@ai-ecoverse/slicc-kernel 1.22.0 → 1.23.0

package/dist/node.js

@@ -1,6 +1,92 @@
 // src/node.ts
 import { MessageChannel as MessageChannel2, Worker } from "node:worker_threads";
 
+// src/cdp/port.ts
+function serveCdpPort(port, hook, request, onDone) {
+  let conn;
+  let done4 = false;
+  const end = () => {
+    done4 = true;
+    port.close();
+    onDone?.();
+  };
+  const finish = (reason) => {
+    if (done4) return;
+    port.postMessage({ close: reason });
+    end();
+  };
+  port.addEventListener("message", ({ data }) => {
+    if (data.m !== void 0) conn?.send(data.m);
+    else if (data.close && !done4) {
+      end();
+      conn?.close();
+    }
+  });
+  port.start?.();
+  new Promise((resolve) => resolve(hook(request))).then(
+    (opened2) => {
+      conn = opened2;
+      if (done4) return opened2.close();
+      opened2.onmessage = (m) => {
+        if (!done4) port.postMessage({ m });
+      };
+      opened2.onclose = (reason) => finish(reason ?? null);
+      port.postMessage({ open: true });
+    },
+    (e) => {
+      if (done4) return;
+      port.postMessage({ error: e instanceof Error ? e.message : String(e) });
+      end();
+    }
+  );
+  return () => {
+    if (done4) return;
+    conn?.close();
+    finish("the CDP host is gone");
+  };
+}
+function portCdpHook(ask, gone) {
+  return (request) => new Promise((resolve, reject) => {
+    const { port1, port2 } = new MessageChannel();
+    let closed = false;
+    const conn = {
+      send: (m) => {
+        if (!closed) port1.postMessage({ m });
+      },
+      onmessage: null,
+      onclose: null,
+      close: () => {
+        if (closed) return;
+        closed = true;
+        port1.postMessage({ close: true });
+        port1.close();
+      }
+    };
+    port1.addEventListener("message", ({ data }) => {
+      if ("m" in data) conn.onmessage?.(data.m);
+      else if ("open" in data) resolve(conn);
+      else if ("error" in data) {
+        closed = true;
+        port1.close();
+        reject(new Error(data.error));
+      } else if (!closed) {
+        closed = true;
+        port1.close();
+        conn.onclose?.(data.close ?? void 0);
+      }
+    });
+    port1.start();
+    void gone?.then(() => {
+      if (closed) return;
+      closed = true;
+      port1.close();
+      reject(new Error("the CDP host is gone"));
+      conn.onclose?.("the CDP host is gone");
+    });
+    ask(request, port2);
+  });
+}
+
 // src/fs/types.ts
 function rangedOps(fs) {
   const { pread, pwrite, truncate } = fs;
@@ -637,7 +723,12 @@ function keyOf(addr) {
 var LoopbackNet = class {
   bound = /* @__PURE__ */ new Map();
   activators = /* @__PURE__ */ new Map();
+  internal = /* @__PURE__ */ new Set();
   nextEphemeral = EPHEMERAL_FIRST;
+  kernelOnly(port, reserve = false) {
+    if (reserve) this.internal.add(port);
+    return this.internal.has(port);
+  }
   activate(addr, start) {
     this.activators.set(keyOf(addr), start);
   }
@@ -698,6 +789,14 @@ var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "
 function dialSocket(net, port, host = "127.0.0.1") {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new KernelError("EINVAL");
   const target = LOOPBACK_NAMES.has(host.toLowerCase()) ? "127.0.0.1" : host;
+  if (net.kernelOnly(port)) {
+    throw Object.assign(
+      new Error(`ECONNREFUSED: port ${port} only takes connections from inside the kernel`),
+      {
+        code: "ECONNREFUSED"
+      }
+    );
+  }
   return net.connect({ family: "inet", host: target, port });
 }
 var codeOf = (err) => {
@@ -985,7 +1084,7 @@ function serveTransport(peer, transport) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 4];
+var PROTOCOL = [1, 5];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -1099,6 +1198,43 @@ function joinable(l, pgid, ours) {
   if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
   if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
 }
+function cdpRegistry(send, gone) {
+  const registered = /* @__PURE__ */ new Map();
+  const drop = (id) => {
+    registered.get(id)?.();
+    return registered.delete(id);
+  };
+  return {
+    serve(l, req) {
+      const hook = portCdpHook(
+        (request, cdp) => send({ cdpOpen: { ...request, registration: req.id }, port: cdp }, [
+          cdp
+        ]),
+        gone
+      );
+      registered.set(req.id, l.cdp.register(hook, req.runtime));
+      return req.id;
+    },
+    drop,
+    close: () => {
+      for (const id of [...registered.keys()]) drop(id);
+    }
+  };
+}
+function watchOp(l, req, watches, send) {
+  if (req.op === "unwatch") {
+    watches.get(req.watch)?.();
+    watches.delete(req.watch);
+    return { result: true };
+  }
+  const unwatch = l.watchers.watch(
+    req.paths,
+    { recursive: req.recursive },
+    (change) => send({ watch: req.id, change })
+  );
+  watches.set(req.id, unwatch);
+  return { result: req.id };
+}
 function serveClient(port, host) {
   let state = "new";
   const terminals = /* @__PURE__ */ new Map();
@@ -1111,6 +1247,7 @@ function serveClient(port, host) {
     if (state !== "closed") port.postMessage(message2, transfer);
   };
   const reply = (id, body, transfer) => send({ id, ...body }, transfer);
+  const cdps = cdpRegistry(send, ended.promise);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
     send({ bye });
@@ -1118,6 +1255,7 @@ function serveClient(port, host) {
     net?.close();
     for (const unwatch of watches.values()) unwatch();
     watches.clear();
+    cdps.close();
     for (const session of terminals.values()) session.close();
     terminals.clear();
     if (kill) killGroups(host, [...groups]);
@@ -1212,19 +1350,9 @@ function serveClient(port, host) {
           throw new Error(`unknown file system call ${req.method}`);
         }
         return fsCall(l.fs, req.method, req.args);
-      case "watch": {
-        const unwatch = l.watchers.watch(
-          req.paths,
-          { recursive: req.recursive },
-          (change) => send({ watch: req.id, change })
-        );
-        watches.set(req.id, unwatch);
-        return { result: req.id };
-      }
+      case "watch":
       case "unwatch":
-        watches.get(req.watch)?.();
-        watches.delete(req.watch);
-        return { result: true };
+        return watchOp(l, req, watches, send);
       case "mount":
         return { result: await l.mount(req.spec) };
       case "umount":
@@ -1234,6 +1362,10 @@ function serveClient(port, host) {
         return { result: l.mounts.list() };
       case "dial":
         return dialFor(l, req, watches);
+      case "serve-cdp":
+        return { result: cdps.serve(l, req) };
+      case "unserve-cdp":
+        return { result: cdps.drop(req.registration) };
       case "detach":
         return { result: true };
       default:
@@ -1817,124 +1949,823 @@ var OpfsFs = class {
   }
 };
 
-// src/commands.ts
-var NAME = /^[A-Za-z0-9._+-]+$/;
-var ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var PACKAGE = /\$\{package\}/g;
-function inside(pkg, rel2) {
-  if (typeof rel2 !== "string" || rel2 === "") return void 0;
-  const clean = rel2.replace(/^\.\//, "");
-  if (clean.startsWith("/") || clean.split("/").includes("..")) return void 0;
-  return `${pkg}/${clean}`;
-}
-function envOf(pkg, raw) {
-  const env = {};
-  if (!raw || typeof raw !== "object") return env;
-  for (const [key, value] of Object.entries(raw)) {
-    if (!ENV_KEY.test(key)) continue;
-    if (typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
-    else if (value === null) env[key] = null;
+// src/kernel/net/http1.ts
+var HttpError = class extends Error {
+  status;
+  constructor(status, message2) {
+    super(message2);
+    this.status = status;
   }
-  return env;
-}
-function envFields(merged) {
-  const env = {};
-  const unset = [];
-  for (const [key, value] of Object.entries(merged)) {
-    if (value === null) unset.push(key);
-    else env[key] = value;
+};
+var CR = 13;
+var LF = 10;
+var READ_SIZE = 64 * 1024;
+var TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var REASON = {
+  100: "Continue",
+  200: "OK",
+  400: "Bad Request",
+  403: "Forbidden",
+  404: "Not Found",
+  405: "Method Not Allowed",
+  408: "Request Timeout",
+  411: "Length Required",
+  413: "Content Too Large",
+  417: "Expectation Failed",
+  421: "Misdirected Request",
+  431: "Request Header Fields Too Large",
+  501: "Not Implemented",
+  502: "Bad Gateway",
+  503: "Service Unavailable",
+  504: "Gateway Timeout",
+  505: "HTTP Version Not Supported"
+};
+var Incoming = class {
+  source;
+  buf = new Uint8Array(0);
+  eof = false;
+  constructor(source) {
+    this.source = source;
   }
-  return {
-    ...Object.keys(env).length > 0 ? { env } : {},
-    ...unset.length > 0 ? { unset } : {}
-  };
-}
-function argsOf(pkg, raw) {
-  if (!Array.isArray(raw) || raw.length === 0) return void 0;
-  if (!raw.every((arg) => typeof arg === "string")) return void 0;
-  return raw.map((arg) => arg.replace(PACKAGE, pkg));
-}
-function abiOf(raw, fallback) {
-  const abi = raw ?? fallback;
-  return abi === "emscripten" || abi === "wasi" ? abi : void 0;
-}
-function commandOf(pkg, name2, raw, packageAbi, shared) {
-  const withEnv = envFields({ ...shared, ...envOf(pkg, raw.env) });
-  const script = inside(pkg, raw.script);
-  if (script) {
-    return { name: name2, abi: packageAbi, glue: script, wasm: script, argv0: name2, script, ...withEnv };
+  get buffered() {
+    return this.buf.length;
   }
-  const abi = abiOf(raw.abi, packageAbi);
-  const wasm = inside(pkg, raw.wasm);
-  const glue = abi === "wasi" ? wasm : inside(pkg, raw.glue);
-  if (!abi || !glue || !wasm) return void 0;
-  const argv0 = typeof raw.argv0 === "string" && raw.argv0 ? raw.argv0 : name2;
-  const args = argsOf(pkg, raw.args);
-  const imports = abi === "wasi" ? inside(pkg, raw.imports) : void 0;
-  return {
-    name: name2,
-    abi,
-    glue,
-    wasm,
-    argv0,
-    ...args ? { args } : {},
-    ...withEnv,
-    ...imports ? { imports } : {}
-  };
-}
-function commandsOf(pkg, manifest) {
-  const slicc = manifest.slicc;
-  if (!slicc || typeof slicc !== "object") return [];
-  const packageAbi = abiOf(slicc.abi, "emscripten");
-  const entries = slicc.commands;
-  if (!packageAbi || !entries || typeof entries !== "object") return [];
-  const shared = envOf(pkg, slicc.env);
-  const out = [];
-  for (const [name2, raw] of Object.entries(entries)) {
-    if (!NAME.test(name2) || name2 === "." || name2 === ".." || !raw || typeof raw !== "object") {
-      continue;
+  async fill(signal) {
+    if (this.eof) return false;
+    const chunk2 = await this.source.read(READ_SIZE, signal);
+    if (chunk2.length === 0) {
+      this.eof = true;
+      return false;
     }
-    const command = commandOf(pkg, name2, raw, packageAbi, shared);
-    if (command) out.push(command);
+    const next = new Uint8Array(this.buf.length + chunk2.length);
+    next.set(this.buf);
+    next.set(chunk2, this.buf.length);
+    this.buf = next;
+    return true;
   }
-  return out;
-}
-async function withPackagePaths(fs, pkg, command) {
-  if (!command.env) return command;
-  const env = {};
-  for (const [key, value] of Object.entries(command.env)) {
-    const path = !value.startsWith("/") && value.includes("/") && inside(pkg, value);
-    env[key] = path && await fs.exists(path) ? path : value;
+  take(n) {
+    const out = this.buf.slice(0, n);
+    this.buf = this.buf.subarray(n);
+    return out;
   }
-  return { ...command, env };
-}
-async function packages(fs, modules) {
-  const names = await fs.readdir(modules).catch(() => []);
-  const dirs = [];
-  for (const name2 of names) {
-    if (name2.startsWith(".")) continue;
-    if (!name2.startsWith("@")) {
-      dirs.push(`${modules}/${name2}`);
-      continue;
+  async some(max, signal) {
+    if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
+    if (this.eof) return new Uint8Array(0);
+    const chunk2 = await this.source.read(max, signal);
+    if (chunk2.length === 0) this.eof = true;
+    return chunk2;
+  }
+  async head(limit, signal) {
+    let from = 0;
+    for (; ; ) {
+      const end = headEnd(this.buf, from);
+      if (end > 0) {
+        if (end > limit) throw new HttpError(431, "request head too large");
+        return this.take(end);
+      }
+      if (this.buf.length > limit) throw new HttpError(431, "request head too large");
+      from = Math.max(0, this.buf.length - 3);
+      if (!await this.fill(signal)) {
+        if (this.buf.length === 0) return null;
+        throw new HttpError(400, "connection closed inside a request head");
+      }
     }
-    for (const inner of await fs.readdir(`${modules}/${name2}`).catch(() => [])) {
-      dirs.push(`${modules}/${name2}/${inner}`);
+  }
+  async line(limit, signal) {
+    let from = 0;
+    for (; ; ) {
+      const at = this.buf.indexOf(LF, from);
+      if (at >= 0) {
+        const line = this.take(at + 1);
+        const text = latin1(line.subarray(0, line[at - 1] === CR ? at - 1 : at));
+        return text;
+      }
+      if (this.buf.length > limit) throw new HttpError(400, "line too long");
+      from = this.buf.length;
+      if (!await this.fill(signal)) throw new HttpError(400, "connection closed inside a body");
     }
   }
-  return dirs;
-}
-async function pnpmGlobalRoots(fs, home) {
-  const roots = [];
-  const global = `${home}/global`;
-  for (const version of (await fs.readdir(global).catch(() => [])).sort()) {
-    for (const group of (await fs.readdir(`${global}/${version}`).catch(() => [])).sort()) {
-      const dir = `${global}/${version}/${group}`;
-      const st = await fs.lstat(dir).catch(() => void 0);
-      if (st?.isDirectory && await fs.exists(`${dir}/node_modules`))
-        roots.push(`${dir}/node_modules`);
+  async exactly(n, signal) {
+    while (this.buf.length < n) {
+      if (!await this.fill(signal)) throw new HttpError(400, "connection closed inside a body");
     }
+    return this.take(n);
   }
-  return roots;
+};
+function headEnd(buf, from) {
+  for (let i = from; i < buf.length; i++) {
+    if (buf[i] !== LF) continue;
+    if (buf[i + 1] === LF) return i + 2;
+    if (buf[i + 1] === CR && buf[i + 2] === LF) return i + 3;
+  }
+  return 0;
+}
+function latin1(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    out += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return out;
+}
+function latin1Bytes(text) {
+  const out = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i) & 255;
+  return out;
+}
+function parseRequestHead(bytes) {
+  const lines = latin1(bytes).split(/\r?\n/);
+  while (lines.length > 0 && lines[0] === "") lines.shift();
+  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines.shift() ?? "");
+  if (!match) throw new HttpError(400, "malformed request line");
+  if (match[3] !== "1") throw new HttpError(505, `HTTP/${match[3]}.${match[4]} is not supported`);
+  return {
+    method: match[1],
+    target: match[2],
+    minor: Number(match[4]),
+    headers: parseFields(lines)
+  };
+}
+function parseFields(lines) {
+  const headers = [];
+  for (const line of lines) {
+    if (line === "") continue;
+    if (line.startsWith(" ") || line.startsWith("	")) {
+      throw new HttpError(400, "obsolete line folding");
+    }
+    const colon = line.indexOf(":");
+    const name2 = colon > 0 ? line.slice(0, colon) : "";
+    if (!TOKEN.test(name2)) throw new HttpError(400, "malformed header field");
+    headers.push([name2, line.slice(colon + 1).trim()]);
+  }
+  return headers;
+}
+function fieldValues(headers, name2) {
+  const lower = name2.toLowerCase();
+  return headers.filter(([n]) => n.toLowerCase() === lower).map(([, v]) => v);
+}
+function fieldTokens(headers, name2) {
+  return fieldValues(headers, name2).flatMap((v) => v.split(",")).map((t) => t.trim().toLowerCase()).filter((t) => t !== "");
+}
+function requestFraming(headers) {
+  const codings = fieldTokens(headers, "transfer-encoding");
+  const lengths = fieldValues(headers, "content-length");
+  if (codings.length > 0) {
+    if (lengths.length > 0) throw new HttpError(400, "both Transfer-Encoding and Content-Length");
+    if (codings.length !== 1 || codings[0] !== "chunked") {
+      throw new HttpError(501, `unsupported Transfer-Encoding: ${codings.join(", ")}`);
+    }
+    return { kind: "chunked" };
+  }
+  if (lengths.length === 0) return { kind: "none" };
+  const distinct = new Set(lengths.flatMap((v) => v.split(",")).map((v) => v.trim()));
+  const [only] = distinct;
+  if (distinct.size !== 1 || !/^\d{1,15}$/.test(only)) {
+    throw new HttpError(400, "invalid Content-Length");
+  }
+  const length2 = Number(only);
+  return length2 === 0 ? { kind: "none" } : { kind: "length", length: length2 };
+}
+var MAX_CHUNK_LINE = 4096;
+var MAX_TRAILERS = 64 * 1024;
+async function readBody(incoming, framing, cap, signal) {
+  if (framing.kind === "none") return void 0;
+  if (framing.kind === "length") {
+    if (framing.length > cap) throw new HttpError(413, `request body over ${cap} bytes`);
+    return incoming.exactly(framing.length, signal);
+  }
+  const chunks2 = [];
+  let total = 0;
+  for (; ; ) {
+    const sizeLine = await incoming.line(MAX_CHUNK_LINE, signal);
+    const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(sizeLine);
+    if (!size) throw new HttpError(400, "malformed chunk size");
+    const n = Number.parseInt(size[1], 16);
+    if (n === 0) break;
+    total += n;
+    if (total > cap) throw new HttpError(413, `request body over ${cap} bytes`);
+    chunks2.push(await incoming.exactly(n, signal));
+    if (await incoming.line(2, signal) !== "") throw new HttpError(400, "malformed chunk");
+  }
+  let trailers = 0;
+  for (let line = await incoming.line(MAX_TRAILERS, signal); line !== ""; ) {
+    trailers += line.length;
+    if (trailers > MAX_TRAILERS) throw new HttpError(431, "trailers too large");
+    line = await incoming.line(MAX_TRAILERS, signal);
+  }
+  return concat(chunks2, total);
+}
+function concat(chunks2, total = chunks2.reduce((n, c) => n + c.length, 0)) {
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const chunk2 of chunks2) {
+    out.set(chunk2, at);
+    at += chunk2.length;
+  }
+  return out;
+}
+function safeValue(value) {
+  return !/[\r\n\0]/.test(value);
+}
+function responseHead(status, reason, headers) {
+  const phrase = /^[\t\x20-\x7e\x80-\xff]*$/.test(reason) ? reason : "";
+  let head = `HTTP/1.1 ${status} ${phrase}\r
+`;
+  for (const [name2, value] of headers) {
+    if (TOKEN.test(name2) && safeValue(value)) head += `${name2}: ${value}\r
+`;
+  }
+  return latin1Bytes(`${head}\r
+`);
+}
+function chunk(bytes) {
+  const size = latin1Bytes(`${bytes.length.toString(16)}\r
+`);
+  const out = new Uint8Array(size.length + bytes.length + 2);
+  out.set(size);
+  out.set(bytes, size.length);
+  out[out.length - 2] = CR;
+  out[out.length - 1] = LF;
+  return out;
+}
+var LAST_CHUNK = latin1Bytes("0\r\n\r\n");
+
+// src/cdp/types.ts
+var CDP_PORT = 9222;
+var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
+
+// src/cdp/websocket.ts
+var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var MAX_MESSAGE = 256 * 1024 * 1024;
+var CLOSE = {
+  normal: 1e3,
+  protocol: 1002,
+  unsupported: 1003,
+  invalid: 1007,
+  tooBig: 1009,
+  error: 1011
+};
+var OP_TEXT = 1;
+var OP = { continuation: 0, text: OP_TEXT, binary: 2, close: 8, ping: 9, pong: 10 };
+var WsError = class extends Error {
+  code;
+  constructor(code, message2) {
+    super(message2);
+    this.code = code;
+  }
+};
+function field(headers, name2) {
+  return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
+}
+async function acceptKey(headers) {
+  const tokens = (name2) => (field(headers, name2) ?? "").split(",").map((t) => t.trim().toLowerCase());
+  if (!tokens("upgrade").includes("websocket") || !tokens("connection").includes("upgrade")) {
+    throw new HttpError(400, "expected a WebSocket upgrade");
+  }
+  if (field(headers, "sec-websocket-version") !== "13") {
+    throw new HttpError(400, "Sec-WebSocket-Version must be 13");
+  }
+  const key = field(headers, "sec-websocket-key") ?? "";
+  if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
+  const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
+  return btoa(String.fromCharCode(...new Uint8Array(digest)));
+}
+function isUpgrade(headers) {
+  return (field(headers, "upgrade") ?? "").toLowerCase().includes("websocket");
+}
+function frame(opcode, payload) {
+  const n = payload.length;
+  const size = n < 126 ? 2 : n < 65536 ? 4 : 10;
+  const out = new Uint8Array(size + n);
+  const view = new DataView(out.buffer);
+  out[0] = 128 | opcode;
+  if (n < 126) out[1] = n;
+  else if (n < 65536) {
+    out[1] = 126;
+    view.setUint16(2, n);
+  } else {
+    out[1] = 127;
+    view.setBigUint64(2, BigInt(n));
+  }
+  out.set(payload, size);
+  return out;
+}
+function closeFrame(code, reason = "") {
+  let bytes = new TextEncoder().encode(reason);
+  if (bytes.length > 123) bytes = bytes.subarray(0, 123);
+  const payload = new Uint8Array(2 + bytes.length);
+  new DataView(payload.buffer).setUint16(0, code);
+  payload.set(bytes, 2);
+  return frame(OP.close, payload);
+}
+function pongFrame(payload) {
+  return frame(OP.pong, payload);
+}
+async function fill(incoming, out, signal) {
+  for (let at = 0; at < out.length; ) {
+    const piece = await incoming.some(out.length - at, signal);
+    if (piece.length === 0) throw new WsError(CLOSE.protocol, "the connection closed mid-frame");
+    out.set(piece, at);
+    at += piece.length;
+  }
+}
+var fatal = new TextDecoder("utf-8", { fatal: true });
+function decode(bytes) {
+  try {
+    return fatal.decode(bytes);
+  } catch {
+    throw new WsError(CLOSE.invalid, "a text message is not UTF-8");
+  }
+}
+var WsReader = class {
+  incoming;
+  max;
+  parts = [];
+  size = 0;
+  continuing = false;
+  constructor(incoming, max = MAX_MESSAGE) {
+    this.incoming = incoming;
+    this.max = max;
+  }
+  async next(signal) {
+    for (; ; ) {
+      const first = await this.incoming.some(1, signal);
+      if (first.length === 0) return null;
+      const head = new Uint8Array(2);
+      head[0] = first[0];
+      await fill(this.incoming, head.subarray(1), signal);
+      const fin = (head[0] & 128) !== 0;
+      const opcode = head[0] & 15;
+      if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
+      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
+      const length2 = await this.length(head[1] & 127, signal);
+      const control = opcode >= 8;
+      if (control && (length2 > 125 || !fin)) {
+        throw new WsError(CLOSE.protocol, "a control frame is too long or fragmented");
+      }
+      if (!control && this.size + length2 > this.max) {
+        throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
+      }
+      const mask = new Uint8Array(4);
+      await fill(this.incoming, mask, signal);
+      const payload = new Uint8Array(length2);
+      await fill(this.incoming, payload, signal);
+      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+      const event = this.take(opcode, fin, payload);
+      if (event) return event;
+    }
+  }
+  async length(short, signal) {
+    if (short < 126) return short;
+    const ext = new Uint8Array(short === 126 ? 2 : 8);
+    await fill(this.incoming, ext, signal);
+    const view = new DataView(ext.buffer);
+    if (short === 126) return view.getUint16(0);
+    const long = view.getBigUint64(0);
+    return long > BigInt(this.max) ? this.max + 1 : Number(long);
+  }
+  take(opcode, fin, payload) {
+    switch (opcode) {
+      case OP.ping:
+        return { kind: "ping", payload };
+      case OP.pong:
+        return void 0;
+      case OP.close: {
+        if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
+        const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
+        return { kind: "close", code, reason: decode(payload.subarray(2)) };
+      }
+      case OP.text:
+      case OP.continuation: {
+        if (opcode === OP.continuation !== this.continuing) {
+          throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+        }
+        this.parts.push(payload);
+        this.size += payload.length;
+        this.continuing = !fin;
+        if (!fin) return void 0;
+        const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
+        this.parts = [];
+        this.size = 0;
+        return { kind: "text", text: decode(whole) };
+      }
+      case OP.binary:
+        throw new WsError(CLOSE.unsupported, "CDP messages are text");
+      default:
+        throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
+    }
+  }
+};
+function switchingHead(accept2) {
+  return latin1Bytes(
+    `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept2}\r
+\r
+`
+  );
+}
+
+// src/cdp/facade.ts
+var MAX_HEAD = 64 * 1024;
+var LIST_TIMEOUT = 1e4;
+function respond(status, body, type = "text/plain; charset=utf-8") {
+  const bytes = new TextEncoder().encode(body);
+  const head = latin1Bytes(
+    `HTTP/1.1 ${status} ${REASON[status]}\r
+Content-Type: ${type}\r
+Content-Length: ${bytes.length}\r
+Connection: close\r
+\r
+`
+  );
+  const out = new Uint8Array(head.length + bytes.length);
+  out.set(head);
+  out.set(bytes, head.length);
+  return out;
+}
+function json(value) {
+  return respond(200, `${JSON.stringify(value, null, 2)}
+`, "application/json; charset=UTF-8");
+}
+var CdpFacade = class {
+  options;
+  listener;
+  stop = new AbortController();
+  connections = /* @__PURE__ */ new Set();
+  closed;
+  constructor(options) {
+    this.options = options;
+    this.listener = options.net.listen({
+      family: "inet",
+      host: "127.0.0.1",
+      port: options.port ?? CDP_PORT
+    });
+    this.closed = this.acceptLoop();
+  }
+  close() {
+    if (this.stop.signal.aborted) return;
+    this.stop.abort();
+    this.listener.close();
+    for (const conn of this.connections) conn.close();
+  }
+  async acceptLoop() {
+    const served = /* @__PURE__ */ new Set();
+    for (; ; ) {
+      let conn;
+      try {
+        conn = await this.listener.accept(this.stop.signal);
+      } catch {
+        break;
+      }
+      const done4 = this.serve(conn).finally(() => served.delete(done4));
+      served.add(done4);
+    }
+    await Promise.allSettled([...served]);
+  }
+  async serve(conn) {
+    this.connections.add(conn);
+    const incoming = new Incoming(conn);
+    try {
+      const head = await incoming.head(MAX_HEAD, this.stop.signal);
+      if (head) await this.route(conn, incoming, parseRequestHead(head));
+    } catch (e) {
+      if (e instanceof HttpError) await this.write(conn, respond(e.status, `${e.message}
+`));
+    } finally {
+      this.connections.delete(conn);
+      conn.close();
+    }
+  }
+  async write(conn, bytes) {
+    try {
+      await conn.write(bytes, this.stop.signal);
+    } catch {
+    }
+  }
+  async route(conn, incoming, req) {
+    const url = new URL(req.target, "http://127.0.0.1");
+    const runtime = url.searchParams.get("runtime") ?? void 0;
+    const host = req.headers.find(([n]) => n.toLowerCase() === "host")?.[1] ?? "127.0.0.1";
+    if (req.method !== "GET") throw new HttpError(405, `${req.method} is not supported here`);
+    const { hosts } = this.options;
+    if (url.pathname === hosts.path && isUpgrade(req.headers)) {
+      return this.upgrade(conn, incoming, req, runtime);
+    }
+    const path = url.pathname.replace(/\/+$/, "");
+    if (path !== "/json/version" && path !== "/json/list" && path !== "/json") {
+      throw new HttpError(404, "not found: try /json/version");
+    }
+    if (!this.options.hosts.available(runtime)) {
+      throw new HttpError(503, NO_CDP_HOST);
+    }
+    if (path === "/json/version") {
+      await this.write(
+        conn,
+        json({
+          Browser: "slicc-kernel",
+          "Protocol-Version": "1.3",
+          webSocketDebuggerUrl: `ws://${host}${hosts.path}${url.search}`
+        })
+      );
+      return;
+    }
+    await this.write(conn, json(await this.list(runtime)));
+  }
+  async list(runtime) {
+    const conn = await this.host(runtime);
+    try {
+      const reply = await new Promise(
+        (resolve, reject) => {
+          const timer = setTimeout(
+            () => reject(new HttpError(504, "the CDP host did not answer Target.getTargets")),
+            this.options.listTimeout ?? LIST_TIMEOUT
+          );
+          conn.onclose = (reason) => {
+            clearTimeout(timer);
+            reject(new HttpError(502, `the CDP host closed: ${reason ?? "no reason"}`));
+          };
+          conn.onmessage = (message2) => {
+            const parsed = JSON.parse(message2);
+            if (parsed.id !== 1) return;
+            clearTimeout(timer);
+            resolve(parsed);
+          };
+          conn.send(JSON.stringify({ id: 1, method: "Target.getTargets" }));
+        }
+      );
+      if (!reply.result) {
+        throw new HttpError(502, `Target.getTargets failed: ${JSON.stringify(reply.error)}`);
+      }
+      return (reply.result.targetInfos ?? []).map((t) => ({
+        description: "",
+        id: t.targetId,
+        title: t.title,
+        type: t.type,
+        url: t.url
+      }));
+    } finally {
+      conn.close();
+    }
+  }
+  host(runtime) {
+    return this.options.hosts.connect(runtime ? { runtime } : {});
+  }
+  async upgrade(conn, incoming, req, runtime) {
+    const accept2 = await acceptKey(req.headers);
+    const host = await this.host(runtime);
+    await new Relay(conn, incoming, host, this.options.maxMessage ?? MAX_MESSAGE, this.stop.signal).start(switchingHead(accept2)).finally(() => host.close());
+  }
+};
+var Relay = class {
+  writes = Promise.resolve();
+  ended = false;
+  conn;
+  incoming;
+  host;
+  max;
+  stop;
+  constructor(conn, incoming, host, max, stop) {
+    this.conn = conn;
+    this.incoming = incoming;
+    this.host = host;
+    this.max = max;
+    this.stop = stop;
+  }
+  send(bytes) {
+    this.writes = this.writes.then(() => this.conn.write(bytes, this.stop)).catch(() => void 0);
+    return this.writes;
+  }
+  end(code, reason) {
+    if (this.ended) return this.writes;
+    this.ended = true;
+    return this.send(closeFrame(code, reason));
+  }
+  async start(head) {
+    await this.send(head);
+    const hostGone = new Promise((resolve) => {
+      this.host.onclose = (reason) => {
+        void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve());
+      };
+    });
+    this.host.onmessage = (message2) => {
+      if (this.ended) return;
+      const bytes = new TextEncoder().encode(message2);
+      if (bytes.length > this.max)
+        void this.end(CLOSE.tooBig, `a message is over ${this.max} bytes`);
+      else void this.send(frame(OP_TEXT, bytes));
+    };
+    await Promise.race([this.pump(), hostGone]);
+    await this.writes;
+  }
+  async pump() {
+    const reader = new WsReader(this.incoming, this.max);
+    try {
+      for (; ; ) {
+        const event = await reader.next(this.stop);
+        if (!event) return;
+        if (event.kind === "text") this.host.send(event.text);
+        else if (event.kind === "ping") void this.send(pongFrame(event.payload));
+        else {
+          await this.end(event.code === 1005 ? CLOSE.normal : event.code, "");
+          return;
+        }
+      }
+    } catch (e) {
+      if (e instanceof WsError) await this.end(e.code, e.message);
+    }
+  }
+};
+function enableCdp(net, hosts) {
+  let facade;
+  net.kernelOnly(CDP_PORT, true);
+  net.activate({ family: "inet", host: "127.0.0.1", port: CDP_PORT }, () => {
+    const started = new CdpFacade({ net, hosts });
+    facade = started;
+    void started.closed.then(() => {
+      if (facade === started) facade = void 0;
+    });
+  });
+  return () => facade;
+}
+
+// src/cdp/hosts.ts
+var CdpHosts = class {
+  embedder;
+  clients = [];
+  closed = false;
+  path = `/devtools/browser/${crypto.randomUUID()}`;
+  url = `ws://127.0.0.1:${CDP_PORT}${this.path}`;
+  constructor(hook) {
+    this.embedder = hook ? { hook, runtime: void 0, open: /* @__PURE__ */ new Set() } : void 0;
+  }
+  register(hook, runtime) {
+    const entry = { hook, runtime, open: /* @__PURE__ */ new Set() };
+    this.clients.push(entry);
+    return () => {
+      const at = this.clients.indexOf(entry);
+      if (at >= 0) this.clients.splice(at, 1);
+      closeAll(entry);
+    };
+  }
+  pick(runtime) {
+    if (this.closed) return void 0;
+    const named = runtime ? this.clients.findLast((c) => c.runtime === runtime) : void 0;
+    return named ?? this.embedder ?? this.clients.at(-1);
+  }
+  available(runtime) {
+    return this.pick(runtime) !== void 0;
+  }
+  async connect(request) {
+    const entry = this.pick(request.runtime);
+    if (!entry) throw new HttpError(503, NO_CDP_HOST);
+    let conn;
+    try {
+      conn = await entry.hook(request.runtime ? { runtime: request.runtime } : {});
+    } catch (e) {
+      throw new HttpError(502, `CDP host: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (this.closed || !(entry === this.embedder || this.clients.includes(entry))) {
+      conn.close();
+      throw new HttpError(503, NO_CDP_HOST);
+    }
+    entry.open.add(conn);
+    const close = conn.close.bind(conn);
+    conn.close = () => {
+      if (entry.open.delete(conn)) close();
+    };
+    return conn;
+  }
+  close() {
+    this.closed = true;
+    for (const entry of [this.embedder, ...this.clients]) if (entry) closeAll(entry);
+  }
+};
+function closeAll(entry) {
+  for (const conn of [...entry.open]) {
+    conn.close();
+    conn.onclose?.("the CDP host is gone");
+  }
+}
+
+// src/commands.ts
+var NAME = /^[A-Za-z0-9._+-]+$/;
+var ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var PACKAGE = /\$\{package\}/g;
+function inside(pkg, rel2) {
+  if (typeof rel2 !== "string" || rel2 === "") return void 0;
+  const clean = rel2.replace(/^\.\//, "");
+  if (clean.startsWith("/") || clean.split("/").includes("..")) return void 0;
+  return `${pkg}/${clean}`;
+}
+function envOf(pkg, raw) {
+  const env = {};
+  if (!raw || typeof raw !== "object") return env;
+  for (const [key, value] of Object.entries(raw)) {
+    if (!ENV_KEY.test(key)) continue;
+    if (typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
+    else if (value === null) env[key] = null;
+  }
+  return env;
+}
+function envFields(merged) {
+  const env = {};
+  const unset = [];
+  for (const [key, value] of Object.entries(merged)) {
+    if (value === null) unset.push(key);
+    else env[key] = value;
+  }
+  return {
+    ...Object.keys(env).length > 0 ? { env } : {},
+    ...unset.length > 0 ? { unset } : {}
+  };
+}
+function argsOf(pkg, raw) {
+  if (!Array.isArray(raw) || raw.length === 0) return void 0;
+  if (!raw.every((arg) => typeof arg === "string")) return void 0;
+  return raw.map((arg) => arg.replace(PACKAGE, pkg));
+}
+function abiOf(raw, fallback) {
+  const abi = raw ?? fallback;
+  return abi === "emscripten" || abi === "wasi" ? abi : void 0;
+}
+function commandOf(pkg, name2, raw, packageAbi, shared) {
+  const withEnv = envFields({ ...shared, ...envOf(pkg, raw.env) });
+  const script = inside(pkg, raw.script);
+  if (script) {
+    return { name: name2, abi: packageAbi, glue: script, wasm: script, argv0: name2, script, ...withEnv };
+  }
+  const abi = abiOf(raw.abi, packageAbi);
+  const wasm = inside(pkg, raw.wasm);
+  const glue = abi === "wasi" ? wasm : inside(pkg, raw.glue);
+  if (!abi || !glue || !wasm) return void 0;
+  const argv0 = typeof raw.argv0 === "string" && raw.argv0 ? raw.argv0 : name2;
+  const args = argsOf(pkg, raw.args);
+  const imports = abi === "wasi" ? inside(pkg, raw.imports) : void 0;
+  return {
+    name: name2,
+    abi,
+    glue,
+    wasm,
+    argv0,
+    ...args ? { args } : {},
+    ...withEnv,
+    ...imports ? { imports } : {}
+  };
+}
+function commandsOf(pkg, manifest) {
+  const slicc = manifest.slicc;
+  if (!slicc || typeof slicc !== "object") return [];
+  const packageAbi = abiOf(slicc.abi, "emscripten");
+  const entries = slicc.commands;
+  if (!packageAbi || !entries || typeof entries !== "object") return [];
+  const shared = envOf(pkg, slicc.env);
+  const out = [];
+  for (const [name2, raw] of Object.entries(entries)) {
+    if (!NAME.test(name2) || name2 === "." || name2 === ".." || !raw || typeof raw !== "object") {
+      continue;
+    }
+    const command = commandOf(pkg, name2, raw, packageAbi, shared);
+    if (command) out.push(command);
+  }
+  return out;
+}
+async function withPackagePaths(fs, pkg, command) {
+  if (!command.env) return command;
+  const env = {};
+  for (const [key, value] of Object.entries(command.env)) {
+    const path = !value.startsWith("/") && value.includes("/") && inside(pkg, value);
+    env[key] = path && await fs.exists(path) ? path : value;
+  }
+  return { ...command, env };
+}
+async function packages(fs, modules) {
+  const names = await fs.readdir(modules).catch(() => []);
+  const dirs = [];
+  for (const name2 of names) {
+    if (name2.startsWith(".")) continue;
+    if (!name2.startsWith("@")) {
+      dirs.push(`${modules}/${name2}`);
+      continue;
+    }
+    for (const inner of await fs.readdir(`${modules}/${name2}`).catch(() => [])) {
+      dirs.push(`${modules}/${name2}/${inner}`);
+    }
+  }
+  return dirs;
+}
+async function pnpmGlobalRoots(fs, home) {
+  const roots = [];
+  const global = `${home}/global`;
+  for (const version of (await fs.readdir(global).catch(() => [])).sort()) {
+    for (const group of (await fs.readdir(`${global}/${version}`).catch(() => [])).sort()) {
+      const dir = `${global}/${version}/${group}`;
+      const st = await fs.lstat(dir).catch(() => void 0);
+      if (st?.isDirectory && await fs.exists(`${dir}/node_modules`))
+        roots.push(`${dir}/node_modules`);
+    }
+  }
+  return roots;
 }
 async function packagesIn(fs, roots) {
   const dirs = [];
@@ -2203,7 +3034,7 @@ var CONTINUED_STATUS = 65535;
 function waitStatus(code, termsig) {
   return termsig ? termsig & 127 : (code & 255) << 8;
 }
-function concat(chunks2) {
+function concat2(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let offset = 0;
   for (const chunk2 of chunks2) {
@@ -2360,7 +3191,7 @@ var ChildTable = class {
     if (!slots || !chunks2) return new Uint8Array(0);
     slots.delete(slot);
     if (slots.size === 0) this.leftovers.delete(pid);
-    return concat(chunks2);
+    return concat2(chunks2);
   }
 };
 
@@ -2528,7 +3359,7 @@ function statOf(attr, path, mount) {
     ...mount.caps.ranges ? { ranged: true } : {}
   };
 }
-function concat2(chunks2, total) {
+function concat3(chunks2, total) {
   if (chunks2.length === 1 && chunks2[0]?.length === total) return chunks2[0];
   const out = new Uint8Array(total);
   let at = 0;
@@ -2557,6 +3388,7 @@ var MountTable = class {
   mounts = /* @__PURE__ */ new Map();
   devices = 0;
   pending = /* @__PURE__ */ new Set();
+  notes = /* @__PURE__ */ new Map();
   deps;
   constructor(deps) {
     this.deps = deps;
@@ -2565,7 +3397,7 @@ var MountTable = class {
     return this.mounts.get(target);
   }
   list() {
-    return [...this.mounts.values()].map(
+    const mounted = [...this.mounts.values()].map(
       ({ type, source, target, options, state, error, present }) => ({
         type,
         source,
@@ -2575,6 +3407,19 @@ var MountTable = class {
         ...error ? { error } : {}
       })
     );
+    const noted = [...this.notes.values()].filter((note) => !this.mounts.has(note.target));
+    return [...mounted, ...noted.map((note) => ({ ...note, options: { ...note.options } }))];
+  }
+  note(spec, state, error) {
+    const target = normalizePath(spec.target);
+    this.notes.set(target, {
+      type: spec.type,
+      source: spec.source,
+      target,
+      options: { ...spec.options },
+      state,
+      ...error ? { error } : {}
+    });
   }
   locate(path) {
     let best;
@@ -2651,13 +3496,19 @@ var MountTable = class {
     };
     mounted = mount;
     this.mounts.set(target, mount);
+    this.notes.delete(target);
     return this.list().find((m) => m.target === target);
   }
+  unnote(target) {
+    this.notes.delete(normalizePath(target));
+  }
   umount(target, detach = false) {
     const at = normalizePath(target);
     const mount = this.mounts.get(at);
+    if (!mount && this.notes.delete(at)) return;
     if (!mount) throw errnoError("EINVAL", `${at} is not mounted`);
     if (!detach && this.deps.busy(at)) throw errnoError("EBUSY", `${at} has open files`);
+    this.notes.delete(at);
     this.mounts.delete(at);
     mount.conn.close();
     mount.dispose();
@@ -2803,7 +3654,7 @@ var MountFs = class {
     } finally {
       await mount.conn.call({ op: "release", fh });
     }
-    return concat2(chunks2, total);
+    return concat3(chunks2, total);
   }
   async writeFile(path, content) {
     const real = await this.follow(path, 0, true);
@@ -2867,7 +3718,7 @@ var MountFs = class {
     } finally {
       await mount.conn.call({ op: "release", fh });
     }
-    return concat2(chunks2, total);
+    return concat3(chunks2, total);
   }
   fits(mount, real, end) {
     if (mount.maxFile > 0 && end > mount.maxFile) {
@@ -3120,7 +3971,7 @@ async function storageUsage() {
   return { quota: estimate.quota, usage: estimate.usage ?? 0 };
 }
 var done = { ok: true, kind: "void" };
-function json(value) {
+function json2(value) {
   return { ok: true, kind: "json", json: value };
 }
 async function run(entry, path, req) {
@@ -3132,15 +3983,15 @@ async function run(entry, path, req) {
       await fs.writeFile(path, req.body ?? new Uint8Array(0));
       return done;
     case "exists":
-      return json(await fs.exists(path));
+      return json2(await fs.exists(path));
     case "stat":
-      return json(statJson(await fs.stat(path)));
+      return json2(statJson(await fs.stat(path)));
     case "lstat":
-      return json(statJson(await fs.lstat(path)));
+      return json2(statJson(await fs.lstat(path)));
     case "readdir":
-      return json(await fs.readdir(path));
+      return json2(await fs.readdir(path));
     case "readdir-stat":
-      return json(await readdirStat(fs, path));
+      return json2(await readdirStat(fs, path));
     case "mkdir":
       await fs.mkdir(path, { recursive: true });
       return done;
@@ -3166,7 +4017,7 @@ async function run(entry, path, req) {
       await fs.symlink(req.arg2 ?? "", path);
       return done;
     case "readlink":
-      return json(await fs.readlink(path));
+      return json2(await fs.readlink(path));
     case "chmod":
       await fs.chmod(path, req.mode ?? 0);
       return done;
@@ -3197,7 +4048,7 @@ async function dispatchSyncFs(req) {
   const { fs, cwd } = entry;
   try {
     const path = fs.resolvePath(cwd, req.path);
-    if (req.op === "statfs") return json(await entry.statfs?.(path) ?? await storageUsage());
+    if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
     if (req.op === "hold") {
       entry.hold?.(path, req.mode === 1);
       return done;
@@ -3370,7 +4221,7 @@ var HOST_OPS = [
   "async-cancel",
   "async-close"
 ];
-var json2 = (value) => ({ ok: true, kind: "json", json: value });
+var json3 = (value) => ({ ok: true, kind: "json", json: value });
 var done2 = { ok: true, kind: "void" };
 var LockTable = class {
   held = /* @__PURE__ */ new Map();
@@ -3411,361 +4262,124 @@ var AsyncOps = class {
   }
   submit(req) {
     const id = this.hold();
-    this.run(req).then(
-      (result) => this.complete(id, result),
-      (err) => this.complete(id, { ok: false, errno: "EIO", message: String(err) })
-    );
-    return id;
-  }
-  resolve(value) {
-    const id = this.hold();
-    this.complete(id, json2(value));
-    return id;
-  }
-  hold() {
-    const id = this.next++;
-    this.results.set(id, void 0);
-    return id;
-  }
-  take(id) {
-    if (!this.results.has(id)) throw new KernelError("EINVAL");
-    const result = this.results.get(id);
-    if (!result) throw new KernelError("EAGAIN");
-    this.cancel(id);
-    return result;
-  }
-  cancel(id) {
-    this.results.delete(id);
-    const at = this.ready.indexOf(id);
-    if (at >= 0) this.ready.splice(at, 1);
-  }
-  async wait(timeoutMs, signal) {
-    for (; ; ) {
-      if (this.closed) return -1;
-      const id = this.ready.shift();
-      if (id !== void 0) return id;
-      if (timeoutMs !== void 0 && timeoutMs <= 0) return 0;
-      const woke = await this.sleep(timeoutMs, signal);
-      if (!woke) return 0;
-    }
-  }
-  close() {
-    this.closed = true;
-    this.wake();
-  }
-  sleep(timeoutMs, signal) {
-    return new Promise((resolve, reject) => {
-      let timer;
-      const cleanup = () => {
-        clearTimeout(timer);
-        this.waiters.delete(wake);
-        signal.removeEventListener("abort", abort);
-      };
-      const wake = () => {
-        cleanup();
-        resolve(true);
-      };
-      const abort = () => {
-        cleanup();
-        reject(new KernelError("EINTR"));
-      };
-      this.waiters.add(wake);
-      signal.addEventListener("abort", abort, { once: true });
-      if (timeoutMs !== void 0) {
-        timer = setTimeout(() => {
-          cleanup();
-          resolve(false);
-        }, timeoutMs);
-      }
-    });
-  }
-  complete(id, result) {
-    if (!this.results.has(id)) return;
-    this.results.set(id, result);
-    this.ready.push(id);
-    this.wake();
-  }
-  wake() {
-    for (const wake of [...this.waiters]) wake();
-  }
-};
-async function hostSyscall(req, ctx) {
-  switch (req.op) {
-    case "lock":
-      if (!ctx.locks) throw new KernelError("ENOSYS");
-      if (!ctx.locks.lock(ctx.pid, req.path, req.exclusive, req.fd))
-        throw new KernelError("EAGAIN");
-      return done2;
-    case "unlock":
-      ctx.locks?.unlock(ctx.pid, req.path);
-      return done2;
-    case "async-submit":
-      if (!ctx.valid(req.req)) throw new KernelError("EINVAL");
-      return json2(ctx.ops.submit(req.req));
-    case "async-wait":
-      return json2(await ctx.ops.wait(req.timeoutMs, ctx.blocking()));
-    case "async-take":
-      return ctx.ops.take(req.id);
-    case "async-resolve":
-      return json2(ctx.ops.resolve(req.value));
-    case "async-hold":
-      return json2(ctx.ops.hold());
-    case "async-cancel":
-      ctx.ops.cancel(req.id);
-      return done2;
-    case "async-close":
-      ctx.ops.close();
-      return done2;
-  }
-}
-
-// src/kernel/net/loopback-names.ts
-var HOST_LOOPBACK = "host.slicc.internal";
-var PAGE_LOOPBACK = "kernel.localhost";
-var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
-function toHostLoopback(href) {
-  const url = new URL(href);
-  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
-  url.hostname = "127.0.0.1";
-  return url.href;
-}
-
-// src/kernel/net/http1.ts
-var HttpError = class extends Error {
-  status;
-  constructor(status, message2) {
-    super(message2);
-    this.status = status;
-  }
-};
-var CR = 13;
-var LF = 10;
-var READ_SIZE = 64 * 1024;
-var TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-var REASON = {
-  100: "Continue",
-  200: "OK",
-  400: "Bad Request",
-  403: "Forbidden",
-  408: "Request Timeout",
-  411: "Length Required",
-  413: "Content Too Large",
-  417: "Expectation Failed",
-  421: "Misdirected Request",
-  431: "Request Header Fields Too Large",
-  501: "Not Implemented",
-  502: "Bad Gateway",
-  503: "Service Unavailable",
-  505: "HTTP Version Not Supported"
-};
-var Incoming = class {
-  source;
-  buf = new Uint8Array(0);
-  eof = false;
-  constructor(source) {
-    this.source = source;
-  }
-  get buffered() {
-    return this.buf.length;
-  }
-  async fill(signal) {
-    if (this.eof) return false;
-    const chunk2 = await this.source.read(READ_SIZE, signal);
-    if (chunk2.length === 0) {
-      this.eof = true;
-      return false;
-    }
-    const next = new Uint8Array(this.buf.length + chunk2.length);
-    next.set(this.buf);
-    next.set(chunk2, this.buf.length);
-    this.buf = next;
-    return true;
-  }
-  take(n) {
-    const out = this.buf.slice(0, n);
-    this.buf = this.buf.subarray(n);
-    return out;
-  }
-  async some(max, signal) {
-    if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
-    if (this.eof) return new Uint8Array(0);
-    const chunk2 = await this.source.read(max, signal);
-    if (chunk2.length === 0) this.eof = true;
-    return chunk2;
-  }
-  async head(limit, signal) {
-    let from = 0;
-    for (; ; ) {
-      const end = headEnd(this.buf, from);
-      if (end > 0) {
-        if (end > limit) throw new HttpError(431, "request head too large");
-        return this.take(end);
-      }
-      if (this.buf.length > limit) throw new HttpError(431, "request head too large");
-      from = Math.max(0, this.buf.length - 3);
-      if (!await this.fill(signal)) {
-        if (this.buf.length === 0) return null;
-        throw new HttpError(400, "connection closed inside a request head");
-      }
-    }
-  }
-  async line(limit, signal) {
-    let from = 0;
-    for (; ; ) {
-      const at = this.buf.indexOf(LF, from);
-      if (at >= 0) {
-        const line = this.take(at + 1);
-        const text = latin1(line.subarray(0, line[at - 1] === CR ? at - 1 : at));
-        return text;
-      }
-      if (this.buf.length > limit) throw new HttpError(400, "line too long");
-      from = this.buf.length;
-      if (!await this.fill(signal)) throw new HttpError(400, "connection closed inside a body");
-    }
+    this.run(req).then(
+      (result) => this.complete(id, result),
+      (err) => this.complete(id, { ok: false, errno: "EIO", message: String(err) })
+    );
+    return id;
   }
-  async exactly(n, signal) {
-    while (this.buf.length < n) {
-      if (!await this.fill(signal)) throw new HttpError(400, "connection closed inside a body");
-    }
-    return this.take(n);
+  resolve(value) {
+    const id = this.hold();
+    this.complete(id, json3(value));
+    return id;
   }
-};
-function headEnd(buf, from) {
-  for (let i = from; i < buf.length; i++) {
-    if (buf[i] !== LF) continue;
-    if (buf[i + 1] === LF) return i + 2;
-    if (buf[i + 1] === CR && buf[i + 2] === LF) return i + 3;
+  hold() {
+    const id = this.next++;
+    this.results.set(id, void 0);
+    return id;
   }
-  return 0;
-}
-function latin1(bytes) {
-  let out = "";
-  for (let i = 0; i < bytes.length; i += 32768) {
-    out += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  take(id) {
+    if (!this.results.has(id)) throw new KernelError("EINVAL");
+    const result = this.results.get(id);
+    if (!result) throw new KernelError("EAGAIN");
+    this.cancel(id);
+    return result;
   }
-  return out;
-}
-function latin1Bytes(text) {
-  const out = new Uint8Array(text.length);
-  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i) & 255;
-  return out;
-}
-function parseRequestHead(bytes) {
-  const lines = latin1(bytes).split(/\r?\n/);
-  while (lines.length > 0 && lines[0] === "") lines.shift();
-  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines.shift() ?? "");
-  if (!match) throw new HttpError(400, "malformed request line");
-  if (match[3] !== "1") throw new HttpError(505, `HTTP/${match[3]}.${match[4]} is not supported`);
-  return {
-    method: match[1],
-    target: match[2],
-    minor: Number(match[4]),
-    headers: parseFields(lines)
-  };
-}
-function parseFields(lines) {
-  const headers = [];
-  for (const line of lines) {
-    if (line === "") continue;
-    if (line.startsWith(" ") || line.startsWith("	")) {
-      throw new HttpError(400, "obsolete line folding");
-    }
-    const colon = line.indexOf(":");
-    const name2 = colon > 0 ? line.slice(0, colon) : "";
-    if (!TOKEN.test(name2)) throw new HttpError(400, "malformed header field");
-    headers.push([name2, line.slice(colon + 1).trim()]);
+  cancel(id) {
+    this.results.delete(id);
+    const at = this.ready.indexOf(id);
+    if (at >= 0) this.ready.splice(at, 1);
   }
-  return headers;
-}
-function fieldValues(headers, name2) {
-  const lower = name2.toLowerCase();
-  return headers.filter(([n]) => n.toLowerCase() === lower).map(([, v]) => v);
-}
-function fieldTokens(headers, name2) {
-  return fieldValues(headers, name2).flatMap((v) => v.split(",")).map((t) => t.trim().toLowerCase()).filter((t) => t !== "");
-}
-function requestFraming(headers) {
-  const codings = fieldTokens(headers, "transfer-encoding");
-  const lengths = fieldValues(headers, "content-length");
-  if (codings.length > 0) {
-    if (lengths.length > 0) throw new HttpError(400, "both Transfer-Encoding and Content-Length");
-    if (codings.length !== 1 || codings[0] !== "chunked") {
-      throw new HttpError(501, `unsupported Transfer-Encoding: ${codings.join(", ")}`);
+  async wait(timeoutMs, signal) {
+    for (; ; ) {
+      if (this.closed) return -1;
+      const id = this.ready.shift();
+      if (id !== void 0) return id;
+      if (timeoutMs !== void 0 && timeoutMs <= 0) return 0;
+      const woke = await this.sleep(timeoutMs, signal);
+      if (!woke) return 0;
     }
-    return { kind: "chunked" };
-  }
-  if (lengths.length === 0) return { kind: "none" };
-  const distinct = new Set(lengths.flatMap((v) => v.split(",")).map((v) => v.trim()));
-  const [only] = distinct;
-  if (distinct.size !== 1 || !/^\d{1,15}$/.test(only)) {
-    throw new HttpError(400, "invalid Content-Length");
   }
-  const length2 = Number(only);
-  return length2 === 0 ? { kind: "none" } : { kind: "length", length: length2 };
-}
-var MAX_CHUNK_LINE = 4096;
-var MAX_TRAILERS = 64 * 1024;
-async function readBody(incoming, framing, cap, signal) {
-  if (framing.kind === "none") return void 0;
-  if (framing.kind === "length") {
-    if (framing.length > cap) throw new HttpError(413, `request body over ${cap} bytes`);
-    return incoming.exactly(framing.length, signal);
+  close() {
+    this.closed = true;
+    this.wake();
   }
-  const chunks2 = [];
-  let total = 0;
-  for (; ; ) {
-    const sizeLine = await incoming.line(MAX_CHUNK_LINE, signal);
-    const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(sizeLine);
-    if (!size) throw new HttpError(400, "malformed chunk size");
-    const n = Number.parseInt(size[1], 16);
-    if (n === 0) break;
-    total += n;
-    if (total > cap) throw new HttpError(413, `request body over ${cap} bytes`);
-    chunks2.push(await incoming.exactly(n, signal));
-    if (await incoming.line(2, signal) !== "") throw new HttpError(400, "malformed chunk");
+  sleep(timeoutMs, signal) {
+    return new Promise((resolve, reject) => {
+      let timer;
+      const cleanup = () => {
+        clearTimeout(timer);
+        this.waiters.delete(wake);
+        signal.removeEventListener("abort", abort);
+      };
+      const wake = () => {
+        cleanup();
+        resolve(true);
+      };
+      const abort = () => {
+        cleanup();
+        reject(new KernelError("EINTR"));
+      };
+      this.waiters.add(wake);
+      signal.addEventListener("abort", abort, { once: true });
+      if (timeoutMs !== void 0) {
+        timer = setTimeout(() => {
+          cleanup();
+          resolve(false);
+        }, timeoutMs);
+      }
+    });
   }
-  let trailers = 0;
-  for (let line = await incoming.line(MAX_TRAILERS, signal); line !== ""; ) {
-    trailers += line.length;
-    if (trailers > MAX_TRAILERS) throw new HttpError(431, "trailers too large");
-    line = await incoming.line(MAX_TRAILERS, signal);
+  complete(id, result) {
+    if (!this.results.has(id)) return;
+    this.results.set(id, result);
+    this.ready.push(id);
+    this.wake();
   }
-  return concat3(chunks2, total);
-}
-function concat3(chunks2, total = chunks2.reduce((n, c) => n + c.length, 0)) {
-  const out = new Uint8Array(total);
-  let at = 0;
-  for (const chunk2 of chunks2) {
-    out.set(chunk2, at);
-    at += chunk2.length;
+  wake() {
+    for (const wake of [...this.waiters]) wake();
   }
-  return out;
-}
-function safeValue(value) {
-  return !/[\r\n\0]/.test(value);
-}
-function responseHead(status, reason, headers) {
-  const phrase = /^[\t\x20-\x7e\x80-\xff]*$/.test(reason) ? reason : "";
-  let head = `HTTP/1.1 ${status} ${phrase}\r
-`;
-  for (const [name2, value] of headers) {
-    if (TOKEN.test(name2) && safeValue(value)) head += `${name2}: ${value}\r
-`;
+};
+async function hostSyscall(req, ctx) {
+  switch (req.op) {
+    case "lock":
+      if (!ctx.locks) throw new KernelError("ENOSYS");
+      if (!ctx.locks.lock(ctx.pid, req.path, req.exclusive, req.fd))
+        throw new KernelError("EAGAIN");
+      return done2;
+    case "unlock":
+      ctx.locks?.unlock(ctx.pid, req.path);
+      return done2;
+    case "async-submit":
+      if (!ctx.valid(req.req)) throw new KernelError("EINVAL");
+      return json3(ctx.ops.submit(req.req));
+    case "async-wait":
+      return json3(await ctx.ops.wait(req.timeoutMs, ctx.blocking()));
+    case "async-take":
+      return ctx.ops.take(req.id);
+    case "async-resolve":
+      return json3(ctx.ops.resolve(req.value));
+    case "async-hold":
+      return json3(ctx.ops.hold());
+    case "async-cancel":
+      ctx.ops.cancel(req.id);
+      return done2;
+    case "async-close":
+      ctx.ops.close();
+      return done2;
   }
-  return latin1Bytes(`${head}\r
-`);
 }
-function chunk(bytes) {
-  const size = latin1Bytes(`${bytes.length.toString(16)}\r
-`);
-  const out = new Uint8Array(size.length + bytes.length + 2);
-  out.set(size);
-  out.set(bytes, size.length);
-  out[out.length - 2] = CR;
-  out[out.length - 1] = LF;
-  return out;
+
+// src/kernel/net/loopback-names.ts
+var HOST_LOOPBACK = "host.slicc.internal";
+var PAGE_LOOPBACK = "kernel.localhost";
+var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
+function toHostLoopback(href) {
+  const url = new URL(href);
+  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
+  url.hostname = "127.0.0.1";
+  return url.href;
 }
-var LAST_CHUNK = latin1Bytes("0\r\n\r\n");
 
 // src/kernel/net/proxy-service.ts
 var REALM_PROXY_PORT = 3128;
@@ -5358,23 +5972,23 @@ function terminalOf(ctx, fd) {
   if (!tty) throw new KernelError("ENOTTY");
   return tty;
 }
-var json3 = (value) => ({ ok: true, kind: "json", json: value });
+var json4 = (value) => ({ ok: true, kind: "json", json: value });
 var done3 = { ok: true, kind: "void" };
 function ptySyscall(req, ctx) {
   switch (req.op) {
     case "pty-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
-      return json3(ctx.fds.install(ctx.ptys.open().master, 3));
+      return json4(ctx.fds.install(ctx.ptys.open().master, 3));
     }
     case "pty-slave-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
       const pair = ctx.ptys.get(req.n);
       const fd = ctx.fds.install(pair.openSlave(), 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
-      return json3(fd);
+      return json4(fd);
     }
     case "pty-number":
-      return json3(masterOf(ctx, req.fd).index);
+      return json4(masterOf(ctx, req.fd).index);
     case "pty-lock":
       masterOf(ctx, req.fd).locked = req.lock;
       return done3;
@@ -5386,7 +6000,7 @@ function ptySyscall(req, ctx) {
       return done3;
     }
     case "pty-list":
-      return json3(ctx.ptys?.numbers() ?? []);
+      return json4(ctx.ptys?.numbers() ?? []);
     case "pty-packet":
       masterOf(ctx, req.fd).packet = req.on;
       return done3;
@@ -5464,7 +6078,7 @@ function socketAt(fds, fd) {
   if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
   return file;
 }
-var ok = (json4) => json4 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json4 };
+var ok = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
@@ -7428,8 +8042,8 @@ function umountCall(target, flags) {
 var FSTAB_PATH = "/etc/fstab";
 var FSTAB_RETRIES = [1e3, 4e3, 16e3];
 var FINAL = /* @__PURE__ */ new Set(["EINVAL", "EBUSY", "EPERM", "EACCES"]);
-function unescape(field) {
-  return field.replace(
+function unescape(field2) {
+  return field2.replace(
     /\\([0-7]{3})/g,
     (_, octal) => String.fromCharCode(Number.parseInt(octal, 8))
   );
@@ -7468,28 +8082,34 @@ function wait(ms, signal) {
   });
 }
 async function mountFstab(lines, mount, signal, retries = FSTAB_RETRIES, discard = () => {
+}, settled = () => {
 }) {
   return Promise.all(
-    lines.map(async ({ line, spec, invalid }) => {
-      let failed = invalid;
-      for (let attempt = 0; !invalid && attempt <= retries.length && !signal.aborted; attempt++) {
-        try {
-          const entry = await mount(spec);
-          if (!signal.aborted) return { line, target: spec.target, entry };
-          discard(entry);
-          failed = Object.assign(new Error("the kernel stopped"), { code: "ECANCELED" });
-          break;
-        } catch (err) {
-          failed = err;
-          if (FINAL.has(codeOf3(err)) || attempt === retries.length) break;
-          await wait(retries[attempt], signal);
-        }
-      }
-      const code = codeOf3(failed);
-      return { line, target: spec.target, code, error: String(failed?.message ?? code) };
+    lines.map(async (each) => {
+      const result = await mountLine(each, mount, signal, retries, discard);
+      settled(each, result);
+      return result;
     })
   );
 }
+async function mountLine({ line, spec, invalid }, mount, signal, retries, discard) {
+  let failed = invalid;
+  for (let attempt = 0; !invalid && attempt <= retries.length && !signal.aborted; attempt++) {
+    try {
+      const entry = await mount(spec);
+      if (!signal.aborted) return { line, target: spec.target, entry };
+      discard(entry);
+      failed = Object.assign(new Error("the kernel stopped"), { code: "ECANCELED" });
+      break;
+    } catch (err) {
+      failed = err;
+      if (FINAL.has(codeOf3(err)) || attempt === retries.length) break;
+      await wait(retries[attempt], signal);
+    }
+  }
+  const code = codeOf3(failed);
+  return { line, target: spec.target, code, error: String(failed?.message ?? code) };
+}
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
@@ -8080,7 +8700,7 @@ function importedMemory(bytes) {
     const count = u32();
     for (let i = 0; i < count; i++) {
       const module = name2();
-      const field = name2();
+      const field2 = name2();
       const kind = bytes[at++];
       if (kind === 0) u32();
       else if (kind === 1) {
@@ -8088,7 +8708,7 @@ function importedMemory(bytes) {
         limits();
       } else if (kind === 2) {
         const l = limits();
-        return { module, name: field, ...l };
+        return { module, name: field2, ...l };
       } else if (kind === 3) at += 2;
       else if (kind === 4) {
         at++;
@@ -8179,12 +8799,12 @@ function readImports(r, types) {
   const foreign = {};
   for (let i = r.u32(); i > 0; i--) {
     const module = r.name();
-    const field = r.name();
+    const field2 = r.name();
     const kind = r.byte();
     if (kind !== 0) skipImport(r, kind);
     else {
       const type = types[r.u32()] ?? "other";
-      if (!RESERVED_NAMESPACES.has(module)) (foreign[module] ??= {})[field] = type;
+      if (!RESERVED_NAMESPACES.has(module)) (foreign[module] ??= {})[field2] = type;
     }
   }
   return foreign;
@@ -8291,6 +8911,7 @@ var Launcher = class {
   locks = new LockTable();
   ptys = new PtyTable((tty, sig) => this.jobs.signalOwnedForeground(tty, sig));
   net = new LoopbackNet();
+  cdp;
   ca;
   transport;
   watchers = new FsWatchers();
@@ -8301,6 +8922,7 @@ var Launcher = class {
   onMountPending;
   removable = /* @__PURE__ */ new Map();
   hostfs;
+  fstabRetries;
   inserted = /* @__PURE__ */ new Map();
   openFiles = /* @__PURE__ */ new Set();
   held = /* @__PURE__ */ new Set();
@@ -8322,10 +8944,12 @@ var Launcher = class {
     this.media = options.media ?? memoryMedia();
     this.onMountPending = options.onMountPending;
     this.hostfs = options;
+    this.fstabRetries = options.fstabRetries ?? FSTAB_RETRIES;
     this.processMounts = options.processMounts ?? true;
     this.pnpmHome = options.env?.PNPM_HOME ?? PNPM_HOME;
     this.modulesDir = options.modules ?? "/node_modules";
-    this.env = { ...networkEnv(), ...options.env };
+    this.cdp = new CdpHosts(options.cdp);
+    this.env = { ...networkEnv(), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = options.transport ?? missingTransport();
     enableNetwork(this.net, {
@@ -8333,6 +8957,7 @@ var Launcher = class {
       engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
       ca: this.ca
     });
+    enableCdp(this.net, this.cdp);
     this.fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
     this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
       this.catalog = void 0;
@@ -8755,12 +9380,22 @@ var Launcher = class {
   }
   async mountFstab() {
     const text = await this.base.readFile(FSTAB_PATH).catch(() => "");
+    const lines = parseFstab(text);
+    for (const { spec } of lines) this.mounts.note(spec, "pending");
     return mountFstab(
-      parseFstab(text),
-      (spec) => this.mount(spec),
+      lines,
+      (spec) => this.mount(spec).catch((err) => {
+        this.mounts.note(spec, "pending", err?.message ?? String(err));
+        throw err;
+      }),
       this.booting.signal,
-      FSTAB_RETRIES,
-      (entry) => this.umount(entry.target, true)
+      this.fstabRetries,
+      (entry) => this.umount(entry.target, true),
+      ({ spec }, result) => {
+        if (!result.code || result.code === "ECANCELED" || this.booting.signal.aborted) {
+          this.mounts.unnote(spec.target);
+        } else this.mounts.note(spec, "failed", result.error);
+      }
     );
   }
   environment(cwd, extra) {
@@ -9394,6 +10029,8 @@ var Channel = class {
   failure;
   pending = /* @__PURE__ */ new Map();
   watching = /* @__PURE__ */ new Map();
+  cdpHooks = /* @__PURE__ */ new Map();
+  cdpOpen = /* @__PURE__ */ new Set();
   protocol = PROTOCOL;
   nextId = 0;
   port;
@@ -9414,6 +10051,8 @@ var Channel = class {
     this.failure = error;
     this.greeted.reject(error);
     this.remote?.fail(error);
+    for (const close of [...this.cdpOpen]) close();
+    this.cdpOpen.clear();
     for (const call of this.pending.values()) call.reject(error);
     this.pending.clear();
     this.release();
@@ -9434,6 +10073,10 @@ var Channel = class {
     return this.request(call).done;
   }
   receive(data) {
+    if (data.cdpOpen && data.port) {
+      this.openCdp(data);
+      return;
+    }
     if (data.watch !== void 0) {
       this.watching.get(data.watch)?.(data.change);
       return;
@@ -9465,7 +10108,39 @@ var Channel = class {
     if (reply.error !== void 0) call.reject(new KernelCallError(reply.error, reply.code));
     else call.resolve(reply.result);
   }
+  openCdp({ cdpOpen: { registration, ...request }, port }) {
+    const hook = registration === void 0 ? void 0 : this.cdpHooks.get(registration);
+    if (!hook || this.failure) {
+      port.postMessage({ error: "this client no longer serves CDP" });
+      port.close();
+      return;
+    }
+    const close = serveCdpPort(port, hook, request, () => this.cdpOpen.delete(close));
+    this.cdpOpen.add(close);
+  }
 };
+async function serveCdpOn(channel, hook, options) {
+  await since(channel, 5, "CDP serving", async () => {
+  });
+  const req = {
+    op: "serve-cdp",
+    ...options.runtime ? { runtime: options.runtime } : {}
+  };
+  const { id, done: done4 } = channel.request(req);
+  channel.cdpHooks.set(id, hook);
+  try {
+    await done4;
+  } catch (error) {
+    channel.cdpHooks.delete(id);
+    throw error;
+  }
+  return {
+    close: () => {
+      if (!channel.cdpHooks.delete(id)) return;
+      void channel.call({ op: "unserve-cdp", registration: id }).catch(() => void 0);
+    }
+  };
+}
 async function dialOn(channel, { port, host }) {
   const req = { op: "dial", port, ...host ? { host } : {} };
   return dialStream(await since(channel, 4, "dial", () => channel.call(req)));
@@ -9651,6 +10326,7 @@ async function attachKernel(port, options = {}) {
     dial: (options2) => dialOn(channel, options2),
     loopbackFetch: (input, options2) => loopbackFetch((o) => dialOn(channel, o), input, options2),
     fs: fsOn(channel),
+    serveCdp: (hook, options2 = {}) => serveCdpOn(channel, hook, options2),
     async close(o = {}) {
       if (channel.failure) return;
       await channel.call({ op: "detach", ...o.kill ? { kill: true } : {} }).catch(() => void 0);
@@ -9731,7 +10407,9 @@ async function createNodeKernel(options = {}) {
     ...options.modules ? { modules: options.modules } : {},
     ...options.env ? { env: options.env } : {},
     ...transport ? { transport } : {},
-    ...options.processMounts !== void 0 ? { processMounts: options.processMounts } : {}
+    ...options.processMounts !== void 0 ? { processMounts: options.processMounts } : {},
+    ...options.fstabRetries ? { fstabRetries: options.fstabRetries } : {},
+    ...options.cdp ? { cdp: options.cdp } : {}
   });
   await launcher.prepare();
   const guard = (work) => new Promise((resolve, reject) => {
@@ -9811,6 +10489,7 @@ async function createNodeKernel(options = {}) {
       for (const client of [...clients]) client.detach();
       for (const reject of [...pending]) reject(new Error(TERMINATED));
       for (const kill of [...live]) kill();
+      launcher.cdp.close();
       launcher.unmountAll();
     }
   };