@ai-ecoverse/slicc-kernel 1.43.1 → 1.45.0

package/dist/kernel-worker.js

@@ -873,8 +873,8 @@ var MEDIA_STORE = "handles";
 function memoryMedia() {
   const handles = /* @__PURE__ */ new Map();
   return {
-    get: async (id) => handles.get(id),
-    put: async (id, handle) => void handles.set(id, handle)
+    get: async (id2) => handles.get(id2),
+    put: async (id2, handle) => void handles.set(id2, handle)
   };
 }
 function settle2(request2, value) {
@@ -890,11 +890,11 @@ function openMedia(name2, factory) {
     const db = request2.result;
     const store = (mode) => db.transaction(MEDIA_STORE, mode).objectStore(MEDIA_STORE);
     return {
-      get: (id) => {
-        const got = store("readonly").get(id);
+      get: (id2) => {
+        const got = store("readonly").get(id2);
         return settle2(got, () => got.result);
       },
-      put: (id, handle) => settle2(store("readwrite").put(handle, id), () => void 0)
+      put: (id2, handle) => settle2(store("readwrite").put(handle, id2), () => void 0)
     };
   });
 }
@@ -959,7 +959,7 @@ function portCdpHook(ask, gone) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 7];
+var PROTOCOL = [1, 8];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -1920,8 +1920,8 @@ function serveSocket(socket, port, onClose) {
   let writes = Promise.resolve();
   let credit = 0;
   let granted2;
-  const send = (message2, transfer) => {
-    if (!closed) port.postMessage(message2, transfer);
+  const send = (message3, transfer) => {
+    if (!closed) port.postMessage(message3, transfer);
   };
   const close = (reset = false) => {
     if (closed) return;
@@ -2036,8 +2036,8 @@ var BODY_IDLE_MS = 5 * 60 * 1e3;
 var INBOUND_LIMIT = 16 * 1024 * 1024;
 var MESSAGE_LIMIT = 64 * 1024 * 1024;
 var TOO_BIG = 1009;
-function payloadSize(message2) {
-  return typeof message2 === "string" ? new TextEncoder().encode(message2).length : message2.length;
+function payloadSize(message3) {
+  return typeof message3 === "string" ? new TextEncoder().encode(message3).length : message3.length;
 }
 var MessageQueue = class {
   items = [];
@@ -2057,9 +2057,9 @@ var MessageQueue = class {
       this.settle = resolve;
     });
   }
-  push(message2) {
+  push(message3) {
     if (this.ended) return;
-    const size = payloadSize(message2);
+    const size = payloadSize(message3);
     const huge = size > MESSAGE_LIMIT;
     if (huge || this.items.length > 0 && this.size + size > this.limit) {
       const reason = huge ? `a message is over ${MESSAGE_LIMIT} bytes` : `over ${this.limit} bytes of messages are waiting`;
@@ -2068,7 +2068,7 @@ var MessageQueue = class {
       return;
     }
     this.size += size;
-    this.items.push(message2);
+    this.items.push(message3);
     this.wake();
   }
   end(close) {
@@ -2107,7 +2107,7 @@ var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport ne
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
 function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const open = /* @__PURE__ */ new Map();
-  const fail = (nid, e) => {
+  const fail2 = (nid, e) => {
     open.delete(nid);
     const { status, code } = e;
     peer.postMessage({
@@ -2143,7 +2143,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         headers: response.headers
       });
     } catch (e) {
-      fail(call.nid, e);
+      fail2(call.nid, e);
     }
   };
   const sockets = /* @__PURE__ */ new Map();
@@ -2177,7 +2177,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
       peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
       void relay(call.nid, socket);
     } catch (e) {
-      fail(call.nid, e);
+      fail2(call.nid, e);
     }
   };
   const relay = async (nid, socket) => {
@@ -2249,7 +2249,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         peer.postMessage({ net: "chunk", nid, bytes }, [bytes.buffer]);
       }
     } catch (e) {
-      fail(nid, e);
+      fail2(nid, e);
     }
   };
   const drop = (nid) => {
@@ -2278,6 +2278,287 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   };
 }
 
+// src/kernel/cred.ts
+var ROOT = Object.freeze({
+  ruid: 0,
+  euid: 0,
+  suid: 0,
+  rgid: 0,
+  egid: 0,
+  sgid: 0,
+  groups: [0]
+});
+var MAX_ID = 4294967294;
+var MAX_GROUPS = 65536;
+var UIDS = ["ruid", "euid", "suid"];
+var GIDS = ["rgid", "egid", "sgid"];
+function userCred(uid, gid, groups = [gid]) {
+  return { ruid: uid, euid: uid, suid: uid, rgid: gid, egid: gid, sgid: gid, groups: [...groups] };
+}
+function copyCred(cred) {
+  return { ...cred, groups: [...cred.groups] };
+}
+function id(value) {
+  if (value === void 0 || value === -1 || value === 4294967295) return void 0;
+  if (!Number.isInteger(value) || value < 0 || value > MAX_ID) {
+    throw fsError("EINVAL", `not a user or group id: ${String(value)}`);
+  }
+  return value;
+}
+function changeCred(cur, change) {
+  const privileged = cur.euid === 0;
+  const next2 = copyCred(cur);
+  for (const keys of [UIDS, GIDS]) {
+    const own = keys.map((key) => cur[key]);
+    for (const key of keys) {
+      const value = id(change[key]);
+      if (value === void 0) continue;
+      if (!privileged && !own.includes(value)) throw fsError("EPERM", `${key} ${value}`);
+      next2[key] = value;
+    }
+  }
+  if (change.groups !== void 0) {
+    if (!Array.isArray(change.groups) || change.groups.length > MAX_GROUPS) {
+      throw fsError("EINVAL", "not a group list");
+    }
+    const groups = change.groups.map((g) => id(g) ?? Number.NaN);
+    if (groups.some(Number.isNaN)) throw fsError("EINVAL", "not a group list");
+    if (!privileged) throw fsError("EPERM", "setgroups");
+    next2.groups = groups;
+  }
+  return next2;
+}
+function maySignal(sender, target) {
+  if (sender.euid === 0) return true;
+  return [sender.ruid, sender.euid].some((uid) => uid === target.ruid || uid === target.suid);
+}
+function maySee(viewer, target) {
+  return viewer.euid === 0 || target.ruid === viewer.euid || target.euid === viewer.euid;
+}
+
+// src/users.ts
+var PASSWD = "/etc/passwd";
+var GROUP = "/etc/group";
+var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
+var DEFAULT_GROUP = "root:x:0:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
+var NAME = /^[a-z_][a-z0-9_.-]*$/;
+var MAX_NAME = 255;
+var FIRST_UID = 1e3;
+var LAST_UID = 6e4;
+var USERS_GROUP = "users";
+var HOME_DIR = /^\/home\/[^/]+$/;
+var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
+var isId = (text) => text !== void 0 && /^\d+$/.test(text);
+function lines(text) {
+  return text.split("\n").filter((line, i, all) => line !== "" || i < all.length - 1);
+}
+function parsePasswd(text) {
+  return lines(text).map((line) => {
+    const [name2, , uid, gid, gecos = "", home = "/", shell = "/bin/sh"] = line.split(":");
+    if (!name2 || !isId(uid) || !isId(gid)) return line;
+    return { name: name2, uid: Number(uid), gid: Number(gid), gecos, home, shell };
+  });
+}
+function parseGroup(text) {
+  return lines(text).map((line) => {
+    const [name2, , gid, members = ""] = line.split(":");
+    if (!name2 || !isId(gid)) return line;
+    return { name: name2, gid: Number(gid), members: members.split(",").filter(Boolean) };
+  });
+}
+function formatPasswd(rows) {
+  const line = (r) => `${r.name}:x:${r.uid}:${r.gid}:${r.gecos}:${r.home}:${r.shell}`;
+  return `${rows.map((r) => typeof r === "string" ? r : line(r)).join("\n")}
+`;
+}
+function formatGroup(rows) {
+  const line = (r) => `${r.name}:x:${r.gid}:${r.members.join(",")}`;
+  return `${rows.map((r) => typeof r === "string" ? r : line(r)).join("\n")}
+`;
+}
+var parsed = (rows) => rows.filter((r) => typeof r !== "string");
+function homeOf(home) {
+  if (typeof home !== "string" || !home.startsWith("/") || /[:\r\n]/.test(home)) {
+    throw fsError("EINVAL", `not a home directory: ${String(home)}`);
+  }
+  return home;
+}
+function freeId(users, groups) {
+  const taken = /* @__PURE__ */ new Set([...users.map((r) => r.uid), ...groups.map((r) => r.gid)]);
+  let uid = FIRST_UID;
+  while (taken.has(uid)) uid++;
+  if (uid > LAST_UID) throw fsError("ENOSPC", "no free user id");
+  return uid;
+}
+function credOf(account) {
+  return userCred(account.uid, account.gid, account.groups);
+}
+function pnpmHomeOf(account, system = SYSTEM_PNPM_HOME) {
+  return account.uid === 0 ? system : `${account.home}/.local/share/pnpm`;
+}
+function userEnv(account, system) {
+  const pnpm = pnpmHomeOf(account, system);
+  return {
+    HOME: account.home,
+    USER: account.name,
+    LOGNAME: account.name,
+    PNPM_HOME: pnpm,
+    PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
+  };
+}
+var UserDb = class {
+  fs;
+  umasks = /* @__PURE__ */ new Map();
+  writing = Promise.resolve();
+  constructor(fs) {
+    this.fs = fs;
+  }
+  async read(path, fallback) {
+    try {
+      return await this.fs.readFile(path);
+    } catch (err) {
+      if (err?.code === "ENOENT") return fallback;
+      throw err;
+    }
+  }
+  async tables() {
+    return {
+      passwd: parsePasswd(await this.read(PASSWD, DEFAULT_PASSWD)),
+      group: parseGroup(await this.read(GROUP, DEFAULT_GROUP))
+    };
+  }
+  async commit(passwd, group, then) {
+    const before = [await this.read(PASSWD, DEFAULT_PASSWD), await this.read(GROUP, DEFAULT_GROUP)];
+    try {
+      await this.fs.writeFile(GROUP, group);
+      await this.fs.writeFile(PASSWD, passwd);
+      await then?.();
+    } catch (err) {
+      await this.fs.writeFile(GROUP, before[1]);
+      await this.fs.writeFile(PASSWD, before[0]);
+      throw err;
+    }
+  }
+  serial(work) {
+    const next2 = this.writing.then(work);
+    this.writing = next2.catch(() => void 0);
+    return next2;
+  }
+  async ensure() {
+    await this.fs.mkdir("/etc", { recursive: true });
+    for (const [path, text] of [
+      [PASSWD, DEFAULT_PASSWD],
+      [GROUP, DEFAULT_GROUP]
+    ]) {
+      if (!await this.fs.exists(path)) await this.fs.writeFile(path, text);
+    }
+    if (!await this.fs.exists("/root")) {
+      await this.fs.mkdir("/root", { recursive: true });
+      try {
+        await this.fs.chmod("/root", 448);
+      } catch (err) {
+        await this.fs.rm("/root", { recursive: true, force: true });
+        throw err;
+      }
+    }
+  }
+  account(row, groups) {
+    const extra = groups.filter((g) => g.members.includes(row.name) && g.gid !== row.gid);
+    const umask = this.umasks.get(row.name);
+    return {
+      name: row.name,
+      uid: row.uid,
+      gid: row.gid,
+      home: row.home,
+      shell: row.shell,
+      groups: [row.gid, ...extra.map((g) => g.gid)],
+      ...umask !== void 0 ? { umask } : {}
+    };
+  }
+  async lookup(user) {
+    const { passwd, group } = await this.tables();
+    const key = typeof user === "number" ? "uid" : "name";
+    const row = parsed(passwd).find((r) => r[key] === user);
+    return row && this.account(row, parsed(group));
+  }
+  async list() {
+    const { passwd, group } = await this.tables();
+    const groups = parsed(group);
+    return parsed(passwd).map((row) => this.account(row, groups));
+  }
+  add(options) {
+    return this.serial(async () => {
+      const { name: name2 } = options;
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME.test(name2)) {
+        throw fsError("EINVAL", `not a user name: ${String(name2)}`);
+      }
+      const remember = () => {
+        if (options.umask !== void 0) this.umasks.set(name2, options.umask & 511);
+      };
+      const { passwd, group } = await this.tables();
+      const users = parsed(passwd);
+      const groups = parsed(group);
+      const found = users.find((r) => r.name === name2);
+      if (found) {
+        remember();
+        return this.account(found, groups);
+      }
+      const home = homeOf(options.home ?? `/home/${name2}`);
+      const extra = [USERS_GROUP, ...options.groups ?? []].map((g) => {
+        const row2 = groups.find((r) => r.name === g);
+        if (!row2) throw fsError("ENOENT", `no group ${g}`);
+        return row2;
+      });
+      if (groups.some((r) => r.name === name2)) throw fsError("EEXIST", `group ${name2} exists`);
+      const uid = freeId(users, groups);
+      const row = { name: name2, uid, gid: uid, gecos: name2, home, shell: "/bin/bash" };
+      for (const g of extra) if (!g.members.includes(name2)) g.members.push(name2);
+      group.push({ name: name2, gid: uid, members: [] });
+      passwd.push(row);
+      const fresh = !await this.fs.exists(home);
+      await this.fs.mkdir(home, { recursive: true });
+      try {
+        await this.fs.mkdir("/etc", { recursive: true });
+        await this.commit(formatPasswd(passwd), formatGroup(group));
+      } catch (err) {
+        if (fresh) await this.fs.rm(home, { recursive: true, force: true });
+        throw err;
+      }
+      remember();
+      return this.account(row, parsed(group));
+    });
+  }
+  remove(name2, options = {}) {
+    return this.serial(async () => {
+      const { passwd, group } = await this.tables();
+      const row = parsed(passwd).find((r) => r.name === name2);
+      if (!row) return false;
+      if (row.uid < FIRST_UID || row.uid > LAST_UID) {
+        throw fsError("EPERM", `${name2} is a system account`);
+      }
+      const keptGroups = group.filter(
+        (r) => typeof r === "string" || !(r.name === name2 && r.gid === row.gid)
+      );
+      for (const r of parsed(keptGroups)) r.members = r.members.filter((m) => m !== name2);
+      const home = this.fs.resolvePath("/", row.home);
+      const shared = parsed(passwd).some(
+        (r) => r !== row && this.fs.resolvePath("/", r.home) === home
+      );
+      const removeHome = !options.keepHome && !shared && HOME_DIR.test(home) && await this.fs.exists(home);
+      const staged = `/home/.${name2}.removed-${Date.now()}`;
+      await this.commit(
+        formatPasswd(passwd.filter((r) => r !== row)),
+        formatGroup(keptGroups),
+        removeHome ? () => this.fs.rename(home, staged) : void 0
+      );
+      this.umasks.delete(name2);
+      if (removeHome)
+        await this.fs.rm(staged, { recursive: true, force: true }).catch(() => void 0);
+      return true;
+    });
+  }
+};
+
 // src/client/serve-client.ts
 var MAX_LINKS2 = 40;
 function act(session, req, signal) {
@@ -2355,6 +2636,39 @@ function dialFor(l, req, open) {
   );
   return { result: port2, transfer: [port2] };
 }
+async function accountOf(l, user) {
+  const found = await l.users.lookup(user);
+  if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
+  return found;
+}
+async function runAs(l, self, requested) {
+  if (requested === void 0) return self;
+  const target = await accountOf(l, requested);
+  if (self.uid !== 0 && target.uid !== self.uid) {
+    throw fsError("EPERM", `${self.name} may not run as ${target.name}`);
+  }
+  return target;
+}
+function processes(l, self) {
+  const viewer = credOf(self);
+  return l.list(viewer).map(({ tid: _, cred = viewer, umask: _umask, ...entry }) => ({
+    ...entry,
+    uid: cred.euid,
+    gid: cred.egid
+  }));
+}
+function killAs(l, host, self, req) {
+  if (!l.kill(req.pid, signalOf(host)(req.signal), credOf(self))) {
+    throw fsError("ESRCH", `pid ${req.pid}`);
+  }
+  return { result: true };
+}
+function terminalAction(terminals, req, host) {
+  const session = terminals.get(req.terminal);
+  if (!session) throw new Error(`no terminal ${req.terminal}`);
+  act(session, req, signalOf(host));
+  return { result: true };
+}
 function killGroups(host, pgids) {
   if (pgids.length === 0) return;
   void host.launcher().then((launcher) => {
@@ -2368,9 +2682,9 @@ function joinable(l, pgid, ours) {
 }
 function cdpRegistry(send, gone) {
   const registered = /* @__PURE__ */ new Map();
-  const drop = (id) => {
-    registered.get(id)?.();
-    return registered.delete(id);
+  const drop = (id2) => {
+    registered.get(id2)?.();
+    return registered.delete(id2);
   };
   return {
     serve(l, req) {
@@ -2385,7 +2699,7 @@ function cdpRegistry(send, gone) {
     },
     drop,
     close: () => {
-      for (const id of [...registered.keys()]) drop(id);
+      for (const id2 of [...registered.keys()]) drop(id2);
     }
   };
 }
@@ -2405,16 +2719,17 @@ function watchOp(l, req, watches, send) {
 }
 function serveClient(port, host) {
   let state = "new";
+  let self;
   const terminals = /* @__PURE__ */ new Map();
   const groups = /* @__PURE__ */ new Set();
   const sessions = /* @__PURE__ */ new Set();
   const watches = /* @__PURE__ */ new Map();
   let net;
   const ended = Promise.withResolvers();
-  const send = (message2, transfer = []) => {
-    if (state !== "closed") port.postMessage(message2, transfer);
+  const send = (message3, transfer = []) => {
+    if (state !== "closed") port.postMessage(message3, transfer);
   };
-  const reply = (id, body, transfer) => send({ id, ...body }, transfer);
+  const reply = (id2, body, transfer) => send({ id: id2, ...body }, transfer);
   const cdps = cdpRegistry(send, ended.promise);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
@@ -2431,18 +2746,19 @@ function serveClient(port, host) {
     port.close?.();
     ended.resolve();
   }
-  async function hello(message2) {
-    const refused = versionError(message2.protocol);
+  async function hello(message3) {
+    const refused = versionError(message3.protocol);
     if (refused) {
       send({ hello: { protocol: PROTOCOL, error: refused } });
       detach();
       return;
     }
     const launcher = await host.launcher();
+    if (host.scope !== "transport") self = await accountOf(launcher, host.user ?? 0);
     const transport = host.transport?.() ?? launcher.transport;
     net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
     state = "open";
-    if (message2.lock && host.locks) void host.locks.request(message2.lock, () => detach());
+    if (message3.lock && host.locks) void host.locks.request(message3.lock, () => detach());
     send({
       hello: {
         protocol: PROTOCOL,
@@ -2454,6 +2770,7 @@ function serveClient(port, host) {
   async function terminal(req, l) {
     const session = await l.openTerminal(req.argv, {
       ...req.options,
+      user: await runAs(l, self, req.options.user),
       onData: (bytes) => reply(req.id, { fd: 1, bytes: bytes.slice() })
     });
     if (state === "closed") {
@@ -2475,6 +2792,7 @@ function serveClient(port, host) {
     let leader;
     const result = await l.run(req.argv, {
       ...req.options,
+      user: await runAs(l, self, req.options.user),
       collect: false,
       onStdout: out(1),
       onStderr: out(2),
@@ -2500,19 +2818,12 @@ function serveClient(port, host) {
         return spawn(req, l);
       case "open-terminal":
         return terminal(req, l);
-      case "terminal": {
-        const session = terminals.get(req.terminal);
-        if (!session) throw new Error(`no terminal ${req.terminal}`);
-        act(session, req, signalOf(host));
-        return { result: true };
-      }
+      case "terminal":
+        return terminalAction(terminals, req, host);
       case "kill":
-        if (!l.kill(req.pid, signalOf(host)(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
-        return { result: true };
+        return killAs(l, host, self, req);
       case "ps":
-        return {
-          result: l.list().map(({ tid: _, ...entry }) => entry)
-        };
+        return { result: processes(l, self) };
       case "fs":
         if (!FS_METHODS.includes(req.method)) {
           throw new Error(`unknown file system call ${req.method}`);
@@ -2607,8 +2918,8 @@ function ownNames(hostname) {
 // src/kernel/net/http1.ts
 var HttpError = class extends Error {
   status;
-  constructor(status, message2) {
-    super(message2);
+  constructor(status, message3) {
+    super(message3);
     this.status = status;
   }
 };
@@ -2732,21 +3043,21 @@ function latin1Bytes(text) {
   return out;
 }
 function parseRequestHead(bytes) {
-  const lines = latin1(bytes).split(/\r?\n/);
-  while (lines.length > 0 && lines[0] === "") lines.shift();
-  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines.shift() ?? "");
+  const lines2 = latin1(bytes).split(/\r?\n/);
+  while (lines2.length > 0 && lines2[0] === "") lines2.shift();
+  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines2.shift() ?? "");
   if (!match) throw new HttpError(400, "malformed request line");
   if (match[3] !== "1") throw new HttpError(505, `HTTP/${match[3]}.${match[4]} is not supported`);
   return {
     method: match[1],
     target: match[2],
     minor: Number(match[4]),
-    headers: parseFields(lines)
+    headers: parseFields(lines2)
   };
 }
-function parseFields(lines) {
+function parseFields(lines2) {
   const headers = [];
-  for (const line of lines) {
+  for (const line of lines2) {
     if (line === "") continue;
     if (line.startsWith(" ") || line.startsWith("	")) {
       throw new HttpError(400, "obsolete line folding");
@@ -2871,8 +3182,8 @@ var OP = {
 };
 var WsError = class extends Error {
   code;
-  constructor(code, message2) {
-    super(message2);
+  constructor(code, message3) {
+    super(message3);
     this.code = code;
   }
 };
@@ -3238,8 +3549,8 @@ function untilAborted(response, signal) {
     response.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
-function plainResponse(status, message2) {
-  const body = latin1Bytes(`slicc realm proxy: ${message2}
+function plainResponse(status, message3) {
+  const body = latin1Bytes(`slicc realm proxy: ${message3}
 `);
   return {
     status,
@@ -3421,10 +3732,10 @@ var RealmProxy = class {
       return await untilAborted(fetching, signal);
     } catch (e) {
       if (signal.aborted) throw e;
-      const message2 = e instanceof Error ? e.message : String(e);
+      const message3 = e instanceof Error ? e.message : String(e);
       const status = e?.status;
       const own = typeof status === "number" && status >= 400 && status <= 599 ? status : 502;
-      return plainResponse(own, message2 || "upstream request failed");
+      return plainResponse(own, message3 || "upstream request failed");
     }
   }
   async relay(conn, method, minor, response, keepAlive) {
@@ -3661,8 +3972,8 @@ function name(dn) {
   rdns.push(set(seq(oid("2.5.4.3"), utf8(dn.commonName))));
   return seq(...rdns);
 }
-function extension(id, critical, value) {
-  return critical ? seq(oid(id), TRUE, octets(value)) : seq(oid(id), octets(value));
+function extension(id2, critical, value) {
+  return critical ? seq(oid(id2), TRUE, octets(value)) : seq(oid(id2), octets(value));
 }
 function children(der) {
   const out = [];
@@ -3778,9 +4089,9 @@ function pem(der) {
   for (let i = 0; i < der.length; i += 32768) {
     b64 += String.fromCharCode(...der.subarray(i, i + 32768));
   }
-  const lines = btoa(b64).match(/.{1,64}/g) ?? [];
+  const lines2 = btoa(b64).match(/.{1,64}/g) ?? [];
   return `-----BEGIN CERTIFICATE-----
-${lines.join("\n")}
+${lines2.join("\n")}
 -----END CERTIFICATE-----
 `;
 }
@@ -3864,11 +4175,11 @@ var RealmCa = class _RealmCa {
   static async create(owner, now) {
     const pair = await crypto.subtle.generateKey(ECDSA, false, ["sign", "verify"]);
     const spki = new Uint8Array(await crypto.subtle.exportKey("spki", pair.publicKey));
-    const id = Array.from(
+    const id2 = Array.from(
       crypto.getRandomValues(new Uint8Array(4)),
       (b) => b.toString(16).padStart(2, "0")
     ).join("");
-    const name2 = { organization: "SLICC", commonName: `SLICC realm CA ${owner} ${id}` };
+    const name2 = { organization: "SLICC", commonName: `SLICC realm CA ${owner} ${id2}` };
     const notAfter = now + CA_LIFETIME;
     const cert = await certificate({
       serial: randomSerial(),
@@ -3929,8 +4240,8 @@ var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
   code;
-  constructor(code, message2) {
-    super(message2);
+  constructor(code, message3) {
+    super(message3);
     this.code = code;
   }
 };
@@ -4319,8 +4630,8 @@ function enableNetwork(net, options) {
 var TransportError = class extends Error {
   status;
   code;
-  constructor(message2, status, code) {
-    super(message2);
+  constructor(message3, status, code) {
+    super(message3);
     this.status = status;
     this.code = code;
   }
@@ -4517,12 +4828,12 @@ function parsePrefix(text) {
   const parts = text.trim().split("/");
   if (parts.length > 2) return void 0;
   const [address = "", size] = parts;
-  const parsed = addressBits(address);
-  if (!parsed) return void 0;
-  const max = parsed.v6 ? 128 : 32;
+  const parsed2 = addressBits(address);
+  if (!parsed2) return void 0;
+  const max = parsed2.v6 ? 128 : 32;
   const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
   if (length2 < 0 || length2 > max) return void 0;
-  return { ...parsed, length: length2 };
+  return { ...parsed2, length: length2 };
 }
 function within2(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
@@ -4548,10 +4859,10 @@ var Routes = class {
     this.ipv6 = ipv62;
   }
   set(table) {
-    const parsed = (table.prefixes ?? []).map(parsePrefix);
-    const bad = (table.prefixes ?? []).find((_, i) => !parsed[i]);
+    const parsed2 = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed2[i]);
     if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
-    this.table = parsed;
+    this.table = parsed2;
     this.exit = table.exit === true;
   }
   classify(host) {
@@ -4778,11 +5089,11 @@ var CdpFacade = class {
             clearTimeout(timer);
             reject(new HttpError(502, `the CDP host closed: ${reason ?? "no reason"}`));
           };
-          conn.onmessage = (message2) => {
-            const parsed = JSON.parse(message2);
-            if (parsed.id !== 1) return;
+          conn.onmessage = (message3) => {
+            const parsed2 = JSON.parse(message3);
+            if (parsed2.id !== 1) return;
             clearTimeout(timer);
-            resolve(parsed);
+            resolve(parsed2);
           };
           conn.send(JSON.stringify({ id: 1, method: "Target.getTargets" }));
         }
@@ -4847,9 +5158,9 @@ var Relay = class {
         void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve());
       };
     });
-    this.host.onmessage = (message2) => {
+    this.host.onmessage = (message3) => {
       if (this.ended) return;
-      const bytes = new TextEncoder().encode(message2);
+      const bytes = new TextEncoder().encode(message3);
       if (bytes.length > this.max)
         void this.end(CLOSE.tooBig, `a message is over ${this.max} bytes`);
       else void this.send(frame(OP_TEXT, bytes));
@@ -4955,7 +5266,7 @@ function closeAll(entry) {
 }
 
 // src/commands.ts
-var NAME = /^[A-Za-z0-9._+-]+$/;
+var NAME2 = /^[A-Za-z0-9._+-]+$/;
 var ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var PACKAGE = /\$\{package\}/g;
 function inside(pkg, rel2) {
@@ -5044,7 +5355,7 @@ function commandsOf(pkg, manifest) {
   const shared = envOf(pkg, slicc.env);
   const out = [];
   for (const [name2, raw] of Object.entries(entries)) {
-    if (!NAME.test(name2) || name2 === "." || name2 === ".." || !raw || typeof raw !== "object") {
+    if (!NAME2.test(name2) || name2 === "." || name2 === ".." || !raw || typeof raw !== "object") {
       continue;
     }
     const command = commandOf(pkg, name2, raw, packageAbi, shared);
@@ -5128,7 +5439,7 @@ async function scanFilesystems(fs, modules) {
     if (!declared || typeof declared !== "object") continue;
     for (const [type, entry] of Object.entries(declared)) {
       const module = inside(pkg, entry?.module);
-      if (NAME.test(type) && module && !found.has(type)) found.set(type, module);
+      if (NAME2.test(type) && module && !found.has(type)) found.set(type, module);
     }
   }
   return found;
@@ -5148,7 +5459,7 @@ async function scanBinfmts(fs, modules, warn = () => {
     const declared = manifest.slicc?.binfmt;
     if (!declared || typeof declared !== "object") continue;
     for (const [suffix, command] of Object.entries(declared)) {
-      if (!SUFFIX.test(suffix) || typeof command !== "string" || !NAME.test(command)) continue;
+      if (!SUFFIX.test(suffix) || typeof command !== "string" || !NAME2.test(command)) continue;
       const owner = owners.get(suffix);
       if (owner === void 0) {
         found.set(suffix, command);
@@ -5516,9 +5827,9 @@ var UnlinkedKeeper = class {
       if (!names) return;
       const held = query && new Set(((await query()).held ?? []).map((lock) => lock.name));
       for (const name2 of names) {
-        const id = name2.slice(0, name2.lastIndexOf("."));
-        const at = id.indexOf("~");
-        const dead = id !== this.instance && (at < 0 ? held !== void 0 && !held.has(lockName(id)) : owner?.alive(id.slice(0, at)) === false);
+        const id2 = name2.slice(0, name2.lastIndexOf("."));
+        const at = id2.indexOf("~");
+        const dead = id2 !== this.instance && (at < 0 ? held !== void 0 && !held.has(lockName(id2)) : owner?.alive(id2.slice(0, at)) === false);
         if (dead) await this.fs.rm(`${dir}/${name2}`, { recursive: true }).catch(() => void 0);
       }
       await this.tidy(dir);
@@ -5628,10 +5939,10 @@ var SpawnError = class extends Error {
 };
 function interrupted(signal) {
   const { promise, reject } = Promise.withResolvers();
-  const fail = () => reject(new KernelError("EINTR"));
-  if (signal?.aborted) fail();
-  else signal?.addEventListener("abort", fail, { once: true });
-  return { promise, done: () => signal?.removeEventListener("abort", fail) };
+  const fail2 = () => reject(new KernelError("EINTR"));
+  if (signal?.aborted) fail2();
+  else signal?.addEventListener("abort", fail2, { once: true });
+  return { promise, done: () => signal?.removeEventListener("abort", fail2) };
 }
 function stoppedStatus(sig) {
   return (sig & 255) << 8 | 127;
@@ -5822,8 +6133,8 @@ function unref(timer) {
   timer.unref?.();
   return timer;
 }
-function errnoError(code, message2) {
-  return Object.assign(new Error(`${code}: ${message2}`), { code });
+function errnoError(code, message3) {
+  return Object.assign(new Error(`${code}: ${message3}`), { code });
 }
 var DriverConnection = class _DriverConnection {
   capabilities;
@@ -5876,11 +6187,11 @@ var DriverConnection = class _DriverConnection {
   }
   call(call, transfer = []) {
     if (this.failure) return Promise.reject(this.failure);
-    const id = ++this.nextId;
+    const id2 = ++this.nextId;
     return new Promise((resolve, reject) => {
       const timer = unref(
         setTimeout(() => {
-          this.waiting.delete(id);
+          this.waiting.delete(id2);
           const error = errnoError(
             "EIO",
             `the driver did not answer ${call.op} within ${this.timeoutMs} ms`
@@ -5890,8 +6201,8 @@ var DriverConnection = class _DriverConnection {
           this.onFail?.(error);
         }, this.timeoutMs)
       );
-      this.waiting.set(id, { resolve, reject, timer });
-      this.port.postMessage({ ...call, id }, transfer);
+      this.waiting.set(id2, { resolve, reject, timer });
+      this.port.postMessage({ ...call, id: id2 }, transfer);
     });
   }
   fail(error) {
@@ -5966,22 +6277,22 @@ var HeldPaths = class extends Map {
   }
   isKept(path) {
     const ids = this.handlesAt(path);
-    return ids.length === 0 ? this.unlinked.has(path) : ids.every((id) => this.keptHandles.has(id));
+    return ids.length === 0 ? this.unlinked.has(path) : ids.every((id2) => this.keptHandles.has(id2));
   }
   handlesAt(path) {
-    return [...this.handles].filter(([, key]) => key === path).map(([id]) => id);
+    return [...this.handles].filter(([, key]) => key === path).map(([id2]) => id2);
   }
   keptFor(handle) {
     return this.keptHandles.get(handle);
   }
   keep(path, file) {
-    const fresh = this.handlesAt(path).filter((id) => !this.keptHandles.has(id));
-    for (const id of fresh) this.keptHandles.set(id, file);
+    const fresh = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
+    for (const id2 of fresh) this.keptHandles.set(id2, file);
     this.uses.set(file, Math.max(fresh.length, 1));
     this.unlinked.set(path, file);
   }
   unkeep(path, file) {
-    for (const [id, kept] of this.keptHandles) if (kept === file) this.keptHandles.delete(id);
+    for (const [id2, kept] of this.keptHandles) if (kept === file) this.keptHandles.delete(id2);
     this.uses.delete(file);
     if (this.unlinked.get(path) === file) this.unlinked.delete(path);
   }
@@ -6018,7 +6329,7 @@ var HeldPaths = class extends Map {
     if (count > 0) this.opens.set(key, count);
     else {
       this.opens.delete(key);
-      for (const id of this.handlesAt(key)) this.handles.delete(id);
+      for (const id2 of this.handlesAt(key)) this.handles.delete(id2);
       const kept = this.unlinked.get(key);
       if (kept) this.letGo(kept, true);
       for (const [alias, target] of this.aliases) if (target === key) this.aliases.delete(alias);
@@ -6065,8 +6376,8 @@ var HeldPaths = class extends Map {
       this.opens.delete(path);
       this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
     }
-    for (const [id, key] of this.handles) {
-      if (within4(key, from)) this.handles.set(id, to + key.slice(from.length));
+    for (const [id2, key] of this.handles) {
+      if (within4(key, from)) this.handles.set(id2, to + key.slice(from.length));
     }
   }
   isRevoked(path) {
@@ -6805,12 +7116,12 @@ function syncError(code, label) {
 
 // src/realm/sync-fs-dispatch.ts
 function toErrno(err) {
-  const message2 = err instanceof Error ? err.message : String(err);
+  const message3 = err instanceof Error ? err.message : String(err);
   const code = err?.code;
   if (typeof code === "string" && /^E[A-Z]+$/.test(code)) {
-    return { ok: false, errno: code, message: message2 };
+    return { ok: false, errno: code, message: message3 };
   }
-  return { ok: false, errno: "EIO", message: message2 };
+  return { ok: false, errno: "EIO", message: message3 };
 }
 function statJson(s) {
   return {
@@ -7035,15 +7346,15 @@ function attachSyncSabResponder(port, sab, token, opts) {
   const pending = /* @__PURE__ */ new Map();
   let disposed = false;
   const { dispatch: dispatch2 } = opts;
-  function drop(id) {
-    const entry = pending.get(id);
+  function drop(id2) {
+    const entry = pending.get(id2);
     if (!entry) return;
     clearTimeout(entry.timer);
-    pending.delete(id);
+    pending.delete(id2);
   }
-  function publish(id, entry, offset) {
-    if (Atomics.load(header2, SAB_I_REQ) !== id) {
-      drop(id);
+  function publish(id2, entry, offset) {
+    if (Atomics.load(header2, SAB_I_REQ) !== id2) {
+      drop(id2);
       return;
     }
     const chunk2 = Math.min(window.byteLength, entry.payload.byteLength - offset);
@@ -7052,23 +7363,23 @@ function attachSyncSabResponder(port, sab, token, opts) {
     storeU53(header2, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
     Atomics.store(header2, SAB_I_CHUNK, chunk2);
     storeU53(header2, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
-    Atomics.store(header2, SAB_I_SEQ, id);
+    Atomics.store(header2, SAB_I_SEQ, id2);
     Atomics.store(header2, SAB_I_STATE, SAB_STATE_READY);
     Atomics.add(header2, SAB_I_PUB, 1);
     Atomics.notify(header2, SAB_I_PUB);
-    if (offset + chunk2 >= entry.payload.byteLength) drop(id);
+    if (offset + chunk2 >= entry.payload.byteLength) drop(id2);
   }
-  function settle3(id, result) {
+  function settle3(id2, result) {
     if (disposed) return;
     const { status, payload } = encodeSabResult(result);
-    drop(id);
+    drop(id2);
     const entry = {
       status,
       payload,
-      timer: setTimeout(() => drop(id), PENDING_TTL_MS)
+      timer: setTimeout(() => drop(id2), PENDING_TTL_MS)
     };
-    pending.set(id, entry);
-    publish(id, entry, 0);
+    pending.set(id2, entry);
+    publish(id2, entry, 0);
   }
   const handler = (event) => {
     const data = event.data;
@@ -7084,14 +7395,14 @@ function attachSyncSabResponder(port, sab, token, opts) {
       return;
     }
     if (data.type !== SYNC_SAB_REQ_MSG || !data.req || typeof data.req !== "object") return;
-    const id = data.id;
+    const id2 = data.id;
     const body = data.req;
     const req = { ...body, token };
     let dispatched;
     try {
       dispatched = dispatch2(req);
     } catch (err) {
-      settle3(id, {
+      settle3(id2, {
         ok: false,
         errno: "EIO",
         message: err instanceof Error ? err.message : String(err)
@@ -7099,8 +7410,8 @@ function attachSyncSabResponder(port, sab, token, opts) {
       return;
     }
     void dispatched.then(
-      (result) => settle3(id, result),
-      (err) => settle3(id, {
+      (result) => settle3(id2, result),
+      (err) => settle3(id2, {
         ok: false,
         errno: "EIO",
         message: err instanceof Error ? err.message : String(err)
@@ -7113,7 +7424,7 @@ function attachSyncSabResponder(port, sab, token, opts) {
       if (disposed) return;
       disposed = true;
       port.removeEventListener("message", handler);
-      for (const id of [...pending.keys()]) drop(id);
+      for (const id2 of [...pending.keys()]) drop(id2);
     }
   };
 }
@@ -7173,47 +7484,47 @@ var AsyncOps = class {
     this.onReady = onReady;
   }
   submit(req) {
-    const id = this.hold();
+    const id2 = this.hold();
     const running = new AbortController();
-    this.running.set(id, running);
+    this.running.set(id2, running);
     this.run(req, running.signal).then(
-      (result) => this.complete(id, result),
-      (err) => this.complete(id, { ok: false, errno: "EIO", message: String(err) })
+      (result) => this.complete(id2, result),
+      (err) => this.complete(id2, { ok: false, errno: "EIO", message: String(err) })
     );
-    return id;
+    return id2;
   }
   resolve(value) {
-    const id = this.hold();
-    this.complete(id, json3(value));
-    return id;
+    const id2 = this.hold();
+    this.complete(id2, json3(value));
+    return id2;
   }
   hold() {
-    const id = this.next++;
-    this.results.set(id, void 0);
-    return id;
+    const id2 = this.next++;
+    this.results.set(id2, void 0);
+    return id2;
   }
-  take(id) {
-    if (!this.results.has(id)) throw new KernelError("EINVAL");
-    const result = this.results.get(id);
+  take(id2) {
+    if (!this.results.has(id2)) throw new KernelError("EINVAL");
+    const result = this.results.get(id2);
     if (!result) throw new KernelError("EAGAIN");
-    this.forget(id);
+    this.forget(id2);
     return result;
   }
-  cancel(id) {
-    this.running.get(id)?.abort();
-    this.forget(id);
+  cancel(id2) {
+    this.running.get(id2)?.abort();
+    this.forget(id2);
   }
-  forget(id) {
-    this.running.delete(id);
-    this.results.delete(id);
-    const at = this.ready.indexOf(id);
+  forget(id2) {
+    this.running.delete(id2);
+    this.results.delete(id2);
+    const at = this.ready.indexOf(id2);
     if (at >= 0) this.ready.splice(at, 1);
   }
   async wait(timeoutMs, signal) {
     for (; ; ) {
       if (this.closed) return -1;
-      const id = this.ready.shift();
-      if (id !== void 0) return id;
+      const id2 = this.ready.shift();
+      if (id2 !== void 0) return id2;
       if (timeoutMs !== void 0 && timeoutMs <= 0) return 0;
       const woke = await this.sleep(timeoutMs, signal);
       if (!woke) return 0;
@@ -7249,11 +7560,11 @@ var AsyncOps = class {
       }
     });
   }
-  complete(id, result) {
-    this.running.delete(id);
-    if (!this.results.has(id)) return;
-    this.results.set(id, result);
-    this.ready.push(id);
+  complete(id2, result) {
+    this.running.delete(id2);
+    if (!this.results.has(id2)) return;
+    this.results.set(id2, result);
+    this.ready.push(id2);
     this.wake();
     this.onReady?.();
   }
@@ -7291,10 +7602,133 @@ async function hostSyscall(req, ctx) {
   }
 }
 
+// src/kernel/net/ws-syscalls.ts
+var WS_OPS = [
+  "net-ws-open",
+  "net-ws-ready",
+  "net-ws-recv",
+  "net-ws-wait",
+  "net-ws-send",
+  "net-ws-close"
+];
+var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function message(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function fail(errno, text) {
+  return { ok: false, errno, message: text };
+}
+var WsHandles = class {
+  transport;
+  open = /* @__PURE__ */ new Map();
+  next;
+  constructor(transport, next2) {
+    this.transport = transport;
+    this.next = next2;
+  }
+  owns(handle) {
+    return this.open.has(handle);
+  }
+  syscall(req) {
+    if (req.op === "net-ws-open") return Promise.resolve(this.start(req));
+    const entry = this.open.get(req.handle);
+    if (!entry) return Promise.resolve(fail("EBADF", `no websocket ${req.handle}`));
+    if (req.op === "net-ws-ready") return entry.ready;
+    if (!entry.socket) return Promise.resolve(fail("ENOTCONN", "websocket not open"));
+    if (req.op === "net-ws-recv") return this.recv(entry.socket, entry);
+    if (req.op === "net-ws-wait") return this.closed(entry.socket);
+    if (req.op === "net-ws-send") return Promise.resolve(this.send(entry.socket, req, entry));
+    entry.ended = true;
+    entry.socket.close(req.code ?? 1e3, req.reason ?? "");
+    return Promise.resolve({ ok: true, kind: "void" });
+  }
+  start(req) {
+    const handle = this.next();
+    const entry = {
+      abort: new AbortController(),
+      ready: Promise.resolve({ ok: true, kind: "void" })
+    };
+    this.open.set(handle, entry);
+    entry.ready = this.connect(handle, req, entry);
+    return { ok: true, kind: "json", json: handle };
+  }
+  async connect(handle, req, entry) {
+    const { transport } = this;
+    if (!transport.traits.websocket || !transport.websocket) return fail("ENOTSUP", NO_WEBSOCKET2);
+    let socket;
+    try {
+      socket = await transport.websocket({
+        url: req.url,
+        protocols: req.protocols,
+        headers: req.headers,
+        signal: entry.abort.signal
+      });
+    } catch (e) {
+      return fail("ECONNREFUSED", message(e));
+    }
+    if (!this.open.has(handle)) {
+      socket.close(1001, "the program went away");
+      return fail("EBADF", `no websocket ${handle}`);
+    }
+    if (socket.protocol && !(req.protocols.includes(socket.protocol) && TOKEN3.test(socket.protocol))) {
+      socket.close(1002, "subprotocol not offered");
+      return fail("EPROTO", "the far end chose a subprotocol the program did not offer");
+    }
+    entry.socket = socket;
+    void socket.closed.then(() => {
+      entry.ended = true;
+    });
+    entry.messages = socket.messages[Symbol.asyncIterator]();
+    return { ok: true, kind: "json", json: { protocol: socket.protocol } };
+  }
+  async recv(socket, entry) {
+    try {
+      const next2 = await entry.messages.next();
+      if (!next2.done) {
+        return typeof next2.value === "string" ? { ok: true, kind: "json", json: { text: next2.value } } : { ok: true, kind: "bytes", bytes: next2.value };
+      }
+      const closed = await socket.closed;
+      return { ok: true, kind: "json", json: { code: closed.code, reason: closed.reason } };
+    } catch (e) {
+      return fail("ECONNRESET", message(e));
+    }
+  }
+  async closed(socket) {
+    const { code, reason } = await socket.closed;
+    return { ok: true, kind: "json", json: { code, reason } };
+  }
+  send(socket, req, entry) {
+    const data = req.text ?? req.body;
+    if (entry.ended) return fail("EPIPE", "the websocket is closed");
+    try {
+      if (data !== void 0) socket.send(data);
+    } catch (e) {
+      return fail("EPIPE", message(e));
+    }
+    return { ok: true, kind: "json", json: socket.buffered };
+  }
+  close(handle) {
+    const entry = this.open.get(handle);
+    if (!entry) return;
+    this.open.delete(handle);
+    entry.abort.abort();
+    entry.socket?.close(1001, "the program went away");
+  }
+  closeAll() {
+    for (const handle of [...this.open.keys()]) this.close(handle);
+  }
+};
+
 // src/kernel/net/http-syscalls.ts
-var HTTP_OPS = ["net-request", "net-read", "net-close", "net-traits"];
+var HTTP_OPS = [
+  "net-request",
+  "net-read",
+  "net-close",
+  "net-traits",
+  ...WS_OPS
+];
 var EMPTY = new Uint8Array(0);
-function message(e) {
+function message2(e) {
   return e instanceof Error ? e.message : String(e);
 }
 async function* once(bytes) {
@@ -7304,10 +7738,13 @@ var HttpHandles = class {
   transport;
   open = /* @__PURE__ */ new Map();
   nextHandle = 0;
+  ws;
   constructor(transport) {
     this.transport = transport;
+    this.ws = new WsHandles(transport, () => ++this.nextHandle);
   }
   syscall(req) {
+    if (req.op.startsWith("net-ws-")) return this.ws.syscall(req);
     if (req.op === "net-request") return this.request(req);
     if (req.op === "net-read") return this.read(req.handle, req.max);
     if (req.op === "net-traits") return Promise.resolve(this.traits());
@@ -7350,7 +7787,7 @@ var HttpHandles = class {
       };
       return { ok: true, kind: "json", json: head };
     } catch (e) {
-      const text = message(e);
+      const text = message2(e);
       if (text === NO_TRANSPORT) return { ok: false, errno: "ENETUNREACH", message: text };
       const status = e.status;
       if (typeof status !== "number" || status === 502) {
@@ -7384,7 +7821,7 @@ var HttpHandles = class {
       } catch (e) {
         entry.done = true;
         const timedOut = e?.code === "ETIMEDOUT";
-        return { ok: false, errno: timedOut ? "ETIMEDOUT" : "EIO", message: message(e) };
+        return { ok: false, errno: timedOut ? "ETIMEDOUT" : "EIO", message: message2(e) };
       }
     }
     const bytes = entry.left.subarray(0, Math.max(0, max));
@@ -7392,6 +7829,10 @@ var HttpHandles = class {
     return { ok: true, kind: "bytes", bytes };
   }
   async close(handle) {
+    if (this.ws.owns(handle)) {
+      this.ws.close(handle);
+      return { ok: true, kind: "void" };
+    }
     const entry = this.open.get(handle);
     if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
     this.open.delete(handle);
@@ -7400,6 +7841,7 @@ var HttpHandles = class {
     return { ok: true, kind: "void" };
   }
   async closeAll() {
+    this.ws.closeAll();
     await Promise.all([...this.open.keys()].map((handle) => this.close(handle)));
   }
 };
@@ -7432,7 +7874,7 @@ var Resolver = class {
     this.routes = options.routes;
     this.now = options.now ?? Date.now;
     this.timeoutMs = options.timeoutMs ?? RESOLVE_TIMEOUT_MS;
-    this.log = options.log ?? ((message2) => console.warn(message2));
+    this.log = options.log ?? ((message3) => console.warn(message3));
     this.own = ownNames(options.hostname ?? DEFAULT_HOSTNAME);
   }
   async resolve(name2, family, blocking) {
@@ -7449,21 +7891,21 @@ var Resolver = class {
     if (!this.uplink || key === "") return [];
     const asked = this.uplink.traits.ipv6 ? family : 4;
     if (family === 6 && asked !== 6) return [];
-    const id = `${asked}:${key}`;
-    const hit = this.cache.get(id);
+    const id2 = `${asked}:${key}`;
+    const hit = this.cache.get(id2);
     if (hit && hit.expires > this.now()) return hit.addresses;
     const signal = blocking?.();
     if (signal?.aborted) throw new KernelError("EINTR");
-    let lookup = this.pending.get(id);
+    let lookup = this.pending.get(id2);
     if (!lookup) {
       const abort = new AbortController();
-      lookup = { work: this.lookup(key, asked, id, abort.signal), abort, waiters: 0 };
-      this.pending.set(id, lookup);
-      void lookup.work.then(() => this.pending.delete(id));
+      lookup = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
+      this.pending.set(id2, lookup);
+      void lookup.work.then(() => this.pending.delete(id2));
     }
     return waitFor(lookup, signal);
   }
-  async lookup(name2, family, id, abandoned) {
+  async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
     const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
     let answer;
@@ -7480,7 +7922,7 @@ var Resolver = class {
       return [];
     }
     const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
-    if (addresses.length > 0) this.remember(id, addresses, answer.ttl);
+    if (addresses.length > 0) this.remember(id2, addresses, answer.ttl);
     return addresses;
   }
   usable(name2, address, family) {
@@ -7492,11 +7934,11 @@ var Resolver = class {
     this.log(`slicc-kernel: dropped the uplink's answer ${address} for ${name2}: it is ${kind}`);
     return false;
   }
-  remember(id, addresses, ttl) {
+  remember(id2, addresses, ttl) {
     const seconds = Math.min(ttl ?? RESOLVE_TTL_MAX, RESOLVE_TTL_MAX);
     if (seconds <= 0) return;
-    this.cache.delete(id);
-    this.cache.set(id, { addresses, expires: this.now() + seconds * 1e3 });
+    this.cache.delete(id2);
+    this.cache.set(id2, { addresses, expires: this.now() + seconds * 1e3 });
     if (this.cache.size > RESOLVE_CACHE_MAX) {
       this.cache.delete(this.cache.keys().next().value);
     }
@@ -7992,10 +8434,10 @@ function ready(fds, read, write) {
 }
 function interruption(signal) {
   const { promise, reject } = Promise.withResolvers();
-  const fail = () => reject(new KernelError("EINTR"));
-  if (signal.aborted) fail();
-  else signal.addEventListener("abort", fail, { once: true });
-  return { promise, done: () => signal.removeEventListener("abort", fail) };
+  const fail2 = () => reject(new KernelError("EINTR"));
+  if (signal.aborted) fail2();
+  else signal.addEventListener("abort", fail2, { once: true });
+  return { promise, done: () => signal.removeEventListener("abort", fail2) };
 }
 async function selectFds(fds, read, write, timeoutMs, interrupt) {
   const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : Date.now() + timeoutMs;
@@ -8938,6 +9380,8 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-list",
   "proc-alarm",
   "proc-umask",
+  "proc-cred",
+  "proc-setcred",
   "dl-log",
   "fd-renumber",
   "fd-promote",
@@ -8988,6 +9432,7 @@ var WasmProcess = class {
   interrupt = new AbortController();
   dying = false;
   umask = DEFAULT_UMASK;
+  cred;
   execChild;
   killed = false;
   execTermsig;
@@ -9007,6 +9452,7 @@ var WasmProcess = class {
     this.options = options;
     this.inherited = options.ignored ?? 0;
     this.umask = options.umask ?? DEFAULT_UMASK;
+    this.cred = copyCred(options.cred ?? ROOT);
     this.children = new ChildTable(fds, options.spawner, options.forker);
     this.nodes = options.nodes ?? new VfsNodes(options.fs);
     if (!options.nodes) options.openFiles?.add(this.nodes);
@@ -9523,6 +9969,11 @@ var WasmProcess = class {
         return { ok: true, kind: "void" };
       case "proc-umask":
         return { ok: true, kind: "json", json: this.setUmask(req.mask) };
+      case "proc-cred":
+        return { ok: true, kind: "json", json: copyCred(this.cred) };
+      case "proc-setcred":
+        this.cred = changeCred(this.cred, req.change);
+        return { ok: true, kind: "json", json: copyCred(this.cred) };
       case "dl-log":
         if (req.append) this.dlLog.push(req.append);
         return { ok: true, kind: "json", json: this.dlLog.slice(req.from) };
@@ -9617,9 +10068,9 @@ var KILL_GRACE_MS = 2e3;
 var descIds = /* @__PURE__ */ new WeakMap();
 var nextDescId = 1;
 function descId(file) {
-  const id = descIds.get(file) ?? nextDescId++;
-  descIds.set(file, id);
-  return id;
+  const id2 = descIds.get(file) ?? nextDescId++;
+  descIds.set(file, id2);
+  return id2;
 }
 function inheritedFds(fds) {
   return fds.numbers().filter((fd) => fd > 2 && !fds.get(fd).file.held).map((fd) => {
@@ -9736,7 +10187,8 @@ function processInit(opts, sab, umask, lane) {
 function inherited(opts) {
   return {
     ...opts.ignored ? { ignored: opts.ignored } : {},
-    ...opts.umask !== void 0 ? { umask: opts.umask } : {}
+    ...opts.umask !== void 0 ? { umask: opts.umask } : {},
+    ...opts.cred ? { cred: opts.cred } : {}
   };
 }
 function holdingToken(opts, holds) {
@@ -9900,6 +10352,7 @@ function spawnWasmProcess(opts) {
     ignoredSignals: (fork) => process.inheritable(fork),
     signalMasks: () => process.signalMasks(),
     umask: () => process.umask,
+    cred: () => copyCred(process.cred),
     writesBack: () => opts.program.abi === "wasi" && !done4
   };
 }
@@ -9958,6 +10411,9 @@ var JobTable = class {
   pgidOf(pid) {
     return this.members.get(pid)?.pgid;
   }
+  sidOf(pid) {
+    return this.members.get(pid)?.sid;
+  }
   member(pid) {
     const member = this.members.get(pid);
     if (!member) throw new KernelError("ESRCH");
@@ -9966,27 +10422,27 @@ var JobTable = class {
   idOf(pid) {
     return this.members.get(pid)?.shownAs ?? pid;
   }
-  byId(id) {
-    for (const member of this.members.values()) if (member.shownAs === id) return member;
-    return this.member(id);
+  byId(id2) {
+    for (const member of this.members.values()) if (member.shownAs === id2) return member;
+    return this.member(id2);
   }
   setpgid(caller, pid, pgid) {
     const me = this.idOf(caller);
     const target = this.byId(pid || me);
-    const id = this.idOf(target.pid);
-    const group = pgid || id;
+    const id2 = this.idOf(target.pid);
+    const group = pgid || id2;
     if (group < 0) throw new KernelError("EINVAL");
     const self = this.member(caller);
-    if (id !== me) {
+    if (id2 !== me) {
       if (target.ppid === void 0 || this.idOf(target.ppid) !== me) {
         throw new KernelError("ESRCH");
       }
       if (target.execed) throw new KernelError("EACCES");
     }
     if (target.sid !== self.sid) throw new KernelError("EPERM");
-    if (id === target.sid) throw new KernelError("EPERM");
+    if (id2 === target.sid) throw new KernelError("EPERM");
     const exists = [...this.members.values()].some((m) => m.pgid === group && m.sid === target.sid);
-    if (group !== id && !exists) throw new KernelError("EPERM");
+    if (group !== id2 && !exists) throw new KernelError("EPERM");
     target.pgid = group;
   }
   getpgid(caller, pid) {
@@ -9997,12 +10453,12 @@ var JobTable = class {
   }
   setsid(pid) {
     const member = this.member(pid);
-    const id = this.idOf(pid);
-    if (member.pgid === id) throw new KernelError("EPERM");
-    member.sid = id;
-    member.pgid = id;
-    this.terminals.delete(id);
-    return id;
+    const id2 = this.idOf(pid);
+    if (member.pgid === id2) throw new KernelError("EPERM");
+    member.sid = id2;
+    member.pgid = id2;
+    this.terminals.delete(id2);
+    return id2;
   }
   terminalNamed(name2) {
     return this.knownTerminals().find((tty) => tty.name === name2);
@@ -10019,15 +10475,17 @@ var JobTable = class {
   }
   acquireTerminal(pid, tty) {
     const member = this.members.get(pid);
-    const id = this.idOf(pid);
-    if (!member || member.sid !== id || this.terminals.has(id)) return false;
+    const id2 = this.idOf(pid);
+    if (!member || member.sid !== id2 || this.terminals.has(id2)) return false;
     if ([...this.terminals.values()].includes(tty)) return false;
-    this.terminals.set(id, tty);
+    this.terminals.set(id2, tty);
     this.foreground.set(tty, member.pgid);
     return true;
   }
-  killGroup(pgid, sig) {
-    const targets = [...this.members.values()].filter((m) => m.pgid === pgid);
+  killGroup(pgid, sig, may = () => true) {
+    const group = [...this.members.values()].filter((m) => m.pgid === pgid);
+    const targets = group.filter((m) => may(m.pid));
+    if (targets.length === 0 && group.length > 0) throw new KernelError("EPERM");
     const pids = new Set(targets.map((m) => m.pid));
     if (sig !== 0) {
       for (const m of targets)
@@ -10128,8 +10586,8 @@ var SettlingChildren = class {
 };
 
 // src/mount/driver.ts
-function fsError2(code, message2 = code) {
-  return Object.assign(new Error(message2), { code });
+function fsError2(code, message3 = code) {
+  return Object.assign(new Error(message3), { code });
 }
 async function dispatch(h, req) {
   switch (req.op) {
@@ -10179,15 +10637,15 @@ async function dispatch(h, req) {
 }
 function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open = false;
-  const reply = (message2, transfer = []) => port.postMessage(message2, transfer);
-  async function hello(message2) {
-    const refused = driverVersionError(message2.protocol);
+  const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
+  async function hello(message3) {
+    const refused = driverVersionError(message3.protocol);
     if (refused) {
       reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused, errno: "EPROTO" } });
       return;
     }
     try {
-      const refined = await handlers.mount?.(message2.mount);
+      const refined = await handlers.mount?.(message3.mount);
       open = true;
       reply({
         hello: { protocol: DRIVER_PROTOCOL, capabilities: { ...capabilities, ...refined } }
@@ -10489,7 +10947,7 @@ function unescape(field2) {
   );
 }
 function parseFstab(text) {
-  const lines = [];
+  const lines2 = [];
   text.split("\n").forEach((raw, index) => {
     const content = raw.replace(/#.*$/, "").trim();
     if (!content) return;
@@ -10498,12 +10956,12 @@ function parseFstab(text) {
     if (options.split(",").includes("noauto")) return;
     const spec = { source, target, type, options: {} };
     try {
-      lines.push({ line: index + 1, spec: { ...spec, options: parseMountOptions(options) } });
+      lines2.push({ line: index + 1, spec: { ...spec, options: parseMountOptions(options) } });
     } catch (err) {
-      lines.push({ line: index + 1, spec, invalid: err });
+      lines2.push({ line: index + 1, spec, invalid: err });
     }
   });
-  return lines;
+  return lines2;
 }
 function codeOf3(err) {
   const code = err?.code;
@@ -10521,11 +10979,11 @@ function wait(ms, signal) {
     signal.addEventListener("abort", done4, { once: true });
   });
 }
-async function mountFstab(lines, mount, signal, retries = FSTAB_RETRIES, discard = () => {
+async function mountFstab(lines2, mount, signal, retries = FSTAB_RETRIES, discard = () => {
 }, settled = () => {
 }) {
   return Promise.all(
-    lines.map(async (each) => {
+    lines2.map(async (each) => {
       const result = await mountLine(each, mount, signal, retries, discard);
       settled(each, result);
       return result;
@@ -11172,10 +11630,10 @@ function importedMemory(bytes) {
     return { initial, maximum, shared: (flags & 2) !== 0 };
   };
   while (at < bytes.length) {
-    const id = bytes[at++];
+    const id2 = bytes[at++];
     const size = u32();
     const end = at + size;
-    if (id !== 2) {
+    if (id2 !== 2) {
       at = end;
       continue;
     }
@@ -11295,18 +11753,17 @@ function foreignImports(bytes) {
   const r = new Reader(bytes);
   let types = [];
   while (r.at < bytes.length) {
-    const id = r.byte();
+    const id2 = r.byte();
     const end = r.u32() + r.at;
-    if (id === 1) types = readTypes(r);
+    if (id2 === 1) types = readTypes(r);
     if (!types) return void 0;
-    if (id === 2) return readImports(r, types);
+    if (id2 === 2) return readImports(r, types);
     r.at = end;
   }
   return {};
 }
 
 // src/launcher.ts
-var PNPM_HOME = "/home/.local/share/pnpm";
 var COMMAND2 = /^\/(?:usr\/)?bin\/([^/]+)$/;
 var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
 var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
@@ -11406,6 +11863,8 @@ var Launcher = class {
   zombies = /* @__PURE__ */ new Set();
   orphans = /* @__PURE__ */ new Set();
   described = /* @__PURE__ */ new Map();
+  creds = /* @__PURE__ */ new Map();
+  users;
   jobs = new JobTable();
   locks = new LockTable();
   settling = new SettlingChildren((pid) => this.jobs.pgidOf(pid));
@@ -11457,7 +11916,7 @@ var Launcher = class {
     this.hostfs = options;
     this.fstabRetries = options.fstabRetries ?? FSTAB_RETRIES;
     this.processMounts = options.processMounts ?? true;
-    this.pnpmHome = options.env?.PNPM_HOME ?? PNPM_HOME;
+    this.pnpmHome = options.env?.PNPM_HOME ?? SYSTEM_PNPM_HOME;
     this.modulesDir = options.modules ?? "/node_modules";
     this.cdp = new CdpHosts(options.cdp);
     const hostname = options.hostname ?? DEFAULT_HOSTNAME;
@@ -11493,6 +11952,7 @@ var Launcher = class {
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
+    this.users = new UserDb(this.fs);
     void this.unlinked.sweep("/");
     this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
       this.catalog = void 0;
@@ -11508,10 +11968,10 @@ var Launcher = class {
   }
   interpreters() {
     this.binfmts ??= this.roots().then(
-      (roots) => scanBinfmts(this.base, roots, (message2) => {
-        if (this.warned.has(message2)) return;
-        this.warned.add(message2);
-        console.warn(message2);
+      (roots) => scanBinfmts(this.base, roots, (message3) => {
+        if (this.warned.has(message3)) return;
+        this.warned.add(message3);
+        console.warn(message3);
       })
     );
     return this.binfmts;
@@ -11693,6 +12153,7 @@ var Launcher = class {
       },
       ...req.ignored ? { ignored: req.ignored } : {},
       ...req.umask !== void 0 ? { umask: req.umask } : {},
+      cred: req.cred,
       program: req.program,
       argv0: req.argv0,
       args: req.args,
@@ -11704,9 +12165,9 @@ var Launcher = class {
       onError: req.report,
       spawner: this.spawner(pid, req.report),
       forker: this.forker(pid, req),
-      kill: (target, sig) => this.kill(target, sig),
+      kill: (target, sig) => this.kill(target, sig, this.credOf(pid), pid),
       writesBack: (target) => this.processes.get(target)?.writesBack() === true,
-      processes: () => ({ boot: this.boot, processes: this.list() }),
+      processes: () => ({ boot: this.boot, processes: this.list(this.credOf(pid)) }),
       openFiles: this.openFiles,
       nodes: this.nodes,
       held: this.held,
@@ -11726,6 +12187,8 @@ var Launcher = class {
       ...this.shownIds(req)
     });
     this.processes.set(pid, handle);
+    const { cred } = req;
+    this.creds.set(pid, () => handle.cred?.() ?? copyCred(cred));
     if (req.ppid !== void 0) this.settling.started(pid, req.ppid);
     this.jobs.add(pid, req.ppid, (sig) => handle.signal(sig), terminal);
     if (req.exec && req.ppid !== void 0) this.jobs.exec(req.ppid, pid, true);
@@ -11752,12 +12215,13 @@ var Launcher = class {
   forget(pid) {
     this.jobs.remove(pid);
     this.described.delete(pid);
+    this.creds.delete(pid);
   }
   reaped(pid) {
     if (this.zombies.delete(pid)) this.forget(pid);
     else this.orphans.add(pid);
   }
-  list() {
+  list(viewer = ROOT) {
     const members = new Map(this.jobs.list().map((member) => [member.pid, member]));
     const rootOf = (member) => {
       let root = member;
@@ -11775,6 +12239,8 @@ var Launcher = class {
     for (const member of members.values()) {
       const described = this.described.get(member.pid);
       if (member.execed || !described) continue;
+      const cred = this.credOf(member.pid);
+      if (!maySee(viewer, cred)) continue;
       const root = rootOf(member);
       listed.push({
         pid: root.pid,
@@ -11787,6 +12253,7 @@ var Launcher = class {
         state: this.processes.has(member.pid) ? "S" : "Z",
         memory: this.processes.get(member.pid)?.memory() ?? 0,
         umask: this.umaskOf(member.pid),
+        cred,
         ...this.signalMasksOf(member.pid)
       });
     }
@@ -11810,6 +12277,7 @@ var Launcher = class {
         ppid,
         ignored: this.ignoredBy(ppid),
         umask: this.umaskOf(ppid),
+        cred: this.credOf(ppid),
         ...exec
       });
       deciding?.attach();
@@ -11855,7 +12323,8 @@ var Launcher = class {
         ppid,
         fork: state,
         ignored: this.ignoredBy(ppid, true),
-        umask: this.umaskOf(ppid)
+        umask: this.umaskOf(ppid),
+        cred: this.credOf(ppid)
       })
     );
   }
@@ -11867,6 +12336,18 @@ var Launcher = class {
   umaskOf(pid) {
     return this.processes.get(pid)?.umask?.() ?? DEFAULT_UMASK;
   }
+  imageOf(pid) {
+    const members = this.jobs.list();
+    let image = pid;
+    for (; ; ) {
+      const next2 = members.find((m) => m.execParent === image);
+      if (!next2) return image;
+      image = next2.pid;
+    }
+  }
+  credOf(pid) {
+    return this.creds.get(pid)?.() ?? copyCred(ROOT);
+  }
   released(path) {
     const at = normalizePath(path);
     this.unlinked.closed(at);
@@ -11880,10 +12361,13 @@ var Launcher = class {
   ignoredBy(pid, fork = false) {
     return this.processes.get(pid)?.ignoredSignals(fork) ?? 0;
   }
-  kill(pid, sig) {
-    if (pid < 0) return this.jobs.killGroup(-pid, sig);
+  kill(pid, sig, sender, from) {
+    const session = from === void 0 ? void 0 : this.jobs.sidOf(from);
+    const may = (target) => !sender || maySignal(sender, this.credOf(target)) || sig === SIG.CONT && session !== void 0 && this.jobs.sidOf(target) === session || from !== void 0 && this.imageOf(from) === this.imageOf(target);
+    if (pid < 0) return this.jobs.killGroup(-pid, sig, (member) => may(this.imageOf(member)));
     const handle = this.processes.get(pid);
     if (!handle) return false;
+    if (!may(this.imageOf(pid))) throw fsError("EPERM", `pid ${pid}`);
     if (sig !== 0) handle.signal(sig);
     return true;
   }
@@ -11954,9 +12438,9 @@ var Launcher = class {
       ask(handle);
     });
     const served = serveFilesystem(port2, medium.handlers, FSA_CAPABILITIES);
-    const id = source.slice("fsa:".length);
-    this.removable.set(target, { id, medium, served });
-    const stored = this.inserted.get(id) ?? await this.media.get(id);
+    const id2 = source.slice("fsa:".length);
+    this.removable.set(target, { id: id2, medium, served });
+    const stored = this.inserted.get(id2) ?? await this.media.get(id2);
     if (stored && await granted(stored)) medium.insert(stored);
     else ask(stored);
     return {
@@ -12040,15 +12524,16 @@ var Launcher = class {
   }
   async prepare() {
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
+    await this.users.ensure();
     await writeCaFile(this.base, this.ca).catch(() => void 0);
     this.fstab = this.mountFstab();
   }
   async mountFstab() {
     const text = await this.base.readFile(FSTAB_PATH).catch(() => "");
-    const lines = parseFstab(text);
-    for (const { spec } of lines) this.mounts.note(spec, "pending");
+    const lines2 = parseFstab(text);
+    for (const { spec } of lines2) this.mounts.note(spec, "pending");
     return mountFstab(
-      lines,
+      lines2,
       (spec) => this.mount(spec).catch((err) => {
         this.mounts.note(spec, "pending", err?.message ?? String(err));
         throw err;
@@ -12063,14 +12548,19 @@ var Launcher = class {
       }
     );
   }
-  environment(cwd, extra) {
+  environment(cwd, extra, account) {
+    return { ...this.env, ...userEnv(account, this.pnpmHome), PWD: cwd, ...extra };
+  }
+  async account(user) {
+    if (typeof user === "object") return user;
+    const found = await this.users.lookup(user ?? 0);
+    if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
+    return found;
+  }
+  identity(account) {
     return {
-      PATH: `/usr/bin:/bin:${this.pnpmHome}/bin`,
-      HOME: "/home",
-      PNPM_HOME: this.pnpmHome,
-      ...this.env,
-      PWD: cwd,
-      ...extra
+      cred: credOf(account),
+      ...account.umask !== void 0 ? { umask: account.umask } : {}
     };
   }
   async starting(argv, dir) {
@@ -12083,6 +12573,7 @@ var Launcher = class {
     return { cwd, file, planned: await this.plan(file, argv, cwd) };
   }
   async openTerminal(argv, options) {
+    const account = await this.account(options.user);
     const { cwd, file, planned } = await this.starting(argv, options.cwd);
     if (!planned) throw new Error(`${file}: command not found`);
     let leader = 0;
@@ -12098,14 +12589,18 @@ var Launcher = class {
     fds.installAt(0, stdio);
     fds.installAt(1, stdio.retain());
     fds.installAt(2, stdio.retain());
-    const env = this.environment(cwd, {
-      TERM: "xterm-256color",
-      COLORTERM: "truecolor",
-      ...options.env
-    });
-    const report = (message2) => options.onData(encoder3.encode(`${message2}\r
+    const env = this.environment(
+      cwd,
+      {
+        TERM: "xterm-256color",
+        COLORTERM: "truecolor",
+        ...options.env
+      },
+      account
+    );
+    const report = (message3) => options.onData(encoder3.encode(`${message3}\r
 `));
-    const handle = await this.launch(planned, { env, cwd, fds, report });
+    const handle = await this.launch(planned, { env, cwd, fds, report, ...this.identity(account) });
     leader = handle.pid;
     void handle.exited.then(() => tty.hangup());
     return {
@@ -12121,8 +12616,9 @@ var Launcher = class {
     };
   }
   async run(argv, options = {}) {
+    const account = await this.account(options.user);
     const { cwd, file, planned } = await this.starting(argv, options.cwd);
-    const env = this.environment(cwd, options.env);
+    const env = this.environment(cwd, options.env, account);
     const out = [];
     const err = [];
     const keep = options.collect !== false;
@@ -12132,7 +12628,7 @@ var Launcher = class {
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message2) => stderr(encoder3.encode(`${message2}
+    const report = (message3) => stderr(encoder3.encode(`${message3}
 `));
     if (!planned) {
       report(`${file}: command not found`);
@@ -12143,7 +12639,14 @@ var Launcher = class {
     fds.installAt(1, sinkFile(stdout));
     fds.installAt(2, sinkFile(stderr));
     const group = options.pgid !== void 0 ? { pgid: options.pgid } : {};
-    const handle = await this.launch(planned, { env, cwd, fds, report, ...group });
+    const handle = await this.launch(planned, {
+      env,
+      cwd,
+      fds,
+      report,
+      ...group,
+      ...this.identity(account)
+    });
     options.onStarted?.(handle.pid);
     const status = await handle.exited;
     return { status, stdout: concat5(out), stderr: concat5(err) };
@@ -12209,12 +12712,28 @@ function answered(data, remote, uplink) {
   else return false;
   return true;
 }
+var USERS_OPS = /* @__PURE__ */ new Set(["users-add", "users-remove", "users-list"]);
+function isUsersRequest(req) {
+  return USERS_OPS.has(req.op);
+}
+function failure(err) {
+  const code = err?.code;
+  return {
+    error: err instanceof Error ? err.message : String(err),
+    ...typeof code === "string" ? { code } : {}
+  };
+}
+function usersOp(l, req) {
+  if (req.op === "users-add") return l.users.add(req.user);
+  if (req.op === "users-remove") return l.users.remove(req.name, req.options);
+  return l.users.list();
+}
 function serveKernel(port, deps) {
   let launcher;
   let remote;
   let uplink;
   const terminals = /* @__PURE__ */ new Map();
-  const reply = (id, body, transfer) => port.postMessage({ id, ...body }, transfer);
+  const reply = (id2, body, transfer) => port.postMessage({ id: id2, ...body }, transfer);
   const clients = /* @__PURE__ */ new Set();
   const locks = deps.locks === null ? void 0 : deps.locks ?? locksOf();
   let holding;
@@ -12229,13 +12748,17 @@ function serveKernel(port, deps) {
     });
     return holding;
   }
-  async function connect() {
-    await ready2();
+  async function connect(user) {
+    const l = await ready2();
+    if (user !== void 0 && !await l.users.lookup(user)) {
+      throw fsError("ENOENT", `no user ${String(user)}`);
+    }
     const { port1, port2 } = new MessageChannel();
     const held = locks ? await holdLock(locks) : void 0;
     const served = serveClient(port1, {
       launcher: ready2,
       signal: signalNumber,
+      ...user !== void 0 ? { user } : {},
       ...locks ? { locks } : {},
       ...held ? { lock: held } : {}
     });
@@ -12304,7 +12827,8 @@ function serveKernel(port, deps) {
   async function handle(req) {
     if (req.op === "init") return init(req);
     if (req.op === "open-terminal") return terminal(req);
-    if (req.op === "connect") return connect();
+    if (req.op === "connect") return connect(req.user);
+    if (isUsersRequest(req)) return usersOp(await ready2(), req);
     if (req.op === "routes") {
       (await ready2()).setRoutes(req.routes);
       return true;
@@ -12327,25 +12851,25 @@ function serveKernel(port, deps) {
   const grants = /* @__PURE__ */ new Map();
   let nextGrant = 0;
   const askGrant = (source, options) => {
-    const id = ++nextGrant;
+    const id2 = ++nextGrant;
     const waiting = Promise.withResolvers();
-    grants.set(id, waiting);
-    port.postMessage({ hostfs: { id, source, ...options } });
+    grants.set(id2, waiting);
+    port.postMessage({ hostfs: { id: id2, source, ...options } });
     return waiting.promise;
   };
-  function granted2({ id, grant, error }) {
-    const waiting = grants.get(id);
+  function granted2({ id: id2, grant, error }) {
+    const waiting = grants.get(id2);
     if (!waiting) return;
-    grants.delete(id);
+    grants.delete(id2);
     if (grant) waiting.resolve(grant);
     else waiting.reject(Object.assign(new Error(error ?? "no grant"), { code: "EACCES" }));
   }
   const policies = /* @__PURE__ */ new Map();
   let nextPolicy = 0;
   const askPolicy = (req) => new Promise((resolve) => {
-    const id = ++nextPolicy;
-    policies.set(id, resolve);
-    port.postMessage({ mountPolicy: { id, req } });
+    const id2 = ++nextPolicy;
+    policies.set(id2, resolve);
+    port.postMessage({ mountPolicy: { id: id2, req } });
   });
   const mountPolicy = (policy) => policy === void 0 ? {} : { processMounts: policy === "ask" ? askPolicy : policy };
   port.addEventListener("message", (event) => {
@@ -12361,7 +12885,7 @@ function serveKernel(port, deps) {
     const req = event.data;
     handle(req).then(
       (result) => reply(req.id, { result }, result instanceof MessagePort ? [result] : void 0),
-      (err) => reply(req.id, { error: err instanceof Error ? err.message : String(err) })
+      (err) => reply(req.id, failure(err))
     );
   });
 }