@ai-ecoverse/slicc-kernel 1.56.2 → 1.57.1

package/dist/node-process-worker.js

@@ -533,10 +533,26 @@ function pathInode(path) {
   }
   return h;
 }
-function cachingBridge(bridge, now = () => performance.now()) {
-  const stats = /* @__PURE__ */ new Map();
-  const lstats = /* @__PURE__ */ new Map();
+function inoKey(st) {
+  return "ino" in st && typeof st.ino === "number" ? st.ino % 4294967296 | 0 : 0;
+}
+function pathHash(path) {
+  let h = 2166136261;
+  for (let i = 0; i < path.length; i++) h = Math.imul(h ^ path.charCodeAt(i), 16777619);
+  return h === 0 ? 1 : h;
+}
+function index(map, key, path) {
+  const paths = map.get(key) ?? /* @__PURE__ */ new Set();
+  paths.add(path);
+  map.set(key, paths);
+}
+function cachingBridge(bridge, now = () => performance.now(), shared) {
+  const blind = shared !== void 0 && shared.length * 4 < SHARED_IDS_BYTES;
+  const cache = new StatCache(blind ? void 0 : shared);
+  const { stats, lstats } = cache;
   const cached = (map, path, get) => {
+    if (blind) return get();
+    cache.fresh();
     let hit = map.get(path);
     if (hit === void 0 || "until" in hit && hit.until <= now()) {
       try {
@@ -544,22 +560,29 @@ function cachingBridge(bridge, now = () => performance.now()) {
       } catch (e) {
         hit = { error: e, until: now() + MISS_TTL_MS };
       }
-      map.set(path, hit);
+      cache.put(map, path, hit);
     }
     if ("until" in hit) throw hit.error;
     return hit;
   };
-  const invalidate = () => {
-    stats.clear();
-    lstats.clear();
+  const invalidate = () => cache.mutated([]);
+  const touched = (path, ino) => cache.changed(path, ino);
+  const mutating = (op, ...paths) => {
+    try {
+      return op();
+    } finally {
+      cache.mutated(paths);
+    }
   };
-  const mutating = (op) => {
+  const rewriting = (p, op, ...also) => {
+    const ino = cache.inoOf(p, () => bridge.stat(p));
     try {
       return op();
     } finally {
-      invalidate();
+      cache.mutated([p, ...also], ino);
     }
   };
+  const entry = (p) => [p, p.slice(0, p.lastIndexOf("/")) || "/"];
   return {
     readFile: (p) => bridge.readFile(p),
     readdir: (p) => bridge.readdir(p),
@@ -567,9 +590,9 @@ function cachingBridge(bridge, now = () => performance.now()) {
       const list = bridge.readdirStat(p);
       const base = p === "/" ? "" : p;
       for (const [name2, st] of list) {
-        if (!st) continue;
-        lstats.set(`${base}/${name2}`, st);
-        if (!st.isSymbolicLink) stats.set(`${base}/${name2}`, st);
+        if (!st || blind) continue;
+        cache.put(lstats, `${base}/${name2}`, st);
+        if (!st.isSymbolicLink) cache.put(stats, `${base}/${name2}`, st);
       }
       return list;
     },
@@ -584,40 +607,41 @@ function cachingBridge(bridge, now = () => performance.now()) {
         return false;
       }
     },
-    writeFile: (p, bytes, open) => mutating(() => bridge.writeFile(p, bytes, open)),
-    mkdir: (p) => mutating(() => bridge.mkdir(p)),
+    writeFile: (p, bytes, open) => rewriting(p, () => bridge.writeFile(p, bytes, open), ...entry(p).slice(1)),
+    mkdir: (p) => mutating(() => bridge.mkdir(p), ...entry(p)),
     rm: (p) => mutating(() => bridge.rm(p)),
     rename: (from, to) => mutating(() => bridge.rename(from, to)),
     unlink: (p) => mutating(() => bridge.unlink(p)),
     rmdir: (p) => mutating(() => bridge.rmdir(p)),
-    symlink: (target, link) => mutating(() => bridge.symlink(target, link)),
-    chmod: (p, mode) => mutating(() => bridge.chmod(p, mode)),
-    utimes: (p, a, m) => mutating(() => bridge.utimes(p, a, m)),
-    lutimes: (p, a, m) => mutating(() => bridge.lutimes(p, a, m)),
+    symlink: (target, link) => mutating(() => bridge.symlink(target, link), ...entry(link)),
+    chmod: (p, mode) => rewriting(p, () => bridge.chmod(p, mode)),
+    utimes: (p, a, m) => rewriting(p, () => bridge.utimes(p, a, m)),
+    lutimes: (p, a, m) => mutating(() => bridge.lutimes(p, a, m), p),
     ...bridge.hold ? { hold: bridge.hold.bind(bridge) } : {},
     ...bridge.kept ? { kept: bridge.kept.bind(bridge) } : {},
-    ...bridge.pinned ? { pinned: (handle) => pinnedIo(bridge, handle, mutating) } : {},
-    ...bridge.create ? { create: (p) => mutating(() => bridge.create?.(p)) } : {},
+    ...bridge.pinned ? { pinned: (handle) => pinnedIo(bridge, handle, rewriting) } : {},
+    ...bridge.create ? { create: (p) => mutating(() => bridge.create?.(p), ...entry(p)) } : {},
     ...bridge.pread && bridge.pwrite && bridge.truncate ? {
       pread: bridge.pread.bind(bridge),
-      pwrite: (p, at, bytes, transfer) => mutating(() => bridge.pwrite?.(p, at, bytes, transfer)),
-      truncate: (p, size) => mutating(() => bridge.truncate?.(p, size))
+      pwrite: (p, at, bytes, transfer) => rewriting(p, () => bridge.pwrite?.(p, at, bytes, transfer)),
+      truncate: (p, size) => rewriting(p, () => bridge.truncate?.(p, size))
     } : {},
-    invalidate
+    invalidate,
+    touched
   };
 }
-function pinnedIo(bridge, handle, mutating) {
+function pinnedIo(bridge, handle, rewriting) {
   const io = bridge.pinned(handle);
   const { pread, pwrite, truncate } = io;
   return {
     readFile: (p) => io.readFile(p),
-    writeFile: (p, bytes, open) => mutating(() => io.writeFile(p, bytes, open)),
+    writeFile: (p, bytes, open) => rewriting(p, () => io.writeFile(p, bytes, open)),
     pread: (p, at, n, version) => pread(p, at, n, version),
-    pwrite: (p, at, bytes, transfer) => mutating(() => pwrite(p, at, bytes, transfer)),
-    truncate: (p, size) => mutating(() => truncate(p, size))
+    pwrite: (p, at, bytes, transfer) => rewriting(p, () => pwrite(p, at, bytes, transfer)),
+    truncate: (p, size) => rewriting(p, () => truncate(p, size))
   };
 }
-var WasiError, FileBuffer, LocalFile, MAX_LINKS, MISS_TTL_MS;
+var WasiError, FileBuffer, LocalFile, MAX_LINKS, MISS_TTL_MS, FS_GEN, RING, RING_SIZE, SLOT, SHARED_IDS_BYTES, StatCache;
 var init_wasi_files = __esm({
   "src/process/wasi/wasi-files.ts"() {
     "use strict";
@@ -807,6 +831,110 @@ var init_wasi_files = __esm({
     };
     MAX_LINKS = 40;
     MISS_TTL_MS = 20;
+    FS_GEN = 4;
+    RING = 8;
+    RING_SIZE = 64;
+    SLOT = 3;
+    SHARED_IDS_BYTES = (RING + RING_SIZE * SLOT) * 4;
+    StatCache = class {
+      stats = /* @__PURE__ */ new Map();
+      lstats = /* @__PURE__ */ new Map();
+      byHash = /* @__PURE__ */ new Map();
+      byIno = /* @__PURE__ */ new Map();
+      shared;
+      seen;
+      constructor(shared) {
+        this.shared = shared;
+        this.seen = shared ? Atomics.load(shared, FS_GEN) : 0;
+      }
+      put(map, path, entry) {
+        map.set(path, entry);
+        if (!this.shared) return;
+        index(this.byHash, pathHash(path), path);
+        const ino = inoKey(entry);
+        if (ino !== 0) index(this.byIno, ino, path);
+      }
+      fresh() {
+        if (!this.shared) return;
+        const now = Atomics.load(this.shared, FS_GEN);
+        if (now === this.seen) return;
+        this.replay(now);
+        this.seen = now;
+      }
+      changed(path, ino = 0) {
+        const key = ino % 4294967296 | 0;
+        if (this.shared) {
+          const g = this.publish(this.shared, path === void 0 ? 0 : pathHash(path), key);
+          this.replay(g - 1);
+          this.seen = g;
+          if (path === void 0) this.clear();
+          else this.drop(pathHash(path), key);
+        }
+        if (path === void 0) return;
+        this.stats.delete(path);
+        this.lstats.delete(path);
+      }
+      mutated(paths, ino = 0) {
+        this.clear();
+        if (!this.shared) return;
+        const key = ino % 4294967296 | 0;
+        for (const [i, hash] of (paths.length > 0 ? paths.map(pathHash) : [0]).entries()) {
+          this.seen = this.publish(this.shared, hash, i === 0 ? key : 0);
+        }
+      }
+      inoOf(path, look) {
+        if (!this.shared) return 0;
+        this.fresh();
+        const hit = this.stats.get(path);
+        if (hit && "ino" in hit && typeof hit.ino === "number") return hit.ino;
+        try {
+          return look().ino ?? 0;
+        } catch {
+          return 0;
+        }
+      }
+      publish(shared, hash, ino) {
+        const g = Atomics.add(shared, FS_GEN, 1) + 1;
+        const at = RING + g % RING_SIZE * SLOT;
+        Atomics.store(shared, at, 0);
+        Atomics.store(shared, at + 1, hash);
+        Atomics.store(shared, at + 2, ino);
+        Atomics.store(shared, at, g);
+        return g;
+      }
+      replay(upTo) {
+        const shared = this.shared;
+        const missed = [];
+        for (let g = this.seen + 1; g <= upTo && upTo - this.seen <= RING_SIZE; g++) {
+          const at = RING + g % RING_SIZE * SLOT;
+          const tag = Atomics.load(shared, at);
+          const hash = Atomics.load(shared, at + 1);
+          const ino = Atomics.load(shared, at + 2);
+          if (tag !== g || hash === 0 || Atomics.load(shared, at) !== g) break;
+          missed.push([hash, ino]);
+        }
+        if (missed.length < upTo - this.seen) this.clear();
+        else for (const [hash, ino] of missed) this.drop(hash, ino);
+      }
+      drop(hash, ino) {
+        const paths = [
+          ...this.byHash.get(hash) ?? [],
+          ...ino === 0 ? [] : this.byIno.get(ino) ?? []
+        ];
+        for (const path of paths) {
+          this.stats.delete(path);
+          this.lstats.delete(path);
+        }
+        this.byHash.delete(hash);
+        if (ino !== 0) this.byIno.delete(ino);
+      }
+      clear() {
+        this.stats.clear();
+        this.lstats.clear();
+        this.byHash.clear();
+        this.byIno.clear();
+      }
+    };
   }
 });
 
@@ -836,6 +964,7 @@ var init_wasi_threads = __esm({
   "src/process/wasi/wasi-threads.ts"() {
     "use strict";
     init_protocol();
+    init_wasi_files();
     LAST_TID = 0;
     RUNNING = 1;
     MAIN_TID = 1;
@@ -858,7 +987,7 @@ var init_wasi_threads = __esm({
         this.memory = memory;
         this.cap = cap;
         this.tid = tid;
-        this.ids = new Int32Array(ids ?? new SharedArrayBuffer(16));
+        this.ids = new Int32Array(ids ?? new SharedArrayBuffer(SHARED_IDS_BYTES));
         if (!ids) Atomics.store(this.ids, LAST_TID, MAIN_TID);
       }
       spawn(arg) {
@@ -1327,7 +1456,14 @@ var init_wasi_fds = __esm({
             handed.add(e.file.buffer);
             promoted.set(e.file, fd);
           }
-          this.table.set(fd, { type: "kernel", kind: "file", nonblock: false, append: e.file.append });
+          this.table.set(fd, {
+            type: "kernel",
+            kind: "file",
+            nonblock: false,
+            append: e.file.append,
+            path: e.file.path,
+            ino: this.inoOf(e.file.path)
+          });
         }
         for (const file of promoted.keys()) {
           if (--file.buffer.opens <= 0) {
@@ -1441,9 +1577,21 @@ var init_wasi_fds = __esm({
         buffer.orphan();
         this.buffers.delete(path);
       }
+      inoOf(path) {
+        try {
+          return this.fs.stat(path).ino;
+        } catch {
+          return void 0;
+        }
+      }
       renamed(from, to) {
         if (from === to) return;
         if (this.shared) this.kernel.call({ op: "fd-path-renamed", from, to });
+        for (const e of this.table.values()) {
+          if (e.type === "kernel" && e.path !== void 0 && within(e.path, from)) {
+            e.path = to + e.path.slice(from.length);
+          }
+        }
         const moved = [];
         for (const [p, buffer] of this.buffers) {
           if (within(p, from)) moved.push([p, buffer]);
@@ -1522,7 +1670,10 @@ var init_wasi_fds = __esm({
         const made = !existing && this.createNew(path, oflags);
         const truncate = made || (oflags & OFLAGS.TRUNC) !== 0;
         const fd = this.kernel.sys.openVfs(path, flags, 0, truncate ? { truncate } : {});
-        this.table.set(fd, { type: "kernel", kind: "file", nonblock: false, append });
+        const was = existing && this.inoOf(path);
+        if (truncate) this.fs.touched?.(path, was);
+        const ino = existing ? was : this.inoOf(path);
+        this.table.set(fd, { type: "kernel", kind: "file", nonblock: false, append, path, ino });
         if (append) this.publishFlags(fd, { nonblock: false, append });
         this.bump();
         return fd;
@@ -2316,11 +2467,29 @@ var init_wasi_host = __esm({
             if (!kernel.sys.pread) throw new WasiError("ESPIPE");
             return kernel.sys.pread(fd, Math.min(max, MAX_READ), at);
           },
-          pwrite: (body, at) => kernel.call({ op: "fd-pwrite", fd, offset: at, body }),
+          pwrite: (body, at) => this.changed(fd, e, kernel.call({ op: "fd-pwrite", fd, offset: at, body })),
           size: () => this.kernelStat(fd).size,
-          truncate: (size) => void kernel.call({ op: "fd-resize", fd, size })
+          truncate: (size) => this.changed(fd, e, void kernel.call({ op: "fd-resize", fd, size }))
         };
       }
+      unnamed = /* @__PURE__ */ new WeakSet();
+      changed(fd, e, result) {
+        if (e.path === void 0 && !this.unnamed.has(e)) this.learnPath(fd, e);
+        this.o.fs.touched?.(e.path, e.ino);
+        return result;
+      }
+      learnPath(fd, e) {
+        this.unnamed.add(e);
+        let path;
+        try {
+          const st = this.kernelStat(fd);
+          path = st.orphan ? void 0 : st.path;
+          if (path !== void 0) e.ino = this.o.fs.stat(path).ino;
+        } catch {
+          return;
+        }
+        e.path = path;
+      }
       kernelStat(fd) {
         return this.o.kernel.call({ op: "fd-vfs-stat", fd });
       }
@@ -2329,7 +2498,8 @@ var init_wasi_host = __esm({
         const e = this.fds.get(fd);
         if (e.type === "kernel") {
           try {
-            return this.o.kernel.sys.write(fd, data, { nonblock: e.nonblock });
+            const n = this.o.kernel.sys.write(fd, data, { nonblock: e.nonblock });
+            return this.fds.kind(fd, e) === "file" ? this.changed(fd, e, n) : n;
           } catch (err) {
             const broken = err.code === "EPIPE";
             if (broken && this.fds.kind(fd, e) !== "socket") throw new WasiExit(SIGPIPE_EXIT);
@@ -3025,8 +3195,8 @@ var init_sync_sab_wire = __esm({
 });
 
 // src/process/js/async-sab.ts
-async function changed(header, index2, seen, waitAsync = defaultWaitAsync) {
-  const waited = waitAsync(header, index2, seen);
+async function changed(header, index3, seen, waitAsync = defaultWaitAsync) {
+  const waited = waitAsync(header, index3, seen);
   if (waited.async) await waited.value;
 }
 function createAsyncSabTransport(sab, port3, waitAsync = defaultWaitAsync) {
@@ -3184,7 +3354,9 @@ function parseSyncFsStat(json) {
     ...s.readonly === true ? { readonly: true } : {},
     ...typeof s.maxFile === "number" ? { maxFile: s.maxFile } : {},
     ...s.ranged === true ? { ranged: true } : {},
-    ...typeof s.version === "string" ? { version: s.version } : {}
+    ...typeof s.version === "string" ? { version: s.version } : {},
+    ...typeof s.uid === "number" ? { uid: s.uid } : {},
+    ...typeof s.gid === "number" ? { gid: s.gid } : {}
   };
 }
 var SYNC_FS_OPS, SYNC_FS_REQUEST_TIMEOUT_MS;
@@ -3215,7 +3387,9 @@ var init_sync_fs_wire = __esm({
       "kept",
       "pread",
       "pwrite",
-      "truncate"
+      "truncate",
+      "chown",
+      "lchown"
     ];
     SYNC_FS_REQUEST_TIMEOUT_MS = 25e3;
   }
@@ -3916,7 +4090,7 @@ function openRequest(abs, o) {
     ...o.truncate ? { truncate: true } : {}
   };
 }
-function index(n, what) {
+function index2(n, what) {
   if (!Number.isSafeInteger(n) || n < 0) throw new JsCallError("EINVAL", what);
 }
 var CHUNK2, MAX_IO, O_WRONLY3, O_RDWR3, O_APPEND3;
@@ -4207,8 +4381,8 @@ function createSyncFsSabBridge(transport, opts = {}) {
       if (typeof v !== "boolean") throw errnoError("EIO", path);
       return v;
     },
-    mkdir: (path) => {
-      run({ op: "mkdir", path }, path);
+    mkdir: (path, mode) => {
+      run({ op: "mkdir", path, ...mode !== void 0 ? { mode } : {} }, path);
     },
     rm: (path) => {
       run({ op: "rm", path }, path);
@@ -4239,9 +4413,14 @@ function createSyncFsSabBridge(transport, opts = {}) {
     lutimes: (path, atimeMs, mtimeMs) => {
       run({ op: "lutimes", path, atimeMs, mtimeMs }, path);
     },
-    create: (path) => {
-      run({ op: "create", path }, path);
+    create: (path, mode) => {
+      run({ op: "create", path, ...mode !== void 0 ? { mode } : {} }, path);
+    },
+    chown: (path, uid, gid) => {
+      const ids = { ...uid !== void 0 ? { uid } : {}, ...gid !== void 0 ? { gid } : {} };
+      run({ op: "lchown", path, ...ids }, path);
     },
+    ...opts.owners ? { owners: true } : {},
     hold: (path, held, open, handle) => {
       const mode = (held ? 1 : 0) | (open ? 2 : 0);
       if (mode === 3) return json({ op: "hold", path, mode }, path);
@@ -4275,7 +4454,7 @@ function syncOps(kernel, shared) {
     return got;
   };
   const read2 = (fd, max = CHUNK2) => {
-    index(max, "read");
+    index2(max, "read");
     const emulated = readDevice(info(fd), max, shared.random);
     if (emulated) return emulated;
     const r = kernel.blocking({ op: "fd-read", fd, max: Math.min(max, MAX_IO) });
@@ -4353,8 +4532,8 @@ function syncFile(kernel, fd, path, append, forget) {
       return kernel.json({ op: "fd-vfs-stat", fd }).size;
     },
     read(position, length) {
-      index(position, "read");
-      index(length, "read");
+      index2(position, "read");
+      index2(length, "read");
       const parts = [];
       let got = 0;
       do {
@@ -4369,7 +4548,7 @@ function syncFile(kernel, fd, path, append, forget) {
       return joined(parts, got);
     },
     write(position, data) {
-      index(position, "write");
+      index2(position, "write");
       let at = 0;
       do {
         live();
@@ -4383,7 +4562,7 @@ function syncFile(kernel, fd, path, append, forget) {
     },
     truncate(size) {
       live();
-      index(size, "truncate");
+      index2(size, "truncate");
       kernel.call({ op: "fd-resize", fd, size });
     },
     sync() {
@@ -4779,7 +4958,7 @@ function createContext(o) {
     return got;
   };
   const read2 = async (fd, max = CHUNK2, signal) => {
-    index(max, "read");
+    index2(max, "read");
     const emulated = readDevice(await info(fd), max, random);
     if (emulated) return emulated;
     return readPipe(kernel, fd, Math.min(max, MAX_IO), signal);
@@ -4926,8 +5105,8 @@ function fileHandle(kernel, fd, path, append, forget) {
       return s.size;
     },
     async read(position, length) {
-      index(position, "read");
-      index(length, "read");
+      index2(position, "read");
+      index2(length, "read");
       const parts = [];
       let got = 0;
       do {
@@ -4942,7 +5121,7 @@ function fileHandle(kernel, fd, path, append, forget) {
       return joined(parts, got);
     },
     async write(position, data) {
-      index(position, "write");
+      index2(position, "write");
       let at = 0;
       do {
         live();
@@ -4956,7 +5135,7 @@ function fileHandle(kernel, fd, path, append, forget) {
     },
     async truncate(size) {
       live();
-      index(size, "truncate");
+      index2(size, "truncate");
       await kernel.call({ op: "fd-resize", fd, size });
     },
     async sync() {
@@ -5447,6 +5626,7 @@ function createNodeOps(h) {
   return {
     getattr(node) {
       const st = statOf(node);
+      const owned = bridgeOf(node).owners === true;
       const s = node.live;
       const size = Fs.isDir(node.mode) ? 4096 : s.ranged?.size() ?? (s.loaded ? s.len : st.size);
       const mtime = new Date(st.mtimeMs ?? 0);
@@ -5455,8 +5635,8 @@ function createNodeOps(h) {
         ino: st.ino ?? inodeOf(liveNodePath(node)),
         mode: node.mode,
         nlink: 1,
-        uid: 0,
-        gid: 0,
+        uid: owned ? st.uid ?? 0 : 0,
+        gid: owned ? st.gid ?? 0 : 0,
         rdev: 0,
         size,
         atime: new Date(st.atimeMs ?? mtime.getTime()),
@@ -5499,14 +5679,17 @@ function createNodeOps(h) {
     mknod(parent, name2, mode) {
       parent.live.listed = void 0;
       const path = childPath(parent, name2);
-      if (Fs.isDir(mode)) {
-        call2(() => bridgeOf(parent).mkdir(path));
-        const perm = mode & PERM_MASK & ~UMASK;
-        if (perm !== DEFAULT_DIR_PERM) metadataCall(() => bridgeOf(parent).chmod(path, perm));
+      const bridge = bridgeOf(parent);
+      const perm = bridge.owners ? mode & PERM_MASK : void 0;
+      if (Fs.isDir(mode) && perm !== void 0) {
+        call2(() => bridge.mkdir(path, perm));
+      } else if (Fs.isDir(mode)) {
+        call2(() => bridge.mkdir(path));
+        const masked = mode & PERM_MASK & ~UMASK;
+        if (masked !== DEFAULT_DIR_PERM) metadataCall(() => bridge.chmod(path, masked));
       } else if (Fs.isFile(mode)) {
-        const bridge = bridgeOf(parent);
         call2(
-          () => bridge.create ? bridge.create(path) : bridge.writeFile(path, new Uint8Array(0))
+          () => bridge.create ? bridge.create(path, perm) : bridge.writeFile(path, new Uint8Array(0))
         );
       } else {
         throw new Fs.ErrnoError(wasiErrno("EPERM"));
@@ -5909,6 +6092,32 @@ function guardRenames(Fs) {
     rename(from, to);
   };
 }
+function idOf(value2) {
+  return value2 === -1 || value2 === 4294967295 ? void 0 : value2 >>> 0;
+}
+function useLiveChown(Fs) {
+  const chown = Fs.chown?.bind(Fs);
+  if (!chown) return;
+  Fs.chown = (path, uid, gid, dontFollow) => {
+    const node = typeof path === "string" ? Fs.lookupPath(path, { follow: !dontFollow }).node : path;
+    if (!node.live || node.live.orphan) return chown(path, uid, gid, dontFollow);
+    try {
+      node.mount.opts.bridge.chown?.(liveNodePath(node), idOf(uid), idOf(gid));
+    } catch (err) {
+      throw toErrno(Fs, err);
+    }
+    node.live.stat = void 0;
+    if (node.parent?.live) node.parent.live.listed = void 0;
+  };
+  const { getStreamChecked } = Fs;
+  if (!Fs.fchown || !getStreamChecked) return;
+  Fs.fchown = (fd, uid, gid) => {
+    const stream = getStreamChecked.call(Fs, fd);
+    const live = stream.node.live !== void 0;
+    const target = live || stream.path === void 0 ? stream.node : stream.path;
+    Fs.chown(target, uid, gid);
+  };
+}
 var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
@@ -5953,6 +6162,7 @@ function mountVfsIntoEmscripten(Fs, deps) {
   const dirs = topLevelDirs(bridge, warn);
   const { plugin, mounted } = mountLiveVfsDirs(Fs, bridge, dirs ?? [], warn);
   if (dirs) liveRoot(Fs, bridge);
+  if (bridge.owners && Fs.lookupPath) useLiveChown(Fs);
   try {
     Fs.chdir(deps.cwd);
   } catch (err) {
@@ -8358,6 +8568,9 @@ function reportGrowth(imports, publish) {
     return grown;
   };
 }
+function callerOwner(Fs, init) {
+  return init.owners ? {} : { owner: ownByCaller(Fs, init.cred, credAbi(init.program.glue)) };
+}
 async function runWasmProcess(init, port3, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port3, {
@@ -8468,7 +8681,7 @@ async function runWasmProcess(init, port3, deps = {}) {
   const running = module;
   if (!hasStreams(running)) return runStdioOnly(running, init);
   const vfs = mountVfsIntoEmscripten(running.FS, {
-    bridge: createSyncFsSabBridge(transport),
+    bridge: createSyncFsSabBridge(transport, init.owners ? { owners: true } : {}),
     cwd: init.cwd,
     warn: deps.warn ?? say(2)
   });
@@ -8510,7 +8723,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     describeFork: () => describeForFork(running.FS, sys, streams, livePath),
     inherit: (actions) => describeInherited(running.FS, sys, streams, livePath, actions),
     stdioPromoter: () => vfsPromoter(running.FS, sys, streams, livePath),
-    owner: ownByCaller(running.FS, init.cred, credAbi(init.program.glue))
+    ...callerOwner(running.FS, init)
   });
   running.sliccKernel.http = createHttpKernel(transport);
   running.sliccKernel.hostname = hostnameOf(init.env);
@@ -9694,8 +9907,8 @@ function readExports(r, s) {
   for (let i = r.u32(); i > 0; i--) {
     const name2 = r.name();
     const kind = r.byte();
-    const index2 = r.u32();
-    if (kind === 0) s.info.exports[name2] = index2;
+    const index3 = r.u32();
+    if (kind === 0) s.info.exports[name2] = index3;
   }
 }
 function readElems(r, s) {
@@ -9998,15 +10211,15 @@ var init_wasix_linker = __esm({
         return out;
       }
       allocateClosure() {
-        const index2 = this.indices.allocate(this.table.length);
-        growTable(this.table, index2 + 1);
-        this.live.add(index2);
-        return index2;
+        const index3 = this.indices.allocate(this.table.length);
+        growTable(this.table, index3 + 1);
+        this.live.add(index3);
+        return index3;
       }
-      freeClosure(index2) {
-        this.indices?.free(index2);
-        this.live.delete(index2);
-        this.table.set(index2, null);
+      freeClosure(index3) {
+        this.indices?.free(index3);
+        this.live.delete(index3);
+        this.table.set(index3, null);
       }
       live = /* @__PURE__ */ new Set();
       prepareClosure(record) {
@@ -10239,12 +10452,12 @@ var init_wasix_linker = __esm({
         this.indexTable();
         const known = this.slots.get(fn);
         if (known !== void 0) return known;
-        const index2 = this.reserve(1);
-        growTable(this.table, index2 + 1);
-        this.table.set(index2, fn);
-        this.slots.set(fn, index2);
-        this.publisher?.({ kind: "slot", index: index2, handle, name: name2 });
-        return index2;
+        const index3 = this.reserve(1);
+        growTable(this.table, index3 + 1);
+        this.table.set(index3, fn);
+        this.slots.set(fn, index3);
+        this.publisher?.({ kind: "slot", index: index3, handle, name: name2 });
+        return index3;
       }
       allocate(size, alignment) {
         if (size === 0) return 0;
@@ -10529,11 +10742,11 @@ var init_wasix_sockets = __esm({
 });
 
 // src/process/wasi/wasix-host.ts
-function futexWait(view, index2, expected, ms, interrupted) {
+function futexWait(view, index3, expected, ms, interrupted) {
   const deadline = performance.now() + ms;
   for (; ; ) {
     const slice = interrupted ? Math.min(FUTEX_SLICE_MS, ms) : ms;
-    if (Atomics.wait(view, index2, expected, slice) !== "timed-out") return true;
+    if (Atomics.wait(view, index3, expected, slice) !== "timed-out") return true;
     if (interrupted?.()) return true;
     ms = deadline - performance.now();
     if (ms <= 0) return false;
@@ -10662,21 +10875,21 @@ var init_wasix_host = __esm({
             if (!this.linker) throw new WasiError("ENOTSUP");
             this.mem.view().setUint32(out, this.linker.allocateClosure(), true);
           },
-          closure_prepare: (backing, index2, argTypes, argCount, resultTypes, resultCount, userData) => {
+          closure_prepare: (backing, index3, argTypes, argCount, resultTypes, resultCount, userData) => {
             if (!this.linker) throw new WasiError("ENOTSUP");
             const params = valueTypes(this.mem.bytes(argTypes, argCount));
             const results = valueTypes(this.mem.bytes(resultTypes, resultCount));
             if (!params || !results) throw new WasiError("EINVAL");
             try {
-              this.linker.prepareClosure({ index: index2, backing, userData, params, results });
+              this.linker.prepareClosure({ index: index3, backing, userData, params, results });
             } catch (e) {
               if (e instanceof DlError) throw new WasiError("EINVAL");
               throw e;
             }
           },
-          closure_free: (index2) => {
+          closure_free: (index3) => {
             if (!this.linker) throw new WasiError("ENOTSUP");
-            this.linker.freeClosure(index2);
+            this.linker.freeClosure(index3);
           },
           call_dynamic: (...a) => void callDynamic(
             { mem: this.mem, table: () => this.table, types: this.types },
@@ -10981,10 +11194,10 @@ function parseFunctionNames(payload) {
     if (end > payload.length) throw new RangeError("truncated name section");
     if (id === 1) {
       for (let count = leb(); count > 0; count--) {
-        const index2 = leb();
+        const index3 = leb();
         const length = leb();
         if (at + length > end) throw new RangeError("truncated name section");
-        names.set(index2, decoder3.decode(payload.subarray(at, at + length)));
+        names.set(index3, decoder3.decode(payload.subarray(at, at + length)));
         at += length;
       }
     }
@@ -11008,7 +11221,7 @@ function nameFrame(line, module, name2) {
 }
 function sidecarNames(read2, path) {
   let names;
-  return (index2) => {
+  return (index3) => {
     if (!names) {
       try {
         names = parseFunctionNames(read2(path));
@@ -11016,7 +11229,7 @@ function sidecarNames(read2, path) {
         names = /* @__PURE__ */ new Map();
       }
     }
-    return names.get(index2);
+    return names.get(index3);
   };
 }
 var UNNAMED_FRAME, WASM_MODULE;
@@ -11377,7 +11590,7 @@ async function runWasiProcess(init, port3) {
     parent: () => identify(transport, init).ppid,
     kernel: { sys: traced(stats, "kernel", sys), call: call2 },
     fs: procfsBridge(
-      cachingBridge(traced(stats, "fs", createSyncFsSabBridge(transport))),
+      cachingBridge(traced(stats, "fs", createSyncFsSabBridge(transport)), void 0, threads?.ids),
       procTree(call2, id.pid)
     ),
     ...descriptors(init, fork, threads)
@@ -11470,7 +11683,10 @@ async function runWasiThread(init, port3) {
     ppid: id.ppid,
     parent: () => identify(transport, init).ppid,
     kernel: { sys, call: call2 },
-    fs: procfsBridge(cachingBridge(createSyncFsSabBridge(transport)), procTree(call2, id.pid)),
+    fs: procfsBridge(
+      cachingBridge(createSyncFsSabBridge(transport), void 0, threads.ids),
+      procTree(call2, id.pid)
+    ),
     shared: threads.ids
   });
   const program = await programImports(init.program, host, transport, thread.tid);
@@ -11582,13 +11798,13 @@ var init_wasi_runtime = __esm({
           },
           unlock: () => this.call({ op: "dl-unlock", owner: this.owner }),
           allocate: (floor) => {
-            const index2 = this.call({ op: "dl-closure", floor });
+            const index3 = this.call({ op: "dl-closure", floor });
             this.catchUp();
             this.bump();
-            return index2;
+            return index3;
           },
-          free: (index2) => {
-            this.call({ op: "dl-closure-free", index: index2 });
+          free: (index3) => {
+            this.call({ op: "dl-closure-free", index: index3 });
             this.bump();
           }
         };