@ai-ecoverse/slicc-kernel 1.56.1 → 1.57.0

package/dist/kernel-worker.js

@@ -216,11 +216,69 @@ function inodeOf(path) {
   return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
 }
 
+// src/fs/owners.ts
+var ROOT_OWNER = Object.freeze({ uid: 0, gid: 0 });
+var S_ISUID = 2048;
+var S_ISGID = 1024;
+var S_IXGRP = 8;
+function ownOf(entry) {
+  if (entry?.uid === void 0 || entry.gid === void 0) return void 0;
+  return { uid: entry.uid, gid: entry.gid };
+}
+function handedBy(entry) {
+  return entry?.heir ? { uid: entry.heir[0], gid: entry.heir[1] } : ownOf(entry);
+}
+function inherit(entries) {
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const found = handedBy(entries[i]);
+    if (found) return found;
+  }
+  return { ...ROOT_OWNER };
+}
+function chain(path) {
+  const parts = path.split("/").filter(Boolean);
+  return ["/", ...parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`)];
+}
+function sameOwner(a, b) {
+  return a.uid === b.uid && a.gid === b.gid;
+}
+function ownerOf(cred, mode) {
+  return { uid: cred.euid, gid: cred.egid, ...mode !== void 0 ? { mode } : {} };
+}
+function inGroup(cred, gid) {
+  return cred.egid === gid || cred.groups.includes(gid);
+}
+function mayChown(cred, current, uid, gid) {
+  if (cred.euid === 0) return true;
+  const owner = cred.euid === current.uid;
+  if (uid !== void 0 && !(owner && uid === current.uid)) return false;
+  if (gid !== void 0 && !(owner && (gid === current.gid || inGroup(cred, gid)))) return false;
+  return true;
+}
+function clearedSetId(mode) {
+  const bits2 = S_ISUID | (mode & S_IXGRP ? S_ISGID : 0);
+  return mode & 4095 & ~bits2;
+}
+async function chownAs(fs, cred, path, change) {
+  const { uid, gid, follow: follow2 } = change;
+  const st = follow2 ? await fs.stat(path) : await fs.lstat(path);
+  const current = { uid: st.uid ?? 0, gid: st.gid ?? 0 };
+  if (!fs.chown || !mayChown(cred, current, uid, gid)) throw fsError("EPERM", path);
+  const clear = st.isFile && (uid !== void 0 || gid !== void 0) ? clearedSetId(st.mode) : void 0;
+  await fs.chown(path, {
+    ...uid !== void 0 ? { uid } : {},
+    ...gid !== void 0 ? { gid } : {},
+    follow: follow2,
+    ...clear !== void 0 && clear !== (st.mode & 4095) ? { mode: clear } : {}
+  });
+}
+
 // src/fs/opfs.ts
 var S_IFDIR = 16384;
 var S_IFREG = 32768;
 var S_IFLNK = 40960;
 var PERM_MASK = 4095;
+var S_ISGID2 = 1024;
 var READ_ATTEMPTS = 3;
 var MAX_LINKS = 40;
 var CHECK_MS = 1e3;
@@ -322,6 +380,7 @@ var OpfsFs = class {
   checked = /* @__PURE__ */ new WeakMap();
   channel;
   ranged;
+  owners = false;
   constructor(root, meta = new MemoryMeta(), channel, options = {}) {
     this.root = root;
     this.meta = meta;
@@ -341,6 +400,73 @@ var OpfsFs = class {
   resolvePath(base, path) {
     return resolvePath(base, path);
   }
+  trackOwners() {
+    this.owners = true;
+  }
+  async handedTo(dir) {
+    return inherit(await this.meta.get(chain(dir)));
+  }
+  async ownerAt(path, entry) {
+    const own = ownOf(entry);
+    if (own) return own;
+    return path === "/" ? { ...ROOT_OWNER } : this.handedTo(parentOf2(path));
+  }
+  async owned(stat, path, entry) {
+    return this.owners ? { ...stat, ...await this.ownerAt(path, entry) } : stat;
+  }
+  async newFields(path, owner, directory) {
+    if (!this.owners || !owner) return void 0;
+    const entries = await this.meta.get(chain(path));
+    const self = entries.pop();
+    const parent = entries.at(-1);
+    const setgid = ((parent?.mode ?? 0) & S_ISGID2) !== 0;
+    const parentGid = (ownOf(parent) ?? inherit(entries.slice(0, -1))).gid;
+    const want = { uid: owner.uid, gid: setgid ? parentGid : owner.gid };
+    let mode = owner.mode === void 0 ? void 0 : owner.mode & PERM_MASK;
+    if (directory && setgid) mode = (mode ?? 493) | S_ISGID2;
+    const fields = {};
+    if (mode !== void 0 && mode !== (this.mode(path, directory, void 0) & PERM_MASK)) {
+      fields.mode = mode;
+    }
+    if (self) fields.heir = void 0;
+    if (ownOf(self) || !sameOwner(want, inherit(entries))) Object.assign(fields, want);
+    return Object.keys(fields).length > 0 ? fields : void 0;
+  }
+  async stampNew(path, owner, directory) {
+    const fields = await this.newFields(path, owner, directory);
+    if (fields) await this.meta.update(path, (entry) => ({ ...entry, path, ...fields }));
+  }
+  async chown(path, change) {
+    if (!this.owners) return;
+    if (change.kind === "new") {
+      const at = resolvePath((await this.locate(parentOf2(path), true)).path, baseOf(path));
+      const { uid = 0, gid = 0, mode } = change;
+      return this.stampNew(at, { uid, gid, ...mode !== void 0 ? { mode } : {} }, false);
+    }
+    const found = await this.locate(path, change.follow !== false);
+    const [stored] = found.link ? [found.link] : await this.meta.get([found.path]);
+    const current = await this.ownerAt(found.path, stored);
+    const next2 = { uid: change.uid ?? current.uid, gid: change.gid ?? current.gid };
+    const handing = found.handle?.kind === "directory" && !sameOwner(next2, current);
+    const heir = change.kind === "adopt" ? void 0 : stored?.heir ?? (handing ? [current.uid, current.gid] : void 0);
+    const ctimeMs = Date.now();
+    await this.meta.update(found.path, (entry) => {
+      const { heir: _, ...rest2 } = entry ?? found.link ?? { path: found.path };
+      return {
+        ...rest2,
+        path: found.path,
+        ...next2,
+        ...heir ? { heir } : {},
+        ...change.mode !== void 0 ? { mode: change.mode & PERM_MASK } : {},
+        ctimeMs
+      };
+    });
+  }
+  async movedOwner(source) {
+    if (!this.owners) return void 0;
+    const [stored] = source.link ? [source.link] : await this.meta.get([source.path]);
+    return ownOf(stored) ? void 0 : this.ownerAt(source.path, stored);
+  }
   async walk(parts, from, start2) {
     let dir = start2;
     for (let at = from; at < parts.length; at++) {
@@ -438,12 +564,34 @@ var OpfsFs = class {
         const link2 = await this.linkAlong(current);
         if (!link2) throw err;
         if (link2.path === current && !follow2) return { path: current, link: link2 };
-        const rest2 = current.slice(link2.path.length);
-        current = resolvePath(parentOf2(link2.path), `${link2.link}${rest2}`);
+        const target = `${link2.link}${current.slice(link2.path.length)}`;
+        current = target.split("/").includes("..") ? await this.physical(parentOf2(link2.path), target, hops + 1) : resolvePath(parentOf2(link2.path), target);
       }
     }
     throw fsError("ELOOP", path);
   }
+  async physical(base, path, used) {
+    let done4 = [];
+    let todo = (path.startsWith("/") ? path : `${base}/${path}`).split("/").filter((p) => p !== "" && p !== ".");
+    for (let hops = used; todo.length > 0; ) {
+      const part = todo.shift();
+      if (part === "..") done4.pop();
+      else if (!todo.includes("..")) done4.push(part);
+      else {
+        const at = `/${[...done4, part].join("/")}`;
+        const st = await this.lstat(at);
+        if (!st.isSymbolicLink && !st.isDirectory) throw fsError("ENOTDIR", at);
+        if (!st.isSymbolicLink) done4.push(part);
+        else if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
+        else {
+          const link2 = await this.readlink(at);
+          if (link2.startsWith("/")) done4 = [];
+          todo = [...link2.split("/").filter((p) => p !== "" && p !== "."), ...todo];
+        }
+      }
+    }
+    return `/${done4.join("/")}`;
+  }
   mode(path, directory, meta) {
     const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
     return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
@@ -511,9 +659,15 @@ var OpfsFs = class {
     };
   }
   async describe(found) {
-    if (found.link) return this.linkStat(found.link);
-    const [meta] = await this.meta.get([found.path]);
-    return this.statOf(found.path, found.handle, meta);
+    if (found.link) return this.owned(this.linkStat(found.link), found.path, found.link);
+    if (!this.owners) {
+      const [meta2] = await this.meta.get([found.path]);
+      return this.statOf(found.path, found.handle, meta2);
+    }
+    const entries = await this.meta.get(chain(found.path));
+    const meta = entries.pop();
+    const stat = await this.statOf(found.path, found.handle, meta);
+    return { ...stat, ...ownOf(meta) ?? inherit(entries) };
   }
   async stat(path) {
     return this.describe(await this.locate(path, true));
@@ -603,14 +757,15 @@ var OpfsFs = class {
         (parent) => parent.getFileHandle(name2, { create: true })
       );
       if (!existed) this.touch(parentOf2(target));
-      return [handle, existed];
+      return [handle, existed, target];
     } catch (err) {
       const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
       throw code ? fsError(code, path) : translate(err, path);
     }
   }
-  async writeFile(path, content) {
-    const [file, existed] = await this.fileFor(path);
+  async writeFile(path, content, owner) {
+    const [file, existed, target] = await this.fileFor(path);
+    if (!existed) await this.stampNew(target, owner, false);
     if (!existed && content.length === 0) return;
     const writable = await file.createWritable();
     await writable.write(content);
@@ -635,11 +790,13 @@ var OpfsFs = class {
     const [dir, children2] = await this.listing(path);
     const base = dir === "/" ? "" : dir;
     const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
+    const handed2 = this.owners ? await this.handedTo(dir) : void 0;
+    const owned = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
     return Promise.all(
       children2.map(async ([name2, child], i) => {
-        if (!isHandle(child)) return [name2, this.linkStat(child)];
+        if (!isHandle(child)) return [name2, owned(this.linkStat(child), child)];
         const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
-        return [name2, stat];
+        return [name2, stat && owned(stat, metas[i])];
       })
     );
   }
@@ -657,11 +814,22 @@ var OpfsFs = class {
     }
     const [entry] = await this.meta.get([path]);
     if (entry?.link !== void 0) throw fsError("EEXIST", path);
-    if (options.recursive) await this.mkdir(parentOf2(path), options);
+    const { owner } = options;
+    if (options.recursive) {
+      const mode = owner?.parents;
+      const above = owner && {
+        uid: owner.uid,
+        gid: owner.gid,
+        ...mode ? { mode, parents: mode } : {}
+      };
+      await this.mkdir(parentOf2(path), { recursive: true, ...above ? { owner: above } : {} });
+    }
     const parent = await this.locate(parentOf2(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
-    this.touch(parent.path, `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`);
+    const made = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
+    await this.stampNew(made, owner, true);
+    this.touch(parent.path, made);
   }
   async rm(path, options = {}) {
     let found;
@@ -708,9 +876,11 @@ var OpfsFs = class {
       throw fsError("ENOTEMPTY", to);
     }
     const now = Date.now();
+    const moving = await this.movedOwner(source);
     const carry = (entry) => ({
       ino: inodeOf(source.path),
       ...entry,
+      ...moving,
       path: destination,
       ctimeMs: now
     });
@@ -784,7 +954,7 @@ var OpfsFs = class {
     const target = await dir.getDirectoryHandle(name2, { create: true });
     for await (const child of handle.values()) await this.copy(child, target, child.name);
   }
-  async symlink(target, path) {
+  async symlink(target, path, owner) {
     const parent = await this.locate(parentOf2(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const at = resolvePath(parent.path, baseOf(path));
@@ -795,13 +965,15 @@ var OpfsFs = class {
       throw fsError("EEXIST", path);
     }
     const now = Date.now();
+    const fields = await this.newFields(at, owner && { uid: owner.uid, gid: owner.gid }, false);
     await this.meta.update(at, () => ({
       path: at,
       link: target,
       dir: parent.path,
       ino: inodeOf(at),
       mtimeMs: now,
-      ctimeMs: now
+      ctimeMs: now,
+      ...fields
     }));
     this.touch(parent.path);
   }
@@ -2445,12 +2617,30 @@ function userEnv(account, system) {
     PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
   };
 }
+function homeGroupOf(groups, name2) {
+  if (name2 === void 0) return void 0;
+  const found = groups.find((g) => g.name === name2);
+  if (!found) throw fsError("ENOENT", `no group ${name2}`);
+  return found;
+}
 var UserDb = class {
   fs;
+  owners;
   umasks = /* @__PURE__ */ new Map();
   writing = Promise.resolve();
-  constructor(fs) {
+  constructor(fs, owners = false) {
     this.fs = fs;
+    this.owners = owners;
+  }
+  async stampHome(row, shared) {
+    const home = this.fs.resolvePath("/", row.home);
+    if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
+    if (await this.fs.realpath?.(home, false).catch(() => void 0) !== home) return;
+    if (!(await this.fs.lstat(home)).isDirectory) return;
+    const gid = shared?.gid ?? row.gid;
+    await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
+    const mode = shared ? 1512 : row.name.startsWith("scoop-") ? 488 : 448;
+    await this.fs.chmod(home, mode);
   }
   async read(path, fallback) {
     try {
@@ -2550,8 +2740,12 @@ var UserDb = class {
       const users = parsed(passwd);
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
+      const shared = homeGroupOf(groups, options.homeGroup);
       if (found) {
-        if (found.uid >= FIRST_UID && found.uid <= LAST_UID) await this.provision(found);
+        if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
+          await this.provision(found);
+          await this.stampHome(found, shared);
+        }
         remember();
         return this.account(found, groups);
       }
@@ -2571,6 +2765,7 @@ var UserDb = class {
       await this.fs.mkdir(home, { recursive: true });
       try {
         await this.provision(row);
+        await this.stampHome(row, shared);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -2639,7 +2834,7 @@ async function realpath(fs, path) {
   }
   return resolved || "/";
 }
-async function fsCall(fs, method, args) {
+async function fsCall(fs, method, args, owner) {
   const path = (i) => fs.resolvePath("/", String(args[i]));
   switch (method) {
     case "readFile": {
@@ -2647,7 +2842,7 @@ async function fsCall(fs, method, args) {
       return { result: bytes, transfer: [bytes.buffer] };
     }
     case "writeFile":
-      await fs.writeFile(path(0), args[1]);
+      await fs.writeFile(path(0), args[1], owner);
       return { result: true };
     case "stat":
       return { result: await fs.stat(path(0)) };
@@ -2656,7 +2851,7 @@ async function fsCall(fs, method, args) {
     case "readdir":
       return { result: await fs.readdir(path(0)) };
     case "mkdir":
-      await fs.mkdir(path(0), { recursive: true });
+      await fs.mkdir(path(0), owner ? { recursive: true, owner } : { recursive: true });
       return { result: true };
     case "rm":
       await fs.rm(path(0), { recursive: true, force: args[1] === true });
@@ -2667,7 +2862,7 @@ async function fsCall(fs, method, args) {
     case "realpath":
       return { result: await realpath(fs, String(args[0])) };
     case "symlink":
-      await fs.symlink(String(args[0]), path(1));
+      await fs.symlink(String(args[0]), path(1), owner);
       return { result: true };
     case "readlink":
       return { result: await fs.readlink(path(0)) };
@@ -2689,6 +2884,9 @@ function dialFor(l, req, open) {
   );
   return { result: port2, transfer: [port2] };
 }
+function ownerFor(l, self) {
+  return l.owners && self ? { uid: self.uid, gid: self.gid } : void 0;
+}
 async function accountOf(l, user) {
   const found = await l.users.lookup(user);
   if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
@@ -2816,6 +3014,7 @@ function serveClient(port, host) {
       hello: {
         protocol: PROTOCOL,
         traits: transport.traits,
+        ...launcher.usersMode ? { users: launcher.usersMode } : {},
         ...host.lock ? { lock: host.lock } : {}
       }
     });
@@ -2881,7 +3080,7 @@ function serveClient(port, host) {
         if (!FS_METHODS.includes(req.method)) {
           throw new Error(`unknown file system call ${req.method}`);
         }
-        return fsCall(l.fs, req.method, req.args);
+        return fsCall(l.fs, req.method, req.args, ownerFor(l, self));
       case "watch":
       case "unwatch":
         return watchOp(l, req, watches, send);
@@ -3904,10 +4103,10 @@ var RealmProxy = class {
   }
   async bridge(ctx, socket, hangup) {
     const stop = this.stop.signal;
-    let chain = Promise.resolve();
+    let chain2 = Promise.resolve();
     const toGuest = (bytes) => {
-      chain = chain.then(() => ctx.sink.write(bytes, stop));
-      return chain;
+      chain2 = chain2.then(() => ctx.sink.write(bytes, stop));
+      return chain2;
     };
     const done4 = new AbortController();
     const reading = AbortSignal.any([stop, done4.signal, hangup]);
@@ -5614,7 +5813,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0) {
         throw err;
       }
     },
-    writeFile: (path, content) => fs.writeFile(path, content),
+    writeFile: (path, content, owner) => fs.writeFile(path, content, owner),
     async exists(path) {
       return await fs.exists(path) || await linked(path) !== void 0;
     },
@@ -5652,9 +5851,10 @@ function withCommandDirs(fs, names, userDir = async () => void 0) {
     mkdir: (path, options) => fs.mkdir(path, options),
     rm: (path, options) => fs.rm(path, options),
     rename: (from, to) => fs.rename(from, to),
-    symlink: (target, path) => fs.symlink(target, path),
+    symlink: (target, path, owner) => fs.symlink(target, path, owner),
     readlink: (path) => fs.readlink(path),
     ...fs.realpath ? { realpath: fs.realpath.bind(fs) } : {},
+    ...fs.chown ? { chown: fs.chown.bind(fs) } : {},
     chmod: (path, mode) => fs.chmod(path, mode),
     utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime),
     lutimes: (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
@@ -5971,6 +6171,7 @@ var FsWatchers = class {
       rename: after(fs.rename.bind(fs), (from, to) => [from, to]),
       symlink: after(fs.symlink.bind(fs), (_target, path) => [path]),
       chmod: after(fs.chmod.bind(fs), (path) => [path]),
+      ...fs.chown ? { chown: after(fs.chown.bind(fs), (path) => [path]) } : {},
       utimes: after(fs.utimes.bind(fs), (path) => [path]),
       lutimes: after(
         (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
@@ -6042,13 +6243,13 @@ var ChildTable = class {
     if (!this.forker) throw new SpawnError("ENOSYS");
     return this.track(state, this.parentFds.fork(), /* @__PURE__ */ new Map(), this.forker);
   }
-  async spawn(req, stdio, inherit = []) {
+  async spawn(req, stdio, inherit2 = []) {
     if (!this.spawner) throw new SpawnError("ENOSYS");
     const fds = new FdTable();
     const captured = /* @__PURE__ */ new Map();
     try {
       for (const [n, slot] of stdio.entries()) fds.installAt(n, this.openSlot(slot, n, captured));
-      for (const slot of inherit) {
+      for (const slot of inherit2) {
         if (slot.fd <= 2) continue;
         if ("device" in slot) {
           fds.installAt(slot.fd, deviceFile(slot.device, slot.access));
@@ -6129,8 +6330,8 @@ var ChildTable = class {
   candidates(pid, flags) {
     const all = [...this.children];
     if (pid > 0) return all.filter(([p]) => p === pid);
-    const inGroup = flags.inGroup;
-    return pid === -1 || !inGroup ? all : all.filter(([p]) => inGroup(p));
+    const inGroup2 = flags.inGroup;
+    return pid === -1 || !inGroup2 ? all : all.filter(([p]) => inGroup2(p));
   }
   async nextChange(candidates, flags, interrupt) {
     let wake;
@@ -6851,10 +7052,10 @@ var MountFs = class {
     }
     return concat4(chunks, total);
   }
-  async writeFile(path, content) {
+  async writeFile(path, content, owner) {
     const real = await this.follow(path, 0, true);
     const found = this.at(real);
-    if (!found) return this.base.writeFile(real, content);
+    if (!found) return this.base.writeFile(real, content, owner);
     const { mount, rel: rel2 } = found;
     this.writable(mount, real);
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
@@ -7121,9 +7322,9 @@ var MountFs = class {
       this.table.forget(a.mount, normalizePath(to));
     }
   }
-  async symlink(target, path) {
+  async symlink(target, path, owner) {
     const found = this.at(path);
-    if (!found) return this.base.symlink(target, path);
+    if (!found) return this.base.symlink(target, path, owner);
     this.writable(found.mount, normalizePath(path));
     if (!found.mount.caps.symlinks)
       throw errnoError("EPERM", `${path}: this file system has no symlinks`);
@@ -7141,6 +7342,15 @@ var MountFs = class {
     if (!found) return this.base.readlink(path);
     return await found.mount.conn.call({ op: "readlink", path: found.rel });
   }
+  async chown(path, change) {
+    const real = change.follow === false || change.kind === "new" ? path : await this.follow(path);
+    if (this.at(real)) {
+      if (change.kind === "new") return;
+      throw errnoError("EPERM", `${path}: this file system keeps no owners`);
+    }
+    if (!this.base.chown) throw errnoError("EPERM", path);
+    return this.base.chown(real, change);
+  }
   async chmod(path, mode) {
     const found = this.at(path);
     if (!found) return this.base.chmod(path, mode);
@@ -7215,7 +7425,9 @@ function statJson(s) {
     ...s.readonly ? { readonly: true } : {},
     ...s.maxFile ? { maxFile: s.maxFile } : {},
     ...s.ranged ? { ranged: true } : {},
-    ...s.version !== void 0 ? { version: s.version } : {}
+    ...s.version !== void 0 ? { version: s.version } : {},
+    ...s.uid !== void 0 ? { uid: s.uid } : {},
+    ...s.gid !== void 0 ? { gid: s.gid } : {}
   };
 }
 async function readdirStat(fs, dir) {
@@ -7230,13 +7442,34 @@ var done = { ok: true, kind: "void" };
 function json2(value) {
   return { ok: true, kind: "json", json: value };
 }
+function ownerFor2(entry, mode) {
+  const cred = entry.cred?.();
+  if (!cred) return void 0;
+  return ownerOf(cred, mode === void 0 ? void 0 : mode & ~(entry.umask?.() ?? 18));
+}
+function mkdirOptions(entry, mode = 511) {
+  const owner = ownerFor2(entry, mode);
+  if (!owner) return { recursive: true };
+  const parents = 511 & ~(entry.umask?.() ?? 18) | 192;
+  return { recursive: true, owner: { ...owner, parents } };
+}
+async function chown(entry, path, req) {
+  const cred = entry.cred?.();
+  if (!cred) return done;
+  await chownAs(entry.fs, cred, path, {
+    ...req.uid !== void 0 ? { uid: req.uid } : {},
+    ...req.gid !== void 0 ? { gid: req.gid } : {},
+    follow: req.op === "chown"
+  });
+  return done;
+}
 async function run(entry, path, req) {
   const { fs, cwd } = entry;
   switch (req.op) {
     case "read":
       return { ok: true, kind: "bytes", bytes: await fs.readFileBuffer(path) };
     case "write":
-      await fs.writeFile(path, req.body ?? new Uint8Array(0));
+      await fs.writeFile(path, req.body ?? new Uint8Array(0), ownerFor2(entry, 438));
       return done;
     case "exists":
       return json2(await fs.exists(path));
@@ -7249,7 +7482,7 @@ async function run(entry, path, req) {
     case "readdir-stat":
       return json2(await readdirStat(fs, path));
     case "mkdir":
-      await fs.mkdir(path, { recursive: true });
+      await fs.mkdir(path, mkdirOptions(entry, req.mode));
       return done;
     case "rm":
       await fs.rm(path, { recursive: true });
@@ -7270,10 +7503,10 @@ async function run(entry, path, req) {
       await fs.rm(path, { recursive: true });
       return done;
     case "symlink":
-      await fs.symlink(req.arg2 ?? "", path);
+      await fs.symlink(req.arg2 ?? "", path, ownerFor2(entry));
       return done;
     case "create":
-      await createExclusive(fs, path);
+      await createExclusive(fs, path, ownerFor2(entry, req.mode ?? 438));
       return done;
     case "readlink":
       return json2(await fs.readlink(path));
@@ -7286,6 +7519,9 @@ async function run(entry, path, req) {
     case "lutimes":
       await lutimesOf(fs, path, new Date(req.atimeMs ?? 0), new Date(req.mtimeMs ?? 0));
       return done;
+    case "chown":
+    case "lchown":
+      return chown(entry, path, req);
     case "pread":
     case "pwrite":
     case "truncate":
@@ -7294,14 +7530,14 @@ async function run(entry, path, req) {
       return { ok: false, errno: "EINVAL", message: `sync-fs: unknown op '${req.op}'` };
   }
 }
-async function createExclusive(fs, path) {
-  if (fs.createExclusive) return fs.createExclusive(path);
+async function createExclusive(fs, path, owner) {
+  if (fs.createExclusive) return fs.createExclusive(path, owner);
   if (await fs.lstat(path).then(
     () => true,
     () => false
   ))
     throw syncError("EEXIST", path);
-  await fs.writeFile(path, new Uint8Array(0));
+  await fs.writeFile(path, new Uint8Array(0), owner);
 }
 async function ranged(fs, path, req) {
   const ops = rangedOps(fs);
@@ -9496,12 +9732,12 @@ var VfsNodes = class {
     }
     return walk();
   }
-  createExclusive(path) {
+  createExclusive(path, owner) {
     return this.onEntry(path, async () => {
       const node = this.byPath.get(path);
       const held = node ? await node.serial(async () => node.holds()) : false;
       if (held || await present(this.fs, path)) throw fsError("EEXIST", path);
-      await this.fs.writeFile(path, new Uint8Array(0));
+      await this.fs.writeFile(path, new Uint8Array(0), owner);
     });
   }
   open(path, pin, writable = false) {
@@ -9631,6 +9867,11 @@ var MAX_LINKS5 = 40;
 function parentOf6(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
+async function mustBeDir(fs, path) {
+  if (!fs.lstat) return;
+  const st = await fs.lstat(path);
+  if (st.isDirectory !== true) throw fsError("ENOTDIR", path);
+}
 async function linkOf(fs, path) {
   return fs.readlink?.(path).catch(() => void 0);
 }
@@ -9647,6 +9888,7 @@ async function realDir(fs, dir, budget = { hops: 0 }) {
     const next2 = at === "/" ? `/${part}` : `${at}/${part}`;
     const link2 = await linkOf(fs, next2);
     if (link2 === void 0) {
+      if (queue.find((p) => p !== ".") === "..") await mustBeDir(fs, next2);
       at = next2;
       continue;
     }
@@ -9712,9 +9954,9 @@ function keepingOpen(fs, nodes) {
         nodes.renamed(a, b);
       });
     },
-    writeFile: (path, content) => nodes.onEntry(fs.resolvePath("/", path), () => fs.writeFile(path, content)),
-    createExclusive: async (path) => nodes.createExclusive(await nodes.entryKey(fs.resolvePath("/", path))),
-    symlink: (target, path) => nodes.onEntry(fs.resolvePath("/", path), () => fs.symlink(target, path)),
+    writeFile: (path, content, owner) => nodes.onEntry(fs.resolvePath("/", path), () => fs.writeFile(path, content, owner)),
+    createExclusive: async (path, owner) => nodes.createExclusive(await nodes.entryKey(fs.resolvePath("/", path)), owner),
+    symlink: (target, path, owner) => nodes.onEntry(fs.resolvePath("/", path), () => fs.symlink(target, path, owner)),
     mkdir: (path, options) => nodes.onEntry(fs.resolvePath("/", path), () => fs.mkdir(path, options))
   };
 }
@@ -9985,9 +10227,9 @@ var WasmProcess = class {
     return "deliver";
   }
   async spawn(req) {
-    const { file, argv, env, cwd, stdio, inherit, exec } = req;
+    const { file, argv, env, cwd, stdio, inherit: inherit2, exec } = req;
     const spawned = { file, argv, env, cwd, ...exec ? { exec } : {} };
-    const pid = await this.children.spawn(spawned, stdio, inherit);
+    const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (!exec) return pid;
     if (this.killed) void Promise.allSettled([this.options.kill?.(pid, SIG.KILL)]);
     else this.adoptExec(pid);
@@ -10152,12 +10394,14 @@ var WasmProcess = class {
       }
       const open = { ...req, path };
       if (req.exclusive) {
-        await nodes.createExclusive(path);
+        await nodes.createExclusive(path, this.newOwner());
         this.fds.installAt(fd, this.openVfsFile(open));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
+          const fresh = this.options.owners && !await present(this.options.fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open));
           await this.fds.get(fd).file.stat?.();
+          if (fresh) await this.options.fs.chown?.(path, { ...this.newOwner(), kind: "new" });
         });
       } else {
         this.fds.installAt(fd, this.openVfsFile(open));
@@ -10171,6 +10415,10 @@ var WasmProcess = class {
     }
     return fd;
   }
+  newOwner() {
+    if (!this.options.owners) return void 0;
+    return { uid: this.cred.euid, gid: this.cred.egid, mode: 438 & ~this.umask };
+  }
   async openProc(req, path) {
     return this.fds.install(await this.procFile(req, path), 3);
   }
@@ -10817,6 +11065,7 @@ function processInit(opts, sab, umask, cred, lane) {
     sab,
     umask,
     cred,
+    ...opts.owners ? { owners: true } : {},
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {}
   };
   if (opts.program.abi === "js") {
@@ -10840,8 +11089,9 @@ function inherited(opts) {
     ...opts.cred ? { cred: opts.cred } : {}
   };
 }
-function holdingToken(opts, holds) {
+function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
+    ...opts.owners ? caller : {},
     fs: opts.fs,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
@@ -10857,6 +11107,7 @@ function holdingToken(opts, holds) {
 function processOptions(opts, header3, hooks) {
   return {
     ...inherited(opts),
+    ...opts.owners ? { owners: true } : {},
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
     ...opts.settling ? { settling: opts.settling } : {},
@@ -10901,7 +11152,10 @@ function spawnWasmProcess(opts) {
   publishStops(process, header3);
   const holds = new HeldPaths();
   opts.held?.add(holds);
-  const token = holdingToken(opts, holds);
+  const token = holdingToken(opts, holds, {
+    cred: () => process.cred,
+    umask: () => process.umask
+  });
   process.keptPath = (path) => holds.keptAt(path)?.hidden;
   process.keptHandle = (handle2) => holds.keptFor(handle2)?.hidden;
   const worker = opts.createWorker();
@@ -11262,26 +11516,26 @@ function replayingHops(inner, heldMs = HELD_MS) {
     void entry.final.cancel().catch(() => void 0);
   };
   const keyOf2 = (owner, method, url) => `${owner} ${method} ${url}`;
-  const hold = (key, chain) => {
+  const hold = (key, chain2) => {
     drop(key);
-    const mine = [...held.keys()].filter((k) => held.get(k)?.owner === chain.owner);
+    const mine = [...held.keys()].filter((k) => held.get(k)?.owner === chain2.owner);
     if (mine.length >= HELD_PER_OWNER) drop(mine[0]);
     if (held.size >= HELD_MAX) drop(held.keys().next().value);
     const timer = setTimeout(() => drop(key), heldMs);
     timer.unref?.();
-    held.set(key, { ...chain, timer });
+    held.set(key, { ...chain2, timer });
   };
-  const replay = (chain) => {
-    const [hop, ...rest2] = chain.hops;
+  const replay = (chain2) => {
+    const [hop, ...rest2] = chain2.hops;
     const location = hop && header2(hop.headers, "location");
-    if (!hop || location === void 0) return chain.final;
+    if (!hop || location === void 0) return chain2.final;
     const target = new URL(location, hop.url);
     target.hash = "";
-    const method = followedWith(hop.status, chain.method);
+    const method = followedWith(hop.status, chain2.method);
     const away = target.origin !== new URL(hop.url).origin;
-    const print = away ? unauthorized(chain.fingerprint) : chain.fingerprint;
-    hold(keyOf2(chain.owner, method, target.href), {
-      ...chain,
+    const print = away ? unauthorized(chain2.fingerprint) : chain2.fingerprint;
+    hold(keyOf2(chain2.owner, method, target.href), {
+      ...chain2,
       method,
       fingerprint: print,
       hops: rest2
@@ -12870,6 +13124,11 @@ var DECIDE_MS = 100;
 var INIT_PID = 1;
 var SHARED_DIRS = ["/tmp", "/home"];
 var encoder3 = new TextEncoder();
+var USERS_MODES = ["off", "report", "enforce"];
+function usersMode(mode = "off") {
+  if (USERS_MODES.includes(mode)) return mode;
+  throw new Error(`users must be 'off', 'report' or 'enforce', not ${String(mode)}`);
+}
 function baseName(path) {
   return path.slice(path.lastIndexOf("/") + 1);
 }
@@ -12997,10 +13256,13 @@ var Launcher = class {
   processMounts;
   booting = new AbortController();
   fstab = Promise.resolve([]);
+  usersMode;
   nextPid = 1e3;
   boot = Date.now();
   terminals = 0;
   constructor(options) {
+    this.usersMode = usersMode(options.users);
+    if (this.owners) options.fs.trackOwners?.();
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
       busy: (target) => [...this.openFiles].some((nodes) => nodes.holds(target)) || heldUnder(this.held, target),
@@ -13054,7 +13316,7 @@ var Launcher = class {
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
-    this.users = new UserDb(this.fs);
+    this.users = new UserDb(this.fs, this.owners);
     void this.unlinked.sweep("/");
     this.watchers.watch(
       [this.modulesDir, this.pnpmHome],
@@ -13066,6 +13328,9 @@ var Launcher = class {
       this.resetCatalogs();
     });
   }
+  get owners() {
+    return this.usersMode !== "off";
+  }
   setRoutes(table) {
     this.routes.set(table);
   }
@@ -13324,6 +13589,7 @@ var Launcher = class {
       ...req.ignored ? { ignored: req.ignored } : {},
       ...req.umask !== void 0 ? { umask: req.umask } : {},
       cred: req.cred,
+      ...this.owners ? { owners: true } : {},
       program: req.program,
       argv0: req.argv0,
       args: req.args,
@@ -13902,6 +14168,12 @@ function usersOp(l, req) {
   if (req.op === "users-remove") return l.users.remove(req.name, req.options);
   return l.users.list();
 }
+function hostOptions(req) {
+  return {
+    ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
+    ...req.users !== void 0 ? { users: req.users } : {}
+  };
+}
 function serveKernel(port, deps) {
   let launcher;
   let remote;
@@ -13976,7 +14248,7 @@ function serveKernel(port, deps) {
         ...deps.createDriverWorker ? { createDriverWorker: deps.createDriverWorker } : {},
         ...req.modules ? { modules: req.modules } : {},
         ...req.env ? { env: req.env } : {},
-        ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
+        ...hostOptions(req),
         ...net,
         ...media ? { media } : {},
         onMountPending: (medium) => port.postMessage({ medium }),