@ai-ecoverse/slicc-kernel 1.36.0 → 1.37.1

package/dist/node.js

@@ -3249,6 +3249,35 @@ async function scanFilesystems(fs, modules) {
   }
   return found;
 }
+var SUFFIX = /^\.[A-Za-z0-9_+-][A-Za-z0-9._+-]*$/;
+async function scanBinfmts(fs, modules) {
+  const found = /* @__PURE__ */ new Map();
+  for (const pkg of await packagesIn(fs, modules)) {
+    let manifest;
+    try {
+      manifest = JSON.parse(await fs.readFile(`${pkg}/package.json`));
+    } catch {
+      continue;
+    }
+    const declared = manifest.slicc?.binfmt;
+    if (!declared || typeof declared !== "object") continue;
+    for (const [suffix, command] of Object.entries(declared)) {
+      if (!SUFFIX.test(suffix) || typeof command !== "string" || !NAME.test(command)) continue;
+      if (!found.has(suffix)) found.set(suffix, command);
+    }
+  }
+  return found;
+}
+function binfmtOf(binfmts, path) {
+  const name2 = path.slice(path.lastIndexOf("/") + 1);
+  let best;
+  for (const suffix of binfmts.keys()) {
+    if (name2.length > suffix.length && name2.endsWith(suffix)) {
+      if (best === void 0 || suffix.length > best.length) best = suffix;
+    }
+  }
+  return best === void 0 ? void 0 : binfmts.get(best);
+}
 
 // src/fs/commands.ts
 var S_IFDIR2 = 16384;
@@ -3365,13 +3394,193 @@ function withCommandDirs(fs, names) {
   };
 }
 
+// src/fs/unlinked.ts
+var UNLINKED_DIR = ".slicc-unlinked";
+function webLocks() {
+  return globalThis.navigator?.locks;
+}
+var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var lockName = (instance) => `slicc-unlinked:${instance}`;
+var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
+var PathGate = class {
+  tails = /* @__PURE__ */ new Map();
+  async acquire(path) {
+    const prev = this.tails.get(path) ?? Promise.resolve();
+    const { promise, resolve } = Promise.withResolvers();
+    const tail = prev.then(() => promise);
+    this.tails.set(path, tail);
+    await prev;
+    return () => {
+      resolve();
+      if (this.tails.get(path) === tail) this.tails.delete(path);
+    };
+  }
+  async run(path, op) {
+    const release = await this.acquire(path);
+    try {
+      return await op();
+    } finally {
+      release();
+    }
+  }
+};
+var UnlinkedKeeper = class {
+  fs;
+  holders;
+  rootOf;
+  locks;
+  busy;
+  waiting = /* @__PURE__ */ new Set();
+  instance = crypto.randomUUID();
+  gate = new PathGate();
+  queue = Promise.resolve();
+  count = 0;
+  constructor(fs, holders, rootOf, locks, busy = () => false) {
+    this.fs = fs;
+    this.holders = holders;
+    this.rootOf = rootOf;
+    this.locks = locks;
+    this.busy = busy;
+    void locks?.request(lockName(this.instance), () => new Promise(() => void 0));
+  }
+  serial(op) {
+    const next = this.queue.then(op);
+    this.queue = next.catch(() => void 0);
+    return next;
+  }
+  wrap() {
+    const fs = this.fs;
+    const keeper = this;
+    const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
+    return {
+      ...fs,
+      async rm(path, options) {
+        const target = fs.resolvePath("/", path);
+        const pinned = await keeper.pin(target);
+        if (pinned.moved.has(target)) pinned.commit();
+        else await keeper.settle(pinned, () => fs.rm(path, options));
+      },
+      async rename(from, to) {
+        const pinned = await keeper.pin(fs.resolvePath("/", to));
+        await keeper.settle(pinned, () => fs.rename(from, to));
+      },
+      readdir: async (path) => visible(await fs.readdir(path)),
+      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR)
+    };
+  }
+  async settle(pinned, op) {
+    try {
+      await op();
+    } catch (err) {
+      await pinned.rollback();
+      throw err;
+    }
+    pinned.commit();
+  }
+  async pin(target) {
+    const held = /* @__PURE__ */ new Map();
+    for (const holder of this.holders) {
+      if (holder.owns(target)) continue;
+      for (const path of holder.opens.keys()) {
+        if (!within2(path, target) || holder.unlinked.has(path)) continue;
+        held.set(path, [...held.get(path) ?? [], holder]);
+      }
+    }
+    const paths = [...held.keys()].sort();
+    const releases = [];
+    for (const path of paths) releases.push(await this.gate.acquire(path));
+    const hidden = /* @__PURE__ */ new Map();
+    for (const path of paths) {
+      const at = await this.hide(path);
+      if (at !== void 0) hidden.set(path, at);
+    }
+    const done4 = () => {
+      for (const release of releases) release();
+    };
+    return {
+      moved: new Set(hidden.keys()),
+      commit: () => {
+        for (const [path, at] of hidden) {
+          const holders = held.get(path);
+          const file = this.keptFile(at, { refs: holders.length });
+          for (const holder of holders) holder.unlinked.set(path, file);
+        }
+        done4();
+      },
+      rollback: async () => {
+        for (const [path, at] of hidden) {
+          await this.serial(async () => {
+            await Promise.allSettled([this.fs.rename(at, path)]);
+            await this.tidy(parentOf3(at));
+          });
+        }
+        done4();
+      }
+    };
+  }
+  keptFile(hidden, entry) {
+    return {
+      hidden,
+      release: () => {
+        if (--entry.refs === 0) void this.serial(() => this.drop(hidden));
+      }
+    };
+  }
+  hide(path) {
+    return this.serial(async () => {
+      const dir = dirOf(this.rootOf(path));
+      const hidden = `${dir}/${this.instance}.${++this.count}`;
+      try {
+        await this.fs.mkdir(dir, { recursive: true });
+        await this.fs.rename(path, hidden);
+        return hidden;
+      } catch {
+        await this.tidy(dir);
+        return void 0;
+      }
+    });
+  }
+  closed(path) {
+    if (this.waiting.delete(path)) void this.serial(() => this.drop(path));
+  }
+  async drop(hidden) {
+    if (this.busy(hidden)) {
+      this.waiting.add(hidden);
+      return;
+    }
+    await this.fs.rm(hidden).catch(() => void 0);
+    await this.tidy(parentOf3(hidden));
+  }
+  async tidy(dir) {
+    const left = await this.fs.readdir(dir).catch(() => [UNLINKED_DIR]);
+    if (left.length === 0) await this.fs.rm(dir, { recursive: true }).catch(() => void 0);
+  }
+  sweep(root) {
+    const query = this.locks?.query?.bind(this.locks);
+    if (!query) return Promise.resolve();
+    return this.serial(async () => {
+      const dir = dirOf(root);
+      const names = await this.fs.readdir(dir).catch(() => void 0);
+      if (!names) return;
+      const held = new Set(((await query()).held ?? []).map((lock) => lock.name));
+      for (const name2 of names) {
+        const owner = name2.slice(0, name2.lastIndexOf("."));
+        if (owner === this.instance || held.has(lockName(owner))) continue;
+        await this.fs.rm(`${dir}/${name2}`, { recursive: true }).catch(() => void 0);
+      }
+      await this.tidy(dir);
+    });
+  }
+};
+
 // src/fs/watch.ts
 var WATCH_BATCH_LIMIT = 1e3;
 var under2 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
-var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 function touches(watcher, changed) {
   return watcher.paths.some(
-    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf3(changed) === watched)
+    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf4(changed) === watched)
   );
 }
 var FsWatchers = class {
@@ -3753,7 +3962,7 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -3766,18 +3975,47 @@ var HeldSet = class extends Set {
   }
   delete(holds) {
     const removed = super.delete(holds);
-    for (const path of holds.keys()) this.idle(path);
+    for (const path of /* @__PURE__ */ new Set([...holds.keys(), ...holds.opens.keys()])) this.idle(path);
+    for (const kept of holds.unlinked.values()) kept.release();
+    holds.unlinked.clear();
     return removed;
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within2(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within3(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
   revoked = /* @__PURE__ */ new Set();
+  opens = /* @__PURE__ */ new Map();
+  unlinked = /* @__PURE__ */ new Map();
+  aliases = /* @__PURE__ */ new Map();
+  owning;
   onIdle;
-  hold(path, on) {
+  keyOf(path) {
+    return this.aliases.get(path) ?? path;
+  }
+  keptAt(path) {
+    return this.unlinked.get(this.keyOf(path));
+  }
+  holding(path) {
+    return this.opens.has(this.keyOf(path));
+  }
+  hold(path, on, open = false, real) {
+    if (open) {
+      const key = real ?? this.keyOf(path);
+      if (key !== path) this.aliases.set(path, key);
+      const count2 = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
+      if (count2 > 0) this.opens.set(key, count2);
+      else {
+        this.opens.delete(key);
+        this.unlinked.get(key)?.release();
+        this.unlinked.delete(key);
+        for (const [alias, target] of this.aliases) if (target === key) this.aliases.delete(alias);
+        this.onIdle?.(key);
+      }
+      return;
+    }
     const count = (this.get(path) ?? 0) + (on ? 1 : -1);
     if (count > 0) this.set(path, count);
     else {
@@ -3786,23 +4024,40 @@ var HeldPaths = class extends Map {
       this.onIdle?.(path);
     }
   }
+  async own(path, op) {
+    this.owning = path;
+    try {
+      return await op();
+    } finally {
+      this.owning = void 0;
+    }
+  }
+  owns(path) {
+    return this.owning === path;
+  }
   revoke(prefix) {
-    for (const path of this.keys()) if (within2(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within3(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count] of [...this]) {
-      if (!within2(path, from)) continue;
+      if (!within3(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
+    for (const [path, count] of [...this.opens]) {
+      if (!within3(path, from)) continue;
+      const moved2 = to + path.slice(from.length);
+      this.opens.delete(path);
+      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
+    }
   }
   isRevoked(path) {
     return this.revoked.has(path);
   }
 };
-var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var readonly = (mount) => mount.caps.readonly === true || mount.options.ro !== void 0;
 function statOf(attr, path, mount) {
   const mtime = new Date(attr.mtime);
@@ -3891,7 +4146,7 @@ var MountTable = class {
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within2(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within3(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -4030,7 +4285,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within2(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within3(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -4064,10 +4319,10 @@ var MountTable = class {
     this.deps.changed?.(...full);
   }
   forget(mount, path) {
-    for (const key of [...mount.attrs.keys()]) if (within2(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within3(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
-    mount.lists.delete(parentOf4(path));
-    for (const key of [...mount.lists.keys()]) if (within2(key, path)) mount.lists.delete(key);
+    mount.lists.delete(parentOf5(path));
+    for (const key of [...mount.lists.keys()]) if (within3(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2) {
     if (mount.conn.failure) throw mount.conn.failure;
@@ -4132,7 +4387,7 @@ var MountFs = class {
     if (attr.kind !== "symlink") return real;
     if (hops >= MAX_LINKS4) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
-    return this.follow(this.base.resolvePath(parentOf4(real), target), hops + 1, create);
+    return this.follow(this.base.resolvePath(parentOf5(real), target), hops + 1, create);
   }
   async open(mount, rel2, write) {
     return await mount.conn.call({
@@ -4646,6 +4901,8 @@ async function ranged(fs, path, req) {
   else await ops.truncate(path, req.length ?? 0);
   return done;
 }
+var UNLINKED_OPS = /* @__PURE__ */ new Set(["read", "pread", "pwrite", "truncate"]);
+var OWN_OPS = /* @__PURE__ */ new Set(["rm", "unlink", "rmdir", "rename"]);
 async function dispatchSyncFs(req) {
   const entry = resolveSyncFsToken(req.token);
   if (!entry) return { ok: false, errno: "EACCES", message: "sync-fs: unknown or revoked token" };
@@ -4654,11 +4911,22 @@ async function dispatchSyncFs(req) {
     const path = fs.resolvePath(cwd, req.path);
     if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
     if (req.op === "hold") {
-      entry.hold?.(path, req.mode === 1);
+      const [on, open] = [((req.mode ?? 0) & 1) === 1, ((req.mode ?? 0) & 2) === 2];
+      const real = on && open ? await fs.realpath?.(path, true).catch(() => path) : void 0;
+      entry.hold?.(path, on, open, real);
       return done;
     }
     if (entry.revoked?.(path)) return { ok: false, errno: "EIO", message: `${path} was unmounted` };
-    return await run(entry, path, req);
+    if (req.op === "write" && req.mode === 1 || UNLINKED_OPS.has(req.op)) {
+      const serve = async () => {
+        const kept = entry.unlinked?.(path);
+        return run(entry, kept && !await fs.exists(path) ? kept.hidden : path, req);
+      };
+      return await (entry.gate ? entry.gate(path, serve) : serve());
+    }
+    if (!entry.own || !OWN_OPS.has(req.op)) return await run(entry, path, req);
+    const target = req.op === "rename" ? fs.resolvePath(cwd, req.arg2 ?? "") : path;
+    return await entry.own(target, () => run(entry, path, req));
   } catch (err) {
     return toErrno(err);
   }
@@ -6237,7 +6505,7 @@ function parsePrefix(text) {
   if (length2 < 0 || length2 > max) return void 0;
   return { ...parsed, length: length2 };
 }
-function within3(prefix, addr) {
+function within4(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
   const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
   return addr.bits >> shift === prefix.bits >> shift;
@@ -6277,9 +6545,9 @@ var Routes = class {
     if (!addr) return "unreachable";
     if (addr.v6 && addr.bits === 1n) return "loopback";
     if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
+    if (RESERVED.some((p) => within4(p, addr))) return "reserved";
     if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
+    if (this.exit || this.table.some((p) => within4(p, addr))) return "uplink";
     return "unreachable";
   }
 };
@@ -7248,7 +7516,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within4(path, root) {
+function within5(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -7453,7 +7721,7 @@ var VfsNodes = class {
     return run2;
   }
   async entryKey(path) {
-    const parent = parentOf5(path);
+    const parent = parentOf6(path);
     const dir = await this.real(parent, true, () => realDir(this.fs, parent));
     return joinName(dir, path.slice(path.lastIndexOf("/") + 1));
   }
@@ -7501,12 +7769,12 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within5(path, prefix)) return true;
     return false;
   }
   writes(prefix) {
     for (const [path, node] of this.byPath)
-      if (node.writers > 0 && within4(path, prefix)) return true;
+      if (node.writers > 0 && within5(path, prefix)) return true;
     return false;
   }
   closed(node, writable = false) {
@@ -7520,24 +7788,24 @@ var VfsNodes = class {
     this.onClosed?.(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within5(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within4(held, path)) continue;
+      if (!within5(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within4(path, prefix)) continue;
+      if (!within5(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within4(held, path)) continue;
+      if (!within5(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -7546,8 +7814,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within4(p, from)) moved2.push(node);
-      else if (within4(p, to)) {
+      if (within5(p, from)) moved2.push(node);
+      else if (within5(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -7570,7 +7838,7 @@ async function present(fs, path, follow = false) {
   }
 }
 var MAX_LINKS5 = 40;
-function parentOf5(path) {
+function parentOf6(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
 async function linkOf(fs, path) {
@@ -7583,7 +7851,7 @@ async function realDir(fs, dir, budget = { hops: 0 }) {
     const part = queue.shift();
     if (part === ".") continue;
     if (part === "..") {
-      at = parentOf5(at);
+      at = parentOf6(at);
       continue;
     }
     const next = at === "/" ? `/${part}` : `${at}/${part}`;
@@ -7607,7 +7875,7 @@ function joinName(dir, name2) {
 }
 async function realTarget(fs, path) {
   const budget = { hops: 0 };
-  let dir = await realDir(fs, parentOf5(path), budget);
+  let dir = await realDir(fs, parentOf6(path), budget);
   let name2 = path.slice(path.lastIndexOf("/") + 1);
   for (; ; ) {
     const link2 = await linkOf(fs, joinName(dir, name2));
@@ -7615,13 +7883,13 @@ async function realTarget(fs, path) {
     if (budget.hops >= MAX_LINKS5) throw fsError("ELOOP", path);
     budget.hops++;
     const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
-    dir = await realDir(fs, parentOf5(target), budget);
+    dir = await realDir(fs, parentOf6(target), budget);
     name2 = target.slice(target.lastIndexOf("/") + 1);
   }
   return joinName(dir, name2);
 }
 async function targetDir(fs, path) {
-  return parentOf5(await realTarget(fs, path).catch(() => path));
+  return parentOf6(await realTarget(fs, path).catch(() => path));
 }
 async function refuseReadonly(fs, path, flags, opts = {}) {
   const writes = (flags & O_ACCMODE) !== 0 || opts.truncate === true;
@@ -8010,7 +8278,7 @@ var WasmProcess = class {
     const fd = this.fds.install(heldFile(), 3);
     try {
       const nodes = this.nodes;
-      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : await nodes.targetKey(req.path);
+      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : req.create ? await nodes.targetKey(req.path) : await this.keptOr(await nodes.targetKey(req.path));
       const open = { ...req, path };
       if (req.exclusive) {
         await nodes.createExclusive(path);
@@ -8166,6 +8434,11 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: await file.stat() };
     }
   }
+  keptPath;
+  async keptOr(path) {
+    const kept = this.keptPath?.(path);
+    return kept !== void 0 && !await present(this.options.fs, path, true) ? kept : path;
+  }
   async promote(req) {
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     if (req.share !== void 0) {
@@ -8173,7 +8446,7 @@ var WasmProcess = class {
       return;
     }
     if (req.path === void 0) throw new KernelError("EINVAL");
-    const path = req.orphan ? req.path : await this.nodes.targetKey(req.path);
+    const path = req.orphan ? req.path : await this.keptOr(await this.nodes.targetKey(req.path));
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     const file = vfsFile(
       this.options.fs,
@@ -8532,6 +8805,19 @@ function inherited(opts) {
     ...opts.umask !== void 0 ? { umask: opts.umask } : {}
   };
 }
+function holdingToken(opts, holds) {
+  return mintSyncFsToken({
+    fs: opts.fs,
+    cwd: opts.cwd,
+    ...opts.statfs ? { statfs: opts.statfs } : {},
+    hold: (path, on, open, real) => holds.hold(path, on, open, real),
+    unlinked: (path) => holds.keptAt(path),
+    gate: (path, op) => opts.unlinkGate && holds.holding(path) ? opts.unlinkGate.run(holds.keyOf(path), op) : op(),
+    own: (path, op) => holds.own(path, op),
+    revoked: (path) => holds.isRevoked(path),
+    renamed: (from, to) => holds.renamed(from, to)
+  });
+}
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
@@ -8576,14 +8862,8 @@ function spawnWasmProcess(opts) {
   });
   const holds = new HeldPaths();
   opts.held?.add(holds);
-  const token = mintSyncFsToken({
-    fs: opts.fs,
-    cwd: opts.cwd,
-    ...opts.statfs ? { statfs: opts.statfs } : {},
-    hold: (path, on) => holds.hold(path, on),
-    revoked: (path) => holds.isRevoked(path),
-    renamed: (from, to) => holds.renamed(from, to)
-  });
+  const token = holdingToken(opts, holds);
+  process.keptPath = (path) => holds.keptAt(path)?.hidden;
   const worker = opts.createWorker();
   const dying = new Dying();
   const dispatch2 = (req) => dying.serving(() => isWasmSyscall(req) ? process.syscall(req) : dispatchSyncFs(req));
@@ -10110,6 +10390,7 @@ var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
 var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 var WASM_MAGIC = [0, 97, 115, 109];
 var SHEBANG_MAX = 256;
+var MAX_INTERPRETERS = 4;
 var NOT_FOUND = 127;
 var DECIDE_MS = 100;
 var INIT_PID = 1;
@@ -10161,6 +10442,17 @@ function targetOf(command) {
     ...command.preopenRoot ? { preopenRoot: true } : {}
   };
 }
+function withScriptEnv(target, command) {
+  if (!command) return target;
+  return {
+    ...target,
+    env: { ...target.env, ...command.env },
+    unset: [
+      ...(target.unset ?? []).filter((key) => !Object.hasOwn(command.env ?? {}, key)),
+      ...command.unset ?? []
+    ]
+  };
+}
 function childHandle(handle) {
   return {
     pid: handle.pid,
@@ -10185,6 +10477,7 @@ var Launcher = class {
   modulesDir;
   env;
   catalog;
+  binfmts;
   compiled = /* @__PURE__ */ new Map();
   processes = /* @__PURE__ */ new Map();
   zombies = /* @__PURE__ */ new Set();
@@ -10219,6 +10512,7 @@ var Launcher = class {
   deciding = /* @__PURE__ */ new Map();
   identities = { asked: 0, timedOut: 0 };
   nodes;
+  unlinked;
   held = new HeldSet((path) => this.released(path));
   processMounts;
   booting = new AbortController();
@@ -10263,9 +10557,18 @@ var Launcher = class {
     const fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.openFiles.add(this.nodes);
-    this.fs = keepingOpen(fs, this.nodes);
+    this.unlinked = new UnlinkedKeeper(
+      fs,
+      this.held,
+      (path) => this.mountRoot(path),
+      webLocks(),
+      (path) => [...this.openFiles].some((nodes) => nodes.holds(path))
+    );
+    this.fs = keepingOpen(this.unlinked.wrap(), this.nodes);
+    void this.unlinked.sweep("/");
     this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
       this.catalog = void 0;
+      this.binfmts = void 0;
     });
   }
   setRoutes(table) {
@@ -10275,6 +10578,10 @@ var Launcher = class {
     this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
     return this.catalog;
   }
+  interpreters() {
+    this.binfmts ??= this.roots().then((roots) => scanBinfmts(this.base, roots));
+    return this.binfmts;
+  }
   async roots() {
     return [this.modulesDir, ...await pnpmGlobalRoots(this.base, this.pnpmHome)];
   }
@@ -10320,30 +10627,28 @@ var Launcher = class {
     const command = (await this.commands()).get(name2);
     return command?.script ? command : void 0;
   }
-  async interpreted(file, argv, cwd) {
+  async interpreted(file, argv, cwd, depth = 0) {
     const command = await this.scriptCommand(file);
     const script = command?.script ?? this.fs.resolvePath(cwd, file);
-    const words = shebang(await this.head(script) ?? new Uint8Array());
+    const head = await this.head(script);
+    if (!head) return void 0;
+    const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(), script);
+    const words = shebang(head) ?? (binfmt ? [binfmt] : void 0);
     if (!words) return void 0;
     if (baseName(words[0]) === "env") words.shift();
     const [interp, ...rest] = words;
-    const found = interp ? await this.resolve(interp, interp, cwd) : void 0;
-    if (!found) return void 0;
-    const target = command ? {
-      ...found,
-      env: { ...found.env, ...command.env },
-      unset: [...found.unset ?? [], ...command.unset ?? []]
-    } : found;
     const arg = rest.join(" ");
-    return {
-      target,
-      args: [
-        ...target.prefix ?? [],
-        ...arg ? [arg] : [],
-        command ? script : file,
-        ...argv.slice(1)
-      ]
-    };
+    const passed = [...arg ? [arg] : [], command ? script : file, ...argv.slice(1)];
+    const found = interp ? await this.resolve(interp, interp, cwd) : void 0;
+    if (!found) {
+      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp)) {
+        return void 0;
+      }
+      const inner = await this.interpreted(interp, [interp, ...passed], cwd, depth + 1);
+      return inner && { ...inner, target: withScriptEnv(inner.target, command) };
+    }
+    const target = withScriptEnv(found, command);
+    return { target, args: [...target.prefix ?? [], ...passed] };
   }
   async plan(file, argv, cwd) {
     const direct = await this.resolve(file, argv[0] ?? file, cwd);
@@ -10351,8 +10656,10 @@ var Launcher = class {
     return this.interpreted(file, argv, cwd);
   }
   async unrunnable(file, cwd) {
-    const head = await this.base.readFileBuffer(this.fs.resolvePath(cwd, file)).catch(() => null);
-    return head && !(head[0] === 35 && head[1] === 33) ? "ENOEXEC" : "ENOENT";
+    const path = this.fs.resolvePath(cwd, file);
+    const head = await this.base.readFileBuffer(path).catch(() => null);
+    if (!head || head[0] === 35 && head[1] === 33) return "ENOENT";
+    return binfmtOf(await this.interpreters(), path) ? "ENOENT" : "ENOEXEC";
   }
   module(path) {
     return this.base.stat(path).then((st) => {
@@ -10468,6 +10775,7 @@ var Launcher = class {
       openFiles: this.openFiles,
       nodes: this.nodes,
       held: this.held,
+      unlinkGate: this.unlinked.gate,
       statfs: (path) => this.mounts.statfs(path),
       mounts: () => this.mounts.list(),
       mount: (call, signal) => this.processMount(pid, call, signal),
@@ -10625,6 +10933,7 @@ var Launcher = class {
   }
   released(path) {
     const at = normalizePath(path);
+    this.unlinked.closed(at);
     const open = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
     if (!open) void this.mounts.commit(at).catch(() => void 0);
   }
@@ -10720,10 +11029,23 @@ var Launcher = class {
       }
     };
   }
-  mount(spec) {
-    if (spec.type !== "fsa" || spec.source.startsWith("fsa:"))
-      return this.mounts.mount(spec, this.fs);
-    return this.mounts.mount({ ...spec, source: `fsa:${crypto.randomUUID()}` }, this.fs);
+  async mount(spec) {
+    const fsa = spec.type === "fsa" && !spec.source.startsWith("fsa:");
+    const entry = await this.mounts.mount(
+      fsa ? { ...spec, source: `fsa:${crypto.randomUUID()}` } : spec,
+      this.fs
+    );
+    void this.unlinked.sweep(entry.target);
+    return entry;
+  }
+  mountRoot(path) {
+    let root = "/";
+    for (const { target } of this.mounts.list()) {
+      if (target.length > root.length && (path === target || path.startsWith(`${target}/`))) {
+        root = target;
+      }
+    }
+    return root;
   }
   async insert(target, handle, source) {
     const at = normalizePath(target);
@@ -10737,6 +11059,7 @@ var Launcher = class {
     await this.media.put(slot.id, handle);
     slot.medium.insert(handle);
     slot.served.invalidate(true);
+    void this.unlinked.sweep(at);
   }
   umount(target, detach = false) {
     const at = normalizePath(target);
@@ -10812,6 +11135,7 @@ var Launcher = class {
   }
   async starting(argv, dir) {
     this.catalog = void 0;
+    this.binfmts = void 0;
     const cwd = this.fs.resolvePath("/", dir ?? "/");
     const [file = ""] = argv;
     await this.base.mkdir(cwd, { recursive: true });