@ai-ecoverse/slicc-kernel 1.54.9 → 1.56.0

package/README.md

@@ -88,7 +88,7 @@ The user database, `/etc/passwd` and `/etc/group` (see [Users](#users)):
 
 | | |
 | --- | --- |
-| `add({ name, home?, groups?, umask? })` | adds a user and resolves with `{ name, uid, gid, home, shell, groups, umask? }`. It's idempotent: an existing name resolves with its entry and changes nothing but the remembered `umask`. The new user gets the lowest free id from 1000 up, a private group of the same id and name, membership of `users` and of each group in `groups` (such as `sudo`), `home` (default `/home/<name>`, created), and `/bin/bash`. `umask` is the umask its processes start with; the kernel keeps it in memory, so pass it again after a reload. A name must match `[a-z_][a-z0-9_.-]*`; a group that doesn't exist rejects with `ENOENT` |
+| `add({ name, home?, groups?, umask? })` | adds a user and resolves with `{ name, uid, gid, home, shell, groups, umask? }`. It's idempotent: an existing name resolves with its entry and changes nothing but the remembered `umask`. The new user gets the lowest free id from 1000 up, a private group of the same id and name, membership of `users` and of each group in `groups` (such as `sudo`), `home` (default `/home/<name>`, created), its pnpm home `~/.local/share/pnpm` (`0700`, `0750` for a `scoop-` user) and `~/.config/pnpm/config.yaml` with `minimumReleaseAge: 1440` (pnpm skips releases less than a day old), each only if missing, which an `add` of an existing user also does, and `/bin/bash`. `umask` is the umask its processes start with; the kernel keeps it in memory, so pass it again after a reload. A name must match `[a-z_][a-z0-9_.-]*`; a group that doesn't exist rejects with `ENOENT` |
 | `remove(name, { keepHome }?)` | removes the user, its private group and its group memberships, and deletes its home unless `keepHome` is set. A home outside `/home/<dir>` is never deleted. Resolves `false` for an unknown name; system accounts (ids below 1000 or above 60000) reject with `EPERM` |
 | `list()` | every user, as `add` returns them |
 
@@ -188,7 +188,7 @@ On top of preview1 a WASI program gets:
 - **Threads**: `wasi.thread-spawn` (wasm32-wasip1-threads) and WASIX `thread_spawn_v2` start a worker per thread on the process's shared memory, sized from the module's own import (a 2 GiB maximum when the engine cannot reserve more). The threads share one descriptor table; `exit` or a trap in any thread ends the process. At most 64 threads per process; `SLICC_WASM_THREADS` sets another cap, up to 256.
 - **WASIX** (a module importing `wasix_32v1`): fork and setjmp/longjmp through Asyncify (the module is built with `wasm-opt --asyncify`), exec, `posix_spawn`, `waitpid` (with `WNOHANG`, and `WUNTRACED` for a child that stops; WASIX has no `WCONTINUED`), pipes, `dup2`, signal handlers and interval timers, terminal modes, and dynamic linking: a position-independent main module loads side modules with `dlopen` from `LD_LIBRARY_PATH`, its runtime path, `/lib`, `/usr/lib` and `/usr/local/lib`. Each thread has its own copy of the function table, so the kernel hands out its slots (a side module's range, a `dlsym`'d function, a closure): threads loading or looking up at the same time never get the same slot. As in glibc, one `dlopen` at a time runs in a process, constructors included: a `dlopen` from a library's constructor goes ahead in its own thread, and another thread's `dlopen` waits, then finds the library loaded and gets the same handle. A thread waiting there still ends or stops with its process, but a signal handler it has runs once that `dlopen` returns. The lock is let go when a `dlopen` fails (an exception, a trap or `pthread_exit` out of a constructor included) and when its thread ends; a forked child starts with it free. In such a program, `dlopen(NULL)`, and `dlopen` of the program's own file (also by a path that resolves to it through symlinks), give a handle for the program that is already running (no second copy is loaded); a program that isn't position-independent gets an error from `dlopen(NULL)`, as from any `dlopen`; `dlsym` on it searches the program, then the loaded libraries, and `dlclose` of it does nothing. A function already in the table (the program's own, or a library's) keeps its slot, so `dlsym(handle, "strlen") == strlen`.
 - **Foreign calls** (libffi's WASIX backend, so Python's `ctypes`): `call_dynamic` calls a function through the program's indirect function table (a static module's exported `__indirect_function_table`, or the dynamic linker's), its arguments and results packed in memory one after another (`i32`/`f32` 4 bytes, `i64`/`f64` 8). With `strict` set, the buffers must fit the function exactly (else `EINVAL`, before the function is called); without it, missing arguments are zero (one cut short keeps the bytes given, with zeros above them) and results that do not fit are left out. A trap or exception of the callee goes through to the caller. JS cannot ask a function for its type, so the kernel reads the types from the module files (the program's and each side module's, once, when a program first calls through `call_dynamic`): a table slot that is empty, past the end, holds a function of no module the kernel knows of, or takes or returns a `v128`, gives `EINVAL`. For closures (callbacks such as `CFUNCTYPE`), a dynamically linked program gets table slots from `closure_allocate`, and `closure_free` gives them back for reuse and empties the slot in every thread; a static program gets `ENOTSUP`. `closure_prepare` puts a trampoline with the requested signature (any of `i32`, `i64`, `f32`, `f64`, `v128`) into such a slot, in every thread: each call stores its arguments below the stack pointer and calls the backing function as `backing(values, results, user_data)`, then returns what it wrote to `results`. The trampolines are small wasm modules made and compiled at run time, once per signature in each thread (an instance per closure), so a page whose Content Security Policy forbids compiling WebAssembly (no `'wasm-unsafe-eval'`) cannot run them; it cannot run the program either. A `fork` or a `longjmp` (both through Asyncify) inside a function reached through `call_dynamic` cannot unwind through it.
-- **Job control:** `^Z`, `SIGTSTP`, `SIGTTIN` and `SIGTTOU` stop a WASIX program at once, unless it has a handler for them. A stopped program that is busy computing is stopped for job control (`jobs` shows it, `fg`, `bg` and `SIGCONT` work), but its worker keeps a core busy until its next system call, since a worker's running code cannot be frozen from outside. Agents should `kill` such a job rather than leave it stopped. For the same reason, a signal with a handler or a terminating default (`^C`, `SIGTERM`) reaches a program that is busy computing only at its next system call, so a CPU-bound loop may not end on `^C`; `kill -9` always ends it. A thread blocked in the kernel or waiting on a lock (`pthread_cond_wait`, a futex) is woken by a signal for it (a futex wait checks for signals every 50 ms, so each waiting thread wakes briefly that often), and `pthread_kill` runs the handler on the thread it names. A sleep, or a clock in `poll_oneoff`, never ends before the time asked (it can end later, never earlier). A signal that ends a sleep or a `poll`/`select` with a timeout makes the call fail with `EINTR` in a program whose libc says it is wasix-sysroot 2025.9.30-22 or later (its `slicc.libc` custom section). Older libcs turn that answer into `ENOTSUP` from `nanosleep` (up to -18), so for a program without the section the wait ends as if it had timed out, unless it imports `fd_fdflags_set` (then `EINTR`, as before).
+- **Job control:** `^Z`, `SIGTSTP`, `SIGTTIN` and `SIGTTOU` stop a WASIX program at once, unless it has a handler for them. A stopped program that is busy computing is stopped for job control (`jobs` shows it, `fg`, `bg` and `SIGCONT` work), but its worker keeps a core busy until its next system call, since a worker's running code cannot be frozen from outside. Agents should `kill` such a job rather than leave it stopped. For the same reason, a signal with a handler or a terminating default (`^C`, `SIGTERM`) reaches a program that is busy computing only at its next system call, so a CPU-bound loop may not end on `^C`; `kill -9` always ends it. A pending signal is delivered at the program's next WASI or WASIX call, including the calls its worker answers without the kernel (`random_get`, `args_get`, …), except the exempt ones: `clock_time_get` (a tight loop of it measured up to 30% slower), `proc_exit`, `proc_exit2`, `thread_exit`, `thread_spawn_v2` and `wasi.thread-spawn` (wasi-threads), the calls that install handlers (`callback_signal`, `slicc.sigaction_set`), and calls made while Asyncify unwinds or rewinds the stack for `fork` or `longjmp`. A thread blocked in the kernel or waiting on a lock (`pthread_cond_wait`, a futex) is woken by a signal for it (a futex wait checks for signals every 50 ms, so each waiting thread wakes briefly that often), and `pthread_kill` runs the handler on the thread it names. A sleep, or a clock in `poll_oneoff`, never ends before the time asked (it can end later, never earlier). A signal that ends a sleep or a `poll`/`select` with a timeout makes the call fail with `EINTR` in a program whose libc says it is wasix-sysroot 2025.9.30-22 or later (its `slicc.libc` custom section). Older libcs turn that answer into `ENOTSUP` from `nanosleep` (up to -18), so for a program without the section the wait ends as if it had timed out, unless it imports `fd_fdflags_set` (then `EINTR`, as before).
 - **Pipes** have no file type for WASI and WASIX programs' `fstat` (`st_mode` type 0), because WASI has no FIFO file type. A socket type, as kernels 1.47.3 to 1.48.1 gave them, made Ruby treat a `popen` pipe as a socket (`close_write` then never ends the child's input). The kernel's `slicc_fs.fd_mode` answers `S_IFIFO | 0600` (Linux numbering) for a pipe, and wasix-sysroot 2025.9.30-21 and later take the type from it, so programs built on it see a FIFO (`S_ISFIFO`); older libcs keep only the permission bits. Until then Python's asyncio refuses a pipe for a subprocess (`Pipe transport is only for pipes, sockets and character devices`). They are read and written as pipes; socket calls on them fail with `ENOTSOCK`, and `isatty()` is false. Emscripten programs, bash included, see a FIFO. The same holds for any kernel descriptor that is neither seekable nor a terminal or device, such as captured output.
 - **Sockets**: the WASIX socket calls (`sock_open`, `sock_pair` for an `AF_UNIX` stream pair, `bind`, `listen`, `connect`, `accept`, options, local and peer names) are the kernel's loopback sockets, and preview1's `sock_recv` / `sock_send` / `sock_shutdown` work on them and on inherited ones. Writing to a socket whose peer is gone fails with `EPIPE`, through `fd_write` as through `sock_send`, as if `MSG_NOSIGNAL` were set, since a WASI program cannot ignore `SIGPIPE`; a pipe or terminal whose reader is gone still ends the program with status 141. HTTP and HTTPS leave through the realm proxy that `https_proxy` names, as for any other program; `resolve` answers `/etc/hosts` names and literal addresses, and the [uplink](#uplink)'s names.
 - **Diagnostics**: a trap ends the program with 134 and its message on stderr; with `SLICC_WASM_BACKTRACE=1` the wasm frames follow, named from the module's name section, or from a sidecar for a module shipped without one (`<module>.names` beside it, or the same path in a `<package>-names` package). `SLICC_WASI_STATS=1` makes a program print its calls, counted and timed, as it ends.
@@ -490,7 +490,8 @@ Lowering a soft resource limit (`ulimit -S -n 64`) still fails with `EPERM` in E
 Every process has credentials in the kernel, as on Linux: real, effective and saved user and group ids, and supplementary groups. A process gets them from the user it was started as (`run`, `openTerminal`, a client's `spawn`, or the client's own user; root by default) and keeps its parent's across fork, spawn and exec. Setuid and setgid bits are never honoured on exec. Files aren't checked against the credentials yet; they decide who may signal whom, and what `/proc` and `ps` show.
 
 - **The database:** `/etc/passwd` and `/etc/group` are real files. On first start the kernel writes them when they're missing, with `root` (uid 0, home `/root`, created `0700`) and `nobody` (65534), and the groups `root`, `sudo` (27), `users` (100) and `nogroup` (65534); files already there are kept as they are. The kernel reads them for every lookup, so an edit counts at once. [`kernel.users`](#kernelusers) adds and removes users.
-- **Environment:** a process started as a user gets `HOME`, `USER`, `LOGNAME`, `PNPM_HOME` and `PATH`. A user's `PNPM_HOME` is `~/.local/share/pnpm`; root's is `/usr/local/share/pnpm` (or the embedder's `env.PNPM_HOME`), whose global packages are the commands every user finds. `PATH` is `$PNPM_HOME/bin:/usr/local/bin:/usr/bin:/bin`.
+- **Environment:** a process started as a user gets `HOME`, `USER`, `LOGNAME`, `PNPM_HOME`, `NPM_CONFIG_PREFIX` and `PATH`. A user's `PNPM_HOME` is `~/.local/share/pnpm` and its npm prefix `~/.local`; root's are `/usr/local/share/pnpm` (or the embedder's `env.PNPM_HOME`) and `/usr/local`. `PATH` is `$PNPM_HOME/bin:/usr/local/bin:/usr/bin:/bin`.
+- **Commands per user:** root's global packages (`pnpm add -g` as root) are commands every user finds in `/usr/bin`. A user's own global packages are commands for that user only: they show up in the user's `~/.local/share/pnpm/bin`, first on its `PATH`, and a program the user starts finds them by name before the system's; another user, root included, doesn't. A user's packages can map file suffixes (`binfmt`) for that user too. The kernel picks up an install, a removal and a new user as they happen.
 - **Changing credentials:** POSIX `setresuid`/`setresgid` rules. Root (effective uid 0) may set any id and the group list; anyone else may only swap among their own real, effective and saved ids, and gets `EPERM` otherwise.
 - **Signals:** a process may signal another if its effective uid is 0, or if its real or effective uid is the target's real or saved uid; otherwise `kill` fails with `EPERM`. A group kill signals the members it may, and fails with `EPERM` only when it may signal none.
 - **Visibility:** a process that isn't root sees only processes whose real or effective uid is its effective uid, in `/proc` and in `ps`, like Linux's `hidepid=2`; so does a client bound to a user.

package/dist/kernel-worker.js

@@ -661,7 +661,7 @@ var OpfsFs = class {
     const parent = await this.locate(parentOf2(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
-    this.touch(parent.path);
+    this.touch(parent.path, `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`);
   }
   async rm(path, options = {}) {
     let found;
@@ -2385,6 +2385,7 @@ var LAST_UID = 6e4;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
+var PNPM_CONFIG = "minimumReleaseAge: 1440\n";
 var isId = (text) => text !== void 0 && /^\d+$/.test(text);
 function lines(text) {
   return text.split("\n").filter((line, i, all) => line !== "" || i < all.length - 1);
@@ -2440,6 +2441,7 @@ function userEnv(account, system) {
     USER: account.name,
     LOGNAME: account.name,
     PNPM_HOME: pnpm,
+    NPM_CONFIG_PREFIX: account.uid === 0 ? "/usr/local" : `${account.home}/.local`,
     PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
   };
 }
@@ -2464,6 +2466,18 @@ var UserDb = class {
       group: parseGroup(await this.read(GROUP, DEFAULT_GROUP))
     };
   }
+  async provision(row) {
+    const pnpm = `${row.home}/.local/share/pnpm`;
+    if (!await this.fs.exists(pnpm)) {
+      await this.fs.mkdir(pnpm, { recursive: true });
+      await this.fs.chmod(pnpm, row.name.startsWith("scoop-") ? 488 : 448);
+    }
+    const config = `${row.home}/.config/pnpm/config.yaml`;
+    if (!await this.fs.exists(config)) {
+      await this.fs.mkdir(`${row.home}/.config/pnpm`, { recursive: true });
+      await this.fs.writeFile(config, PNPM_CONFIG);
+    }
+  }
   async commit(passwd, group, then) {
     const before = [await this.read(PASSWD, DEFAULT_PASSWD), await this.read(GROUP, DEFAULT_GROUP)];
     try {
@@ -2537,6 +2551,7 @@ var UserDb = class {
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
       if (found) {
+        if (found.uid >= FIRST_UID && found.uid <= LAST_UID) await this.provision(found);
         remember();
         return this.account(found, groups);
       }
@@ -2555,6 +2570,7 @@ var UserDb = class {
       const fresh = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
+        await this.provision(row);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -5558,17 +5574,22 @@ async function followLinks(fs, path) {
   }
   return current;
 }
-function withCommandDirs(fs, names) {
+function withCommandDirs(fs, names, userDir = async () => void 0) {
   async function children2(path) {
     if (path === "/") return ["bin", "usr"];
     if (path === "/usr") return ["bin"];
     if (path === "/bin" || path === "/usr/bin") return [...await names()];
-    return void 0;
+    const own = await userDir(path);
+    return own?.size ? [...own] : void 0;
   }
   async function virtual(path) {
     if (path === "/usr" || path === "/bin" || path === "/usr/bin") return synthetic(true, path);
     const name2 = COMMAND.exec(path)?.[1];
-    return name2 !== void 0 && (await names()).has(name2) ? synthetic(false, path) : void 0;
+    if (name2 !== void 0) return (await names()).has(name2) ? synthetic(false, path) : void 0;
+    if ((await userDir(path))?.size) return synthetic(true, path);
+    const slash = path.lastIndexOf("/");
+    const own = await userDir(path.slice(0, slash));
+    return own?.has(path.slice(slash + 1)) ? synthetic(false, path) : void 0;
   }
   async function linked(path) {
     return await virtual(path) ?? virtual(await followLinks(fs, path));
@@ -12919,8 +12940,11 @@ var Launcher = class {
   createWorker;
   modulesDir;
   env;
-  catalog;
-  binfmts;
+  catalogs = /* @__PURE__ */ new Map();
+  ownCatalogs = /* @__PURE__ */ new Map();
+  binfmts = /* @__PURE__ */ new Map();
+  scopes;
+  unwatchScopes = () => void 0;
   warned = /* @__PURE__ */ new Set();
   compiled = /* @__PURE__ */ new Map();
   processes = /* @__PURE__ */ new Map();
@@ -13000,7 +13024,11 @@ var Launcher = class {
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
-    const fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
+    const fs = withCommandDirs(
+      this.base,
+      async () => new Set((await this.commands()).keys()),
+      (dir) => this.userCommandDir(dir)
+    );
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.nodes.keepsOnDisk = true;
     this.openFiles.add(this.nodes);
@@ -13018,35 +13046,99 @@ var Launcher = class {
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
     this.users = new UserDb(this.fs);
     void this.unlinked.sweep("/");
-    this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
-      this.catalog = void 0;
-      this.binfmts = void 0;
+    this.watchers.watch(
+      [this.modulesDir, this.pnpmHome],
+      { recursive: true },
+      () => this.resetCatalogs()
+    );
+    this.watchers.watch([PASSWD], { recursive: false }, () => {
+      this.scopes = void 0;
+      this.resetCatalogs();
     });
   }
   setRoutes(table) {
     this.routes.set(table);
   }
-  commands() {
-    this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
-    return this.catalog;
+  commands(scope = "") {
+    let found = this.catalogs.get(scope);
+    if (!found) {
+      found = this.roots(scope).then((roots) => scanCommands(this.base, roots));
+      this.catalogs.set(scope, found);
+    }
+    return found;
   }
-  interpreters() {
-    this.binfmts ??= this.roots().then(
-      (roots) => scanBinfmts(this.base, roots, (message3) => {
-        if (this.warned.has(message3)) return;
-        this.warned.add(message3);
-        console.warn(message3);
-      })
-    );
-    return this.binfmts;
+  ownCommands(scope) {
+    let found = this.ownCatalogs.get(scope);
+    if (!found) {
+      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.base, roots)).then((commands) => new Set(commands.keys()));
+      this.ownCatalogs.set(scope, found);
+    }
+    return found;
+  }
+  interpreters(scope = "") {
+    let found = this.binfmts.get(scope);
+    if (!found) {
+      found = this.roots(scope).then(
+        (roots) => scanBinfmts(this.base, roots, (message3) => {
+          if (this.warned.has(message3)) return;
+          this.warned.add(message3);
+          console.warn(message3);
+        })
+      );
+      this.binfmts.set(scope, found);
+    }
+    return found;
   }
-  async roots() {
-    return [this.modulesDir, ...await pnpmGlobalRoots(this.base, this.pnpmHome)];
+  async roots(scope = "") {
+    const system = [this.modulesDir, ...await pnpmGlobalRoots(this.base, this.pnpmHome)];
+    return scope ? [...await pnpmGlobalRoots(this.base, scope), ...system] : system;
+  }
+  resetCatalogs() {
+    this.catalogs.clear();
+    this.ownCatalogs.clear();
+    this.binfmts.clear();
+  }
+  userScopes() {
+    this.scopes ??= this.users.list().then(
+      (accounts) => {
+        const users = accounts.filter((account) => account.uid !== 0);
+        const homes = users.map((account) => pnpmHomeOf(account, this.pnpmHome));
+        this.unwatchScopes();
+        this.unwatchScopes = this.watchers.watch(
+          homes,
+          { recursive: true },
+          () => this.resetCatalogs()
+        );
+        return {
+          byUid: new Map(users.map((account, i) => [account.uid, homes[i]])),
+          byBin: new Map(homes.map((home) => [`${home}/bin`, home]))
+        };
+      },
+      () => ({ byUid: /* @__PURE__ */ new Map(), byBin: /* @__PURE__ */ new Map() })
+    );
+    return this.scopes;
+  }
+  async userCommandDir(dir) {
+    const scope = (await this.userScopes()).byBin.get(dir);
+    return scope === void 0 ? void 0 : this.ownCommands(scope);
+  }
+  async scopeOf(uid) {
+    return (await this.userScopes()).byUid.get(uid) ?? "";
+  }
+  async commandAt(file, scope) {
+    const system = COMMAND2.exec(file)?.[1];
+    if (system !== void 0) return (await this.commands()).get(system);
+    if (!file.includes("/")) return (await this.commands(scope)).get(file);
+    const slash = file.lastIndexOf("/");
+    const owner = (await this.userScopes()).byBin.get(file.slice(0, slash));
+    if (owner === void 0 || !(await this.ownCommands(owner)).has(file.slice(slash + 1))) {
+      return void 0;
+    }
+    return (await this.commands(owner)).get(file.slice(slash + 1));
   }
-  async resolve(file, argv0, cwd) {
-    const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
-    if (name2 !== void 0) {
-      const command = (await this.commands()).get(name2);
+  async resolve(file, argv0, cwd, scope = "") {
+    if (!file.includes("/") || COMMAND2.test(file)) {
+      const command = await this.commandAt(file, scope);
       return command && !command.script ? targetOf(command) : void 0;
     }
     const path = this.fs.resolvePath(cwd, file);
@@ -13057,6 +13149,8 @@ var Launcher = class {
       const byPath = !COMMAND2.test(path) && (await this.commands()).get(linked)?.argv0Path === true;
       return target && byPath ? { ...target, argv0: path } : target;
     }
+    const own = await this.commandAt(glue, scope);
+    if (own) return own.script ? void 0 : targetOf(own);
     const head = await this.head(glue);
     if (!head) return void 0;
     if (isWasm(head)) {
@@ -13079,45 +13173,45 @@ var Launcher = class {
       return void 0;
     }
   }
-  async scriptCommand(file) {
-    const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
-    if (name2 === void 0) return void 0;
-    const command = (await this.commands()).get(name2);
+  async scriptCommand(file, cwd, scope) {
+    const direct = !file.includes("/") || COMMAND2.test(file);
+    const at = direct ? file : await followLinks(this.base, this.fs.resolvePath(cwd, file));
+    const command = await this.commandAt(at, scope);
     return command?.script ? command : void 0;
   }
-  async interpreted(file, argv, cwd, depth = 0) {
-    const command = await this.scriptCommand(file);
+  async interpreted(file, argv, cwd, scope, depth = 0) {
+    const command = await this.scriptCommand(file, cwd, scope);
     const script = command?.script ?? this.fs.resolvePath(cwd, file);
     const head = await this.head(script);
     if (!head) return void 0;
-    const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(), script);
+    const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(scope), script);
     const words = shebang(head) ?? (binfmt ? [binfmt] : void 0);
     if (!words) return void 0;
     if (baseName(words[0]) === "env") words.shift();
     const [interp, ...rest2] = words;
     const arg = rest2.join(" ");
     const passed = [...arg ? [arg] : [], command ? script : file, ...argv.slice(1)];
-    const found = interp ? await this.resolve(interp, interp, cwd) : void 0;
+    const found = interp ? await this.resolve(interp, interp, cwd, scope) : void 0;
     if (!found) {
-      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp)) {
+      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp, cwd, scope)) {
         return void 0;
       }
-      const inner = await this.interpreted(interp, [interp, ...passed], cwd, depth + 1);
+      const inner = await this.interpreted(interp, [interp, ...passed], cwd, scope, depth + 1);
       return inner && { ...inner, target: withScriptEnv(inner.target, command) };
     }
     const target = withScriptEnv(found, command);
     return { target, args: [...target.prefix ?? [], ...passed] };
   }
-  async plan(file, argv, cwd) {
-    const direct = await this.resolve(file, argv[0] ?? file, cwd);
+  async plan(file, argv, cwd, scope) {
+    const direct = await this.resolve(file, argv[0] ?? file, cwd, scope);
     if (direct) return { target: direct, args: [...direct.prefix ?? [], ...argv.slice(1)] };
-    return this.interpreted(file, argv, cwd);
+    return this.interpreted(file, argv, cwd, scope);
   }
-  async unrunnable(file, cwd) {
+  async unrunnable(file, cwd, scope) {
     const path = this.fs.resolvePath(cwd, file);
     const head = await this.base.readFileBuffer(path).catch(() => null);
     if (!head || head[0] === 35 && head[1] === 33) return "ENOENT";
-    return binfmtOf(await this.interpreters(), path) ? "ENOENT" : "ENOEXEC";
+    return binfmtOf(await this.interpreters(scope), path) ? "ENOENT" : "ENOEXEC";
   }
   module(path) {
     return this.base.stat(path).then((st) => {
@@ -13327,10 +13421,11 @@ var Launcher = class {
   }
   spawner(ppid, report) {
     return async (req, fds) => {
-      const planned = await this.plan(req.file, req.argv, req.cwd);
+      const scope = await this.scopeOf(this.credOf(ppid).euid);
+      const planned = await this.plan(req.file, req.argv, req.cwd, scope);
       if (!planned) {
         await fds.closeAll();
-        throw new SpawnError(await this.unrunnable(req.file, req.cwd));
+        throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
       }
       const exec = req.exec ? { exec: true } : {};
       const deciding = req.exec ? void 0 : this.undecided(ppid);
@@ -13632,18 +13727,18 @@ var Launcher = class {
       ...account.umask !== void 0 ? { umask: account.umask } : {}
     };
   }
-  async starting(argv, dir) {
-    this.catalog = void 0;
-    this.binfmts = void 0;
+  async starting(argv, dir, account) {
+    this.resetCatalogs();
+    const scope = account.uid === 0 ? "" : pnpmHomeOf(account, this.pnpmHome);
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
     await this.base.mkdir(cwd, { recursive: true });
-    return { cwd, file, planned: await this.plan(file, argv, cwd) };
+    return { cwd, file, planned: await this.plan(file, argv, cwd, scope) };
   }
   async openTerminal(argv, options) {
     const account = await this.account(options.user);
-    const { cwd, file, planned } = await this.starting(argv, options.cwd);
+    const { cwd, file, planned } = await this.starting(argv, options.cwd, account);
     if (!planned) throw new Error(`${file}: command not found`);
     let leader = 0;
     const tty = new KernelTty(
@@ -13686,7 +13781,7 @@ var Launcher = class {
   }
   async run(argv, options = {}) {
     const account = await this.account(options.user);
-    const { cwd, file, planned } = await this.starting(argv, options.cwd);
+    const { cwd, file, planned } = await this.starting(argv, options.cwd, account);
     const env = this.environment(cwd, options.env, account);
     const out = [];
     const err = [];