@ai-ecoverse/slicc-kernel 1.37.0 → 1.38.0

package/dist/kernel-worker.js

@@ -2032,9 +2032,80 @@ var SIGNAL_BY_NAME = {
 // src/body-idle.ts
 var BODY_IDLE_MS = 5 * 60 * 1e3;
 
+// src/kernel/net/ws-queue.ts
+var INBOUND_LIMIT = 16 * 1024 * 1024;
+var MESSAGE_LIMIT = 64 * 1024 * 1024;
+var TOO_BIG = 1009;
+function payloadSize(message2) {
+  return typeof message2 === "string" ? new TextEncoder().encode(message2).length : message2.length;
+}
+var MessageQueue = class {
+  items = [];
+  limit;
+  waiter;
+  size = 0;
+  ended = false;
+  overflow;
+  taken;
+  closed;
+  settle;
+  constructor(overflow, limit = INBOUND_LIMIT, taken) {
+    this.overflow = overflow;
+    this.limit = limit;
+    this.taken = taken;
+    this.closed = new Promise((resolve) => {
+      this.settle = resolve;
+    });
+  }
+  push(message2) {
+    if (this.ended) return;
+    const size = payloadSize(message2);
+    const huge = size > MESSAGE_LIMIT;
+    if (huge || this.items.length > 0 && this.size + size > this.limit) {
+      const reason = huge ? `a message is over ${MESSAGE_LIMIT} bytes` : `over ${this.limit} bytes of messages are waiting`;
+      this.end({ code: TOO_BIG, reason });
+      this.overflow();
+      return;
+    }
+    this.size += size;
+    this.items.push(message2);
+    this.wake();
+  }
+  end(close) {
+    if (this.ended) return;
+    this.ended = true;
+    this.settle(close);
+    this.wake();
+  }
+  wake() {
+    const waiter = this.waiter;
+    this.waiter = void 0;
+    waiter?.();
+  }
+  async *[Symbol.asyncIterator]() {
+    for (; ; ) {
+      const next = this.items.shift();
+      if (next !== void 0) {
+        const n = payloadSize(next);
+        this.size -= n;
+        this.taken?.(n);
+        yield next;
+        continue;
+      }
+      if (this.ended) return;
+      await new Promise((resolve) => {
+        this.waiter = resolve;
+      });
+    }
+  }
+};
+
 // src/transport.ts
+var SEND_BUFFER = 1024 * 1024;
+var CLOSE_WAIT_MS = 5e3;
+var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
-function serveTransport(peer, transport) {
+function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const open = /* @__PURE__ */ new Map();
   const fail = (nid, e) => {
     open.delete(nid);
@@ -2075,6 +2146,96 @@ function serveTransport(peer, transport) {
       fail(call.nid, e);
     }
   };
+  const sockets = /* @__PURE__ */ new Map();
+  const credit = /* @__PURE__ */ new Map();
+  const refill = (nid, n, closing = false) => {
+    const flow = credit.get(nid);
+    if (!flow) return;
+    flow.inflight -= n;
+    if (closing && !flow.closing) {
+      flow.closing = true;
+      flow.deadline();
+    }
+    flow.wake?.();
+  };
+  const openSocket = async (call) => {
+    const abort = new AbortController();
+    open.set(call.nid, { abort });
+    try {
+      if (!transport.websocket) throw new Error(NO_WEBSOCKET);
+      const socket = await transport.websocket({
+        url: call.url,
+        protocols: call.protocols,
+        headers: call.headers,
+        signal: abort.signal
+      });
+      if (!open.delete(call.nid)) {
+        socket.close(1e3, "cancelled");
+        return;
+      }
+      sockets.set(call.nid, socket);
+      peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
+      void relay(call.nid, socket);
+    } catch (e) {
+      fail(call.nid, e);
+    }
+  };
+  const relay = async (nid, socket) => {
+    let ending;
+    let late;
+    const unanswered = new Promise((resolve) => {
+      late = () => resolve("late");
+    });
+    const flow = {
+      inflight: 0,
+      closing: false,
+      deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
+    };
+    credit.set(nid, flow);
+    const timedOut = { code: 1006, reason: "the far end did not answer the close" };
+    let oversize = false;
+    try {
+      const messages = socket.messages[Symbol.asyncIterator]();
+      for (; ; ) {
+        const next = await Promise.race([messages.next(), unanswered]);
+        if (next === "late" || next.done) break;
+        const data = next.value;
+        if (flow.closing) continue;
+        if (payloadSize(data) > MESSAGE_LIMIT) {
+          oversize = true;
+          break;
+        }
+        if (typeof data === "string") peer.postMessage({ net: "ws-message", nid, data });
+        else {
+          const bytes = data.slice();
+          peer.postMessage({ net: "ws-message", nid, data: bytes }, [bytes.buffer]);
+        }
+        flow.inflight += payloadSize(data);
+        while (flow.inflight > INBOUND_LIMIT && !flow.closing) {
+          await new Promise((resolve) => {
+            flow.wake = resolve;
+          });
+        }
+      }
+      if (oversize) socket.close(1e3, "a message is too big");
+      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut)]);
+    } catch (e) {
+      socket.close(1e3, "the relay failed");
+      ending = { code: 1011, reason: e instanceof Error ? e.message : String(e) };
+    }
+    sockets.delete(nid);
+    credit.delete(nid);
+    peer.postMessage({ net: "ws-closed", nid, ...ending });
+  };
+  const sendOn = async (call) => {
+    const socket = sockets.get(call.nid);
+    if (!socket) return;
+    socket.send(call.data);
+    while (socket.buffered > SEND_BUFFER && sockets.has(call.nid)) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
+  };
   const read = async (nid) => {
     const body = open.get(nid)?.body;
     if (!body) return;
@@ -2092,6 +2253,8 @@ function serveTransport(peer, transport) {
     }
   };
   const drop = (nid) => {
+    sockets.get(nid)?.close(1e3, "cancelled");
+    refill(nid, 0, true);
     const entry = open.get(nid);
     open.delete(nid);
     entry?.abort.abort();
@@ -2101,10 +2264,16 @@ function serveTransport(peer, transport) {
     answer(call) {
       if (call.net === "fetch") void start(call);
       else if (call.net === "read") void read(call.nid);
+      else if (call.net === "ws-open") void openSocket(call);
+      else if (call.net === "ws-send") void sendOn(call);
+      else if (call.net === "ws-close") {
+        sockets.get(call.nid)?.close(call.code, call.reason);
+        refill(call.nid, 0, true);
+      } else if (call.net === "ws-consumed") refill(call.nid, call.n);
       else drop(call.nid);
     },
     close() {
-      for (const nid of [...open.keys()]) drop(nid);
+      for (const nid of [...open.keys(), ...sockets.keys()]) drop(nid);
     }
   };
 }
@@ -2494,6 +2663,10 @@ var Incoming = class {
     this.buf = this.buf.subarray(n);
     return out;
   }
+  async peek(signal) {
+    if (this.buf.length === 0) await this.fill(signal);
+    return this.buf[0];
+  }
   async some(max, signal) {
     if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
     if (this.eof) return new Uint8Array(0);
@@ -2675,13 +2848,219 @@ function chunk(bytes) {
 }
 var LAST_CHUNK = latin1Bytes("0\r\n\r\n");
 
+// src/cdp/websocket.ts
+var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var MAX_MESSAGE = 256 * 1024 * 1024;
+var CLOSE = {
+  normal: 1e3,
+  protocol: 1002,
+  unsupported: 1003,
+  invalid: 1007,
+  tooBig: 1009,
+  error: 1011
+};
+var OP_TEXT = 1;
+var OP_BINARY = 2;
+var OP = {
+  continuation: 0,
+  text: OP_TEXT,
+  binary: OP_BINARY,
+  close: 8,
+  ping: 9,
+  pong: 10
+};
+var WsError = class extends Error {
+  code;
+  constructor(code, message2) {
+    super(message2);
+    this.code = code;
+  }
+};
+function sendableCode(code) {
+  if (code >= 3e3 && code <= 4999) return true;
+  return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006;
+}
+function field(headers, name2) {
+  return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
+}
+async function acceptKey(headers) {
+  const tokens = (name2) => (field(headers, name2) ?? "").split(",").map((t) => t.trim().toLowerCase());
+  if (!tokens("upgrade").includes("websocket") || !tokens("connection").includes("upgrade")) {
+    throw new HttpError(400, "expected a WebSocket upgrade");
+  }
+  if (field(headers, "sec-websocket-version") !== "13") {
+    throw new HttpError(400, "Sec-WebSocket-Version must be 13");
+  }
+  const key = field(headers, "sec-websocket-key") ?? "";
+  if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
+  const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
+  return btoa(String.fromCharCode(...new Uint8Array(digest)));
+}
+function isUpgrade(headers) {
+  return (field(headers, "upgrade") ?? "").toLowerCase().includes("websocket");
+}
+function frame(opcode, payload) {
+  const n = payload.length;
+  const size = n < 126 ? 2 : n < 65536 ? 4 : 10;
+  const out = new Uint8Array(size + n);
+  const view = new DataView(out.buffer);
+  out[0] = 128 | opcode;
+  if (n < 126) out[1] = n;
+  else if (n < 65536) {
+    out[1] = 126;
+    view.setUint16(2, n);
+  } else {
+    out[1] = 127;
+    view.setBigUint64(2, BigInt(n));
+  }
+  out.set(payload, size);
+  return out;
+}
+function closeFrame(code, reason = "") {
+  let bytes = new TextEncoder().encode(reason);
+  if (bytes.length > 123) {
+    let end = 123;
+    while ((bytes[end] & 192) === 128) end--;
+    bytes = bytes.subarray(0, end);
+  }
+  const payload = new Uint8Array(2 + bytes.length);
+  new DataView(payload.buffer).setUint16(0, code);
+  payload.set(bytes, 2);
+  return frame(OP.close, payload);
+}
+function pongFrame(payload) {
+  return frame(OP.pong, payload);
+}
+async function fill(incoming, out, signal) {
+  for (let at = 0; at < out.length; ) {
+    const piece = await incoming.some(out.length - at, signal);
+    if (piece.length === 0) throw new WsError(CLOSE.protocol, "the connection closed mid-frame");
+    out.set(piece, at);
+    at += piece.length;
+  }
+}
+var fatal = new TextDecoder("utf-8", { fatal: true });
+function decode(bytes) {
+  try {
+    return fatal.decode(bytes);
+  } catch {
+    throw new WsError(CLOSE.invalid, "a text message is not UTF-8");
+  }
+}
+var WsReader = class {
+  incoming;
+  max;
+  parts = [];
+  size = 0;
+  continuing = false;
+  binaryMessage = false;
+  binary;
+  constructor(incoming, max = MAX_MESSAGE, binary) {
+    this.incoming = incoming;
+    this.max = max;
+    this.binary = binary;
+  }
+  async next(signal) {
+    for (; ; ) {
+      const first = await this.incoming.some(1, signal);
+      if (first.length === 0) return null;
+      const head = new Uint8Array(2);
+      head[0] = first[0];
+      await fill(this.incoming, head.subarray(1), signal);
+      const fin = (head[0] & 128) !== 0;
+      const opcode = head[0] & 15;
+      if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
+      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
+      const length2 = await this.length(head[1] & 127, signal);
+      const control = opcode >= 8;
+      if (control && (length2 > 125 || !fin)) {
+        throw new WsError(CLOSE.protocol, "a control frame is too long or fragmented");
+      }
+      if (!control && this.size + length2 > this.max) {
+        throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
+      }
+      const mask = new Uint8Array(4);
+      await fill(this.incoming, mask, signal);
+      const payload = new Uint8Array(length2);
+      await fill(this.incoming, payload, signal);
+      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+      const event = this.take(opcode, fin, payload);
+      if (event) return event;
+    }
+  }
+  data(opcode, fin, payload) {
+    if (opcode === OP.continuation !== this.continuing) {
+      throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+    }
+    if (opcode !== OP.continuation) this.binaryMessage = opcode === OP.binary;
+    this.parts.push(payload);
+    this.size += payload.length;
+    this.continuing = !fin;
+    if (!fin) return void 0;
+    const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
+    this.parts = [];
+    this.size = 0;
+    return this.binaryMessage ? { kind: "binary", bytes: whole } : { kind: "text", text: decode(whole) };
+  }
+  async length(short, signal) {
+    if (short < 126) return short;
+    const ext = new Uint8Array(short === 126 ? 2 : 8);
+    await fill(this.incoming, ext, signal);
+    const view = new DataView(ext.buffer);
+    if (short === 126) return view.getUint16(0);
+    const long = view.getBigUint64(0);
+    return long > BigInt(this.max) ? this.max + 1 : Number(long);
+  }
+  take(opcode, fin, payload) {
+    switch (opcode) {
+      case OP.ping:
+        return { kind: "ping", payload };
+      case OP.pong:
+        return void 0;
+      case OP.close: {
+        if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
+        const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
+        if (payload.length >= 2 && !sendableCode(code)) {
+          throw new WsError(CLOSE.protocol, `close code ${code} may not be sent`);
+        }
+        return { kind: "close", code, reason: decode(payload.subarray(2)) };
+      }
+      case OP.binary:
+        if (!this.binary) throw new WsError(CLOSE.unsupported, "CDP messages are text");
+        return this.data(opcode, fin, payload);
+      case OP.text:
+      case OP.continuation:
+        return this.data(opcode, fin, payload);
+      default:
+        throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
+    }
+  }
+};
+function switchingHead(accept2, protocol = "") {
+  const chosen = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+` : "";
+  return latin1Bytes(
+    `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept2}\r
+${chosen}\r
+`
+  );
+}
+
 // src/kernel/net/proxy-service.ts
+var SEND_BUFFER2 = 1024 * 1024;
+var TLS_HANDSHAKE = 22;
+var TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var NO_WEBSOCKET2 = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var REALM_PROXY_PORT = 3128;
 var DEFAULT_LIMITS = {
   maxConnections: 64,
   maxHead: 64 * 1024,
   idleMs: 12e4,
-  bodyBudget: 128 * 1024 * 1024
+  bodyBudget: 128 * 1024 * 1024,
+  closeWaitMs: 5e3
 };
 var HOP_BY_HOP = /* @__PURE__ */ new Set([
   "connection",
@@ -2872,11 +3251,27 @@ function plainResponse(status, message2) {
     cancel: async () => void 0
   };
 }
-function timedSource(conn, idleMs, stop) {
+function timedSource(conn, idle, stop) {
   return {
-    read: (max) => conn.read(max, AbortSignal.any([stop, AbortSignal.timeout(idleMs)]))
+    read: (max, signal) => {
+      const own = signal ? [stop, signal] : [stop];
+      if (Number.isFinite(idle.ms)) own.push(AbortSignal.timeout(idle.ms));
+      return conn.read(max, AbortSignal.any(own));
+    }
   };
 }
+function webSocketTarget(req) {
+  return { ...req, target: req.target.replace(/^ws(s?):/i, (_, s) => `http${s.toLowerCase()}:`) };
+}
+function wireCode(code) {
+  if (code === 1005) return 1e3;
+  return sendableCode(code) ? code : 1011;
+}
+function quietly(ms) {
+  return new Promise((resolve) => {
+    AbortSignal.timeout(ms).addEventListener("abort", () => resolve(), { once: true });
+  });
+}
 var RealmProxy = class {
   options;
   listener;
@@ -2885,6 +3280,7 @@ var RealmProxy = class {
   slots;
   bodies;
   connections = /* @__PURE__ */ new Set();
+  warnedWebSocket = false;
   closed;
   port;
   constructor(options) {
@@ -2933,9 +3329,10 @@ var RealmProxy = class {
   }
   async serve(conn) {
     this.connections.add(conn);
-    const incoming = new Incoming(timedSource(conn, this.limits.idleMs, this.stop.signal));
+    const idle = { ms: this.limits.idleMs };
+    const incoming = new Incoming(timedSource(conn, idle, this.stop.signal));
     try {
-      await this.requests({ sink: conn, incoming, conn, socket: conn });
+      await this.requests({ sink: conn, incoming, conn, socket: conn, idle });
     } finally {
       this.connections.delete(conn);
       conn.close();
@@ -2962,7 +3359,11 @@ var RealmProxy = class {
     const req = parseRequestHead(head);
     if (req.method === "CONNECT") {
       if (!ctx.conn) throw new HttpError(400, "CONNECT inside a tunnel");
-      await this.connect(ctx.conn, incoming, req);
+      await this.connect(ctx.conn, incoming, req, ctx.idle);
+      return false;
+    }
+    if (req.method === "GET" && isUpgrade(req.headers)) {
+      await this.websocket(ctx, req);
       return false;
     }
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
@@ -3057,33 +3458,149 @@ var RealmProxy = class {
     if (chunked) await conn.write(LAST_CHUNK, signal);
     return keep;
   }
-  async connect(conn, incoming, req) {
+  async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const tunnel = this.options.tunnel;
-    if (!tunnel) {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: no tunnels through this proxy`
-      );
-    }
-    await this.options.tunnelReady?.().catch((e) => {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: ${e instanceof Error ? e.message : String(e)}`
-      );
-    });
+    const refused = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused) throw refused;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
+      const first = await incoming.peek(this.stop.signal);
+      if (first === void 0) return;
+      if (first !== TLS_HANDSHAKE) {
+        const origin = `http://${target.port === 80 ? target.host : `${target.host}:${target.port}`}`;
+        await this.requests({ sink: conn, incoming, origin, socket: conn, idle });
+        return;
+      }
+      const tunnel = this.options.tunnel;
+      if (!tunnel || target.port !== 443 && await this.tunnelReady(target)) return;
       await tunnel(
         conn,
         incoming,
         target,
         this.stop.signal,
-        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn })
+        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn, idle })
       );
     } catch {
     }
   }
+  async tunnelReady(target) {
+    const name2 = `CONNECT ${target.host}:${target.port}`;
+    if (!this.options.tunnel) return new HttpError(501, `${name2}: no tunnels through this proxy`);
+    try {
+      await this.options.tunnelReady?.();
+      return void 0;
+    } catch (e) {
+      return new HttpError(501, `${name2}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  async websocket(ctx, req) {
+    const href = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(webSocketTarget(req));
+    const { transport } = this.options;
+    if (!transport.traits.websocket || !transport.websocket) {
+      if (!this.warnedWebSocket) {
+        this.warnedWebSocket = true;
+        console.warn(`slicc-kernel: a program asked for a WebSocket: ${NO_WEBSOCKET2}`);
+      }
+      throw new HttpError(501, NO_WEBSOCKET2);
+    }
+    const accept2 = await acceptKey(req.headers);
+    const protocols = fieldValues(req.headers, "sec-websocket-protocol").flatMap((v) => v.split(",")).map((t) => t.trim()).filter((t) => t !== "");
+    const hangup = new AbortController();
+    const waiting = new AbortController();
+    void watchHangup(ctx.socket, hangup, waiting.signal);
+    let socket;
+    try {
+      socket = await transport.websocket({
+        url: toHostLoopback(href).replace(/^http/, "ws"),
+        protocols,
+        headers: forwardRequestHeaders(req.headers),
+        signal: AbortSignal.any([this.stop.signal, hangup.signal])
+      });
+    } catch (e) {
+      waiting.abort();
+      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+    }
+    ctx.idle.ms = Number.POSITIVE_INFINITY;
+    try {
+      if (hangup.signal.aborted) throw hangup.signal.reason;
+      if (socket.protocol && !(protocols.includes(socket.protocol) && TOKEN2.test(socket.protocol))) {
+        throw new HttpError(502, "the far end chose a subprotocol the client did not offer");
+      }
+      await ctx.sink.write(switchingHead(accept2, socket.protocol), this.stop.signal);
+      await this.bridge(ctx, socket, hangup.signal);
+    } catch (e) {
+      socket.close(1001, "the client went away");
+      throw e;
+    } finally {
+      waiting.abort();
+    }
+  }
+  async bridge(ctx, socket, hangup) {
+    const stop = this.stop.signal;
+    let chain = Promise.resolve();
+    const toGuest = (bytes) => {
+      chain = chain.then(() => ctx.sink.write(bytes, stop));
+      return chain;
+    };
+    const done4 = new AbortController();
+    const reading = AbortSignal.any([stop, done4.signal, hangup]);
+    const stopping = () => socket.close(1001, "the proxy is stopping");
+    stop.addEventListener("abort", stopping, { once: true });
+    let guestDone = false;
+    let closeSent = false;
+    const outbound2 = (async () => {
+      for await (const data of socket.messages) {
+        if (guestDone) continue;
+        const text = typeof data === "string";
+        await toGuest(
+          frame(text ? OP_TEXT : OP_BINARY, text ? new TextEncoder().encode(data) : data)
+        );
+      }
+      const closed = await socket.closed;
+      if (guestDone) return;
+      closeSent = true;
+      await toGuest(closeFrame(wireCode(closed.code), closed.reason));
+      AbortSignal.timeout(this.limits.closeWaitMs).addEventListener("abort", () => done4.abort(), {
+        once: true
+      });
+    })().catch(() => done4.abort());
+    const reader = new WsReader(ctx.incoming, MESSAGE_LIMIT, true);
+    try {
+      for (; ; ) {
+        const event = await reader.next(reading);
+        if (!event) break;
+        if (event.kind === "ping") {
+          await toGuest(pongFrame(event.payload));
+          continue;
+        }
+        if (event.kind === "close") {
+          guestDone = true;
+          if (closeSent) break;
+          const code = wireCode(event.code);
+          socket.close(code, event.reason);
+          const reply = await Promise.race([
+            socket.closed,
+            quietly(this.limits.closeWaitMs).then(() => ({ code, reason: event.reason }))
+          ]);
+          await toGuest(closeFrame(wireCode(reply.code), reply.reason));
+          break;
+        }
+        while (socket.buffered > SEND_BUFFER2 && !reading.aborted) await quietly(10);
+        socket.send(event.kind === "text" ? event.text : event.bytes);
+      }
+    } catch (e) {
+      if (e instanceof WsError) {
+        guestDone = true;
+        socket.close(e.code, e.message);
+        await toGuest(closeFrame(e.code, e.message)).catch(() => void 0);
+      }
+    } finally {
+      guestDone = true;
+      socket.close(1e3, "the client went away");
+      stop.removeEventListener("abort", stopping);
+      await Promise.race([outbound2, quietly(this.limits.closeWaitMs)]);
+    }
+  }
 };
 
 // src/kernel/net/x509.ts
@@ -3813,12 +4330,15 @@ var RemoteTransport = class {
   port;
   waiting = /* @__PURE__ */ new Map();
   nextId = 0;
+  sockets = /* @__PURE__ */ new Map();
   failure;
   constructor(port, traits) {
     this.port = port;
     this.traits = traits;
   }
   receive(reply) {
+    const socket = this.sockets.get(reply.nid);
+    if (socket && this.toSocket(reply, socket)) return;
     const waiter = this.waiting.get(reply.nid);
     if (!waiter) return;
     this.waiting.delete(reply.nid);
@@ -3826,10 +4346,22 @@ var RemoteTransport = class {
       waiter.reject(new TransportError(reply.message, reply.status, reply.code));
     } else waiter.resolve(reply);
   }
+  toSocket(reply, socket) {
+    if (reply.net === "ws-message") socket.queue.push(reply.data);
+    else if (reply.net === "ws-acked") socket.acked(reply.n);
+    else if (reply.net === "ws-closed") {
+      this.sockets.delete(reply.nid);
+      socket.queue.end({ code: reply.code, reason: reply.reason });
+    } else return false;
+    return true;
+  }
   fail(error) {
     this.failure = error;
     for (const waiter of this.waiting.values()) waiter.reject(error);
     this.waiting.clear();
+    for (const socket of this.sockets.values())
+      socket.queue.end({ code: 1011, reason: error.message });
+    this.sockets.clear();
   }
   ask(call) {
     if (this.failure) return Promise.reject(this.failure);
@@ -3908,6 +4440,46 @@ var RemoteTransport = class {
       }
     };
   }
+  async websocket(request2) {
+    const nid = ++this.nextId;
+    const { signal } = request2;
+    signal.throwIfAborted();
+    const abort = () => this.cancel(nid);
+    signal.addEventListener("abort", abort, { once: true });
+    let opened2;
+    try {
+      opened2 = await this.ask({
+        net: "ws-open",
+        nid,
+        url: request2.url,
+        protocols: request2.protocols,
+        headers: request2.headers
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
+    const queue = new MessageQueue(
+      () => close(1e3, "a message is too big"),
+      Number.POSITIVE_INFINITY,
+      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
+    );
+    let unacked = 0;
+    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
+    return {
+      protocol: opened2.protocol,
+      get buffered() {
+        return unacked;
+      },
+      send: (data) => {
+        unacked += payloadSize(data);
+        this.port.postMessage({ net: "ws-send", nid, data });
+      },
+      messages: queue,
+      close,
+      closed: queue.closed
+    };
+  }
 };
 
 // src/kernel/net/routes.ts
@@ -3992,277 +4564,104 @@ var Routes = class {
     if (!addr) return "unreachable";
     if (addr.v6 && addr.bits === 1n) return "loopback";
     if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within2(p, addr))) return "reserved";
-    if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within2(p, addr))) return "uplink";
-    return "unreachable";
-  }
-};
-
-// src/kernel/net/uplink.ts
-function answerOf(result) {
-  const answer = Array.isArray(result) ? { addresses: result } : result;
-  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
-  return {
-    addresses,
-    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
-  };
-}
-var NEVER = new Routes(true);
-var RemoteUplink = class {
-  traits;
-  routes;
-  port;
-  waiting = /* @__PURE__ */ new Map();
-  nextId = 0;
-  constructor(port, traits, routes) {
-    this.port = port;
-    this.traits = traits;
-    this.routes = routes;
-  }
-  receive(reply) {
-    const waiter = this.waiting.get(reply.uid);
-    if (!waiter) return;
-    this.waiting.delete(reply.uid);
-    if (reply.uplink === "error") {
-      waiter.reject(Object.assign(new Error(reply.message), { code: reply.code }));
-    } else waiter.resolve(reply);
-  }
-  ask(call, signal, transfer) {
-    const waiter = Promise.withResolvers();
-    this.waiting.set(call.uid, waiter);
-    const abort = () => {
-      this.waiting.delete(call.uid);
-      this.port.postMessage({ uplink: "cancel", uid: call.uid });
-      waiter.reject(signal?.reason);
-    };
-    signal?.addEventListener("abort", abort, { once: true });
-    const settled = () => signal?.removeEventListener("abort", abort);
-    waiter.promise.then(settled, settled);
-    this.port.postMessage(call, transfer);
-    return waiter.promise;
-  }
-  async resolve(name2, family, signal) {
-    const reply = await this.ask(
-      { uplink: "resolve", uid: ++this.nextId, name: name2, family },
-      signal
-    );
-    return answerOf(reply);
-  }
-  async dial(req) {
-    req.signal.throwIfAborted();
-    const { host, port } = req;
-    const opened2 = await this.ask(
-      { uplink: "dial", uid: ++this.nextId, host, port },
-      req.signal
-    );
-    const { cid, localAddr, remoteAddr } = opened2;
-    return {
-      localAddr,
-      remoteAddr,
-      read: async () => {
-        const got = await this.ask({
-          uplink: "read",
-          uid: ++this.nextId,
-          cid
-        });
-        return got.bytes;
-      },
-      write: async (bytes) => {
-        const copy = bytes.slice();
-        const call = { uplink: "write", uid: ++this.nextId, cid, bytes: copy };
-        const done4 = await this.ask(call, void 0, [
-          copy.buffer
-        ]);
-        return done4.n;
-      },
-      closeWrite: () => this.port.postMessage({ uplink: "close-write", cid }),
-      close: () => this.port.postMessage({ uplink: "close", cid })
-    };
-  }
-};
-
-// src/cdp/types.ts
-var CDP_PORT = 9222;
-var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
-
-// src/cdp/websocket.ts
-var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
-var MAX_MESSAGE = 256 * 1024 * 1024;
-var CLOSE = {
-  normal: 1e3,
-  protocol: 1002,
-  unsupported: 1003,
-  invalid: 1007,
-  tooBig: 1009,
-  error: 1011
-};
-var OP_TEXT = 1;
-var OP = { continuation: 0, text: OP_TEXT, binary: 2, close: 8, ping: 9, pong: 10 };
-var WsError = class extends Error {
-  code;
-  constructor(code, message2) {
-    super(message2);
-    this.code = code;
-  }
-};
-function field(headers, name2) {
-  return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
-}
-async function acceptKey(headers) {
-  const tokens = (name2) => (field(headers, name2) ?? "").split(",").map((t) => t.trim().toLowerCase());
-  if (!tokens("upgrade").includes("websocket") || !tokens("connection").includes("upgrade")) {
-    throw new HttpError(400, "expected a WebSocket upgrade");
-  }
-  if (field(headers, "sec-websocket-version") !== "13") {
-    throw new HttpError(400, "Sec-WebSocket-Version must be 13");
-  }
-  const key = field(headers, "sec-websocket-key") ?? "";
-  if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
-  const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
-  return btoa(String.fromCharCode(...new Uint8Array(digest)));
-}
-function isUpgrade(headers) {
-  return (field(headers, "upgrade") ?? "").toLowerCase().includes("websocket");
-}
-function frame(opcode, payload) {
-  const n = payload.length;
-  const size = n < 126 ? 2 : n < 65536 ? 4 : 10;
-  const out = new Uint8Array(size + n);
-  const view = new DataView(out.buffer);
-  out[0] = 128 | opcode;
-  if (n < 126) out[1] = n;
-  else if (n < 65536) {
-    out[1] = 126;
-    view.setUint16(2, n);
-  } else {
-    out[1] = 127;
-    view.setBigUint64(2, BigInt(n));
-  }
-  out.set(payload, size);
-  return out;
-}
-function closeFrame(code, reason = "") {
-  let bytes = new TextEncoder().encode(reason);
-  if (bytes.length > 123) bytes = bytes.subarray(0, 123);
-  const payload = new Uint8Array(2 + bytes.length);
-  new DataView(payload.buffer).setUint16(0, code);
-  payload.set(bytes, 2);
-  return frame(OP.close, payload);
-}
-function pongFrame(payload) {
-  return frame(OP.pong, payload);
-}
-async function fill(incoming, out, signal) {
-  for (let at = 0; at < out.length; ) {
-    const piece = await incoming.some(out.length - at, signal);
-    if (piece.length === 0) throw new WsError(CLOSE.protocol, "the connection closed mid-frame");
-    out.set(piece, at);
-    at += piece.length;
-  }
-}
-var fatal = new TextDecoder("utf-8", { fatal: true });
-function decode(bytes) {
-  try {
-    return fatal.decode(bytes);
-  } catch {
-    throw new WsError(CLOSE.invalid, "a text message is not UTF-8");
+    if (RESERVED.some((p) => within2(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within2(p, addr))) return "uplink";
+    return "unreachable";
   }
+};
+
+// src/kernel/net/uplink.ts
+function answerOf(result) {
+  const answer = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  return {
+    addresses,
+    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+  };
 }
-var WsReader = class {
-  incoming;
-  max;
-  parts = [];
-  size = 0;
-  continuing = false;
-  constructor(incoming, max = MAX_MESSAGE) {
-    this.incoming = incoming;
-    this.max = max;
+var NEVER = new Routes(true);
+var RemoteUplink = class {
+  traits;
+  routes;
+  port;
+  waiting = /* @__PURE__ */ new Map();
+  nextId = 0;
+  constructor(port, traits, routes) {
+    this.port = port;
+    this.traits = traits;
+    this.routes = routes;
   }
-  async next(signal) {
-    for (; ; ) {
-      const first = await this.incoming.some(1, signal);
-      if (first.length === 0) return null;
-      const head = new Uint8Array(2);
-      head[0] = first[0];
-      await fill(this.incoming, head.subarray(1), signal);
-      const fin = (head[0] & 128) !== 0;
-      const opcode = head[0] & 15;
-      if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
-      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
-      const length2 = await this.length(head[1] & 127, signal);
-      const control = opcode >= 8;
-      if (control && (length2 > 125 || !fin)) {
-        throw new WsError(CLOSE.protocol, "a control frame is too long or fragmented");
-      }
-      if (!control && this.size + length2 > this.max) {
-        throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
-      }
-      const mask = new Uint8Array(4);
-      await fill(this.incoming, mask, signal);
-      const payload = new Uint8Array(length2);
-      await fill(this.incoming, payload, signal);
-      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
-      const event = this.take(opcode, fin, payload);
-      if (event) return event;
-    }
+  receive(reply) {
+    const waiter = this.waiting.get(reply.uid);
+    if (!waiter) return;
+    this.waiting.delete(reply.uid);
+    if (reply.uplink === "error") {
+      waiter.reject(Object.assign(new Error(reply.message), { code: reply.code }));
+    } else waiter.resolve(reply);
   }
-  async length(short, signal) {
-    if (short < 126) return short;
-    const ext = new Uint8Array(short === 126 ? 2 : 8);
-    await fill(this.incoming, ext, signal);
-    const view = new DataView(ext.buffer);
-    if (short === 126) return view.getUint16(0);
-    const long = view.getBigUint64(0);
-    return long > BigInt(this.max) ? this.max + 1 : Number(long);
+  ask(call, signal, transfer) {
+    const waiter = Promise.withResolvers();
+    this.waiting.set(call.uid, waiter);
+    const abort = () => {
+      this.waiting.delete(call.uid);
+      this.port.postMessage({ uplink: "cancel", uid: call.uid });
+      waiter.reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    const settled = () => signal?.removeEventListener("abort", abort);
+    waiter.promise.then(settled, settled);
+    this.port.postMessage(call, transfer);
+    return waiter.promise;
   }
-  take(opcode, fin, payload) {
-    switch (opcode) {
-      case OP.ping:
-        return { kind: "ping", payload };
-      case OP.pong:
-        return void 0;
-      case OP.close: {
-        if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
-        const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
-        return { kind: "close", code, reason: decode(payload.subarray(2)) };
-      }
-      case OP.text:
-      case OP.continuation: {
-        if (opcode === OP.continuation !== this.continuing) {
-          throw new WsError(CLOSE.protocol, "unexpected continuation frame");
-        }
-        this.parts.push(payload);
-        this.size += payload.length;
-        this.continuing = !fin;
-        if (!fin) return void 0;
-        const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
-        this.parts = [];
-        this.size = 0;
-        return { kind: "text", text: decode(whole) };
-      }
-      case OP.binary:
-        throw new WsError(CLOSE.unsupported, "CDP messages are text");
-      default:
-        throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
-    }
+  async resolve(name2, family, signal) {
+    const reply = await this.ask(
+      { uplink: "resolve", uid: ++this.nextId, name: name2, family },
+      signal
+    );
+    return answerOf(reply);
+  }
+  async dial(req) {
+    req.signal.throwIfAborted();
+    const { host, port } = req;
+    const opened2 = await this.ask(
+      { uplink: "dial", uid: ++this.nextId, host, port },
+      req.signal
+    );
+    const { cid, localAddr, remoteAddr } = opened2;
+    return {
+      localAddr,
+      remoteAddr,
+      read: async () => {
+        const got = await this.ask({
+          uplink: "read",
+          uid: ++this.nextId,
+          cid
+        });
+        return got.bytes;
+      },
+      write: async (bytes) => {
+        const copy = bytes.slice();
+        const call = { uplink: "write", uid: ++this.nextId, cid, bytes: copy };
+        const done4 = await this.ask(call, void 0, [
+          copy.buffer
+        ]);
+        return done4.n;
+      },
+      closeWrite: () => this.port.postMessage({ uplink: "close-write", cid }),
+      close: () => this.port.postMessage({ uplink: "close", cid })
+    };
   }
 };
-function switchingHead(accept2) {
-  return latin1Bytes(
-    `HTTP/1.1 101 Switching Protocols\r
-Upgrade: websocket\r
-Connection: Upgrade\r
-Sec-WebSocket-Accept: ${accept2}\r
-\r
-`
-  );
-}
+
+// src/cdp/types.ts
+var CDP_PORT = 9222;
+var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
 
 // src/cdp/facade.ts
 var MAX_HEAD = 64 * 1024;
 var LIST_TIMEOUT = 1e4;
-var CLOSE_WAIT_MS = 1e3;
+var CLOSE_WAIT_MS2 = 1e3;
 function respond(status, body, type = "text/plain; charset=utf-8") {
   const bytes = new TextEncoder().encode(body);
   const head = latin1Bytes(
@@ -4410,7 +4809,7 @@ var CdpFacade = class {
     const host = await this.host(runtime);
     const limits = {
       max: this.options.maxMessage ?? MAX_MESSAGE,
-      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS
+      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS2
     };
     await new Relay(conn, incoming, host, limits, this.stop.signal).start(switchingHead(accept2)).finally(() => host.close());
   }
@@ -4878,13 +5277,193 @@ function withCommandDirs(fs, names) {
   };
 }
 
+// src/fs/unlinked.ts
+var UNLINKED_DIR = ".slicc-unlinked";
+function webLocks() {
+  return globalThis.navigator?.locks;
+}
+var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var lockName = (instance) => `slicc-unlinked:${instance}`;
+var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
+var PathGate = class {
+  tails = /* @__PURE__ */ new Map();
+  async acquire(path) {
+    const prev = this.tails.get(path) ?? Promise.resolve();
+    const { promise, resolve } = Promise.withResolvers();
+    const tail = prev.then(() => promise);
+    this.tails.set(path, tail);
+    await prev;
+    return () => {
+      resolve();
+      if (this.tails.get(path) === tail) this.tails.delete(path);
+    };
+  }
+  async run(path, op) {
+    const release = await this.acquire(path);
+    try {
+      return await op();
+    } finally {
+      release();
+    }
+  }
+};
+var UnlinkedKeeper = class {
+  fs;
+  holders;
+  rootOf;
+  locks;
+  busy;
+  waiting = /* @__PURE__ */ new Set();
+  instance = crypto.randomUUID();
+  gate = new PathGate();
+  queue = Promise.resolve();
+  count = 0;
+  constructor(fs, holders, rootOf, locks, busy = () => false) {
+    this.fs = fs;
+    this.holders = holders;
+    this.rootOf = rootOf;
+    this.locks = locks;
+    this.busy = busy;
+    void locks?.request(lockName(this.instance), () => new Promise(() => void 0));
+  }
+  serial(op) {
+    const next = this.queue.then(op);
+    this.queue = next.catch(() => void 0);
+    return next;
+  }
+  wrap() {
+    const fs = this.fs;
+    const keeper = this;
+    const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
+    return {
+      ...fs,
+      async rm(path, options) {
+        const target = fs.resolvePath("/", path);
+        const pinned = await keeper.pin(target);
+        if (pinned.moved.has(target)) pinned.commit();
+        else await keeper.settle(pinned, () => fs.rm(path, options));
+      },
+      async rename(from, to) {
+        const pinned = await keeper.pin(fs.resolvePath("/", to));
+        await keeper.settle(pinned, () => fs.rename(from, to));
+      },
+      readdir: async (path) => visible(await fs.readdir(path)),
+      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR)
+    };
+  }
+  async settle(pinned, op) {
+    try {
+      await op();
+    } catch (err) {
+      await pinned.rollback();
+      throw err;
+    }
+    pinned.commit();
+  }
+  async pin(target) {
+    const held = /* @__PURE__ */ new Map();
+    for (const holder of this.holders) {
+      if (holder.owns(target)) continue;
+      for (const path of holder.opens.keys()) {
+        if (!within3(path, target) || holder.unlinked.has(path)) continue;
+        held.set(path, [...held.get(path) ?? [], holder]);
+      }
+    }
+    const paths = [...held.keys()].sort();
+    const releases = [];
+    for (const path of paths) releases.push(await this.gate.acquire(path));
+    const hidden = /* @__PURE__ */ new Map();
+    for (const path of paths) {
+      const at = await this.hide(path);
+      if (at !== void 0) hidden.set(path, at);
+    }
+    const done4 = () => {
+      for (const release of releases) release();
+    };
+    return {
+      moved: new Set(hidden.keys()),
+      commit: () => {
+        for (const [path, at] of hidden) {
+          const holders = held.get(path);
+          const file = this.keptFile(at, { refs: holders.length });
+          for (const holder of holders) holder.unlinked.set(path, file);
+        }
+        done4();
+      },
+      rollback: async () => {
+        for (const [path, at] of hidden) {
+          await this.serial(async () => {
+            await Promise.allSettled([this.fs.rename(at, path)]);
+            await this.tidy(parentOf3(at));
+          });
+        }
+        done4();
+      }
+    };
+  }
+  keptFile(hidden, entry) {
+    return {
+      hidden,
+      release: () => {
+        if (--entry.refs === 0) void this.serial(() => this.drop(hidden));
+      }
+    };
+  }
+  hide(path) {
+    return this.serial(async () => {
+      const dir = dirOf(this.rootOf(path));
+      const hidden = `${dir}/${this.instance}.${++this.count}`;
+      try {
+        await this.fs.mkdir(dir, { recursive: true });
+        await this.fs.rename(path, hidden);
+        return hidden;
+      } catch {
+        await this.tidy(dir);
+        return void 0;
+      }
+    });
+  }
+  closed(path) {
+    if (this.waiting.delete(path)) void this.serial(() => this.drop(path));
+  }
+  async drop(hidden) {
+    if (this.busy(hidden)) {
+      this.waiting.add(hidden);
+      return;
+    }
+    await this.fs.rm(hidden).catch(() => void 0);
+    await this.tidy(parentOf3(hidden));
+  }
+  async tidy(dir) {
+    const left = await this.fs.readdir(dir).catch(() => [UNLINKED_DIR]);
+    if (left.length === 0) await this.fs.rm(dir, { recursive: true }).catch(() => void 0);
+  }
+  sweep(root) {
+    const query = this.locks?.query?.bind(this.locks);
+    if (!query) return Promise.resolve();
+    return this.serial(async () => {
+      const dir = dirOf(root);
+      const names = await this.fs.readdir(dir).catch(() => void 0);
+      if (!names) return;
+      const held = new Set(((await query()).held ?? []).map((lock) => lock.name));
+      for (const name2 of names) {
+        const owner = name2.slice(0, name2.lastIndexOf("."));
+        if (owner === this.instance || held.has(lockName(owner))) continue;
+        await this.fs.rm(`${dir}/${name2}`, { recursive: true }).catch(() => void 0);
+      }
+      await this.tidy(dir);
+    });
+  }
+};
+
 // src/fs/watch.ts
 var WATCH_BATCH_LIMIT = 1e3;
 var under2 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
-var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 function touches(watcher, changed) {
   return watcher.paths.some(
-    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf3(changed) === watched)
+    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf4(changed) === watched)
   );
 }
 var FsWatchers = class {
@@ -5266,7 +5845,7 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -5279,18 +5858,47 @@ var HeldSet = class extends Set {
   }
   delete(holds) {
     const removed = super.delete(holds);
-    for (const path of holds.keys()) this.idle(path);
+    for (const path of /* @__PURE__ */ new Set([...holds.keys(), ...holds.opens.keys()])) this.idle(path);
+    for (const kept of holds.unlinked.values()) kept.release();
+    holds.unlinked.clear();
     return removed;
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within3(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within4(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
   revoked = /* @__PURE__ */ new Set();
+  opens = /* @__PURE__ */ new Map();
+  unlinked = /* @__PURE__ */ new Map();
+  aliases = /* @__PURE__ */ new Map();
+  owning;
   onIdle;
-  hold(path, on) {
+  keyOf(path) {
+    return this.aliases.get(path) ?? path;
+  }
+  keptAt(path) {
+    return this.unlinked.get(this.keyOf(path));
+  }
+  holding(path) {
+    return this.opens.has(this.keyOf(path));
+  }
+  hold(path, on, open = false, real) {
+    if (open) {
+      const key = real ?? this.keyOf(path);
+      if (key !== path) this.aliases.set(path, key);
+      const count2 = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
+      if (count2 > 0) this.opens.set(key, count2);
+      else {
+        this.opens.delete(key);
+        this.unlinked.get(key)?.release();
+        this.unlinked.delete(key);
+        for (const [alias, target] of this.aliases) if (target === key) this.aliases.delete(alias);
+        this.onIdle?.(key);
+      }
+      return;
+    }
     const count = (this.get(path) ?? 0) + (on ? 1 : -1);
     if (count > 0) this.set(path, count);
     else {
@@ -5299,23 +5907,40 @@ var HeldPaths = class extends Map {
       this.onIdle?.(path);
     }
   }
+  async own(path, op) {
+    this.owning = path;
+    try {
+      return await op();
+    } finally {
+      this.owning = void 0;
+    }
+  }
+  owns(path) {
+    return this.owning === path;
+  }
   revoke(prefix) {
-    for (const path of this.keys()) if (within3(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within4(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count] of [...this]) {
-      if (!within3(path, from)) continue;
+      if (!within4(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
+    for (const [path, count] of [...this.opens]) {
+      if (!within4(path, from)) continue;
+      const moved2 = to + path.slice(from.length);
+      this.opens.delete(path);
+      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
+    }
   }
   isRevoked(path) {
     return this.revoked.has(path);
   }
 };
-var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var readonly = (mount) => mount.caps.readonly === true || mount.options.ro !== void 0;
 function statOf(attr, path, mount) {
   const mtime = new Date(attr.mtime);
@@ -5404,7 +6029,7 @@ var MountTable = class {
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within3(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within4(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -5543,7 +6168,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within3(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within4(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -5577,10 +6202,10 @@ var MountTable = class {
     this.deps.changed?.(...full);
   }
   forget(mount, path) {
-    for (const key of [...mount.attrs.keys()]) if (within3(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within4(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
-    mount.lists.delete(parentOf4(path));
-    for (const key of [...mount.lists.keys()]) if (within3(key, path)) mount.lists.delete(key);
+    mount.lists.delete(parentOf5(path));
+    for (const key of [...mount.lists.keys()]) if (within4(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2) {
     if (mount.conn.failure) throw mount.conn.failure;
@@ -5645,7 +6270,7 @@ var MountFs = class {
     if (attr.kind !== "symlink") return real;
     if (hops >= MAX_LINKS4) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
-    return this.follow(this.base.resolvePath(parentOf4(real), target), hops + 1, create);
+    return this.follow(this.base.resolvePath(parentOf5(real), target), hops + 1, create);
   }
   async open(mount, rel2, write) {
     return await mount.conn.call({
@@ -6159,6 +6784,8 @@ async function ranged(fs, path, req) {
   else await ops.truncate(path, req.length ?? 0);
   return done;
 }
+var UNLINKED_OPS = /* @__PURE__ */ new Set(["read", "pread", "pwrite", "truncate"]);
+var OWN_OPS = /* @__PURE__ */ new Set(["rm", "unlink", "rmdir", "rename"]);
 async function dispatchSyncFs(req) {
   const entry = resolveSyncFsToken(req.token);
   if (!entry) return { ok: false, errno: "EACCES", message: "sync-fs: unknown or revoked token" };
@@ -6167,11 +6794,22 @@ async function dispatchSyncFs(req) {
     const path = fs.resolvePath(cwd, req.path);
     if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
     if (req.op === "hold") {
-      entry.hold?.(path, req.mode === 1);
+      const [on, open] = [((req.mode ?? 0) & 1) === 1, ((req.mode ?? 0) & 2) === 2];
+      const real = on && open ? await fs.realpath?.(path, true).catch(() => path) : void 0;
+      entry.hold?.(path, on, open, real);
       return done;
     }
     if (entry.revoked?.(path)) return { ok: false, errno: "EIO", message: `${path} was unmounted` };
-    return await run(entry, path, req);
+    if (req.op === "write" && req.mode === 1 || UNLINKED_OPS.has(req.op)) {
+      const serve = async () => {
+        const kept = entry.unlinked?.(path);
+        return run(entry, kept && !await fs.exists(path) ? kept.hidden : path, req);
+      };
+      return await (entry.gate ? entry.gate(path, serve) : serve());
+    }
+    if (!entry.own || !OWN_OPS.has(req.op)) return await run(entry, path, req);
+    const target = req.op === "rename" ? fs.resolvePath(cwd, req.arg2 ?? "") : path;
+    return await entry.own(target, () => run(entry, path, req));
   } catch (err) {
     return toErrno(err);
   }
@@ -7559,7 +8197,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within4(path, root) {
+function within5(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -7764,7 +8402,7 @@ var VfsNodes = class {
     return run2;
   }
   async entryKey(path) {
-    const parent = parentOf5(path);
+    const parent = parentOf6(path);
     const dir = await this.real(parent, true, () => realDir(this.fs, parent));
     return joinName(dir, path.slice(path.lastIndexOf("/") + 1));
   }
@@ -7812,12 +8450,12 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within5(path, prefix)) return true;
     return false;
   }
   writes(prefix) {
     for (const [path, node] of this.byPath)
-      if (node.writers > 0 && within4(path, prefix)) return true;
+      if (node.writers > 0 && within5(path, prefix)) return true;
     return false;
   }
   closed(node, writable = false) {
@@ -7831,24 +8469,24 @@ var VfsNodes = class {
     this.onClosed?.(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within5(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within4(held, path)) continue;
+      if (!within5(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within4(path, prefix)) continue;
+      if (!within5(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within4(held, path)) continue;
+      if (!within5(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -7857,8 +8495,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within4(p, from)) moved2.push(node);
-      else if (within4(p, to)) {
+      if (within5(p, from)) moved2.push(node);
+      else if (within5(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -7881,7 +8519,7 @@ async function present(fs, path, follow = false) {
   }
 }
 var MAX_LINKS5 = 40;
-function parentOf5(path) {
+function parentOf6(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
 async function linkOf(fs, path) {
@@ -7894,7 +8532,7 @@ async function realDir(fs, dir, budget = { hops: 0 }) {
     const part = queue.shift();
     if (part === ".") continue;
     if (part === "..") {
-      at = parentOf5(at);
+      at = parentOf6(at);
       continue;
     }
     const next = at === "/" ? `/${part}` : `${at}/${part}`;
@@ -7918,7 +8556,7 @@ function joinName(dir, name2) {
 }
 async function realTarget(fs, path) {
   const budget = { hops: 0 };
-  let dir = await realDir(fs, parentOf5(path), budget);
+  let dir = await realDir(fs, parentOf6(path), budget);
   let name2 = path.slice(path.lastIndexOf("/") + 1);
   for (; ; ) {
     const link2 = await linkOf(fs, joinName(dir, name2));
@@ -7926,13 +8564,13 @@ async function realTarget(fs, path) {
     if (budget.hops >= MAX_LINKS5) throw fsError("ELOOP", path);
     budget.hops++;
     const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
-    dir = await realDir(fs, parentOf5(target), budget);
+    dir = await realDir(fs, parentOf6(target), budget);
     name2 = target.slice(target.lastIndexOf("/") + 1);
   }
   return joinName(dir, name2);
 }
 async function targetDir(fs, path) {
-  return parentOf5(await realTarget(fs, path).catch(() => path));
+  return parentOf6(await realTarget(fs, path).catch(() => path));
 }
 async function refuseReadonly(fs, path, flags, opts = {}) {
   const writes = (flags & O_ACCMODE) !== 0 || opts.truncate === true;
@@ -8321,7 +8959,7 @@ var WasmProcess = class {
     const fd = this.fds.install(heldFile(), 3);
     try {
       const nodes = this.nodes;
-      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : await nodes.targetKey(req.path);
+      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : req.create ? await nodes.targetKey(req.path) : await this.keptOr(await nodes.targetKey(req.path));
       const open = { ...req, path };
       if (req.exclusive) {
         await nodes.createExclusive(path);
@@ -8477,6 +9115,11 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: await file.stat() };
     }
   }
+  keptPath;
+  async keptOr(path) {
+    const kept = this.keptPath?.(path);
+    return kept !== void 0 && !await present(this.options.fs, path, true) ? kept : path;
+  }
   async promote(req) {
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     if (req.share !== void 0) {
@@ -8484,7 +9127,7 @@ var WasmProcess = class {
       return;
     }
     if (req.path === void 0) throw new KernelError("EINVAL");
-    const path = req.orphan ? req.path : await this.nodes.targetKey(req.path);
+    const path = req.orphan ? req.path : await this.keptOr(await this.nodes.targetKey(req.path));
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     const file = vfsFile(
       this.options.fs,
@@ -8843,6 +9486,19 @@ function inherited(opts) {
     ...opts.umask !== void 0 ? { umask: opts.umask } : {}
   };
 }
+function holdingToken(opts, holds) {
+  return mintSyncFsToken({
+    fs: opts.fs,
+    cwd: opts.cwd,
+    ...opts.statfs ? { statfs: opts.statfs } : {},
+    hold: (path, on, open, real) => holds.hold(path, on, open, real),
+    unlinked: (path) => holds.keptAt(path),
+    gate: (path, op) => opts.unlinkGate && holds.holding(path) ? opts.unlinkGate.run(holds.keyOf(path), op) : op(),
+    own: (path, op) => holds.own(path, op),
+    revoked: (path) => holds.isRevoked(path),
+    renamed: (from, to) => holds.renamed(from, to)
+  });
+}
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header2 = new Int32Array(sab, 0, SAB_HEADER_I32);
@@ -8887,14 +9543,8 @@ function spawnWasmProcess(opts) {
   });
   const holds = new HeldPaths();
   opts.held?.add(holds);
-  const token = mintSyncFsToken({
-    fs: opts.fs,
-    cwd: opts.cwd,
-    ...opts.statfs ? { statfs: opts.statfs } : {},
-    hold: (path, on) => holds.hold(path, on),
-    revoked: (path) => holds.isRevoked(path),
-    renamed: (from, to) => holds.renamed(from, to)
-  });
+  const token = holdingToken(opts, holds);
+  process.keptPath = (path) => holds.keptAt(path)?.hidden;
   const worker = opts.createWorker();
   const dying = new Dying();
   const dispatch2 = (req) => dying.serving(() => isWasmSyscall(req) ? process.syscall(req) : dispatchSyncFs(req));
@@ -10534,6 +11184,7 @@ var Launcher = class {
   deciding = /* @__PURE__ */ new Map();
   identities = { asked: 0, timedOut: 0 };
   nodes;
+  unlinked;
   held = new HeldSet((path) => this.released(path));
   processMounts;
   booting = new AbortController();
@@ -10578,7 +11229,15 @@ var Launcher = class {
     const fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.openFiles.add(this.nodes);
-    this.fs = keepingOpen(fs, this.nodes);
+    this.unlinked = new UnlinkedKeeper(
+      fs,
+      this.held,
+      (path) => this.mountRoot(path),
+      webLocks(),
+      (path) => [...this.openFiles].some((nodes) => nodes.holds(path))
+    );
+    this.fs = keepingOpen(this.unlinked.wrap(), this.nodes);
+    void this.unlinked.sweep("/");
     this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
       this.catalog = void 0;
       this.binfmts = void 0;
@@ -10788,6 +11447,7 @@ var Launcher = class {
       openFiles: this.openFiles,
       nodes: this.nodes,
       held: this.held,
+      unlinkGate: this.unlinked.gate,
       statfs: (path) => this.mounts.statfs(path),
       mounts: () => this.mounts.list(),
       mount: (call, signal) => this.processMount(pid, call, signal),
@@ -10945,6 +11605,7 @@ var Launcher = class {
   }
   released(path) {
     const at = normalizePath(path);
+    this.unlinked.closed(at);
     const open = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
     if (!open) void this.mounts.commit(at).catch(() => void 0);
   }
@@ -11040,10 +11701,23 @@ var Launcher = class {
       }
     };
   }
-  mount(spec) {
-    if (spec.type !== "fsa" || spec.source.startsWith("fsa:"))
-      return this.mounts.mount(spec, this.fs);
-    return this.mounts.mount({ ...spec, source: `fsa:${crypto.randomUUID()}` }, this.fs);
+  async mount(spec) {
+    const fsa = spec.type === "fsa" && !spec.source.startsWith("fsa:");
+    const entry = await this.mounts.mount(
+      fsa ? { ...spec, source: `fsa:${crypto.randomUUID()}` } : spec,
+      this.fs
+    );
+    void this.unlinked.sweep(entry.target);
+    return entry;
+  }
+  mountRoot(path) {
+    let root = "/";
+    for (const { target } of this.mounts.list()) {
+      if (target.length > root.length && (path === target || path.startsWith(`${target}/`))) {
+        root = target;
+      }
+    }
+    return root;
   }
   async insert(target, handle, source) {
     const at = normalizePath(target);
@@ -11057,6 +11731,7 @@ var Launcher = class {
     await this.media.put(slot.id, handle);
     slot.medium.insert(handle);
     slot.served.invalidate(true);
+    void this.unlinked.sweep(at);
   }
   umount(target, detach = false) {
     const at = normalizePath(target);