@ai-ecoverse/slicc-kernel 1.37.0 → 1.39.0

package/dist/node.js

@@ -1190,7 +1190,153 @@ async function readWithin(reader, ms) {
   }
 }
 
+// src/kernel/net/ws-queue.ts
+var INBOUND_LIMIT = 16 * 1024 * 1024;
+var MESSAGE_LIMIT = 64 * 1024 * 1024;
+var TOO_BIG = 1009;
+function payloadSize(message2) {
+  return typeof message2 === "string" ? new TextEncoder().encode(message2).length : message2.length;
+}
+var MessageQueue = class {
+  items = [];
+  limit;
+  waiter;
+  size = 0;
+  ended = false;
+  overflow;
+  taken;
+  closed;
+  settle;
+  constructor(overflow, limit = INBOUND_LIMIT, taken) {
+    this.overflow = overflow;
+    this.limit = limit;
+    this.taken = taken;
+    this.closed = new Promise((resolve) => {
+      this.settle = resolve;
+    });
+  }
+  push(message2) {
+    if (this.ended) return;
+    const size = payloadSize(message2);
+    const huge = size > MESSAGE_LIMIT;
+    if (huge || this.items.length > 0 && this.size + size > this.limit) {
+      const reason = huge ? `a message is over ${MESSAGE_LIMIT} bytes` : `over ${this.limit} bytes of messages are waiting`;
+      this.end({ code: TOO_BIG, reason });
+      this.overflow();
+      return;
+    }
+    this.size += size;
+    this.items.push(message2);
+    this.wake();
+  }
+  end(close) {
+    if (this.ended) return;
+    this.ended = true;
+    this.settle(close);
+    this.wake();
+  }
+  wake() {
+    const waiter = this.waiter;
+    this.waiter = void 0;
+    waiter?.();
+  }
+  async *[Symbol.asyncIterator]() {
+    for (; ; ) {
+      const next = this.items.shift();
+      if (next !== void 0) {
+        const n = payloadSize(next);
+        this.size -= n;
+        this.taken?.(n);
+        yield next;
+        continue;
+      }
+      if (this.ended) return;
+      await new Promise((resolve) => {
+        this.waiter = resolve;
+      });
+    }
+  }
+};
+
+// src/websocket-transport.ts
+var SENT_HEADERS_DROP = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "upgrade",
+  "sec-websocket-key",
+  "sec-websocket-version",
+  "sec-websocket-extensions",
+  "sec-websocket-protocol"
+]);
+function headerRecord(headers) {
+  const out = {};
+  for (const [name2, value] of headers) {
+    if (!SENT_HEADERS_DROP.has(name2.toLowerCase())) out[name2] = value;
+  }
+  return out;
+}
+function sendableClose(code) {
+  return code === 1e3 || code !== void 0 && code >= 3e3 && code <= 4999 ? code : 1e3;
+}
+function blockedReason(url, e) {
+  const name2 = e?.name;
+  if (name2 === "SecurityError" && url.startsWith("ws:")) {
+    return `${url}: ws:// is blocked from an https page; use wss:// or slicc-node`;
+  }
+  return `${url}: ${e instanceof Error ? e.message : String(e)}`;
+}
+function openWebSocket(Socket, request, withHeaders) {
+  const { url, protocols, signal } = request;
+  signal.throwIfAborted();
+  let socket;
+  try {
+    socket = withHeaders ? new Socket(url, { protocols, headers: headerRecord(request.headers) }) : new Socket(url, protocols);
+  } catch (e) {
+    return Promise.reject(Object.assign(new Error(blockedReason(url, e)), { status: 502 }));
+  }
+  socket.binaryType = "arraybuffer";
+  const queue = new MessageQueue(() => socket.close(1e3, "too many waiting messages"));
+  return new Promise((resolve, reject) => {
+    let open = false;
+    const abort = () => {
+      socket.close(1e3, "aborted");
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    socket.addEventListener("open", () => {
+      open = true;
+      signal.removeEventListener("abort", abort);
+      resolve({
+        protocol: socket.protocol,
+        get buffered() {
+          return socket.bufferedAmount;
+        },
+        send: (data) => socket.send(data),
+        messages: queue,
+        close: (code, reason) => socket.close(sendableClose(code), reason),
+        closed: queue.closed
+      });
+    });
+    socket.addEventListener("message", (event) => {
+      queue.push(typeof event.data === "string" ? event.data : new Uint8Array(event.data));
+    });
+    socket.addEventListener("close", (event) => {
+      queue.end({ code: event.code, reason: event.reason });
+      if (open) return;
+      signal.removeEventListener("abort", abort);
+      reject(
+        Object.assign(new Error(`${url}: the WebSocket closed (${event.code}) before it opened`), {
+          status: 502
+        })
+      );
+    });
+  });
+}
+
 // src/transport.ts
+var SEND_BUFFER = 1024 * 1024;
+var CLOSE_WAIT_MS = 5e3;
+var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
 function joinHeaders(headers) {
   const out = new Headers();
@@ -1215,13 +1361,17 @@ async function* chunks(body, idleMs) {
 }
 function fetchTransport(options = {}) {
   const send = options.fetch ?? globalThis.fetch.bind(globalThis);
+  const Socket = options.webSocket === true ? globalThis.WebSocket : options.webSocket || void 0;
+  const headers = options.webSocketHeaders === true;
   return {
     traits: {
       manualRedirects: false,
       encodedBodies: false,
       maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,
-      crossOrigin: "cors"
+      crossOrigin: "cors",
+      ...Socket ? { websocket: true } : {}
     },
+    ...Socket ? { websocket: (request) => openWebSocket(Socket, request, headers) } : {},
     async fetch(request) {
       let response;
       try {
@@ -1243,15 +1393,15 @@ function fetchTransport(options = {}) {
           { status: 502 }
         );
       }
-      const headers = [];
+      const headers2 = [];
       response.headers.forEach((value, name2) => {
-        headers.push([name2, value]);
+        headers2.push([name2, value]);
       });
       const body = chunks(response.body, options.bodyIdleMs ?? BODY_IDLE_MS);
       return {
         status: response.status,
         statusText: response.statusText,
-        headers,
+        headers: headers2,
         body,
         cancel: async () => {
           await body.return(void 0);
@@ -1261,7 +1411,7 @@ function fetchTransport(options = {}) {
     }
   };
 }
-function serveTransport(peer, transport) {
+function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const open = /* @__PURE__ */ new Map();
   const fail2 = (nid, e) => {
     open.delete(nid);
@@ -1302,6 +1452,96 @@ function serveTransport(peer, transport) {
       fail2(call.nid, e);
     }
   };
+  const sockets = /* @__PURE__ */ new Map();
+  const credit = /* @__PURE__ */ new Map();
+  const refill = (nid, n, closing = false) => {
+    const flow = credit.get(nid);
+    if (!flow) return;
+    flow.inflight -= n;
+    if (closing && !flow.closing) {
+      flow.closing = true;
+      flow.deadline();
+    }
+    flow.wake?.();
+  };
+  const openSocket = async (call) => {
+    const abort = new AbortController();
+    open.set(call.nid, { abort });
+    try {
+      if (!transport.websocket) throw new Error(NO_WEBSOCKET);
+      const socket = await transport.websocket({
+        url: call.url,
+        protocols: call.protocols,
+        headers: call.headers,
+        signal: abort.signal
+      });
+      if (!open.delete(call.nid)) {
+        socket.close(1e3, "cancelled");
+        return;
+      }
+      sockets.set(call.nid, socket);
+      peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
+      void relay(call.nid, socket);
+    } catch (e) {
+      fail2(call.nid, e);
+    }
+  };
+  const relay = async (nid, socket) => {
+    let ending;
+    let late;
+    const unanswered = new Promise((resolve) => {
+      late = () => resolve("late");
+    });
+    const flow = {
+      inflight: 0,
+      closing: false,
+      deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
+    };
+    credit.set(nid, flow);
+    const timedOut = { code: 1006, reason: "the far end did not answer the close" };
+    let oversize = false;
+    try {
+      const messages = socket.messages[Symbol.asyncIterator]();
+      for (; ; ) {
+        const next = await Promise.race([messages.next(), unanswered]);
+        if (next === "late" || next.done) break;
+        const data = next.value;
+        if (flow.closing) continue;
+        if (payloadSize(data) > MESSAGE_LIMIT) {
+          oversize = true;
+          break;
+        }
+        if (typeof data === "string") peer.postMessage({ net: "ws-message", nid, data });
+        else {
+          const bytes = data.slice();
+          peer.postMessage({ net: "ws-message", nid, data: bytes }, [bytes.buffer]);
+        }
+        flow.inflight += payloadSize(data);
+        while (flow.inflight > INBOUND_LIMIT && !flow.closing) {
+          await new Promise((resolve) => {
+            flow.wake = resolve;
+          });
+        }
+      }
+      if (oversize) socket.close(1e3, "a message is too big");
+      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut)]);
+    } catch (e) {
+      socket.close(1e3, "the relay failed");
+      ending = { code: 1011, reason: e instanceof Error ? e.message : String(e) };
+    }
+    sockets.delete(nid);
+    credit.delete(nid);
+    peer.postMessage({ net: "ws-closed", nid, ...ending });
+  };
+  const sendOn = async (call) => {
+    const socket = sockets.get(call.nid);
+    if (!socket) return;
+    socket.send(call.data);
+    while (socket.buffered > SEND_BUFFER && sockets.has(call.nid)) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
+  };
   const read = async (nid) => {
     const body = open.get(nid)?.body;
     if (!body) return;
@@ -1319,6 +1559,8 @@ function serveTransport(peer, transport) {
     }
   };
   const drop = (nid) => {
+    sockets.get(nid)?.close(1e3, "cancelled");
+    refill(nid, 0, true);
     const entry = open.get(nid);
     open.delete(nid);
     entry?.abort.abort();
@@ -1328,10 +1570,16 @@ function serveTransport(peer, transport) {
     answer(call) {
       if (call.net === "fetch") void start(call);
       else if (call.net === "read") void read(call.nid);
+      else if (call.net === "ws-open") void openSocket(call);
+      else if (call.net === "ws-send") void sendOn(call);
+      else if (call.net === "ws-close") {
+        sockets.get(call.nid)?.close(call.code, call.reason);
+        refill(call.nid, 0, true);
+      } else if (call.net === "ws-consumed") refill(call.nid, call.n);
       else drop(call.nid);
     },
     close() {
-      for (const nid of [...open.keys()]) drop(nid);
+      for (const nid of [...open.keys(), ...sockets.keys()]) drop(nid);
     }
   };
 }
@@ -2417,6 +2665,10 @@ var Incoming = class {
     this.buf = this.buf.subarray(n);
     return out;
   }
+  async peek(signal) {
+    if (this.buf.length === 0) await this.fill(signal);
+    return this.buf[0];
+  }
   async some(max, signal) {
     if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
     if (this.eof) return new Uint8Array(0);
@@ -2614,7 +2866,15 @@ var CLOSE = {
   error: 1011
 };
 var OP_TEXT = 1;
-var OP = { continuation: 0, text: OP_TEXT, binary: 2, close: 8, ping: 9, pong: 10 };
+var OP_BINARY = 2;
+var OP = {
+  continuation: 0,
+  text: OP_TEXT,
+  binary: OP_BINARY,
+  close: 8,
+  ping: 9,
+  pong: 10
+};
 var WsError = class extends Error {
   code;
   constructor(code, message2) {
@@ -2622,6 +2882,10 @@ var WsError = class extends Error {
     this.code = code;
   }
 };
+function sendableCode(code) {
+  if (code >= 3e3 && code <= 4999) return true;
+  return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006;
+}
 function field(headers, name2) {
   return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
 }
@@ -2660,7 +2924,11 @@ function frame(opcode, payload) {
 }
 function closeFrame(code, reason = "") {
   let bytes = new TextEncoder().encode(reason);
-  if (bytes.length > 123) bytes = bytes.subarray(0, 123);
+  if (bytes.length > 123) {
+    let end = 123;
+    while ((bytes[end] & 192) === 128) end--;
+    bytes = bytes.subarray(0, end);
+  }
   const payload = new Uint8Array(2 + bytes.length);
   new DataView(payload.buffer).setUint16(0, code);
   payload.set(bytes, 2);
@@ -2691,9 +2959,12 @@ var WsReader = class {
   parts = [];
   size = 0;
   continuing = false;
-  constructor(incoming, max = MAX_MESSAGE) {
+  binaryMessage = false;
+  binary;
+  constructor(incoming, max = MAX_MESSAGE, binary) {
     this.incoming = incoming;
     this.max = max;
+    this.binary = binary;
   }
   async next(signal) {
     for (; ; ) {
@@ -2723,6 +2994,20 @@ var WsReader = class {
       if (event) return event;
     }
   }
+  data(opcode, fin, payload) {
+    if (opcode === OP.continuation !== this.continuing) {
+      throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+    }
+    if (opcode !== OP.continuation) this.binaryMessage = opcode === OP.binary;
+    this.parts.push(payload);
+    this.size += payload.length;
+    this.continuing = !fin;
+    if (!fin) return void 0;
+    const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
+    this.parts = [];
+    this.size = 0;
+    return this.binaryMessage ? { kind: "binary", bytes: whole } : { kind: "text", text: decode(whole) };
+  }
   async length(short, signal) {
     if (short < 126) return short;
     const ext = new Uint8Array(short === 126 ? 2 : 8);
@@ -2741,36 +3026,31 @@ var WsReader = class {
       case OP.close: {
         if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
         const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
-        return { kind: "close", code, reason: decode(payload.subarray(2)) };
-      }
-      case OP.text:
-      case OP.continuation: {
-        if (opcode === OP.continuation !== this.continuing) {
-          throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+        if (payload.length >= 2 && !sendableCode(code)) {
+          throw new WsError(CLOSE.protocol, `close code ${code} may not be sent`);
         }
-        this.parts.push(payload);
-        this.size += payload.length;
-        this.continuing = !fin;
-        if (!fin) return void 0;
-        const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
-        this.parts = [];
-        this.size = 0;
-        return { kind: "text", text: decode(whole) };
+        return { kind: "close", code, reason: decode(payload.subarray(2)) };
       }
       case OP.binary:
-        throw new WsError(CLOSE.unsupported, "CDP messages are text");
+        if (!this.binary) throw new WsError(CLOSE.unsupported, "CDP messages are text");
+        return this.data(opcode, fin, payload);
+      case OP.text:
+      case OP.continuation:
+        return this.data(opcode, fin, payload);
       default:
         throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
     }
   }
 };
-function switchingHead(accept2) {
+function switchingHead(accept2, protocol = "") {
+  const chosen = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+` : "";
   return latin1Bytes(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
 Connection: Upgrade\r
 Sec-WebSocket-Accept: ${accept2}\r
-\r
+${chosen}\r
 `
   );
 }
@@ -2778,7 +3058,7 @@ Sec-WebSocket-Accept: ${accept2}\r
 // src/cdp/facade.ts
 var MAX_HEAD = 64 * 1024;
 var LIST_TIMEOUT = 1e4;
-var CLOSE_WAIT_MS = 1e3;
+var CLOSE_WAIT_MS2 = 1e3;
 function respond(status, body, type = "text/plain; charset=utf-8") {
   const bytes = new TextEncoder().encode(body);
   const head = latin1Bytes(
@@ -2926,7 +3206,7 @@ var CdpFacade = class {
     const host = await this.host(runtime);
     const limits = {
       max: this.options.maxMessage ?? MAX_MESSAGE,
-      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS
+      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS2
     };
     await new Relay(conn, incoming, host, limits, this.stop.signal).start(switchingHead(accept2)).finally(() => host.close());
   }
@@ -3394,13 +3674,193 @@ function withCommandDirs(fs, names) {
   };
 }
 
+// src/fs/unlinked.ts
+var UNLINKED_DIR = ".slicc-unlinked";
+function webLocks() {
+  return globalThis.navigator?.locks;
+}
+var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var lockName = (instance) => `slicc-unlinked:${instance}`;
+var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
+var PathGate = class {
+  tails = /* @__PURE__ */ new Map();
+  async acquire(path) {
+    const prev = this.tails.get(path) ?? Promise.resolve();
+    const { promise, resolve } = Promise.withResolvers();
+    const tail = prev.then(() => promise);
+    this.tails.set(path, tail);
+    await prev;
+    return () => {
+      resolve();
+      if (this.tails.get(path) === tail) this.tails.delete(path);
+    };
+  }
+  async run(path, op) {
+    const release = await this.acquire(path);
+    try {
+      return await op();
+    } finally {
+      release();
+    }
+  }
+};
+var UnlinkedKeeper = class {
+  fs;
+  holders;
+  rootOf;
+  locks;
+  busy;
+  waiting = /* @__PURE__ */ new Set();
+  instance = crypto.randomUUID();
+  gate = new PathGate();
+  queue = Promise.resolve();
+  count = 0;
+  constructor(fs, holders, rootOf, locks, busy = () => false) {
+    this.fs = fs;
+    this.holders = holders;
+    this.rootOf = rootOf;
+    this.locks = locks;
+    this.busy = busy;
+    void locks?.request(lockName(this.instance), () => new Promise(() => void 0));
+  }
+  serial(op) {
+    const next = this.queue.then(op);
+    this.queue = next.catch(() => void 0);
+    return next;
+  }
+  wrap() {
+    const fs = this.fs;
+    const keeper = this;
+    const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
+    return {
+      ...fs,
+      async rm(path, options) {
+        const target = fs.resolvePath("/", path);
+        const pinned = await keeper.pin(target);
+        if (pinned.moved.has(target)) pinned.commit();
+        else await keeper.settle(pinned, () => fs.rm(path, options));
+      },
+      async rename(from, to) {
+        const pinned = await keeper.pin(fs.resolvePath("/", to));
+        await keeper.settle(pinned, () => fs.rename(from, to));
+      },
+      readdir: async (path) => visible(await fs.readdir(path)),
+      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR)
+    };
+  }
+  async settle(pinned, op) {
+    try {
+      await op();
+    } catch (err) {
+      await pinned.rollback();
+      throw err;
+    }
+    pinned.commit();
+  }
+  async pin(target) {
+    const held = /* @__PURE__ */ new Map();
+    for (const holder of this.holders) {
+      if (holder.owns(target)) continue;
+      for (const path of holder.opens.keys()) {
+        if (!within2(path, target) || holder.unlinked.has(path)) continue;
+        held.set(path, [...held.get(path) ?? [], holder]);
+      }
+    }
+    const paths = [...held.keys()].sort();
+    const releases = [];
+    for (const path of paths) releases.push(await this.gate.acquire(path));
+    const hidden = /* @__PURE__ */ new Map();
+    for (const path of paths) {
+      const at = await this.hide(path);
+      if (at !== void 0) hidden.set(path, at);
+    }
+    const done4 = () => {
+      for (const release of releases) release();
+    };
+    return {
+      moved: new Set(hidden.keys()),
+      commit: () => {
+        for (const [path, at] of hidden) {
+          const holders = held.get(path);
+          const file = this.keptFile(at, { refs: holders.length });
+          for (const holder of holders) holder.unlinked.set(path, file);
+        }
+        done4();
+      },
+      rollback: async () => {
+        for (const [path, at] of hidden) {
+          await this.serial(async () => {
+            await Promise.allSettled([this.fs.rename(at, path)]);
+            await this.tidy(parentOf3(at));
+          });
+        }
+        done4();
+      }
+    };
+  }
+  keptFile(hidden, entry) {
+    return {
+      hidden,
+      release: () => {
+        if (--entry.refs === 0) void this.serial(() => this.drop(hidden));
+      }
+    };
+  }
+  hide(path) {
+    return this.serial(async () => {
+      const dir = dirOf(this.rootOf(path));
+      const hidden = `${dir}/${this.instance}.${++this.count}`;
+      try {
+        await this.fs.mkdir(dir, { recursive: true });
+        await this.fs.rename(path, hidden);
+        return hidden;
+      } catch {
+        await this.tidy(dir);
+        return void 0;
+      }
+    });
+  }
+  closed(path) {
+    if (this.waiting.delete(path)) void this.serial(() => this.drop(path));
+  }
+  async drop(hidden) {
+    if (this.busy(hidden)) {
+      this.waiting.add(hidden);
+      return;
+    }
+    await this.fs.rm(hidden).catch(() => void 0);
+    await this.tidy(parentOf3(hidden));
+  }
+  async tidy(dir) {
+    const left = await this.fs.readdir(dir).catch(() => [UNLINKED_DIR]);
+    if (left.length === 0) await this.fs.rm(dir, { recursive: true }).catch(() => void 0);
+  }
+  sweep(root) {
+    const query = this.locks?.query?.bind(this.locks);
+    if (!query) return Promise.resolve();
+    return this.serial(async () => {
+      const dir = dirOf(root);
+      const names = await this.fs.readdir(dir).catch(() => void 0);
+      if (!names) return;
+      const held = new Set(((await query()).held ?? []).map((lock) => lock.name));
+      for (const name2 of names) {
+        const owner = name2.slice(0, name2.lastIndexOf("."));
+        if (owner === this.instance || held.has(lockName(owner))) continue;
+        await this.fs.rm(`${dir}/${name2}`, { recursive: true }).catch(() => void 0);
+      }
+      await this.tidy(dir);
+    });
+  }
+};
+
 // src/fs/watch.ts
 var WATCH_BATCH_LIMIT = 1e3;
 var under2 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
-var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 function touches(watcher, changed) {
   return watcher.paths.some(
-    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf3(changed) === watched)
+    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf4(changed) === watched)
   );
 }
 var FsWatchers = class {
@@ -3782,7 +4242,7 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -3795,18 +4255,47 @@ var HeldSet = class extends Set {
   }
   delete(holds) {
     const removed = super.delete(holds);
-    for (const path of holds.keys()) this.idle(path);
+    for (const path of /* @__PURE__ */ new Set([...holds.keys(), ...holds.opens.keys()])) this.idle(path);
+    for (const kept of holds.unlinked.values()) kept.release();
+    holds.unlinked.clear();
     return removed;
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within2(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within3(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
   revoked = /* @__PURE__ */ new Set();
+  opens = /* @__PURE__ */ new Map();
+  unlinked = /* @__PURE__ */ new Map();
+  aliases = /* @__PURE__ */ new Map();
+  owning;
   onIdle;
-  hold(path, on) {
+  keyOf(path) {
+    return this.aliases.get(path) ?? path;
+  }
+  keptAt(path) {
+    return this.unlinked.get(this.keyOf(path));
+  }
+  holding(path) {
+    return this.opens.has(this.keyOf(path));
+  }
+  hold(path, on, open = false, real) {
+    if (open) {
+      const key = real ?? this.keyOf(path);
+      if (key !== path) this.aliases.set(path, key);
+      const count2 = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
+      if (count2 > 0) this.opens.set(key, count2);
+      else {
+        this.opens.delete(key);
+        this.unlinked.get(key)?.release();
+        this.unlinked.delete(key);
+        for (const [alias, target] of this.aliases) if (target === key) this.aliases.delete(alias);
+        this.onIdle?.(key);
+      }
+      return;
+    }
     const count = (this.get(path) ?? 0) + (on ? 1 : -1);
     if (count > 0) this.set(path, count);
     else {
@@ -3815,23 +4304,40 @@ var HeldPaths = class extends Map {
       this.onIdle?.(path);
     }
   }
+  async own(path, op) {
+    this.owning = path;
+    try {
+      return await op();
+    } finally {
+      this.owning = void 0;
+    }
+  }
+  owns(path) {
+    return this.owning === path;
+  }
   revoke(prefix) {
-    for (const path of this.keys()) if (within2(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within3(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count] of [...this]) {
-      if (!within2(path, from)) continue;
+      if (!within3(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
+    for (const [path, count] of [...this.opens]) {
+      if (!within3(path, from)) continue;
+      const moved2 = to + path.slice(from.length);
+      this.opens.delete(path);
+      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
+    }
   }
   isRevoked(path) {
     return this.revoked.has(path);
   }
 };
-var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var readonly = (mount) => mount.caps.readonly === true || mount.options.ro !== void 0;
 function statOf(attr, path, mount) {
   const mtime = new Date(attr.mtime);
@@ -3920,7 +4426,7 @@ var MountTable = class {
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within2(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within3(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -4059,7 +4565,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within2(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within3(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -4093,10 +4599,10 @@ var MountTable = class {
     this.deps.changed?.(...full);
   }
   forget(mount, path) {
-    for (const key of [...mount.attrs.keys()]) if (within2(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within3(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
-    mount.lists.delete(parentOf4(path));
-    for (const key of [...mount.lists.keys()]) if (within2(key, path)) mount.lists.delete(key);
+    mount.lists.delete(parentOf5(path));
+    for (const key of [...mount.lists.keys()]) if (within3(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2) {
     if (mount.conn.failure) throw mount.conn.failure;
@@ -4161,7 +4667,7 @@ var MountFs = class {
     if (attr.kind !== "symlink") return real;
     if (hops >= MAX_LINKS4) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
-    return this.follow(this.base.resolvePath(parentOf4(real), target), hops + 1, create);
+    return this.follow(this.base.resolvePath(parentOf5(real), target), hops + 1, create);
   }
   async open(mount, rel2, write) {
     return await mount.conn.call({
@@ -4675,6 +5181,8 @@ async function ranged(fs, path, req) {
   else await ops.truncate(path, req.length ?? 0);
   return done;
 }
+var UNLINKED_OPS = /* @__PURE__ */ new Set(["read", "pread", "pwrite", "truncate"]);
+var OWN_OPS = /* @__PURE__ */ new Set(["rm", "unlink", "rmdir", "rename"]);
 async function dispatchSyncFs(req) {
   const entry = resolveSyncFsToken(req.token);
   if (!entry) return { ok: false, errno: "EACCES", message: "sync-fs: unknown or revoked token" };
@@ -4683,11 +5191,22 @@ async function dispatchSyncFs(req) {
     const path = fs.resolvePath(cwd, req.path);
     if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
     if (req.op === "hold") {
-      entry.hold?.(path, req.mode === 1);
+      const [on, open] = [((req.mode ?? 0) & 1) === 1, ((req.mode ?? 0) & 2) === 2];
+      const real = on && open ? await fs.realpath?.(path, true).catch(() => path) : void 0;
+      entry.hold?.(path, on, open, real);
       return done;
     }
     if (entry.revoked?.(path)) return { ok: false, errno: "EIO", message: `${path} was unmounted` };
-    return await run(entry, path, req);
+    if (req.op === "write" && req.mode === 1 || UNLINKED_OPS.has(req.op)) {
+      const serve = async () => {
+        const kept = entry.unlinked?.(path);
+        return run(entry, kept && !await fs.exists(path) ? kept.hidden : path, req);
+      };
+      return await (entry.gate ? entry.gate(path, serve) : serve());
+    }
+    if (!entry.own || !OWN_OPS.has(req.op)) return await run(entry, path, req);
+    const target = req.op === "rename" ? fs.resolvePath(cwd, req.arg2 ?? "") : path;
+    return await entry.own(target, () => run(entry, path, req));
   } catch (err) {
     return toErrno(err);
   }
@@ -5037,12 +5556,17 @@ function ownNames(hostname) {
 }
 
 // src/kernel/net/proxy-service.ts
+var SEND_BUFFER2 = 1024 * 1024;
+var TLS_HANDSHAKE = 22;
+var TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var NO_WEBSOCKET2 = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var REALM_PROXY_PORT = 3128;
 var DEFAULT_LIMITS = {
   maxConnections: 64,
   maxHead: 64 * 1024,
   idleMs: 12e4,
-  bodyBudget: 128 * 1024 * 1024
+  bodyBudget: 128 * 1024 * 1024,
+  closeWaitMs: 5e3
 };
 var HOP_BY_HOP = /* @__PURE__ */ new Set([
   "connection",
@@ -5233,11 +5757,27 @@ function plainResponse(status, message2) {
     cancel: async () => void 0
   };
 }
-function timedSource(conn, idleMs, stop) {
+function timedSource(conn, idle, stop) {
   return {
-    read: (max) => conn.read(max, AbortSignal.any([stop, AbortSignal.timeout(idleMs)]))
+    read: (max, signal) => {
+      const own = signal ? [stop, signal] : [stop];
+      if (Number.isFinite(idle.ms)) own.push(AbortSignal.timeout(idle.ms));
+      return conn.read(max, AbortSignal.any(own));
+    }
   };
 }
+function webSocketTarget(req) {
+  return { ...req, target: req.target.replace(/^ws(s?):/i, (_, s) => `http${s.toLowerCase()}:`) };
+}
+function wireCode(code) {
+  if (code === 1005) return 1e3;
+  return sendableCode(code) ? code : 1011;
+}
+function quietly(ms) {
+  return new Promise((resolve) => {
+    AbortSignal.timeout(ms).addEventListener("abort", () => resolve(), { once: true });
+  });
+}
 var RealmProxy = class {
   options;
   listener;
@@ -5246,6 +5786,7 @@ var RealmProxy = class {
   slots;
   bodies;
   connections = /* @__PURE__ */ new Set();
+  warnedWebSocket = false;
   closed;
   port;
   constructor(options) {
@@ -5294,9 +5835,10 @@ var RealmProxy = class {
   }
   async serve(conn) {
     this.connections.add(conn);
-    const incoming = new Incoming(timedSource(conn, this.limits.idleMs, this.stop.signal));
+    const idle = { ms: this.limits.idleMs };
+    const incoming = new Incoming(timedSource(conn, idle, this.stop.signal));
     try {
-      await this.requests({ sink: conn, incoming, conn, socket: conn });
+      await this.requests({ sink: conn, incoming, conn, socket: conn, idle });
     } finally {
       this.connections.delete(conn);
       conn.close();
@@ -5323,7 +5865,11 @@ var RealmProxy = class {
     const req = parseRequestHead(head);
     if (req.method === "CONNECT") {
       if (!ctx.conn) throw new HttpError(400, "CONNECT inside a tunnel");
-      await this.connect(ctx.conn, incoming, req);
+      await this.connect(ctx.conn, incoming, req, ctx.idle);
+      return false;
+    }
+    if (req.method === "GET" && isUpgrade(req.headers)) {
+      await this.websocket(ctx, req);
       return false;
     }
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
@@ -5418,33 +5964,149 @@ var RealmProxy = class {
     if (chunked2) await conn.write(LAST_CHUNK, signal);
     return keep;
   }
-  async connect(conn, incoming, req) {
+  async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const tunnel = this.options.tunnel;
-    if (!tunnel) {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: no tunnels through this proxy`
-      );
-    }
-    await this.options.tunnelReady?.().catch((e) => {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: ${e instanceof Error ? e.message : String(e)}`
-      );
-    });
+    const refused = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused) throw refused;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
+      const first = await incoming.peek(this.stop.signal);
+      if (first === void 0) return;
+      if (first !== TLS_HANDSHAKE) {
+        const origin = `http://${target.port === 80 ? target.host : `${target.host}:${target.port}`}`;
+        await this.requests({ sink: conn, incoming, origin, socket: conn, idle });
+        return;
+      }
+      const tunnel = this.options.tunnel;
+      if (!tunnel || target.port !== 443 && await this.tunnelReady(target)) return;
       await tunnel(
         conn,
         incoming,
         target,
         this.stop.signal,
-        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn })
+        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn, idle })
       );
     } catch {
     }
   }
+  async tunnelReady(target) {
+    const name2 = `CONNECT ${target.host}:${target.port}`;
+    if (!this.options.tunnel) return new HttpError(501, `${name2}: no tunnels through this proxy`);
+    try {
+      await this.options.tunnelReady?.();
+      return void 0;
+    } catch (e) {
+      return new HttpError(501, `${name2}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  async websocket(ctx, req) {
+    const href = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(webSocketTarget(req));
+    const { transport } = this.options;
+    if (!transport.traits.websocket || !transport.websocket) {
+      if (!this.warnedWebSocket) {
+        this.warnedWebSocket = true;
+        console.warn(`slicc-kernel: a program asked for a WebSocket: ${NO_WEBSOCKET2}`);
+      }
+      throw new HttpError(501, NO_WEBSOCKET2);
+    }
+    const accept2 = await acceptKey(req.headers);
+    const protocols = fieldValues(req.headers, "sec-websocket-protocol").flatMap((v) => v.split(",")).map((t) => t.trim()).filter((t) => t !== "");
+    const hangup = new AbortController();
+    const waiting = new AbortController();
+    void watchHangup(ctx.socket, hangup, waiting.signal);
+    let socket;
+    try {
+      socket = await transport.websocket({
+        url: toHostLoopback(href).replace(/^http/, "ws"),
+        protocols,
+        headers: forwardRequestHeaders(req.headers),
+        signal: AbortSignal.any([this.stop.signal, hangup.signal])
+      });
+    } catch (e) {
+      waiting.abort();
+      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+    }
+    ctx.idle.ms = Number.POSITIVE_INFINITY;
+    try {
+      if (hangup.signal.aborted) throw hangup.signal.reason;
+      if (socket.protocol && !(protocols.includes(socket.protocol) && TOKEN2.test(socket.protocol))) {
+        throw new HttpError(502, "the far end chose a subprotocol the client did not offer");
+      }
+      await ctx.sink.write(switchingHead(accept2, socket.protocol), this.stop.signal);
+      await this.bridge(ctx, socket, hangup.signal);
+    } catch (e) {
+      socket.close(1001, "the client went away");
+      throw e;
+    } finally {
+      waiting.abort();
+    }
+  }
+  async bridge(ctx, socket, hangup) {
+    const stop = this.stop.signal;
+    let chain = Promise.resolve();
+    const toGuest = (bytes) => {
+      chain = chain.then(() => ctx.sink.write(bytes, stop));
+      return chain;
+    };
+    const done4 = new AbortController();
+    const reading = AbortSignal.any([stop, done4.signal, hangup]);
+    const stopping = () => socket.close(1001, "the proxy is stopping");
+    stop.addEventListener("abort", stopping, { once: true });
+    let guestDone = false;
+    let closeSent = false;
+    const outbound2 = (async () => {
+      for await (const data of socket.messages) {
+        if (guestDone) continue;
+        const text = typeof data === "string";
+        await toGuest(
+          frame(text ? OP_TEXT : OP_BINARY, text ? new TextEncoder().encode(data) : data)
+        );
+      }
+      const closed = await socket.closed;
+      if (guestDone) return;
+      closeSent = true;
+      await toGuest(closeFrame(wireCode(closed.code), closed.reason));
+      AbortSignal.timeout(this.limits.closeWaitMs).addEventListener("abort", () => done4.abort(), {
+        once: true
+      });
+    })().catch(() => done4.abort());
+    const reader = new WsReader(ctx.incoming, MESSAGE_LIMIT, true);
+    try {
+      for (; ; ) {
+        const event = await reader.next(reading);
+        if (!event) break;
+        if (event.kind === "ping") {
+          await toGuest(pongFrame(event.payload));
+          continue;
+        }
+        if (event.kind === "close") {
+          guestDone = true;
+          if (closeSent) break;
+          const code = wireCode(event.code);
+          socket.close(code, event.reason);
+          const reply = await Promise.race([
+            socket.closed,
+            quietly(this.limits.closeWaitMs).then(() => ({ code, reason: event.reason }))
+          ]);
+          await toGuest(closeFrame(wireCode(reply.code), reply.reason));
+          break;
+        }
+        while (socket.buffered > SEND_BUFFER2 && !reading.aborted) await quietly(10);
+        socket.send(event.kind === "text" ? event.text : event.bytes);
+      }
+    } catch (e) {
+      if (e instanceof WsError) {
+        guestDone = true;
+        socket.close(e.code, e.message);
+        await toGuest(closeFrame(e.code, e.message)).catch(() => void 0);
+      }
+    } finally {
+      guestDone = true;
+      socket.close(1e3, "the client went away");
+      stop.removeEventListener("abort", stopping);
+      await Promise.race([outbound2, quietly(this.limits.closeWaitMs)]);
+    }
+  }
 };
 
 // src/kernel/net/x509.ts
@@ -6266,7 +6928,7 @@ function parsePrefix(text) {
   if (length2 < 0 || length2 > max) return void 0;
   return { ...parsed, length: length2 };
 }
-function within3(prefix, addr) {
+function within4(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
   const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
   return addr.bits >> shift === prefix.bits >> shift;
@@ -6306,9 +6968,9 @@ var Routes = class {
     if (!addr) return "unreachable";
     if (addr.v6 && addr.bits === 1n) return "loopback";
     if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
+    if (RESERVED.some((p) => within4(p, addr))) return "reserved";
     if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
+    if (this.exit || this.table.some((p) => within4(p, addr))) return "uplink";
     return "unreachable";
   }
 };
@@ -7277,7 +7939,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within4(path, root) {
+function within5(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -7482,7 +8144,7 @@ var VfsNodes = class {
     return run2;
   }
   async entryKey(path) {
-    const parent = parentOf5(path);
+    const parent = parentOf6(path);
     const dir = await this.real(parent, true, () => realDir(this.fs, parent));
     return joinName(dir, path.slice(path.lastIndexOf("/") + 1));
   }
@@ -7530,12 +8192,12 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within5(path, prefix)) return true;
     return false;
   }
   writes(prefix) {
     for (const [path, node] of this.byPath)
-      if (node.writers > 0 && within4(path, prefix)) return true;
+      if (node.writers > 0 && within5(path, prefix)) return true;
     return false;
   }
   closed(node, writable = false) {
@@ -7549,24 +8211,24 @@ var VfsNodes = class {
     this.onClosed?.(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within5(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within4(held, path)) continue;
+      if (!within5(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within4(path, prefix)) continue;
+      if (!within5(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within4(held, path)) continue;
+      if (!within5(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -7575,8 +8237,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within4(p, from)) moved2.push(node);
-      else if (within4(p, to)) {
+      if (within5(p, from)) moved2.push(node);
+      else if (within5(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -7599,7 +8261,7 @@ async function present(fs, path, follow = false) {
   }
 }
 var MAX_LINKS5 = 40;
-function parentOf5(path) {
+function parentOf6(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
 async function linkOf(fs, path) {
@@ -7612,7 +8274,7 @@ async function realDir(fs, dir, budget = { hops: 0 }) {
     const part = queue.shift();
     if (part === ".") continue;
     if (part === "..") {
-      at = parentOf5(at);
+      at = parentOf6(at);
       continue;
     }
     const next = at === "/" ? `/${part}` : `${at}/${part}`;
@@ -7636,7 +8298,7 @@ function joinName(dir, name2) {
 }
 async function realTarget(fs, path) {
   const budget = { hops: 0 };
-  let dir = await realDir(fs, parentOf5(path), budget);
+  let dir = await realDir(fs, parentOf6(path), budget);
   let name2 = path.slice(path.lastIndexOf("/") + 1);
   for (; ; ) {
     const link2 = await linkOf(fs, joinName(dir, name2));
@@ -7644,13 +8306,13 @@ async function realTarget(fs, path) {
     if (budget.hops >= MAX_LINKS5) throw fsError("ELOOP", path);
     budget.hops++;
     const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
-    dir = await realDir(fs, parentOf5(target), budget);
+    dir = await realDir(fs, parentOf6(target), budget);
     name2 = target.slice(target.lastIndexOf("/") + 1);
   }
   return joinName(dir, name2);
 }
 async function targetDir(fs, path) {
-  return parentOf5(await realTarget(fs, path).catch(() => path));
+  return parentOf6(await realTarget(fs, path).catch(() => path));
 }
 async function refuseReadonly(fs, path, flags, opts = {}) {
   const writes = (flags & O_ACCMODE) !== 0 || opts.truncate === true;
@@ -8039,7 +8701,7 @@ var WasmProcess = class {
     const fd = this.fds.install(heldFile(), 3);
     try {
       const nodes = this.nodes;
-      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : await nodes.targetKey(req.path);
+      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : req.create ? await nodes.targetKey(req.path) : await this.keptOr(await nodes.targetKey(req.path));
       const open = { ...req, path };
       if (req.exclusive) {
         await nodes.createExclusive(path);
@@ -8195,6 +8857,11 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: await file.stat() };
     }
   }
+  keptPath;
+  async keptOr(path) {
+    const kept = this.keptPath?.(path);
+    return kept !== void 0 && !await present(this.options.fs, path, true) ? kept : path;
+  }
   async promote(req) {
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     if (req.share !== void 0) {
@@ -8202,7 +8869,7 @@ var WasmProcess = class {
       return;
     }
     if (req.path === void 0) throw new KernelError("EINVAL");
-    const path = req.orphan ? req.path : await this.nodes.targetKey(req.path);
+    const path = req.orphan ? req.path : await this.keptOr(await this.nodes.targetKey(req.path));
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     const file = vfsFile(
       this.options.fs,
@@ -8534,7 +9201,42 @@ var Dying = class {
     return [typeof reported === "number" ? reported : CRASHED, void 0];
   }
 };
-function processInit(opts, sab, umask) {
+function notifiers(header3) {
+  return {
+    onPending(sig) {
+      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
+      Atomics.notify(header3, SAB_I_SIGNALS);
+    },
+    onAsync() {
+      Atomics.add(header3, SAB_I_ASYNC, 1);
+      Atomics.notify(header3, SAB_I_ASYNC);
+    }
+  };
+}
+function publishStops(process, header3) {
+  process.onState((state) => {
+    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
+    Atomics.notify(header3, SAB_I_STOP);
+  });
+}
+function transferOf(opts, lane) {
+  const transfer = opts.fork ? [opts.fork.memory.buffer] : [];
+  return lane ? [...transfer, lane.port] : transfer;
+}
+function openLane(token, dispatch2) {
+  const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
+  const { port1, port2 } = new MessageChannel();
+  const responder = attachSyncSabResponder(port1, sab, token, { dispatch: dispatch2 });
+  port1.start();
+  return {
+    lane: { sab, port: port2 },
+    dispose() {
+      responder.dispose();
+      port1.close();
+    }
+  };
+}
+function processInit(opts, sab, umask, lane) {
   const base = {
     type: WASM_PROCESS_INIT,
     pid: opts.shownPid ?? opts.pid,
@@ -8547,7 +9249,12 @@ function processInit(opts, sab, umask) {
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {}
   };
   if (opts.program.abi === "js") {
-    return { ...base, program: opts.program, fds: inheritedFds(opts.fds) };
+    return {
+      ...base,
+      program: opts.program,
+      fds: inheritedFds(opts.fds),
+      lane
+    };
   }
   return {
     ...base,
@@ -8561,6 +9268,19 @@ function inherited(opts) {
     ...opts.umask !== void 0 ? { umask: opts.umask } : {}
   };
 }
+function holdingToken(opts, holds) {
+  return mintSyncFsToken({
+    fs: opts.fs,
+    cwd: opts.cwd,
+    ...opts.statfs ? { statfs: opts.statfs } : {},
+    hold: (path, on, open, real) => holds.hold(path, on, open, real),
+    unlinked: (path) => holds.keptAt(path),
+    gate: (path, op) => opts.unlinkGate && holds.holding(path) ? opts.unlinkGate.run(holds.keyOf(path), op) : op(),
+    own: (path, op) => holds.own(path, op),
+    revoked: (path) => holds.isRevoked(path),
+    renamed: (from, to) => holds.renamed(from, to)
+  });
+}
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
@@ -8586,37 +9306,22 @@ function spawnWasmProcess(opts) {
     locks: opts.locks,
     onReap: opts.onReap,
     resolver: opts.resolver,
-    onPending: (sig) => {
-      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
-      Atomics.notify(header3, SAB_I_SIGNALS);
-    },
-    onAsync: () => {
-      Atomics.add(header3, SAB_I_ASYNC, 1);
-      Atomics.notify(header3, SAB_I_ASYNC);
-    },
+    ...notifiers(header3),
     onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header3, SAB_I_SIGNALS) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
     raise: (sig) => signal(sig),
     ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header3, SAB_I_SIGNALS) } : {}
   });
-  process.onState((state) => {
-    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
-    Atomics.notify(header3, SAB_I_STOP);
-  });
+  publishStops(process, header3);
   const holds = new HeldPaths();
   opts.held?.add(holds);
-  const token = mintSyncFsToken({
-    fs: opts.fs,
-    cwd: opts.cwd,
-    ...opts.statfs ? { statfs: opts.statfs } : {},
-    hold: (path, on) => holds.hold(path, on),
-    revoked: (path) => holds.isRevoked(path),
-    renamed: (from, to) => holds.renamed(from, to)
-  });
+  const token = holdingToken(opts, holds);
+  process.keptPath = (path) => holds.keptAt(path)?.hidden;
   const worker = opts.createWorker();
   const dying = new Dying();
   const dispatch2 = (req) => dying.serving(() => isWasmSyscall(req) ? process.syscall(req) : dispatchSyncFs(req));
   const responder = attachSyncSabResponder(worker, sab, token, { dispatch: dispatch2 });
+  const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
   const { promise: exited, resolve: settle } = Promise.withResolvers();
   let done4 = false;
   let endedBy;
@@ -8629,6 +9334,7 @@ function spawnWasmProcess(opts) {
     worker.removeEventListener("error", onError);
     for (const tid of [...threads.keys()]) endThread(tid);
     responder.dispose();
+    lane?.dispose();
     revokeSyncFsToken(token);
     opts.held?.delete(holds);
     worker.terminate();
@@ -8699,8 +9405,10 @@ function spawnWasmProcess(opts) {
     };
     tw.postMessage(tinit);
   };
-  const init = processInit(opts, sab, process.umask);
-  worker.postMessage(init, opts.fork ? [opts.fork.memory.buffer] : []);
+  worker.postMessage(
+    processInit(opts, sab, process.umask, lane?.lane),
+    transferOf(opts, lane?.lane)
+  );
   const signal = (sig) => {
     if (process.signal(sig) !== "terminate") return;
     const code = sig === SIG.KILL ? 137 : 128 + sig;
@@ -10261,6 +10969,7 @@ var Launcher = class {
   deciding = /* @__PURE__ */ new Map();
   identities = { asked: 0, timedOut: 0 };
   nodes;
+  unlinked;
   held = new HeldSet((path) => this.released(path));
   processMounts;
   booting = new AbortController();
@@ -10305,7 +11014,15 @@ var Launcher = class {
     const fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.openFiles.add(this.nodes);
-    this.fs = keepingOpen(fs, this.nodes);
+    this.unlinked = new UnlinkedKeeper(
+      fs,
+      this.held,
+      (path) => this.mountRoot(path),
+      webLocks(),
+      (path) => [...this.openFiles].some((nodes) => nodes.holds(path))
+    );
+    this.fs = keepingOpen(this.unlinked.wrap(), this.nodes);
+    void this.unlinked.sweep("/");
     this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
       this.catalog = void 0;
       this.binfmts = void 0;
@@ -10515,6 +11232,7 @@ var Launcher = class {
       openFiles: this.openFiles,
       nodes: this.nodes,
       held: this.held,
+      unlinkGate: this.unlinked.gate,
       statfs: (path) => this.mounts.statfs(path),
       mounts: () => this.mounts.list(),
       mount: (call, signal) => this.processMount(pid, call, signal),
@@ -10672,6 +11390,7 @@ var Launcher = class {
   }
   released(path) {
     const at = normalizePath(path);
+    this.unlinked.closed(at);
     const open = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
     if (!open) void this.mounts.commit(at).catch(() => void 0);
   }
@@ -10767,10 +11486,23 @@ var Launcher = class {
       }
     };
   }
-  mount(spec) {
-    if (spec.type !== "fsa" || spec.source.startsWith("fsa:"))
-      return this.mounts.mount(spec, this.fs);
-    return this.mounts.mount({ ...spec, source: `fsa:${crypto.randomUUID()}` }, this.fs);
+  async mount(spec) {
+    const fsa = spec.type === "fsa" && !spec.source.startsWith("fsa:");
+    const entry = await this.mounts.mount(
+      fsa ? { ...spec, source: `fsa:${crypto.randomUUID()}` } : spec,
+      this.fs
+    );
+    void this.unlinked.sweep(entry.target);
+    return entry;
+  }
+  mountRoot(path) {
+    let root = "/";
+    for (const { target } of this.mounts.list()) {
+      if (target.length > root.length && (path === target || path.startsWith(`${target}/`))) {
+        root = target;
+      }
+    }
+    return root;
   }
   async insert(target, handle, source) {
     const at = normalizePath(target);
@@ -10784,6 +11516,7 @@ var Launcher = class {
     await this.media.put(slot.id, handle);
     slot.medium.insert(handle);
     slot.served.invalidate(true);
+    void this.unlinked.sweep(at);
   }
   umount(target, detach = false) {
     const at = normalizePath(target);
@@ -11153,12 +11886,15 @@ var RemoteTransport = class {
   port;
   waiting = /* @__PURE__ */ new Map();
   nextId = 0;
+  sockets = /* @__PURE__ */ new Map();
   failure;
   constructor(port, traits) {
     this.port = port;
     this.traits = traits;
   }
   receive(reply) {
+    const socket = this.sockets.get(reply.nid);
+    if (socket && this.toSocket(reply, socket)) return;
     const waiter = this.waiting.get(reply.nid);
     if (!waiter) return;
     this.waiting.delete(reply.nid);
@@ -11166,10 +11902,22 @@ var RemoteTransport = class {
       waiter.reject(new TransportError(reply.message, reply.status, reply.code));
     } else waiter.resolve(reply);
   }
+  toSocket(reply, socket) {
+    if (reply.net === "ws-message") socket.queue.push(reply.data);
+    else if (reply.net === "ws-acked") socket.acked(reply.n);
+    else if (reply.net === "ws-closed") {
+      this.sockets.delete(reply.nid);
+      socket.queue.end({ code: reply.code, reason: reply.reason });
+    } else return false;
+    return true;
+  }
   fail(error) {
     this.failure = error;
     for (const waiter of this.waiting.values()) waiter.reject(error);
     this.waiting.clear();
+    for (const socket of this.sockets.values())
+      socket.queue.end({ code: 1011, reason: error.message });
+    this.sockets.clear();
   }
   ask(call) {
     if (this.failure) return Promise.reject(this.failure);
@@ -11248,6 +11996,46 @@ var RemoteTransport = class {
       }
     };
   }
+  async websocket(request) {
+    const nid = ++this.nextId;
+    const { signal } = request;
+    signal.throwIfAborted();
+    const abort = () => this.cancel(nid);
+    signal.addEventListener("abort", abort, { once: true });
+    let opened2;
+    try {
+      opened2 = await this.ask({
+        net: "ws-open",
+        nid,
+        url: request.url,
+        protocols: request.protocols,
+        headers: request.headers
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
+    const queue = new MessageQueue(
+      () => close(1e3, "a message is too big"),
+      Number.POSITIVE_INFINITY,
+      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
+    );
+    let unacked = 0;
+    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
+    return {
+      protocol: opened2.protocol,
+      get buffered() {
+        return unacked;
+      },
+      send: (data) => {
+        unacked += payloadSize(data);
+        this.port.postMessage({ net: "ws-send", nid, data });
+      },
+      messages: queue,
+      close,
+      closed: queue.closed
+    };
+  }
 };
 
 // src/serve.ts
@@ -11869,7 +12657,7 @@ function hostfsFetchOf(options) {
   };
 }
 function nodeTransport() {
-  const transport = fetchTransport();
+  const transport = fetchTransport({ webSocket: true, webSocketHeaders: true });
   return { ...transport, traits: { ...transport.traits, crossOrigin: "any" } };
 }
 var TERMINATED = "the kernel is terminated";