@ai-ecoverse/slicc-kernel 1.54.8 → 1.55.0

package/dist/node.js

@@ -1693,6 +1693,7 @@ var LAST_UID = 6e4;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
+var PNPM_CONFIG = "minimumReleaseAge: 1440\n";
 var isId = (text) => text !== void 0 && /^\d+$/.test(text);
 function lines(text) {
   return text.split("\n").filter((line, i, all) => line !== "" || i < all.length - 1);
@@ -1748,6 +1749,7 @@ function userEnv(account, system) {
     USER: account.name,
     LOGNAME: account.name,
     PNPM_HOME: pnpm,
+    NPM_CONFIG_PREFIX: account.uid === 0 ? "/usr/local" : `${account.home}/.local`,
     PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
   };
 }
@@ -1772,6 +1774,18 @@ var UserDb = class {
       group: parseGroup(await this.read(GROUP, DEFAULT_GROUP))
     };
   }
+  async provision(row) {
+    const pnpm = `${row.home}/.local/share/pnpm`;
+    if (!await this.fs.exists(pnpm)) {
+      await this.fs.mkdir(pnpm, { recursive: true });
+      await this.fs.chmod(pnpm, row.name.startsWith("scoop-") ? 488 : 448);
+    }
+    const config = `${row.home}/.config/pnpm/config.yaml`;
+    if (!await this.fs.exists(config)) {
+      await this.fs.mkdir(`${row.home}/.config/pnpm`, { recursive: true });
+      await this.fs.writeFile(config, PNPM_CONFIG);
+    }
+  }
   async commit(passwd, group, then) {
     const before = [await this.read(PASSWD, DEFAULT_PASSWD), await this.read(GROUP, DEFAULT_GROUP)];
     try {
@@ -1845,6 +1859,7 @@ var UserDb = class {
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
       if (found) {
+        if (found.uid >= FIRST_UID && found.uid <= LAST_UID) await this.provision(found);
         remember();
         return this.account(found, groups);
       }
@@ -1863,6 +1878,7 @@ var UserDb = class {
       const fresh = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
+        await this.provision(row);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -2749,7 +2765,7 @@ var OpfsFs = class {
     const parent = await this.locate(parentOf2(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
-    this.touch(parent.path);
+    this.touch(parent.path, `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`);
   }
   async rm(path, options = {}) {
     let found;
@@ -2813,7 +2829,7 @@ var OpfsFs = class {
     const swap = targetStat?.isDirectory === true;
     const staging = swap ? `.${name2}.${crypto.randomUUID()}` : name2;
     this.forget(destination);
-    const timed = await this.explicitTimes(source.path);
+    const timed2 = await this.explicitTimes(source.path);
     const moved2 = await this.place(source.handle, dir, staging);
     if (swap) await this.rm(destination, { recursive: true });
     await this.meta.move(source.path, destination, carry);
@@ -2825,7 +2841,7 @@ var OpfsFs = class {
       if (!placed) await dir.removeEntry(staging, { recursive: true });
       copied ||= !placed;
     }
-    if (copied) await this.restamp(destination, timed);
+    if (copied) await this.restamp(destination, timed2);
     this.changed(source.path, destination);
     this.touch(parentOf2(source.path), parent.path);
   }
@@ -2834,16 +2850,16 @@ var OpfsFs = class {
     return handle.kind === "file" ? (await handle.getFile()).lastModified : 0;
   }
   async explicitTimes(path) {
-    const timed = [];
+    const timed2 = [];
     for (const entry of await this.meta.under(path)) {
       if (entry.mtimeFor === void 0 || entry.link !== void 0) continue;
       const current = await this.modified(entry.path).catch(() => void 0);
-      if (current === entry.mtimeFor) timed.push(entry.path.slice(path.length));
+      if (current === entry.mtimeFor) timed2.push(entry.path.slice(path.length));
     }
-    return timed;
+    return timed2;
   }
-  async restamp(path, timed) {
-    for (const rest2 of timed) {
+  async restamp(path, timed2) {
+    for (const rest2 of timed2) {
       const mtimeFor = await this.modified(path + rest2);
       await this.meta.update(path + rest2, (entry) => entry && { ...entry, mtimeFor });
     }
@@ -4156,17 +4172,22 @@ async function followLinks(fs, path) {
   }
   return current;
 }
-function withCommandDirs(fs, names) {
+function withCommandDirs(fs, names, userDir = async () => void 0) {
   async function children2(path) {
     if (path === "/") return ["bin", "usr"];
     if (path === "/usr") return ["bin"];
     if (path === "/bin" || path === "/usr/bin") return [...await names()];
-    return void 0;
+    const own = await userDir(path);
+    return own?.size ? [...own] : void 0;
   }
   async function virtual(path) {
     if (path === "/usr" || path === "/bin" || path === "/usr/bin") return synthetic(true, path);
     const name2 = COMMAND.exec(path)?.[1];
-    return name2 !== void 0 && (await names()).has(name2) ? synthetic(false, path) : void 0;
+    if (name2 !== void 0) return (await names()).has(name2) ? synthetic(false, path) : void 0;
+    if ((await userDir(path))?.size) return synthetic(true, path);
+    const slash = path.lastIndexOf("/");
+    const own = await userDir(path.slice(0, slash));
+    return own?.has(path.slice(slash + 1)) ? synthetic(false, path) : void 0;
   }
   async function linked(path) {
     return await virtual(path) ?? virtual(await followLinks(fs, path));
@@ -11573,11 +11594,24 @@ var HostfsClient = class {
   get maxIo() {
     return this.capabilities.maxIo ?? HOSTFS_IO;
   }
-  async send(path, init, handle = false, retried = false) {
+  retired;
+  stop = new AbortController();
+  get gone() {
+    return this.retired !== void 0;
+  }
+  retire(why) {
+    this.retired ??= why;
+    this.stop.abort();
+  }
+  async send(path, init, handle = false, retried = false, cleanup = false) {
+    if (this.retired && !cleanup) throw fsError2("ENOTCONN", this.retired);
+    const stop = cleanup ? void 0 : this.stop.signal;
+    const signal = init.signal && stop ? AbortSignal.any([init.signal, stop]) : init.signal ?? stop;
     let response;
     try {
       response = await this.fetch(`${this.grant.url}${path}`, {
         ...init,
+        ...signal ? { signal } : {},
         credentials: "omit",
         headers: {
           ...init.headers,
@@ -11614,6 +11648,20 @@ var HostfsClient = class {
     );
     return await response.json();
   }
+  async cleanup(op, body) {
+    const response = await this.send(
+      "/api/hostfs",
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ op, ...body })
+      },
+      true,
+      false,
+      true
+    );
+    await response.body?.cancel();
+  }
   async read(fh, offset, size, ifMatch) {
     const response = await this.send(
       "/api/hostfs",
@@ -11681,6 +11729,11 @@ function hostfsHandlers(current) {
     return fresh(remote);
   };
   const call = (op, body = {}) => current().call(op, body);
+  const settle = (client, restore) => client.call("setattr", restore).catch((err) => {
+    if (!client.gone || !client.cleanup) throw err;
+    void client.cleanup("setattr", restore).catch(() => {
+    });
+  });
   async function writable(client, path, flags) {
     const { ifMatch: _, ...asked } = flags;
     const opening = () => client.call("open", { path: rel(path), ...asked });
@@ -11691,9 +11744,9 @@ function hostfsHandlers(current) {
       const mode = (await client.call("stat", { path: rel(path) })).mode ?? 0;
       if (mode & 128) throw err;
       const restore = { path: rel(path), mode };
-      await client.call("setattr", { path: rel(path), mode: mode | 128 });
-      const opened2 = await opening().catch(async (again) => {
-        await client.call("setattr", restore);
+      const opened2 = await client.call("setattr", { path: rel(path), mode: mode | 128 }).then(opening).catch(async (again) => {
+        await settle(client, restore).catch(() => {
+        });
         throw again;
       });
       return { opened: opened2, restore };
@@ -11748,7 +11801,7 @@ function hostfsHandlers(current) {
       try {
         await fresh(remote).client.call("release", { fh: remote.fh }, true);
       } finally {
-        if (remote.restore) await current().call("setattr", remote.restore);
+        if (remote.restore) await settle(current(), remote.restore);
       }
     },
     mkdir: async (path) => void await call("mkdir", { path: rel(path) }),
@@ -11878,6 +11931,73 @@ function invalidation(event) {
   return event.paths ?? true;
 }
 var PORT_REQUEST_MS = 6e4;
+var HOSTFS_CALL_MS = 2e4;
+var PORT_BEAT_MS = 1e3;
+var PORT_DEAD_MS = 1e4;
+var PORT_LINGER_MS = 1e3;
+function timed(transport, ms) {
+  const inflight = /* @__PURE__ */ new Set();
+  const guard = (name2, run2, late, expire) => new Promise((resolve, reject) => {
+    let expired = false;
+    const running = run2();
+    inflight.add(running);
+    const done4 = () => inflight.delete(running);
+    running.then(done4, done4);
+    const timer = setTimeout(() => {
+      expired = true;
+      const why = `the host folder did not answer ${name2} within ${ms} ms`;
+      transport.retire?.(why);
+      expire?.(running);
+      reject(fsError2("ENOTCONN", why));
+    }, ms);
+    running.then(
+      (value) => {
+        clearTimeout(timer);
+        if (expired) late?.(value);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+  const cleanup = async (op, body, skip) => {
+    await Promise.allSettled([...inflight].filter((work) => work !== skip));
+    await transport.cleanup?.(op, body);
+  };
+  const release = (opened2) => {
+    const fh = opened2?.fh;
+    if (typeof fh === "number") void cleanup("release", { fh }).catch(() => {
+    });
+  };
+  return {
+    get capabilities() {
+      return transport.capabilities;
+    },
+    get token() {
+      return transport.token;
+    },
+    get maxIo() {
+      return transport.maxIo;
+    },
+    get gone() {
+      return transport.gone;
+    },
+    retire: (why) => transport.retire?.(why),
+    ...transport.cleanup ? { cleanup } : {},
+    call: (op, body, handle) => guard(
+      op,
+      () => transport.call(op, body, handle),
+      op === "open" ? release : void 0,
+      op === "release" ? (running) => void cleanup("release", body ?? {}, running).catch(() => {
+      }) : void 0
+    ),
+    read: (fh, offset, size, ifMatch) => guard("read", () => transport.read(fh, offset, size, ifMatch)),
+    write: (fh, offset, bytes) => guard("write", () => transport.write(fh, offset, bytes)),
+    watch: (signal, onEvent, onOpen) => transport.watch(signal, onEvent, onOpen)
+  };
+}
 var PORT_MS_PER_MIB = 1e3;
 var nextPortToken = 0;
 var PortTransport = class {
@@ -11888,13 +12008,25 @@ var PortTransport = class {
   waiting = /* @__PURE__ */ new Map();
   next = 0;
   dead;
-  constructor(grant, requestMs = PORT_REQUEST_MS) {
+  beatMs;
+  deadMs;
+  lingerMs;
+  beat;
+  answers = false;
+  pinged;
+  constructor(grant, liveness = {}) {
     this.port = grant.port;
-    this.requestMs = requestMs;
+    this.requestMs = liveness.requestMs ?? PORT_REQUEST_MS;
+    this.beatMs = liveness.beatMs ?? PORT_BEAT_MS;
+    this.deadMs = liveness.deadMs ?? PORT_DEAD_MS;
+    this.lingerMs = liveness.lingerMs ?? PORT_LINGER_MS;
     this.capabilities = grant.capabilities ?? {};
     this.token = grant.token ?? `port-${++nextPortToken}`;
     this.port.addEventListener("message", (event) => {
-      this.waiting.get(event.data?.id)?.(event.data);
+      if (event.data?.pong) {
+        this.answers = true;
+        this.pinged = void 0;
+      } else this.waiting.get(event.data?.id)?.(event.data);
     });
     this.port.addEventListener("close", () => this.fail("the folder's port closed"));
     this.port.start();
@@ -11905,8 +12037,51 @@ var PortTransport = class {
   get gone() {
     return this.dead !== void 0;
   }
+  retire(why) {
+    this.fail(why);
+  }
+  ping() {
+    if (this.pinged !== void 0) return;
+    this.pinged = Date.now();
+    try {
+      this.port.postMessage({ id: 0, op: "ping" });
+    } catch {
+    }
+  }
+  watchBeat() {
+    if (this.beat || this.dead) return;
+    this.ping();
+    this.beat = setInterval(() => {
+      if (this.waiting.size === 0) {
+        clearInterval(this.beat);
+        this.beat = void 0;
+        return;
+      }
+      if (this.answers && this.pinged !== void 0 && Date.now() - this.pinged > this.deadMs) {
+        this.fail("the folder's port stopped answering");
+        return;
+      }
+      this.ping();
+    }, this.beatMs);
+  }
+  async cleanup(op, body) {
+    if (this.closed) throw fsError2("ENOTCONN", "the folder's port is closed");
+    this.port.postMessage({ id: 0, op: "cleanup", name: op, body });
+  }
+  closed = false;
   fail(why) {
-    if (this.dead === void 0) this.port.close();
+    if (this.dead === void 0) {
+      setTimeout(() => {
+        try {
+          this.port.postMessage({ id: 0, op: "bye" });
+        } catch {
+        }
+        this.closed = true;
+        this.port.close();
+      }, this.lingerMs);
+    }
+    clearInterval(this.beat);
+    this.beat = void 0;
     this.dead ??= why;
     for (const settle of [...this.waiting.values()])
       settle({ id: 0, error: { code: "ENOTCONN", message: why } });
@@ -11923,6 +12098,7 @@ var PortTransport = class {
         },
         this.requestMs + Math.ceil(bytes / 1048576) * PORT_MS_PER_MIB
       );
+      this.watchBeat();
       this.waiting.set(id2, (reply) => {
         clearTimeout(timer);
         this.waiting.delete(id2);
@@ -11969,6 +12145,7 @@ var PortTransport = class {
         }
         resolve();
       };
+      this.watchBeat();
       this.waiting.set(id2, (reply) => {
         if (reply.open) return onOpen();
         if (reply.event) return onEvent(reply.event);
@@ -11992,11 +12169,38 @@ var errorOf = (err) => ({
 });
 function serveHostfsPort(port, transport) {
   const watches = /* @__PURE__ */ new Map();
+  const handles = /* @__PURE__ */ new Set();
+  let stopped = false;
+  const closeHandles = () => {
+    for (const fh of handles) void transport.call("release", { fh }, true).catch(() => {
+    });
+    handles.clear();
+  };
   const send = (reply, transfer = []) => port.postMessage(reply, transfer);
+  const pending = /* @__PURE__ */ new Set();
+  const track = (work) => {
+    pending.add(work);
+    const done4 = () => pending.delete(work);
+    work.then(done4, done4);
+    return work;
+  };
+  const answer = async (name2, body) => {
+    const result = await track(transport.call(name2, body));
+    const opened2 = result?.fh;
+    if (name2 === "open" && typeof opened2 === "number") handles.add(opened2);
+    if (name2 === "release") handles.delete(body?.fh);
+    if (stopped) closeHandles();
+    return result;
+  };
   const listener = async ({
     data
   }) => {
     const { id: id2, op } = data;
+    if (op === "ping") return send({ id: id2, pong: true });
+    if (op === "bye") return stop();
+    if (op === "cleanup")
+      return void Promise.allSettled([...pending]).then(() => answer(data.name, data.body)).catch(() => {
+      });
     if (op === "unwatch") return watches.get(id2)?.abort();
     if (op === "watch") {
       const stop2 = new AbortController();
@@ -12017,32 +12221,35 @@ function serveHostfsPort(port, transport) {
     }
     try {
       if (op === "read") {
-        const read = await transport.read(
-          data.fh,
-          data.offset,
-          data.size,
-          data.ifMatch
+        const read = await track(
+          transport.read(
+            data.fh,
+            data.offset,
+            data.size,
+            data.ifMatch
+          )
         );
         const bytes = read.slice();
         return send({ id: id2, bytes }, [bytes.buffer]);
       }
       if (op === "write") {
-        await transport.write(data.fh, data.offset, data.bytes);
+        await track(
+          transport.write(data.fh, data.offset, data.bytes)
+        );
         return send({ id: id2 });
       }
       if (op !== "call") throw fsError2("EINVAL", `unknown hostfs port op ${op}`);
-      send({
-        id: id2,
-        result: await transport.call(data.name, data.body)
-      });
+      send({ id: id2, result: await answer(data.name, data.body) });
     } catch (err) {
       send({ id: id2, error: errorOf(err) });
     }
   };
   const stop = () => {
+    stopped = true;
     port.removeEventListener("message", listener);
     port.removeEventListener("close", stop);
     for (const watch of watches.values()) watch.abort();
+    closeHandles();
     port.close();
   };
   port.addEventListener("message", listener);
@@ -12050,10 +12257,10 @@ function serveHostfsPort(port, transport) {
   port.start();
   return stop;
 }
-function grantConnect(hook, fetch2, requestMs) {
+function grantConnect(hook, fetch2, liveness = {}) {
   return async (source, options) => {
     const first = await hook(source, options);
-    if ("port" in first) return new PortTransport(first, requestMs);
+    if ("port" in first) return new PortTransport(first, liveness);
     const grant = async () => {
       const again = await hook(source, options);
       if ("port" in again)
@@ -12073,7 +12280,10 @@ async function openHostfs(spec, connect, timing = {}) {
   const stop = new AbortController();
   let active;
   const handlers = hostfsHandlers(() => active);
-  const ranged2 = () => active?.capabilities.ranges === true ? { ranges: true } : {};
+  const ranged2 = () => ({
+    ...active?.capabilities.ranges === true ? { ranges: true } : {},
+    ...active ? { maxIo: Math.min(active.maxIo, HOSTFS_IO) } : {}
+  });
   const served = serveFilesystem(
     port2,
     { ...slot.handlers, mount: ranged2 },
@@ -12089,7 +12299,7 @@ async function openHostfs(spec, connect, timing = {}) {
     {
       connect: () => connect(spec.source, { readonly: readonly2 }),
       up(client) {
-        active = client;
+        active = timed(client, timing.callMs ?? HOSTFS_CALL_MS);
         slot.insert(client, handlers);
         served.invalidate(true);
       },
@@ -12588,8 +12798,11 @@ var Launcher = class {
   createWorker;
   modulesDir;
   env;
-  catalog;
-  binfmts;
+  catalogs = /* @__PURE__ */ new Map();
+  ownCatalogs = /* @__PURE__ */ new Map();
+  binfmts = /* @__PURE__ */ new Map();
+  scopes;
+  unwatchScopes = () => void 0;
   warned = /* @__PURE__ */ new Set();
   compiled = /* @__PURE__ */ new Map();
   processes = /* @__PURE__ */ new Map();
@@ -12669,7 +12882,11 @@ var Launcher = class {
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
-    const fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
+    const fs = withCommandDirs(
+      this.base,
+      async () => new Set((await this.commands()).keys()),
+      (dir) => this.userCommandDir(dir)
+    );
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.nodes.keepsOnDisk = true;
     this.openFiles.add(this.nodes);
@@ -12687,35 +12904,99 @@ var Launcher = class {
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
     this.users = new UserDb(this.fs);
     void this.unlinked.sweep("/");
-    this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
-      this.catalog = void 0;
-      this.binfmts = void 0;
+    this.watchers.watch(
+      [this.modulesDir, this.pnpmHome],
+      { recursive: true },
+      () => this.resetCatalogs()
+    );
+    this.watchers.watch([PASSWD], { recursive: false }, () => {
+      this.scopes = void 0;
+      this.resetCatalogs();
     });
   }
   setRoutes(table) {
     this.routes.set(table);
   }
-  commands() {
-    this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
-    return this.catalog;
+  commands(scope = "") {
+    let found = this.catalogs.get(scope);
+    if (!found) {
+      found = this.roots(scope).then((roots) => scanCommands(this.base, roots));
+      this.catalogs.set(scope, found);
+    }
+    return found;
   }
-  interpreters() {
-    this.binfmts ??= this.roots().then(
-      (roots) => scanBinfmts(this.base, roots, (message3) => {
-        if (this.warned.has(message3)) return;
-        this.warned.add(message3);
-        console.warn(message3);
-      })
-    );
-    return this.binfmts;
+  ownCommands(scope) {
+    let found = this.ownCatalogs.get(scope);
+    if (!found) {
+      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.base, roots)).then((commands) => new Set(commands.keys()));
+      this.ownCatalogs.set(scope, found);
+    }
+    return found;
   }
-  async roots() {
-    return [this.modulesDir, ...await pnpmGlobalRoots(this.base, this.pnpmHome)];
+  interpreters(scope = "") {
+    let found = this.binfmts.get(scope);
+    if (!found) {
+      found = this.roots(scope).then(
+        (roots) => scanBinfmts(this.base, roots, (message3) => {
+          if (this.warned.has(message3)) return;
+          this.warned.add(message3);
+          console.warn(message3);
+        })
+      );
+      this.binfmts.set(scope, found);
+    }
+    return found;
   }
-  async resolve(file, argv0, cwd) {
-    const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
-    if (name2 !== void 0) {
-      const command = (await this.commands()).get(name2);
+  async roots(scope = "") {
+    const system = [this.modulesDir, ...await pnpmGlobalRoots(this.base, this.pnpmHome)];
+    return scope ? [...await pnpmGlobalRoots(this.base, scope), ...system] : system;
+  }
+  resetCatalogs() {
+    this.catalogs.clear();
+    this.ownCatalogs.clear();
+    this.binfmts.clear();
+  }
+  userScopes() {
+    this.scopes ??= this.users.list().then(
+      (accounts) => {
+        const users = accounts.filter((account) => account.uid !== 0);
+        const homes = users.map((account) => pnpmHomeOf(account, this.pnpmHome));
+        this.unwatchScopes();
+        this.unwatchScopes = this.watchers.watch(
+          homes,
+          { recursive: true },
+          () => this.resetCatalogs()
+        );
+        return {
+          byUid: new Map(users.map((account, i) => [account.uid, homes[i]])),
+          byBin: new Map(homes.map((home) => [`${home}/bin`, home]))
+        };
+      },
+      () => ({ byUid: /* @__PURE__ */ new Map(), byBin: /* @__PURE__ */ new Map() })
+    );
+    return this.scopes;
+  }
+  async userCommandDir(dir) {
+    const scope = (await this.userScopes()).byBin.get(dir);
+    return scope === void 0 ? void 0 : this.ownCommands(scope);
+  }
+  async scopeOf(uid) {
+    return (await this.userScopes()).byUid.get(uid) ?? "";
+  }
+  async commandAt(file, scope) {
+    const system = COMMAND2.exec(file)?.[1];
+    if (system !== void 0) return (await this.commands()).get(system);
+    if (!file.includes("/")) return (await this.commands(scope)).get(file);
+    const slash = file.lastIndexOf("/");
+    const owner = (await this.userScopes()).byBin.get(file.slice(0, slash));
+    if (owner === void 0 || !(await this.ownCommands(owner)).has(file.slice(slash + 1))) {
+      return void 0;
+    }
+    return (await this.commands(owner)).get(file.slice(slash + 1));
+  }
+  async resolve(file, argv0, cwd, scope = "") {
+    if (!file.includes("/") || COMMAND2.test(file)) {
+      const command = await this.commandAt(file, scope);
       return command && !command.script ? targetOf(command) : void 0;
     }
     const path = this.fs.resolvePath(cwd, file);
@@ -12726,6 +13007,8 @@ var Launcher = class {
       const byPath = !COMMAND2.test(path) && (await this.commands()).get(linked)?.argv0Path === true;
       return target && byPath ? { ...target, argv0: path } : target;
     }
+    const own = await this.commandAt(glue, scope);
+    if (own) return own.script ? void 0 : targetOf(own);
     const head = await this.head(glue);
     if (!head) return void 0;
     if (isWasm(head)) {
@@ -12748,45 +13031,45 @@ var Launcher = class {
       return void 0;
     }
   }
-  async scriptCommand(file) {
-    const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
-    if (name2 === void 0) return void 0;
-    const command = (await this.commands()).get(name2);
+  async scriptCommand(file, cwd, scope) {
+    const direct = !file.includes("/") || COMMAND2.test(file);
+    const at = direct ? file : await followLinks(this.base, this.fs.resolvePath(cwd, file));
+    const command = await this.commandAt(at, scope);
     return command?.script ? command : void 0;
   }
-  async interpreted(file, argv, cwd, depth = 0) {
-    const command = await this.scriptCommand(file);
+  async interpreted(file, argv, cwd, scope, depth = 0) {
+    const command = await this.scriptCommand(file, cwd, scope);
     const script = command?.script ?? this.fs.resolvePath(cwd, file);
     const head = await this.head(script);
     if (!head) return void 0;
-    const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(), script);
+    const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(scope), script);
     const words = shebang(head) ?? (binfmt ? [binfmt] : void 0);
     if (!words) return void 0;
     if (baseName(words[0]) === "env") words.shift();
     const [interp, ...rest2] = words;
     const arg = rest2.join(" ");
     const passed = [...arg ? [arg] : [], command ? script : file, ...argv.slice(1)];
-    const found = interp ? await this.resolve(interp, interp, cwd) : void 0;
+    const found = interp ? await this.resolve(interp, interp, cwd, scope) : void 0;
     if (!found) {
-      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp)) {
+      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp, cwd, scope)) {
         return void 0;
       }
-      const inner = await this.interpreted(interp, [interp, ...passed], cwd, depth + 1);
+      const inner = await this.interpreted(interp, [interp, ...passed], cwd, scope, depth + 1);
       return inner && { ...inner, target: withScriptEnv(inner.target, command) };
     }
     const target = withScriptEnv(found, command);
     return { target, args: [...target.prefix ?? [], ...passed] };
   }
-  async plan(file, argv, cwd) {
-    const direct = await this.resolve(file, argv[0] ?? file, cwd);
+  async plan(file, argv, cwd, scope) {
+    const direct = await this.resolve(file, argv[0] ?? file, cwd, scope);
     if (direct) return { target: direct, args: [...direct.prefix ?? [], ...argv.slice(1)] };
-    return this.interpreted(file, argv, cwd);
+    return this.interpreted(file, argv, cwd, scope);
   }
-  async unrunnable(file, cwd) {
+  async unrunnable(file, cwd, scope) {
     const path = this.fs.resolvePath(cwd, file);
     const head = await this.base.readFileBuffer(path).catch(() => null);
     if (!head || head[0] === 35 && head[1] === 33) return "ENOENT";
-    return binfmtOf(await this.interpreters(), path) ? "ENOENT" : "ENOEXEC";
+    return binfmtOf(await this.interpreters(scope), path) ? "ENOENT" : "ENOEXEC";
   }
   module(path) {
     return this.base.stat(path).then((st) => {
@@ -12996,10 +13279,11 @@ var Launcher = class {
   }
   spawner(ppid, report) {
     return async (req, fds) => {
-      const planned = await this.plan(req.file, req.argv, req.cwd);
+      const scope = await this.scopeOf(this.credOf(ppid).euid);
+      const planned = await this.plan(req.file, req.argv, req.cwd, scope);
       if (!planned) {
         await fds.closeAll();
-        throw new SpawnError(await this.unrunnable(req.file, req.cwd));
+        throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
       }
       const exec = req.exec ? { exec: true } : {};
       const deciding = req.exec ? void 0 : this.undecided(ppid);
@@ -13118,11 +13402,7 @@ var Launcher = class {
         throw fsError("ENODEV", "this kernel has no hostfs hook (createKernel({ hostfs }))");
       return openHostfs(
         spec,
-        grantConnect(
-          hostfs,
-          hostfsFetch ?? ((url, init) => fetch(url, init)),
-          hostfsTiming?.requestMs
-        ),
+        grantConnect(hostfs, hostfsFetch ?? ((url, init) => fetch(url, init)), hostfsTiming),
         hostfsTiming
       );
     }
@@ -13305,18 +13585,18 @@ var Launcher = class {
       ...account.umask !== void 0 ? { umask: account.umask } : {}
     };
   }
-  async starting(argv, dir) {
-    this.catalog = void 0;
-    this.binfmts = void 0;
+  async starting(argv, dir, account) {
+    this.resetCatalogs();
+    const scope = account.uid === 0 ? "" : pnpmHomeOf(account, this.pnpmHome);
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
     await this.base.mkdir(cwd, { recursive: true });
-    return { cwd, file, planned: await this.plan(file, argv, cwd) };
+    return { cwd, file, planned: await this.plan(file, argv, cwd, scope) };
   }
   async openTerminal(argv, options) {
     const account = await this.account(options.user);
-    const { cwd, file, planned } = await this.starting(argv, options.cwd);
+    const { cwd, file, planned } = await this.starting(argv, options.cwd, account);
     if (!planned) throw new Error(`${file}: command not found`);
     let leader = 0;
     const tty = new KernelTty(
@@ -13359,7 +13639,7 @@ var Launcher = class {
   }
   async run(argv, options = {}) {
     const account = await this.account(options.user);
-    const { cwd, file, planned } = await this.starting(argv, options.cwd);
+    const { cwd, file, planned } = await this.starting(argv, options.cwd, account);
     const env = this.environment(cwd, options.env, account);
     const out = [];
     const err = [];