
+    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped2(double) : escaped ?? plain3));
   }
   if (word !== void 0) words3.push(word);
   return words3;
@@ -19872,7 +21068,7 @@ function splitPatterns(text) {
     }
     word ??= [];
     if (plain3 !== void 0) addPlain(word, plain3);
-    else addPart(word, single ?? (double !== void 0 ? unescaped(double) : escaped));
+    else addPart(word, single ?? (double !== void 0 ? unescaped2(double) : escaped));
   }
   if (word !== void 0) words3.push(word);
   return words3;
@@ -19923,13 +21119,13 @@ function commandMatches(cmnd, argv) {
   if (cmnd === "*") return true;
   const [path, ...args] = argv;
   if (path !== cmnd.path) return false;
-  const want = cmnd.args;
-  if (want === void 0) return true;
+  const want2 = cmnd.args;
+  if (want2 === void 0) return true;
   return globMatch(
-    want.length,
+    want2.length,
     args.length,
-    (i) => isAny(want[i]),
-    (i, j) => wordMatch(want[i], args[j])
+    (i) => isAny(want2[i]),
+    (i, j) => wordMatch(want2[i], args[j])
   );
 }
 function commandText(cmnd) {
@@ -20226,11 +21422,11 @@ function parsePolicy(text, file) {
   const defaults2 = [];
   const errors = [];
   for (const [n, line] of text.split("\n").entries()) {
-    const parsed2 = parseLine(line, file);
-    if (parsed2 === null) continue;
-    if ("error" in parsed2) errors.push({ line: n + 1, message: parsed2.error });
-    else if ("defaults" in parsed2) defaults2.push(parsed2.defaults);
-    else rules.push(...parsed2.rules);
+    const parsed3 = parseLine(line, file);
+    if (parsed3 === null) continue;
+    if ("error" in parsed3) errors.push({ line: n + 1, message: parsed3.error });
+    else if ("defaults" in parsed3) defaults2.push(parsed3.defaults);
+    else rules.push(...parsed3.rules);
   }
   return { rules, defaults: defaults2, errors };
 }
@@ -20283,11 +21479,11 @@ var REPLAY_TAGS_MAX = 64;
 var REPLAY_ARGV_MAX = 4096;
 var REPLAY_BYTES_MAX = 1024 * 1024;
 var NOT_A_REQUEST = "sudo: that isn't a sudo request this kernel can run";
-function strings(value2, max) {
+function strings2(value2, max) {
   return Array.isArray(value2) && value2.length <= max && value2.every((s) => typeof s === "string");
 }
 function words(value2) {
-  if (!strings(value2, REPLAY_ARGV_MAX) || value2.length === 0) return false;
+  if (!strings2(value2, REPLAY_ARGV_MAX) || value2.length === 0) return false;
   const bytes = value2.reduce((n, s) => n + s.length + 1, 0);
   return bytes <= REPLAY_BYTES_MAX && !value2.some((s) => s.includes("\0"));
 }
@@ -20322,7 +21518,7 @@ function replayOf(value2) {
   const bound3 = filesOf(r.userWritable);
   const named = (s) => typeof s === "string" && s !== "";
   const absolute2 = (s) => typeof s === "string" && s.startsWith("/") && s.length <= PATH_MAX && !s.includes("\0");
-  const valid = typeof id2 === "string" && REPLAY_ID.test(id2) && named(user) && named(target) && Number.isInteger(uid) && uid >= 0 && words(argv) && absolute2(path) && absolute2(cwd) && (stdin === "tty" || stdin === "none") && (tag === void 0 || typeof tag === "string") && (tags === void 0 || strings(tags, REPLAY_TAGS_MAX)) && rootOnly2 !== void 0 && bound3 !== void 0;
+  const valid = typeof id2 === "string" && REPLAY_ID.test(id2) && named(user) && named(target) && Number.isInteger(uid) && uid >= 0 && words(argv) && absolute2(path) && absolute2(cwd) && (stdin === "tty" || stdin === "none") && (tag === void 0 || typeof tag === "string") && (tags === void 0 || strings2(tags, REPLAY_TAGS_MAX)) && rootOnly2 !== void 0 && bound3 !== void 0;
   if (!valid) return failed2("EINVAL", NOT_A_REQUEST);
   const all = tags ?? (tag === void 0 ? [] : [tag]);
   return {
@@ -20414,28 +21610,28 @@ function recordedCommand(argv) {
   const [path = "", ...args] = argv;
   return commandText({ path, args: args.map((a) => [a]) });
 }
-function flags(parsed2, arg, next3) {
+function flags(parsed3, arg, next3) {
   for (let j = 1; j < arg.length; j++) {
     const flag = arg[j];
-    if (flag === "n") parsed2.nonInteractive = true;
-    else if (flag === "l") parsed2.list = true;
-    else if (flag === "v") parsed2.validate = true;
-    else if (flag === "k") parsed2.reset = true;
-    else if (flag === "K") parsed2.removeAll = true;
+    if (flag === "n") parsed3.nonInteractive = true;
+    else if (flag === "l") parsed3.list = true;
+    else if (flag === "v") parsed3.validate = true;
+    else if (flag === "k") parsed3.reset = true;
+    else if (flag === "K") parsed3.removeAll = true;
     else if (flag !== "u") return `sudo: invalid option -- '${flag}'
 ${USAGE}`;
     else {
       const user = arg.slice(j + 1) || next3;
       if (!user) return `sudo: option requires an argument -- 'u'
 ${USAGE}`;
-      parsed2.user = user;
+      parsed3.user = user;
       return arg.slice(j + 1) ? 0 : 1;
     }
   }
   return 0;
 }
 function parseArgs(args) {
-  const parsed2 = {
+  const parsed3 = {
     list: false,
     nonInteractive: false,
     validate: false,
@@ -20452,19 +21648,19 @@ function parseArgs(args) {
       break;
     }
     if (!arg.startsWith("-") || arg === "-") break;
-    const used2 = flags(parsed2, arg, args[i + 1]);
+    const used2 = flags(parsed3, arg, args[i + 1]);
     if (typeof used2 === "string") return used2;
     i += used2;
   }
-  parsed2.command = args.slice(i);
-  return usable(parsed2) ? parsed2 : USAGE;
+  parsed3.command = args.slice(i);
+  return usable(parsed3) ? parsed3 : USAGE;
 }
-function usable(parsed2) {
-  const command = parsed2.command.length > 0;
-  const modes = [parsed2.list, parsed2.validate, parsed2.removeAll].filter(Boolean).length;
-  if (modes > 1 || parsed2.removeAll && parsed2.reset) return false;
+function usable(parsed3) {
+  const command = parsed3.command.length > 0;
+  const modes = [parsed3.list, parsed3.validate, parsed3.removeAll].filter(Boolean).length;
+  if (modes > 1 || parsed3.removeAll && parsed3.reset) return false;
   if (modes === 1) return !command;
-  return command || parsed2.reset;
+  return command || parsed3.reset;
 }
 function policyOf(settings) {
   return { type: settings.timestampType, minutes: settings.timestampTimeout };
@@ -20608,28 +21804,28 @@ var Sudo = class {
     };
   }
   async check(cred, call) {
-    const lines2 = [];
+    const lines3 = [];
     let ok4 = true;
     const report = ({ path, problems, ok: read }) => {
       for (const problem of problems) {
         const where = problem.line === void 0 ? `${path}: sudo skips it:` : `${path}:${problem.line}:`;
-        lines2.push([2, `visudo: ${where} ${problem.message}`]);
+        lines3.push([2, `visudo: ${where} ${problem.message}`]);
       }
-      if (read && problems.length === 0) lines2.push([1, `${path}: parsed OK`]);
+      if (read && problems.length === 0) lines3.push([1, `${path}: parsed OK`]);
       if (problems.length > 0) ok4 = false;
     };
     const values = (defaults2) => {
-      for (const line of defaultsText(defaults2)) lines2.push([1, line]);
+      for (const line of defaultsText(defaults2)) lines3.push([1, line]);
     };
     if (call.files !== void 0) {
       const defaults2 = [];
       for (const { name: name2, text } of call.files) {
-        const parsed2 = parsePolicy(text);
-        defaults2.push(...parsed2.defaults);
-        report({ path: name2, rules: [], problems: parsed2.errors, ok: true });
+        const parsed3 = parsePolicy(text);
+        defaults2.push(...parsed3.defaults);
+        report({ path: name2, rules: [], problems: parsed3.errors, ok: true });
       }
       if (defaults2.length > 0) values(defaults2);
-      return { lines: lines2, ok: ok4 };
+      return { lines: lines3, ok: ok4 };
     }
     if (this.o.mode === "enforce" && cred.euid !== 0) {
       const hint = "check the policy as root (sudo visudo -c), or a file with visudo -c -f <file>";
@@ -20638,7 +21834,7 @@ var Sudo = class {
     const files = await this.policy();
     for (const file of files) report(file);
     values(files.flatMap((f) => f.defaults ?? []));
-    return { lines: lines2, ok: ok4 };
+    return { lines: lines3, ok: ok4 };
   }
   async groupIds() {
     return new Map((await this.o.users.groups()).map((g) => [g.name, g.gid]));
@@ -20703,13 +21899,13 @@ var Sudo = class {
     return void 0;
   }
   async request(caller, call, signal) {
-    const parsed2 = parseArgs(call.args);
-    if (typeof parsed2 === "string") return failed2("EINVAL", parsed2);
+    const parsed3 = parseArgs(call.args);
+    if (typeof parsed3 === "string") return failed2("EINVAL", parsed3);
     if (this.o.mode !== "enforce") {
       const mode = this.o.mode;
-      if (parsed2.list) return { list: `sudo: users are '${mode}': commands run as the caller
+      if (parsed3.list) return { list: `sudo: users are '${mode}': commands run as the caller
 ` };
-      return parsed2.command.length > 0 ? { run: parsed2.command } : DONE;
+      return parsed3.command.length > 0 ? { run: parsed3.command } : DONE;
     }
     const { cred } = caller;
     const policy = await this.policyRules(caller);
@@ -20722,22 +21918,22 @@ var Sudo = class {
     };
     const applies = await this.applies(self, cred);
     const settings = resolveDefaults(policy.defaults, applies);
-    if (parsed2.removeAll) {
+    if (parsed3.removeAll) {
       this.timestamps.remove(owner.uid);
       return DONE;
     }
-    if (parsed2.reset && !parsed2.validate && !parsed2.list && parsed2.command.length === 0) {
+    if (parsed3.reset && !parsed3.validate && !parsed3.list && parsed3.command.length === 0) {
       this.timestamps.invalidate(owner, settings.timestampType);
       return DONE;
     }
-    const target = await this.lookup(parsed2.user);
-    if (!target) return failed2("ENOENT", `sudo: unknown user ${parsed2.user}`);
+    const target = await this.lookup(parsed3.user);
+    if (!target) return failed2("ENOENT", `sudo: unknown user ${parsed3.user}`);
     const root = cred.euid === 0;
     const rules = root ? [] : policy.rules;
     const mine = rules.filter((rule) => applies(rule.who));
-    if (parsed2.list) return await this.listed(self, root, mine, settings.matching);
-    const session = { caller, self, target, owner, policy: policyOf(settings), parsed: parsed2, signal };
-    if (parsed2.validate) return this.validate(session, root, mine, call.cwd);
+    if (parsed3.list) return await this.listed(self, root, mine, settings.matching);
+    const session = { caller, self, target, owner, policy: policyOf(settings), parsed: parsed3, signal };
+    if (parsed3.validate) return this.validate(session, root, mine, call.cwd);
     return this.command(session, root, mine, call);
   }
   async replay(value2) {
@@ -20796,9 +21992,9 @@ var Sudo = class {
     );
   }
   async command(s, root, mine, call) {
-    const { caller, self, target, parsed: parsed2 } = s;
+    const { caller, self, target, parsed: parsed3 } = s;
     const { cred } = caller;
-    const [word = "", ...args] = parsed2.command;
+    const [word = "", ...args] = parsed3.command;
     const cwd = await this.canonical(call.cwd);
     if (cwd === void 0 || !await this.reachable(cred, cwd)) {
       return failed2(
@@ -20813,7 +22009,7 @@ var Sudo = class {
     const matching = mine.filter(
       (rule) => (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && stdinMatches(rule, caller.stdin) && commandMatches(rule.cmnd, argv) && pinned(rule, bound3)
     );
-    const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term, bound3);
+    const grant = () => this.grant(self, target, cred, parsed3.command, path, cwd, call.term, bound3);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
     const quoted = argv.map(quoteWord).join(" ");
     if (matching.length === 0) {
@@ -20822,38 +22018,38 @@ var Sudo = class {
         `sudo: ${self.name} is not allowed to run ${quoted} as ${target.name}`
       );
     }
-    if (!parsed2.reset && this.timestamps.current(s.owner, s.policy, bound3)) {
+    if (!parsed3.reset && this.timestamps.current(s.owner, s.policy, bound3)) {
       this.timestamps.stamp(s.owner, s.policy, bound3);
       this.logged(s, cwd, argv);
       return grant();
     }
-    if (parsed2.nonInteractive) return failed2("EPERM", "sudo: a password is required");
+    if (parsed3.nonInteractive) return failed2("EPERM", "sudo: a password is required");
     return this.pendingFor(cred.ruid, async () => {
-      const answer2 = await this.ask(s, { argv: parsed2.command, path, cwd, bound: bound3 });
+      const answer2 = await this.ask(s, { argv: parsed3.command, path, cwd, bound: bound3 });
       if ("error" in answer2) return answer2;
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
       const now = await this.bound(path, cwd);
       if (!now) return failed2("ENOENT", `sudo: ${word}: command not found`);
-      const shown2 = recordable(cwd, [...parsed2.command, ...Object.keys(bound3)]);
+      const shown2 = recordable(cwd, [...parsed3.command, ...Object.keys(bound3)]);
       const result = answer2.answer === "once" ? grant() : await this.always(self, target, { cwd, argv, bound: bound3 }, now, shown2, grant);
       if (!("error" in result)) this.stamped(s, answer2, bound3);
       return result;
     });
   }
   async validate(s, root, mine, dir) {
-    const { self, parsed: parsed2 } = s;
+    const { self, parsed: parsed3 } = s;
     if (root) return DONE;
     if (mine.length === 0) {
       return failed2("EPERM", `Sorry, user ${self.name} may not run sudo on ${this.o.hostname}.`);
     }
     if (mine.every((rule) => rule.nopasswd)) return DONE;
-    if (!parsed2.reset && this.timestamps.current(s.owner, s.policy)) {
+    if (!parsed3.reset && this.timestamps.current(s.owner, s.policy)) {
       this.timestamps.stamp(s.owner, s.policy);
       return DONE;
     }
-    if (parsed2.nonInteractive) return failed2("EPERM", "sudo: a password is required");
+    if (parsed3.nonInteractive) return failed2("EPERM", "sudo: a password is required");
     const cwd = await this.canonical(dir) ?? normalizePath(dir);
     return this.pendingFor(s.caller.cred.ruid, async () => {
       const answer2 = await this.ask(s, { argv: [], path: "", cwd, bound: {}, validate: true });
@@ -20908,7 +22104,7 @@ var Sudo = class {
     }
     const shown2 = [];
     for (const rule of rules) shown2.push(described(rule, await this.writable(rule)));
-    const lines2 = shown2.join("\n");
+    const lines3 = shown2.join("\n");
     const params = defaults2.flatMap((d) => d.params).join(", ");
     const matching = params === "" ? "" : `Matching Defaults entries for ${self.name} on ${host}:
     ${params}
@@ -20916,7 +22112,7 @@ var Sudo = class {
 `;
     return {
       list: `${matching}User ${self.name} may run the following commands on ${host}:
-${lines2}
+${lines3}
 `
     };
   }
@@ -21333,7 +22529,7 @@ async function epollSyscall(req, proc) {
 
 // src/kernel/locks.ts
 var overlaps = (a, b) => a.start < b.end && b.start < a.end;
-var clashes = (lock, owner, want) => lock.owner !== owner && overlaps(lock, want) && (lock.kind === "write" || want.kind === "write");
+var clashes = (lock, owner, want2) => lock.owner !== owner && overlaps(lock, want2) && (lock.kind === "write" || want2.kind === "write");
 function lockRange(start2, len) {
   if (!Number.isSafeInteger(start2) || !Number.isSafeInteger(len)) throw new KernelError("EINVAL");
   const from = len < 0 ? start2 + len : start2;
@@ -21419,8 +22615,8 @@ var LockTable = class {
   blocked = /* @__PURE__ */ new Map();
   wakers = /* @__PURE__ */ new Map();
   held = /* @__PURE__ */ new Map();
-  holder(key, owner, want) {
-    return this.records.get(key)?.find((lock) => clashes(lock, owner, want));
+  holder(key, owner, want2) {
+    return this.records.get(key)?.find((lock) => clashes(lock, owner, want2));
   }
   set(key, owner, kind, start2, end) {
     if (kind !== "unlock" && this.holder(key, owner, { key, kind, start: start2, end })) return false;
@@ -21439,10 +22635,10 @@ var LockTable = class {
     return true;
   }
   async wait(key, owner, kind, range2, blocking) {
-    const want = { key, kind, ...range2 };
+    const want2 = { key, kind, ...range2 };
     let signal;
     for (; ; ) {
-      const holder = this.holder(key, owner, want);
+      const holder = this.holder(key, owner, want2);
       if (!holder) {
         this.set(key, owner, kind, range2.start, range2.end);
         return;
@@ -21450,7 +22646,7 @@ var LockTable = class {
       if (this.waitsOn(holder.owner, owner)) throw new KernelError("EDEADLK");
       signal ??= blocking();
       if (signal.aborted) throw new KernelError("EINTR");
-      this.blocked.set(owner, want);
+      this.blocked.set(owner, want2);
       try {
         await this.changed(key, signal);
       } finally {
@@ -21462,9 +22658,9 @@ var LockTable = class {
     const seen = /* @__PURE__ */ new Set();
     for (let at = from; at !== void 0 && !seen.has(at); ) {
       seen.add(at);
-      const want = this.blocked.get(at);
-      if (!want) return false;
-      const holder = this.holder(want.key, at, want);
+      const want2 = this.blocked.get(at);
+      if (!want2) return false;
+      const holder = this.holder(want2.key, at, want2);
       if (!holder) return false;
       if (holder.owner === target) return true;
       at = holder.owner;
@@ -21829,24 +23025,24 @@ function errno2(code, message3) {
 }
 function requestHead(method, url, headers, extra, first = []) {
   if (!TOKEN4.test(method)) throw errno2("EINVAL", `method ${method}`);
-  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
-  for (const [name2, value2] of first) lines2.push(`${name2}: ${value2}`);
+  const lines3 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
+  for (const [name2, value2] of first) lines3.push(`${name2}: ${value2}`);
   for (const [name2, value2] of headers) {
     if (OWN_HEADERS.has(name2.toLowerCase())) continue;
     if (!TOKEN4.test(name2) || !SAFE_VALUE.test(value2)) throw errno2("EINVAL", `header ${name2}`);
-    lines2.push(`${name2}: ${value2}`);
+    lines3.push(`${name2}: ${value2}`);
   }
-  for (const [name2, value2] of extra) lines2.push(`${name2}: ${value2}`);
-  return latin1Bytes(`${lines2.join("\r\n")}\r
+  for (const [name2, value2] of extra) lines3.push(`${name2}: ${value2}`);
+  return latin1Bytes(`${lines3.join("\r\n")}\r
 \r
 `);
 }
 function parseHead(bytes) {
-  const [statusLine = "", ...lines2] = latin1(bytes).split(/\r?\n/);
+  const [statusLine = "", ...lines3] = latin1(bytes).split(/\r?\n/);
   const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
   if (!match) throw errno2("EPROTO", `not an HTTP/1.x response: ${statusLine.slice(0, 80)}`);
   const headers = [];
-  for (const line of lines2) {
+  for (const line of lines3) {
     const colon = line.indexOf(":");
     if (colon > 0) headers.push([line.slice(0, colon).trim(), line.slice(colon + 1).trim()]);
   }
@@ -21936,8 +23132,8 @@ var KernelLoopback = class {
       );
     } catch (err) {
       socket.close();
-      const refused4 = err instanceof KernelError && err.code === "ECONNREFUSED";
-      throw refused4 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+      const refused5 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused5 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
     }
     signal.addEventListener("abort", () => socket.close(), { once: true });
     return socket;
@@ -22326,9 +23522,9 @@ function pem(der2) {
   for (let i = 0; i < der2.length; i += 32768) {
     b642 += String.fromCharCode(...der2.subarray(i, i + 32768));
   }
-  const lines2 = btoa(b642).match(/.{1,64}/g) ?? [];
+  const lines3 = btoa(b642).match(/.{1,64}/g) ?? [];
   return `-----BEGIN CERTIFICATE-----
-${lines2.join("\n")}
+${lines3.join("\n")}
 -----END CERTIFICATE-----
 `;
 }
@@ -23112,13 +24308,13 @@ var HOSTS_PATH = "/etc/hosts";
 function parseHosts(text) {
   const table = /* @__PURE__ */ new Map();
   for (const raw2 of text.split("\n")) {
-    const [address, ...names2] = raw2.replace(/#.*/, "").trim().split(/\s+/);
-    if (!address || names2.length === 0) continue;
-    if (ipv4Bytes(address) === void 0 && ipv6Groups(address) === void 0) continue;
+    const [address2, ...names2] = raw2.replace(/#.*/, "").trim().split(/\s+/);
+    if (!address2 || names2.length === 0) continue;
+    if (ipv4Bytes(address2) === void 0 && ipv6Groups(address2) === void 0) continue;
     for (const name2 of names2) {
       const key = name2.toLowerCase().replace(/\.$/, "");
       const known = table.get(key) ?? [];
-      if (!known.includes(address)) known.push(address);
+      if (!known.includes(address2)) known.push(address2);
       table.set(key, known);
     }
   }
@@ -23318,14 +24514,14 @@ var Resolver = class {
     if (hostsEntry(key, this.own) !== void 0) return true;
     return ((await this.hosts?.().catch(() => void 0))?.get(key)?.length ?? 0) > 0;
   }
-  async reverse(address) {
-    const v6 = ipv6Groups(address)?.join(":");
-    const same3 = (a) => a === address || v6 !== void 0 && ipv6Groups(a)?.join(":") === v6;
+  async reverse(address2) {
+    const v6 = ipv6Groups(address2)?.join(":");
+    const same3 = (a) => a === address2 || v6 !== void 0 && ipv6Groups(a)?.join(":") === v6;
     const file = await this.hosts?.().catch(() => void 0);
     for (const table of [file, this.builtin]) {
       for (const [name2, addresses] of table ?? []) if (addresses.some(same3)) return name2;
     }
-    if (ipv4Bytes(address)?.[0] === 127) return "localhost";
+    if (ipv4Bytes(address2)?.[0] === 127) return "localhost";
     return void 0;
   }
   async resolve(name2, family, blocking) {
@@ -23379,13 +24575,13 @@ var Resolver = class {
     if (addresses.length > 0) this.remember(id2, addresses, answer2.ttl);
     return addresses;
   }
-  usable(name2, address, family) {
-    const v4 = ipv4Bytes(address) !== void 0;
-    if (!v4 && (family === 4 || !ipv6Groups(address))) return false;
+  usable(name2, address2, family) {
+    const v4 = ipv4Bytes(address2) !== void 0;
+    if (!v4 && (family === 4 || !ipv6Groups(address2))) return false;
     if (v4 && family === 6) return false;
-    const kind = this.routes.classify(address);
+    const kind = this.routes.classify(address2);
     if (kind !== "loopback" && kind !== "host" && kind !== "reserved") return true;
-    this.log(`slicc-kernel: dropped the uplink's answer ${address} for ${name2}: it is ${kind}`);
+    this.log(`slicc-kernel: dropped the uplink's answer ${address2} for ${name2}: it is ${kind}`);
     return false;
   }
   remember(id2, addresses, ttl) {
@@ -23419,275 +24615,6 @@ function waitFor(lookup2, signal) {
   });
 }
 
-// src/kernel/tty.ts
-var ICRNL = 256;
-var IUTF8 = 16384;
-var OPOST = 1;
-var ONLCR = 4;
-var ISIG = 1;
-var ICANON = 2;
-var ECHO = 8;
-var ECHOE = 16;
-var ECHOCTL = 512;
-var NOFLSH = 128;
-var IEXTEN = 32768;
-var VINTR = 0;
-var VQUIT = 1;
-var VERASE = 2;
-var VKILL = 3;
-var VEOF = 4;
-var VSUSP = 10;
-var VWERASE = 14;
-function defaultTermios() {
-  const cCc = new Array(32).fill(0);
-  Object.assign(cCc, { [VINTR]: 3, [VQUIT]: 28, [VERASE]: 127, [VKILL]: 21 });
-  Object.assign(cCc, { [VEOF]: 4, 6: 1, 8: 17, 9: 19, [VSUSP]: 26 });
-  Object.assign(cCc, { 12: 18, 13: 15, [VWERASE]: 23, 15: 22 });
-  return {
-    c_iflag: ICRNL | 1024 | 8192 | IUTF8,
-    c_oflag: OPOST | ONLCR,
-    c_cflag: 15 | 48 | 128,
-    c_lflag: ISIG | ICANON | ECHO | ECHOE | 32 | ECHOCTL | 2048 | IEXTEN,
-    c_cc: cCc
-  };
-}
-var encoder7 = new TextEncoder();
-function isContinuation(byte) {
-  return (byte & 192) === 128;
-}
-var KernelTty = class {
-  termios = defaultTermios();
-  cols = 80;
-  rows = 24;
-  readable = [];
-  line = [];
-  waiters = [];
-  hungUp = false;
-  name;
-  owner;
-  onRead;
-  readers = 0;
-  screen;
-  signal;
-  constructor(screen, signal) {
-    this.screen = screen;
-    this.signal = signal;
-  }
-  receive(bytes) {
-    for (const byte of bytes) this.key(byte);
-    this.wake();
-  }
-  resize(cols, rows) {
-    if (cols === this.cols && rows === this.rows) return;
-    this.setSize(cols, rows);
-    this.signal(SIG.WINCH);
-  }
-  hangup() {
-    this.hungUp = true;
-    this.wake();
-  }
-  signalHangup() {
-    this.signal(SIG.HUP);
-  }
-  setSize(cols, rows) {
-    this.cols = cols;
-    this.rows = rows;
-  }
-  tcgets() {
-    return { ...this.termios, c_cc: [...this.termios.c_cc] };
-  }
-  tcsets(termios, flush = false) {
-    const wasCanonical = this.canonical;
-    this.termios = { ...termios, c_cc: [...termios.c_cc] };
-    if (flush) {
-      this.line = [];
-      this.readable = [];
-    }
-    if (wasCanonical && !this.canonical && this.line.length > 0) {
-      this.readable.push(Uint8Array.from(this.line));
-      this.line = [];
-      this.wake();
-    }
-  }
-  winsize() {
-    return [this.rows, this.cols];
-  }
-  file() {
-    return new OpenFile({
-      read: (max, signal) => this.read(max, signal),
-      write: async (bytes) => {
-        if (this.hungUp) throw new KernelError("EIO");
-        this.output(bytes);
-        return bytes.length;
-      },
-      poll: () => ({
-        readable: this.readable.length > 0 || this.hungUp,
-        writable: true,
-        hangup: this.hungUp,
-        nread: this.readable.reduce((n, chunk2) => n + (chunk2?.length ?? 0), 0)
-      }),
-      changed: (signal) => this.changed(signal),
-      close: () => {
-      },
-      tty: this
-    });
-  }
-  get canonical() {
-    return (this.termios.c_lflag & ICANON) !== 0;
-  }
-  cc(slot2) {
-    return this.termios.c_cc[slot2] ?? 0;
-  }
-  key(input) {
-    const { c_iflag, c_lflag } = this.termios;
-    const byte = input === 13 && c_iflag & ICRNL ? 10 : input;
-    if (c_lflag & ISIG && this.signalKey(byte)) return;
-    if (!this.canonical) {
-      this.readable.push(Uint8Array.of(byte));
-      if (c_lflag & ECHO) this.echo(byte);
-      return;
-    }
-    this.edit(byte);
-  }
-  signalKey(byte) {
-    const sig = byte === this.cc(VINTR) ? SIG.INT : byte === this.cc(VQUIT) ? SIG.QUIT : byte === this.cc(VSUSP) ? SIG.TSTP : 0;
-    if (!sig || byte === 0) return false;
-    if (this.termios.c_lflag & ECHO) this.echo(byte);
-    if (!(this.termios.c_lflag & NOFLSH)) {
-      this.line = [];
-      this.readable = [];
-    }
-    this.signal(sig);
-    return true;
-  }
-  edit(byte) {
-    const echo = (this.termios.c_lflag & ECHO) !== 0;
-    if (byte === this.cc(VERASE) || byte === 8) {
-      this.rubOut(this.lastCharLength());
-    } else if (byte === this.cc(VKILL)) {
-      this.rubOut(this.line.length);
-    } else if (byte === this.cc(VWERASE)) {
-      this.rubOut(this.lastWordLength());
-    } else if (byte === this.cc(VEOF)) {
-      this.readable.push(this.line.length > 0 ? Uint8Array.from(this.line) : null);
-      this.line = [];
-    } else if (byte === 10) {
-      this.line.push(byte);
-      this.readable.push(Uint8Array.from(this.line));
-      this.line = [];
-      if (echo) this.output(encoder7.encode("\n"));
-    } else {
-      this.line.push(byte);
-      if (echo) this.echo(byte);
-    }
-  }
-  lastWordLength() {
-    let end = this.line.length;
-    while (end > 0 && this.line[end - 1] === 32) end--;
-    while (end > 0 && this.line[end - 1] !== 32) end--;
-    return this.line.length - end;
-  }
-  lastCharLength() {
-    const { line } = this;
-    let n = Math.min(1, line.length);
-    if (this.termios.c_iflag & IUTF8) {
-      while (n < line.length && isContinuation(line[line.length - n] ?? 0)) n++;
-    }
-    return n;
-  }
-  rubOut(n) {
-    const dropped2 = this.line.splice(this.line.length - n, n);
-    const utf83 = (this.termios.c_iflag & IUTF8) !== 0;
-    const cells = utf83 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
-    if (cells > 0 && this.termios.c_lflag & ECHO) {
-      this.output(encoder7.encode("\b \b".repeat(cells)), false);
-    }
-  }
-  echo(byte) {
-    if (byte < 32 && byte !== 10 && byte !== 9 && this.termios.c_lflag & ECHOCTL) {
-      this.output(Uint8Array.of(94, byte + 64), false);
-      return;
-    }
-    this.output(Uint8Array.of(byte));
-  }
-  output(bytes, translate2 = true) {
-    const { c_oflag } = this.termios;
-    if (!translate2 || !(c_oflag & OPOST && c_oflag & ONLCR) || !bytes.includes(10)) {
-      this.screen.write(bytes);
-      return;
-    }
-    const out = [];
-    for (const byte of bytes) {
-      if (byte === 10) out.push(13);
-      out.push(byte);
-    }
-    this.screen.write(Uint8Array.from(out));
-  }
-  get reading() {
-    return this.readers > 0;
-  }
-  async read(max, signal) {
-    this.onRead?.();
-    this.readers++;
-    try {
-      return await this.take(max, signal);
-    } finally {
-      this.readers--;
-    }
-  }
-  async take(max, signal) {
-    while (this.readable.length === 0) {
-      if (this.hungUp) return new Uint8Array(0);
-      await this.changed(signal);
-    }
-    const head = this.readable[0];
-    if (head === null) {
-      this.readable.shift();
-      return new Uint8Array(0);
-    }
-    if (head === void 0) return new Uint8Array(0);
-    const chunks = [];
-    let n = 0;
-    while (this.readable.length > 0 && n < max) {
-      const next3 = this.readable[0];
-      if (next3 === null || next3 === void 0) break;
-      const take = next3.subarray(0, max - n);
-      chunks.push(take);
-      n += take.length;
-      if (take.length < next3.length) this.readable[0] = next3.subarray(take.length);
-      else this.readable.shift();
-      if (this.canonical) break;
-    }
-    const out = new Uint8Array(n);
-    let at = 0;
-    for (const chunk2 of chunks) {
-      out.set(chunk2, at);
-      at += chunk2.length;
-    }
-    return out;
-  }
-  changed(signal) {
-    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve2, reject) => {
-      const onAbort = () => {
-        this.waiters = this.waiters.filter((w) => w !== waiter);
-        reject(new KernelError("EINTR"));
-      };
-      const waiter = () => {
-        signal?.removeEventListener("abort", onAbort);
-        resolve2();
-      };
-      this.waiters.push(waiter);
-      signal?.addEventListener("abort", onAbort, { once: true });
-    });
-  }
-  wake() {
-    const waiters = this.waiters;
-    this.waiters = [];
-    for (const resolve2 of waiters) resolve2();
-  }
-};
-
 // src/kernel/pty.ts
 var PtyPair = class {
   slave;
@@ -23880,6 +24807,7 @@ function ptySyscall(req, ctx) {
       return done4;
     case "pty-ctty": {
       const tty = terminalOf(ctx, req.fd);
+      if (ctx.fds.get(req.fd).file.device) throw new KernelError("EPERM");
       const leader = ctx.jobs?.getsid(ctx.pid, 0) === ctx.pid;
       if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done4;
       if (!ctx.jobs?.acquireTerminal(ctx.pid, tty)) throw new KernelError("EPERM");
@@ -24661,10 +25589,10 @@ function basicOf(value2) {
 function placeholdersIn(text) {
   return [...new Set(text.match(ANY_PLACEHOLDER) ?? [])];
 }
-function scan(lines2) {
+function scan(lines3) {
   const found = [];
-  for (let i = 1; i < lines2.length; i++) {
-    const m = HEADER_LINE.exec(lines2[i]);
+  for (let i = 1; i < lines3.length; i++) {
+    const m = HEADER_LINE.exec(lines3[i]);
     if (!m) return void 0;
     const value2 = m[2];
     const basic = basicOf(value2);
@@ -24687,10 +25615,10 @@ function usable2(values) {
 }
 async function substituteHead(head, ask) {
   if (!head.endsWith("\r\n\r\n")) return void 0;
-  const lines2 = head.slice(0, -4).split("\r\n");
-  if (lines2.some((l) => l.includes("\n") || l.includes("\r"))) return void 0;
-  const request3 = REQUEST_LINE2.exec(lines2[0]);
-  const found = request3 ? scan(lines2) : void 0;
+  const lines3 = head.slice(0, -4).split("\r\n");
+  if (lines3.some((l) => l.includes("\n") || l.includes("\r"))) return void 0;
+  const request3 = REQUEST_LINE2.exec(lines3[0]);
+  const found = request3 ? scan(lines3) : void 0;
   if (!request3 || !found || found.length !== 1) return void 0;
   const at = found[0];
   if (at.placeholders.length > SESSION_PLACEHOLDERS) return void 0;
@@ -24702,8 +25630,8 @@ async function substituteHead(head, ask) {
   );
   if (Object.keys(values).length === 0) return void 0;
   const value2 = at.basic ? `${at.basic.scheme}${btoa(replaced(at.basic.decoded, values))}` : replaced(at.value, values);
-  const out = [...lines2];
-  out[at.line] = `${lines2[at.line].split(":")[0]}: ${value2}`;
+  const out = [...lines3];
+  out[at.line] = `${lines3[at.line].split(":")[0]}: ${value2}`;
   return { head: `${out.join("\r\n")}\r
 \r
 `, values };
@@ -25026,9 +25954,9 @@ function serverHeader(header4, server) {
   return server.plus && server.binding ? END_POINT : "n,,";
 }
 function rewritten(first, header4) {
-  const parsed2 = clientFirstOf(first.data);
-  if (!parsed2 || parsed2.header === header4) return first;
-  return { mechanism: header4 === END_POINT ? PLUS : PLAIN3, data: `${header4}${parsed2.bare}` };
+  const parsed3 = clientFirstOf(first.data);
+  if (!parsed3 || parsed3.header === header4) return first;
+  return { mechanism: header4 === END_POINT ? PLUS : PLAIN3, data: `${header4}${parsed3.bare}` };
 }
 var PgClient = class {
   clientFirst;
@@ -25048,10 +25976,10 @@ var PgClient = class {
     }
     if (server.sasl && this.clientFirst === void 0) {
       const first = initial(message3);
-      const parsed2 = first && clientFirstOf(first.data);
-      if (!first || !parsed2) return { bytes: message3, done: true };
+      const parsed3 = first && clientFirstOf(first.data);
+      if (!first || !parsed3) return { bytes: message3, done: true };
       this.clientFirst = first.data;
-      this.header = serverHeader(parsed2.header, server);
+      this.header = serverHeader(parsed3.header, server);
       const sent = rewritten(first, this.header);
       if (sent === first) return { bytes: message3, done: false };
       return {
@@ -25216,7 +26144,7 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-function modeOf2(start2) {
+function modeOf3(start2) {
   const sniffs = [
     ["http1", sniffHttp1(start2)],
     ["smtp", sniffSmtp(start2)],
@@ -25325,7 +26253,7 @@ var SessionWriter = class {
     joined5.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined5;
-    if (this.mode === "sniff") this.mode = modeOf2(latin12(joined5.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "sniff") this.mode = modeOf3(latin12(joined5.subarray(0, 8))) ?? "sniff";
     if (this.mode === "pg" && !this.sawPg) {
       this.sawPg = true;
       if (!this.s.verified) void this.proof("pg");
@@ -25812,12 +26740,12 @@ function secure(prepared, seal) {
       prepared.own?.release();
     }
   };
-  const abandon = () => {
+  const abandon2 = () => {
     if (ran) return;
     prepared.options.session.free();
     prepared.own?.release();
   };
-  return { make, abandon };
+  return { make, abandon: abandon2 };
 }
 function supportOf(net) {
   const support = net.tlsClient;
@@ -25834,19 +26762,19 @@ async function uplinkAddress(proc, host) {
 async function connectSecure(proc, socket, host, port, req) {
   const servername = serverName(req.servername || host);
   if (isLoopbackHost(servername) || isLoopbackHost(host)) throw new KernelError("ENOTSUP");
-  const address = await uplinkAddress(proc, host);
-  const route2 = proc.net.uplinkFor(address);
+  const address2 = await uplinkAddress(proc, host);
+  const route2 = proc.net.uplinkFor(address2);
   if (!route2)
     throw new KernelError("ENOTSUP", "TLS in the kernel needs a destination the uplink routes");
   const support = supportOf(proc.net);
   let info;
-  const { make, abandon } = secure(await prepare2(support, req, servername), { proc, port });
+  const { make, abandon: abandon2 } = secure(await prepare2(support, req, servername), { proc, port });
   try {
-    await socket.connectSecure({ family: "inet", host: address, port }, route2, async (conn) => {
+    await socket.connectSecure({ family: "inet", host: address2, port }, route2, async (conn) => {
       info = await conn.upgrade(make);
     });
   } finally {
-    abandon();
+    abandon2();
   }
   return sessionOf(info, servername);
 }
@@ -25879,14 +26807,14 @@ async function upgradeSecure(proc, socket, req) {
   const host = req.servername || (peer?.family === "inet" ? peer.host : "");
   const servername = serverName(host);
   const port = peer?.family === "inet" ? peer.port : 0;
-  const { make, abandon } = secure(await prepare2(supportOf(proc.net), req, servername), {
+  const { make, abandon: abandon2 } = secure(await prepare2(supportOf(proc.net), req, servername), {
     proc,
     port
   });
   try {
     return sessionOf(await socket.upgradeSecure(make), servername);
   } finally {
-    abandon();
+    abandon2();
   }
 }
 
@@ -27810,6 +28738,10 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-open-clipboard",
   "fd-clipboard-abort",
   "fd-open-embedder",
+  "fd-dev-nodes",
+  "fd-open-dev",
+  "fd-dev-ioctl",
+  "fd-dev-meta",
   "tty-get",
   "tty-set",
   "tty-winsz",
@@ -28186,7 +29118,7 @@ var WasmProcess = class {
   async dispatch(req, cancelled) {
     try {
       if (isFdSyscall(req)) return await this.fdSyscall(req, cancelled);
-      if (isTtySyscall(req)) return this.ttySyscall(req);
+      if (isTtySyscall(req)) return await this.ttySyscall(req, cancelled);
       if (isJobSyscall(req)) return this.jobSyscall(req);
       if (isSocketSyscall(req)) return await this.socketSyscall(req, cancelled);
       if (isSemSyscall(req)) return await this.semSyscall(req, cancelled);
@@ -28250,7 +29182,7 @@ var WasmProcess = class {
     return owner;
   }
   pathKeys = /* @__PURE__ */ new Map();
-  async lockPath(target, want) {
+  async lockPath(target, want2) {
     if (target.fd !== void 0) {
       const st = await this.fds.get(target.fd).file.stat?.();
       if (!st) throw new KernelError("EBADF");
@@ -28260,9 +29192,9 @@ var WasmProcess = class {
     if (!target.path.startsWith("/")) throw new KernelError("EINVAL");
     const path = target.path;
     const g = this.guarded();
-    const checked = `${want}:${path}`;
-    if (g && want !== 0 && !this.lockChecked.has(checked)) {
-      await openable(g, "lock", path, want, false);
+    const checked = `${want2}:${path}`;
+    if (g && want2 !== 0 && !this.lockChecked.has(checked)) {
+      await openable(g, "lock", path, want2, false);
       this.lockChecked.add(checked);
     }
     return path;
@@ -28275,8 +29207,8 @@ var WasmProcess = class {
     const known = file ? fileKeys.get(file) : this.pathKeys.get(target.path ?? "");
     if (kind === "close" && !file && target.path !== void 0) this.pathKeys.delete(target.path);
     if (access2 && !access2.stat) return objectKey(access2);
-    const want = kind === "read" ? R_OK : kind === "write" ? W_OK : 0;
-    const path = await this.lockPath(target, want);
+    const want2 = kind === "read" ? R_OK : kind === "write" ? W_OK : 0;
+    const path = await this.lockPath(target, want2);
     if (known !== void 0) return known;
     const st = await this.options.fs.stat?.(path).catch((err) => {
       if (!file) throw err;
@@ -28362,7 +29294,7 @@ var WasmProcess = class {
     const file = this.fds.get(req.fd).file;
     const read = req.peek ? file.peek : file.read;
     if (!read) throw new KernelError(req.peek && file.read ? "EOPNOTSUPP" : "EBADF");
-    if (file.tty) this.checkForeground(file.tty);
+    if (file.tty && !file.device) this.checkForeground(file.tty);
     if (file.clipboard) return this.readClipboard(file.clipboard, req, cancelled);
     if (file.embedder) return this.readEmbedder(file, req, cancelled);
     if (file instanceof EventFd && req.max < EventFd.SIZE) throw new KernelError("EINVAL");
@@ -28459,6 +29391,46 @@ var WasmProcess = class {
       throw err;
     });
   }
+  async openDev(path, flags2, cancelled) {
+    const devices = this.options.devices;
+    if (!devices) throw new KernelError("ENOENT");
+    const shown2 = await this.options.identity?.();
+    const tags = this.options.embedder?.tagsOf(this.pid);
+    const stamp = {
+      pid: shown2?.pid ?? this.pid,
+      uid: this.cred.euid,
+      gid: this.cred.egid,
+      groups: [...this.cred.groups],
+      users: devices.users,
+      ...tags?.length ? { tag: tags[0], tags: [...tags] } : {}
+    };
+    const guard2 = this.guarded();
+    const file = await devices.open(path, flags2, {
+      stamp,
+      ...guard2 ? { guard: guard2 } : {},
+      signal: this.blockingSignal(cancelled)
+    });
+    return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
+  }
+  devMeta(path, change) {
+    const devices = this.options.devices;
+    if (!devices) throw new KernelError("ENOENT");
+    devices.meta(path, change, this.guarded());
+    return { ok: true, kind: "void" };
+  }
+  async devIoctl(req, cancelled) {
+    const file = this.fds.get(req.fd).file;
+    if (!file.device) {
+      if (req.request >>> 0 === 21531) return pollFile(file).nread ?? 0;
+      throw new KernelError("ENOTTY");
+    }
+    const result = await file.device.ioctl(
+      req.request >>> 0,
+      req.arg,
+      this.blockingSignal(cancelled)
+    );
+    return result ?? null;
+  }
   async openEmbedder(flags2) {
     const broker = this.options.embedder;
     if (!broker) throw new KernelError("ENOENT");
@@ -28546,11 +29518,11 @@ var WasmProcess = class {
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
           const marks = this.options.owners || plain3 !== void 0;
-          const fresh3 = marks && !await present3(fs, path, true);
+          const fresh4 = marks && !await present3(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open2, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh3 && plain3 !== void 0) await fs.chmod?.(path, plain3);
-          else if (fresh3) {
+          if (fresh4 && plain3 !== void 0) await fs.chmod?.(path, plain3);
+          else if (fresh4) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
         });
@@ -28649,8 +29621,8 @@ var WasmProcess = class {
     if (req.exclusive) return inParent(g, "open", req.path);
     if (req.created && guard2.created?.take(req.path)) return;
     const access2 = req.flags & WRITE_ACCESS;
-    const want = (access2 === 1 ? 0 : R_OK) | (access2 !== 0 || req.truncate ? W_OK : 0);
-    await openable(g, "open", req.path, want, req.create === true);
+    const want2 = (access2 === 1 ? 0 : R_OK) | (access2 !== 0 || req.truncate ? W_OK : 0);
+    await openable(g, "open", req.path, want2, req.create === true);
   }
   openTty(name2) {
     const tty = name2 === void 0 ? this.controllingTerminal() : this.options.jobs?.terminalNamed(name2);
@@ -28714,7 +29686,7 @@ var WasmProcess = class {
   }
   terminalByName(name2) {
     const n = ptsNumber(name2);
-    const tty = n === void 0 ? this.options.jobs?.terminalNamed(name2) : this.options.ptys?.get(n).slave;
+    const tty = n === void 0 ? this.options.jobs?.terminalNamed(name2) ?? this.options.devices?.openTty(name2) : this.options.ptys?.get(n).slave;
     if (!tty) throw new KernelError("ENOENT");
     return tty;
   }
@@ -28836,6 +29808,16 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: await this.openClipboard(req.flags) };
       case "fd-open-embedder":
         return { ok: true, kind: "json", json: await this.openEmbedder(req.flags) };
+      case "fd-dev-nodes":
+        return { ok: true, kind: "json", json: this.options.devices?.list() ?? [] };
+      case "fd-open-dev":
+        return { ok: true, kind: "json", json: await this.openDev(req.path, req.flags, cancelled) };
+      case "fd-dev-ioctl":
+        return { ok: true, kind: "json", json: await this.devIoctl(req, cancelled) };
+      case "fd-dev-meta": {
+        const { op: _, path, ...change } = req;
+        return this.devMeta(path, change);
+      }
       case "fd-clipboard-abort": {
         const file = this.fds.get(req.fd);
         file.file.clipboard?.abort();
@@ -28880,6 +29862,11 @@ var WasmProcess = class {
       return { ok: true, kind: "void" };
     }
     const file = this.fds.get(req.fd).file;
+    const device = file.device;
+    if (device && (req.op === "fd-chmod" || req.op === "fd-chown" || req.op === "fd-utimes")) {
+      const { op: _, fd: __, ...change } = req;
+      return this.devMeta(device.path, change);
+    }
     if (!file.pread || !file.pwrite || !file.resize || !file.stat) throw new KernelError("ESPIPE");
     switch (req.op) {
       case "fd-pread":
@@ -29049,14 +30036,19 @@ var WasmProcess = class {
       ...file.fifo !== void 0 ? { fifo: file.fifo } : {}
     };
   }
-  ttySyscall(req) {
+  async ttySyscall(req, cancelled) {
     const tty = this.tty(req.fd);
     const jobs = this.options.jobs;
+    const device = this.fds.get(req.fd).file.device;
+    if (device && req.op.startsWith("tty-pgrp")) throw new KernelError("ENOTTY");
     switch (req.op) {
       case "tty-get":
         return { ok: true, kind: "json", json: tty.tcgets() };
       case "tty-set":
-        tty.tcsets(req.termios, req.flush === true);
+        if (device) {
+          const how = { flush: req.flush === true, drain: req.drain === true };
+          await device.setTermios(req.termios, how, this.blockingSignal(cancelled));
+        } else tty.tcsets(req.termios, req.flush === true);
         return { ok: true, kind: "void" };
       case "tty-winsz": {
         const size = tty.winsize();
@@ -29937,6 +30929,7 @@ function processOptions(opts, header4, hooks, created4) {
     ...opts.outputFilter ? { outputFilter: opts.outputFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...embedderOptions(opts),
+    devices: opts.devices,
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.source ? { source: opts.source } : {},
     noLinks: opts.noLinks,
@@ -30688,14 +31681,14 @@ var LockService = class {
       );
     });
   }
-  async holder(key, owner, want) {
+  async holder(key, owner, want2) {
     return await this.ask({
       op: "holder",
       key,
       owner,
-      kind: want.kind,
-      start: want.start,
-      end: want.end
+      kind: want2.kind,
+      start: want2.start,
+      end: want2.end
     }) ?? void 0;
   }
   async set(key, owner, kind, start2, end) {
@@ -30974,9 +31967,9 @@ function local(name2) {
 function literal2(name2) {
   return ipv4Bytes(name2) !== void 0 || ipv6Groups(name2) !== void 0;
 }
-function addressData(address, type) {
-  if (type === TYPE_A) return ipv4Bytes(address);
-  const groups = type === TYPE_AAAA ? ipv6Groups(address) : void 0;
+function addressData(address2, type) {
+  if (type === TYPE_A) return ipv4Bytes(address2);
+  const groups = type === TYPE_AAAA ? ipv6Groups(address2) : void 0;
   return groups?.flatMap((g) => [g >> 8, g & 255]);
 }
 var DnsStub = class {
@@ -30989,10 +31982,10 @@ var DnsStub = class {
     this.timeoutMs = options.timeoutMs ?? DNS_FORWARD_TIMEOUT_MS;
   }
   async answer(query, udp) {
-    const parsed2 = parseQuery(query);
-    if (!parsed2) return void 0;
-    if (!parsed2.ok) return errorReply2(parsed2.id, parsed2.flags, parsed2.rcode);
-    const q = parsed2.question;
+    const parsed3 = parseQuery(query);
+    if (!parsed3) return void 0;
+    if (!parsed3.ok) return errorReply2(parsed3.id, parsed3.flags, parsed3.rcode);
+    const q = parsed3.question;
     const reply = await this.reply(query, q).catch(
       () => answerReply(query, q, SERVFAIL, [], false)
     );
@@ -31001,8 +31994,8 @@ var DnsStub = class {
   async reply(query, q) {
     if (q.klass !== CLASS_IN || literal2(q.name)) return this.forward(query, q);
     if (q.type === TYPE_PTR) {
-      const address = reverseAddress(q.name);
-      const name2 = address !== void 0 ? await this.reverse(address) : void 0;
+      const address2 = reverseAddress(q.name);
+      const name2 = address2 !== void 0 ? await this.reverse(address2) : void 0;
       if (name2 !== void 0)
         return answerReply(query, q, NOERROR, [record2(TYPE_PTR, encodeName(name2))], true);
       return this.forward(query, q);
@@ -31032,8 +32025,8 @@ var DnsStub = class {
   known(name2) {
     return this.resolver.known(name2).catch(() => false);
   }
-  reverse(address) {
-    return this.resolver.reverse(address).catch(() => void 0);
+  reverse(address2) {
+    return this.resolver.reverse(address2).catch(() => void 0);
   }
   async forward(query, q) {
     if (!this.forwarder) return answerReply(query, q, SERVFAIL, [], false);
@@ -31212,7 +32205,7 @@ function honors(traits, redirect) {
   const raw2 = traits.manualRedirects === true && (hops === void 0 || hops === false);
   return redirect === "manual" && raw2;
 }
-function refused3(message3) {
+function refused4(message3) {
   return new TransportError(message3, 502, void 0, "transport");
 }
 var RemoteTransport = class {
@@ -31303,7 +32296,7 @@ var RemoteTransport = class {
     const { signal, redirect } = request3;
     signal.throwIfAborted();
     if (unfollowed2(redirect) && !honors(this.traits, redirect)) {
-      throw refused3(`this transport cannot honor redirect: ${redirect}`);
+      throw refused4(`this transport cannot honor redirect: ${redirect}`);
     }
     let finished = false;
     const abort = () => {
@@ -31354,7 +32347,7 @@ var RemoteTransport = class {
     };
     if (unfollowed2(redirect) && (redirected2 || redirects?.length)) {
       await cancel();
-      throw refused3(`this transport followed a redirect despite redirect: ${redirect}`);
+      throw refused4(`this transport followed a redirect despite redirect: ${redirect}`);
     }
     return {
       ...url !== void 0 ? { url } : {},
@@ -31844,6 +32837,7 @@ var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-list",
   "proc-identity",
   "fd-info",
+  "fd-dev-nodes",
   "sig-mask",
   "sig-inherited",
   "proc-setpgid",
@@ -31940,8 +32934,8 @@ var WasmMemories = class {
     const learned = this.learned;
     if (!learned) return this.base;
     const steps = Math.floor((this.now() - learned.at) / DECAY_MS);
-    const raised = learned.ceiling + steps * DECAY_STEP;
-    if (raised < (this.base ?? DEFAULT_CEILING)) return raised;
+    const raised2 = learned.ceiling + steps * DECAY_STEP;
+    if (raised2 < (this.base ?? DEFAULT_CEILING)) return raised2;
     this.learned = void 0;
     return this.base;
   }
@@ -32084,9 +33078,9 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open2 = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
-    const refused4 = driverVersionError(message3.protocol);
-    if (refused4) {
-      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused4, errno: "EPROTO" } });
+    const refused5 = driverVersionError(message3.protocol);
+    if (refused5) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused5, errno: "EPROTO" } });
       return;
     }
     try {
@@ -32392,7 +33386,7 @@ function unescape(field4) {
   );
 }
 function parseFstab(text) {
-  const lines2 = [];
+  const lines3 = [];
   text.split("\n").forEach((raw2, index) => {
     const content = raw2.replace(/#.*$/, "").trim();
     if (!content) return;
@@ -32401,12 +33395,12 @@ function parseFstab(text) {
     if (options.split(",").includes("noauto")) return;
     const spec = { source, target, type, options: {} };
     try {
-      lines2.push({ line: index + 1, spec: { ...spec, options: parseMountOptions(options) } });
+      lines3.push({ line: index + 1, spec: { ...spec, options: parseMountOptions(options) } });
     } catch (err) {
-      lines2.push({ line: index + 1, spec, invalid: err });
+      lines3.push({ line: index + 1, spec, invalid: err });
     }
   });
-  return lines2;
+  return lines3;
 }
 function codeOf6(err) {
   const code = err?.code;
@@ -32424,20 +33418,20 @@ function wait(ms, signal) {
     signal.addEventListener("abort", done5, { once: true });
   });
 }
-async function mountFstab(lines2, mount, signal, retries = FSTAB_RETRIES, discard = () => {
+async function mountFstab(lines3, mount, signal, retries = FSTAB_RETRIES, discard = () => {
 }, settled = () => {
 }) {
   return Promise.all(
-    lines2.map(async (each) => {
+    lines3.map(async (each) => {
       const result = await mountLine(each, mount, signal, retries, discard);
       settled(each, result);
       return result;
     })
   );
 }
-async function mountLine({ line, spec, invalid }, mount, signal, retries, discard) {
-  let failed4 = invalid;
-  for (let attempt = 0; !invalid && attempt <= retries.length && !signal.aborted; attempt++) {
+async function mountLine({ line, spec, invalid: invalid2 }, mount, signal, retries, discard) {
+  let failed4 = invalid2;
+  for (let attempt = 0; !invalid2 && attempt <= retries.length && !signal.aborted; attempt++) {
     try {
       const entry = await mount(spec);
       if (!signal.aborted) return { line, target: spec.target, entry };
@@ -32605,14 +33599,14 @@ var RESTORE_AGAIN_MS = 3e4;
 function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
   const handles = /* @__PURE__ */ new Map();
   let nextFh = 0;
-  const fresh3 = (remote) => {
+  const fresh4 = (remote) => {
     if (remote.client.token === remote.token && !remote.client.gone) return remote;
     throw fsError2("ESTALE", "the folder was granted again, so this open file is gone");
   };
   const live2 = (fh) => {
     const remote = handles.get(fh);
     if (!remote) throw fsError2("EBADF", `handle ${fh}`);
-    return fresh3(remote);
+    return fresh4(remote);
   };
   const call = (op, body = {}) => current().call(op, body);
   const same3 = (was, mode, seen) => seen?.mode === (mode | 128) && (was.ino !== void 0 && seen.ino !== void 0 ? seen.ino === was.ino : seen.size === was.size && seen.mtime === was.mtime);
@@ -32694,7 +33688,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
       if (!remote) throw fsError2("EBADF", `handle ${fh}`);
       handles.delete(fh);
       try {
-        await fresh3(remote).client.call("release", { fh: remote.fh }, true);
+        await fresh4(remote).client.call("release", { fh: remote.fh }, true);
       } finally {
         if (remote.restore) await settle3(current(), remote.restore);
       }
@@ -32744,7 +33738,7 @@ async function resize(h, path, size) {
     await h.release(fh);
   }
 }
-function sleep(ms, signal) {
+function sleep2(ms, signal) {
   return new Promise((resolve2) => {
     const done5 = () => {
       clearTimeout(timer);
@@ -32772,22 +33766,22 @@ function keepWatching(loop, signal) {
     const stop = () => session2.abort();
     signal.addEventListener("abort", stop);
     let timer;
-    const quiet2 = () => {
+    const quiet4 = () => {
       clearTimeout(timer);
       timer = setTimeout(stop, silenceMs);
     };
     let opened2 = false;
     try {
       const client = await loop.connect();
-      quiet2();
+      quiet4();
       await client.watch(
         session2.signal,
         (event) => {
-          quiet2();
+          quiet4();
           if (!event.ping) loop.event(event);
         },
         () => {
-          quiet2();
+          quiet4();
           opened2 = true;
           up = true;
           loop.up(client);
@@ -32816,7 +33810,7 @@ function keepWatching(loop, signal) {
         loop.down();
       }
       ready2.resolve();
-      await sleep(wait2, signal);
+      await sleep2(wait2, signal);
       wait2 = Math.min(wait2 * 2, most);
     }
   })();
@@ -34300,6 +35294,7 @@ var Launcher = class {
   scrubs = /* @__PURE__ */ new Map();
   clipboard;
   embedder;
+  devices;
   rootFs;
   fileWatches;
   nextPid = 1e3;
@@ -34324,6 +35319,7 @@ var Launcher = class {
     );
     this.embedder = this.embedderBroker(options.embedder);
     this.embedder.denied = options.onDenial;
+    this.devices = this.deviceNodes(options.devices);
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -34539,16 +35535,16 @@ var Launcher = class {
     if (!found) {
       found = this.swaps.settled().then(() => this.trustedAppended()).then(async (appended2) => {
         const tiers = await this.tiers(scope, appended2);
-        const refused4 = [];
+        const refused5 = [];
         const commands = await scanCommands(
           this.scanned,
           tiers,
           tiers.length - appended2.length,
           void 0,
-          refused4,
+          refused5,
           await this.globalRoots(scope)
         );
-        this.refusedOf.set(commands, refused4.map(refusing));
+        this.refusedOf.set(commands, refused5.map(refusing));
         return commands;
       }).then(
         (commands) => this.refusals(commands).set(SUDO_COMMAND.name, SUDO_COMMAND).set(VISUDO_COMMAND.name, VISUDO_COMMAND).set(CRONTAB_COMMAND.name, CRONTAB_COMMAND).set(SEALED_COMMAND.name, SEALED_COMMAND)
@@ -34755,14 +35751,14 @@ var Launcher = class {
     return await this.commandAt(path, scope) ?? await this.refusedAt(path, name2, scope);
   }
   async refusedAt(path, name2, scope) {
-    const refused4 = this.refusedOf.get(await this.commands(scope)) ?? [];
-    if (refused4.length === 0) return void 0;
+    const refused5 = this.refusedOf.get(await this.commands(scope)) ?? [];
+    if (refused5.length === 0) return void 0;
     const st = await this.base.stat(path).catch(() => void 0);
     if (!st?.isFile) return void 0;
     const real = await physicalPathAsync(this.base, path).catch(() => path);
     const same3 = async (own) => own === path || await physicalPathAsync(this.base, own).catch(() => own) === real;
     const owners = [];
-    for (const c of refused4) {
+    for (const c of refused5) {
       const origin = c.origin;
       for (const own of [origin.glue, origin.wasm, ...origin.variants ?? []]) {
         if (!await same3(own)) continue;
@@ -34772,11 +35768,11 @@ var Launcher = class {
     }
     const stem = name2.replace(/\.wasm$/, "");
     const named = owners.find((c) => c.name === name2) ?? owners.find((c) => c.name === stem);
-    return named ?? owners[0] ?? await this.refusedCopy(real, name2, refused4);
+    return named ?? owners[0] ?? await this.refusedCopy(real, name2, refused5);
   }
-  async refusedCopy(real, name2, refused4) {
+  async refusedCopy(real, name2, refused5) {
     const dir = real.slice(0, real.lastIndexOf("/"));
-    for (const c of refused4) {
+    for (const c of refused5) {
       const origin = c.origin;
       if (origin.abi !== "emscripten" || origin.script || c.name !== name2) continue;
       const own = await physicalPathAsync(this.base, origin.glue).catch(() => origin.glue);
@@ -34943,8 +35939,8 @@ var Launcher = class {
     const via = planned?.via ?? [];
     for (const [i, file] of via.entries()) {
       if (!byPath(file)) continue;
-      const want = i < via.length - 1 ? R_OK | X_OK : X_OK;
-      await need(g, "exec", this.fs.resolvePath(req.cwd, file), want);
+      const want2 = i < via.length - 1 ? R_OK | X_OK : X_OK;
+      await need(g, "exec", this.fs.resolvePath(req.cwd, file), want2);
     }
     for (const bin of planned?.bins ?? []) await need(g, "exec", bin, R_OK | X_OK);
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
@@ -34984,12 +35980,12 @@ var Launcher = class {
     return void 0;
   }
   async planOne(req, { ppid, cred, scope }, catalogOnly = false) {
-    const refused4 = (err) => {
+    const refused5 = (err) => {
       throw codeOf8(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
-    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused4);
+    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused5);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0, catalogOnly);
-    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused4);
+    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused5);
     if (planned) return planned;
     throw new SpawnError(catalogOnly ? "ENOENT" : await this.unrunnable(file, req.cwd, scope));
   }
@@ -35625,6 +36621,7 @@ var Launcher = class {
       ...scrubs ? { outputFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
       embedder: { broker: this.embedder, session: () => this.sessionOf(pid) },
+      devices: this.devices,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
       changes: this.changes.sab,
@@ -35808,8 +36805,8 @@ var Launcher = class {
     this.sampledAt = Math.max(this.sampledAt, now);
     this.load = this.load.map((avg, i) => {
       const window = LOAD_WINDOWS_MS[i];
-      const fresh3 = 1 - Math.exp(-LOAD_SAMPLE_MS / window);
-      return avg * Math.exp(-elapsed / window) + running * fresh3;
+      const fresh4 = 1 - Math.exp(-LOAD_SAMPLE_MS / window);
+      return avg * Math.exp(-elapsed / window) + running * fresh4;
     });
   }
   idleSince;
@@ -36156,7 +37153,7 @@ var Launcher = class {
   forker(ppid, parent) {
     const { exec: _exec, pgid: _pgid, group: _group, pid: _pid, scrub: _scrub, ...image } = parent;
     return async (state, given) => {
-      const fresh3 = (fds, quietOom) => this.start({
+      const fresh4 = (fds, quietOom) => this.start({
         ...image,
         quietOom,
         cwd: state.cwd ?? parent.cwd,
@@ -36172,7 +37169,7 @@ var Launcher = class {
         tagBase: this.tagBases.get(ppid),
         links: this.links.get(ppid)
       });
-      return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh3));
+      return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh4));
     };
   }
   keySignal(tty, fallback, sig, send2) {
@@ -36213,6 +37210,14 @@ var Launcher = class {
     this.sealed.userOf = async (uid) => (await this.users.lookup(uid))?.name;
     this.sealed.factsOf = (pid) => this.processFacts(pid);
   }
+  deviceNodes(hook) {
+    const nodes = new DeviceNodes(this.usersMode, {
+      groupId: async (name2) => (await this.users.groups()).find((g) => g.name === name2)?.gid,
+      userId: async (name2) => (await this.users.lookup(name2))?.uid
+    });
+    if (hook) nodes.register(0, hook);
+    return nodes;
+  }
   embedderBroker(hook) {
     const broker = new EmbedderBroker(
       this.usersMode,
@@ -36502,8 +37507,8 @@ var Launcher = class {
     for (const [path, mode] of layout) {
       if (isProtected(this.prefixes, normalizePath(path))) continue;
       const real = await this.realLayoutPath(path);
-      const fresh3 = real !== void 0 && !await this.base.hasOwner?.(real);
-      if (fresh3) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
+      const fresh4 = real !== void 0 && !await this.base.hasOwner?.(real);
+      if (fresh4) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
     }
   }
   async realLayoutPath(given) {
@@ -36637,10 +37642,10 @@ var Launcher = class {
   }
   async mountFstab() {
     const text = await this.base.readFile(FSTAB_PATH).catch(() => "");
-    const lines2 = parseFstab(text);
-    for (const { spec } of lines2) this.mounts.note(spec, "pending");
+    const lines3 = parseFstab(text);
+    for (const { spec } of lines3) this.mounts.note(spec, "pending");
     return mountFstab(
-      lines2,
+      lines3,
       (spec) => this.mount(spec).catch((err) => {
         this.mounts.note(spec, "pending", err?.message ?? String(err));
         throw err;
@@ -37537,7 +38542,7 @@ function isAttestRequest(req) {
   return ATTEST_OPS.has(req.op);
 }
 function isUsersRequest(req) {
-  return USERS_OPS.has(req.op);
+  return USERS_OPS.has(req.op) || req.op === "devices-add" || req.op === "devices-remove";
 }
 function transferOf2(req, result) {
   if (result instanceof MessagePort) return [result];
@@ -37570,7 +38575,18 @@ function failure(err) {
     ...typeof code === "string" ? { code } : {}
   };
 }
+function pageReplied(data, requests, devices) {
+  const embedderReply = embedderReplyOf(data);
+  if (embedderReply) requests.answer(embedderReply);
+  const devicesReply = devicesReplyOf(data);
+  if (devicesReply) devices.answer(devicesReply);
+  return embedderReply !== void 0 || devicesReply !== void 0;
+}
+function devicesOp(l, req) {
+  return req.op === "devices-add" ? l.devices.add(req.spec, req.client) : l.devices.remove(req.node);
+}
 function usersOp(l, req) {
+  if (req.op === "devices-add" || req.op === "devices-remove") return devicesOp(l, req);
   if (req.op === "users-add") return l.users.add(req.user);
   if (req.op === "users-remove") return l.users.remove(req.name, req.options);
   if (req.op === "groups-list") return l.users.groups();
@@ -37580,7 +38596,7 @@ function usersOp(l, req) {
   return l.users.list();
 }
 var clientIds = 0;
-async function connectClient(deps, { user, tag, bind: bind2 }) {
+async function connectClient(deps, { user, tag, requests: bind2, devices }) {
   const l = await deps.ready();
   tagOption(tag);
   if (user !== void 0 && !await l.users.lookup(user)) {
@@ -37594,6 +38610,7 @@ async function connectClient(deps, { user, tag, bind: bind2 }) {
     signal: signalNumber,
     session: client,
     ...bind2 === "attach" ? { attachRequests: true } : {},
+    ...devices === "attach" ? { attachDevices: true } : {},
     ...user !== void 0 ? { user } : {},
     ...tag !== void 0 ? { tag } : {},
     ...deps.locks ? { locks: deps.locks } : {},
@@ -37601,13 +38618,15 @@ async function connectClient(deps, { user, tag, bind: bind2 }) {
   });
   deps.clients.add(served2);
   const unbind = bind2 && bind2 !== "attach" ? l.embedder.register(client, deps.requests.hookFor(client, bind2)) : void 0;
+  const unbindDevices = devices === true ? l.devices.register(client, deps.devices.hookFor(client)) : void 0;
   void served2.closed.then(() => {
     deps.clients.delete(served2);
     unbind?.();
+    unbindDevices?.();
   });
-  return unbind ? { port: port2, client } : port2;
+  return unbind || devices ? { port: port2, client } : port2;
 }
-function hostOptions(req, port, sealed, sealedFetch, clipboard, lookup2, requests) {
+function hostOptions(req, port, sealed, sealedFetch, clipboard, lookup2, requests, devices) {
   return {
     cron: { lock: `slicc-kernel-cron:${req.metadata ?? META_DB}` },
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
@@ -37619,7 +38638,8 @@ function hostOptions(req, port, sealed, sealedFetch, clipboard, lookup2, request
     ...req.sealed ? { sealed } : {},
     ...req.sealedFetch ? { sealedFetch } : {},
     ...req.clipboard ? { clipboard } : {},
-    ...req.requests ? { embedder: requests.hookFor(0, req.requests) } : {}
+    ...req.requests ? { embedder: requests.hookFor(0, req.requests) } : {},
+    ...req.devices ? { devices: devices.hookFor(0) } : {}
   };
 }
 function hostProtect(init, lookup2) {
@@ -37673,6 +38693,20 @@ function processOps(ready2, reply) {
   }
   return { terminal, sudoRun, act: onTerminal };
 }
+function lockHolder() {
+  let holding;
+  return (locks) => {
+    holding ??= new Promise((resolve2) => {
+      const name2 = `slicc-kernel:${crypto.randomUUID()}`;
+      void locks.request(name2, () => {
+        resolve2(name2);
+        return new Promise(() => {
+        });
+      });
+    });
+    return holding;
+  };
+}
 function serveKernel(port, deps) {
   let launcher;
   let remote;
@@ -37682,24 +38716,14 @@ function serveKernel(port, deps) {
   const sealed = sealedAsker(port);
   const clipboard = clipboardAsker(port);
   const requests = embedderAsker(port);
+  const devices = devicesAsker(port);
   const integrity = integrityAsker(port);
   const approvals = sudoApprovals(port);
   const locks = deps.locks === null ? void 0 : deps.locks ?? locksOf();
-  let holding;
-  function holdLock(locks2) {
-    holding ??= new Promise((resolve2) => {
-      const name2 = `slicc-kernel:${crypto.randomUUID()}`;
-      void locks2.request(name2, () => {
-        resolve2(name2);
-        return new Promise(() => {
-        });
-      });
-    });
-    return holding;
-  }
-  const connect2 = (user, tag, bind2) => connectClient(
-    { ready: ready2, clients, requests, held: locks ? () => holdLock(locks) : void 0, locks },
-    { user, tag, bind: bind2 }
+  const holdLock = lockHolder();
+  const connect2 = (req) => connectClient(
+    { ready: ready2, clients, requests, devices, held: locks && (() => holdLock(locks)), locks },
+    req
   );
   async function ready2() {
     if (!launcher) throw new Error("the kernel is not initialized");
@@ -37730,7 +38754,8 @@ function serveKernel(port, deps) {
           sealed.fetch,
           clipboard.hook,
           integrity.lookup,
-          requests
+          requests,
+          devices
         ),
         ...req.approve ? { approve: approvals.ask } : {},
         ...net,
@@ -37762,7 +38787,7 @@ function serveKernel(port, deps) {
     if (req.op === "sealed-placeholders") return (await ready2()).setPlaceholders(req.list);
     if (req.op === "open-terminal") return processes2.terminal(req);
     if (req.op === "sudo-run") return processes2.sudoRun(req);
-    if (req.op === "connect") return connect2(req.user, req.tag, req.requests);
+    if (req.op === "connect") return connect2(req);
     if (isUsersRequest(req)) return usersOp(await ready2(), req);
     if (req.op === "routes" || req.op === "transport-traits") {
       return networkOp(await ready2(), req, remote);
@@ -37799,8 +38824,7 @@ function serveKernel(port, deps) {
     if (sealedReply) return sealed.answer(sealedReply);
     const clipboardReply = event.data.clipboardReply;
     if (clipboardReply) return clipboard.answer(clipboardReply);
-    const embedderReply = embedderReplyOf(event.data);
-    if (embedderReply) return requests.answer(embedderReply);
+    if (pageReplied(event.data, requests, devices)) return;
     const integrityReply = event.data.integrityReply;
     if (integrityReply) return integrity.answer(integrityReply);
     const grant = event.data.hostfsGrant;