@ai-ecoverse/slicc-kernel 1.58.0 → 1.59.0

package/dist/kernel-worker.js

@@ -794,12 +794,12 @@ var OpfsFs = class {
     const base = dir === "/" ? "" : dir;
     const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
     const handed2 = this.owners ? await this.handedTo(dir) : void 0;
-    const owned2 = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
+    const owned3 = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
     return Promise.all(
       children2.map(async ([name2, child], i) => {
-        if (!isHandle(child)) return [name2, owned2(this.linkStat(child), child)];
+        if (!isHandle(child)) return [name2, owned3(this.linkStat(child), child)];
         const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
-        return [name2, stat && owned2(stat, metas[i])];
+        return [name2, stat && owned3(stat, metas[i])];
       })
     );
   }
@@ -830,9 +830,9 @@ var OpfsFs = class {
     const parent = await this.locate(parentOf2(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
-    const made = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
-    await this.stampNew(made, owner, true);
-    this.touch(parent.path, made);
+    const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
+    await this.stampNew(made2, owner, true);
+    this.touch(parent.path, made2);
   }
   async rm(path, options = {}) {
     let found;
@@ -2644,12 +2644,22 @@ var UserDb = class {
   async stampHome(row, shared) {
     const home = this.fs.resolvePath("/", row.home);
     if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
-    if (await this.fs.realpath?.(home, false).catch(() => void 0) !== home) return;
-    if (!(await this.fs.lstat(home)).isDirectory) return;
+    if (!await this.realDir(home)) return;
     const gid = shared?.gid ?? row.gid;
     await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
-    const mode = shared ? 1512 : row.name.startsWith("scoop-") ? 488 : 448;
-    await this.fs.chmod(home, mode);
+    const scoop = row.name.startsWith("scoop-");
+    await this.fs.chmod(home, shared ? 1512 : scoop ? 488 : 448);
+    const pnpm = `${home}/.local/share/pnpm`;
+    if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
+  }
+  async realDir(path) {
+    const parts = path.split("/").filter(Boolean);
+    for (let n = 1; n <= parts.length; n++) {
+      const at = `/${parts.slice(0, n).join("/")}`;
+      const st = await this.fs.lstat(at).catch(() => void 0);
+      if (!st?.isDirectory) return false;
+    }
+    return true;
   }
   async read(path, fallback) {
     try {
@@ -2666,15 +2676,17 @@ var UserDb = class {
     };
   }
   async provision(row) {
+    const owner = this.owners ? { uid: row.uid, gid: row.gid } : void 0;
+    const made2 = owner ? { recursive: true, owner } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
     if (!await this.fs.exists(pnpm)) {
-      await this.fs.mkdir(pnpm, { recursive: true });
+      await this.fs.mkdir(pnpm, made2);
       await this.fs.chmod(pnpm, row.name.startsWith("scoop-") ? 488 : 448);
     }
     const config = `${row.home}/.config/pnpm/config.yaml`;
     if (!await this.fs.exists(config)) {
-      await this.fs.mkdir(`${row.home}/.config/pnpm`, { recursive: true });
-      await this.fs.writeFile(config, PNPM_CONFIG);
+      await this.fs.mkdir(`${row.home}/.config/pnpm`, made2);
+      await this.fs.writeFile(config, PNPM_CONFIG, owner);
     }
   }
   async commit(passwd, group, then) {
@@ -2851,7 +2863,7 @@ async function fsCall(fs, method, args, owner) {
       return { result: bytes, transfer: [bytes.buffer] };
     }
     case "writeFile":
-      await fs.writeFile(path(0), args[1], owner);
+      await fs.writeFile(path(0), args[1], created(owner, 438));
       return { result: true };
     case "stat":
       return { result: await fs.stat(path(0)) };
@@ -2860,7 +2872,10 @@ async function fsCall(fs, method, args, owner) {
     case "readdir":
       return { result: await fs.readdir(path(0)) };
     case "mkdir":
-      await fs.mkdir(path(0), owner ? { recursive: true, owner } : { recursive: true });
+      await fs.mkdir(
+        path(0),
+        owner ? { recursive: true, owner: made(owner) } : { recursive: true }
+      );
       return { result: true };
     case "rm":
       await fs.rm(path(0), { recursive: true, force: args[1] === true });
@@ -2871,7 +2886,7 @@ async function fsCall(fs, method, args, owner) {
     case "realpath":
       return { result: await realpath(fs, String(args[0])) };
     case "symlink":
-      await fs.symlink(String(args[0]), path(1), owner);
+      await fs.symlink(String(args[0]), path(1), owner && { uid: owner.uid, gid: owner.gid });
       return { result: true };
     case "readlink":
       return { result: await fs.readlink(path(0)) };
@@ -2893,8 +2908,16 @@ function dialFor(l, req, open) {
   );
   return { result: port2, transfer: [port2] };
 }
+function created(owner, mode) {
+  return owner && { uid: owner.uid, gid: owner.gid, mode: mode & ~owner.umask };
+}
+function made(owner) {
+  const mode = 511 & ~owner.umask;
+  return { uid: owner.uid, gid: owner.gid, mode, parents: mode | 192 };
+}
 function ownerFor(l, self) {
-  return l.owners && self ? { uid: self.uid, gid: self.gid } : void 0;
+  if (!l.owners || !self) return void 0;
+  return { uid: self.uid, gid: self.gid, umask: self.umask ?? 18 };
 }
 async function accountOf(l, user) {
   const found = await l.users.lookup(user);
@@ -5782,7 +5805,17 @@ async function followLinks(fs, path) {
   }
   return current;
 }
-function withCommandDirs(fs, names, userDir = async () => void 0) {
+function withCommandDirs(fs, names, userDir = async () => void 0, owners = false) {
+  async function nearest(path) {
+    const st = await fs.stat(path).catch(() => void 0);
+    if (st || path === "/") return st ?? {};
+    return nearest(path.slice(0, path.lastIndexOf("/")) || "/");
+  }
+  async function owned3(stat2, dir) {
+    if (!owners) return stat2;
+    const { uid = 0, gid = 0 } = dir === void 0 ? {} : await nearest(dir);
+    return { ...stat2, uid, gid };
+  }
   async function children2(path) {
     if (path === "/") return ["bin", "usr"];
     if (path === "/usr") return ["bin"];
@@ -5791,13 +5824,18 @@ function withCommandDirs(fs, names, userDir = async () => void 0) {
     return own?.size ? [...own] : void 0;
   }
   async function virtual(path) {
-    if (path === "/usr" || path === "/bin" || path === "/usr/bin") return synthetic(true, path);
+    if (path === "/usr" || path === "/bin" || path === "/usr/bin") {
+      return owned3(synthetic(true, path));
+    }
     const name2 = COMMAND.exec(path)?.[1];
-    if (name2 !== void 0) return (await names()).has(name2) ? synthetic(false, path) : void 0;
-    if ((await userDir(path))?.size) return synthetic(true, path);
+    if (name2 !== void 0) {
+      return (await names()).has(name2) ? owned3(synthetic(false, path)) : void 0;
+    }
+    if ((await userDir(path))?.size) return owned3(synthetic(true, path), path);
     const slash = path.lastIndexOf("/");
-    const own = await userDir(path.slice(0, slash));
-    return own?.has(path.slice(slash + 1)) ? synthetic(false, path) : void 0;
+    const dir = path.slice(0, slash);
+    const own = await userDir(dir);
+    return own?.has(path.slice(slash + 1)) ? owned3(synthetic(false, path), dir) : void 0;
   }
   async function linked(path) {
     return await virtual(path) ?? virtual(await followLinks(fs, path));
@@ -6192,18 +6230,18 @@ var FsWatchers = class {
     const overrides = {
       writeFile: after(fs.writeFile.bind(fs), (path) => [path]),
       mkdir: async (path, options) => {
-        const created = [];
+        const created3 = [];
         if (options?.recursive) {
           const parts = normalizePath(path).split("/").filter(Boolean);
           for (let at = 1; at < parts.length; at++) {
             const ancestor = `/${parts.slice(0, at).join("/")}`;
-            if (created.length > 0 || !await fs.exists(ancestor)) created.push(ancestor);
+            if (created3.length > 0 || !await fs.exists(ancestor)) created3.push(ancestor);
           }
         }
         try {
           await fs.mkdir(path, options);
         } finally {
-          this.changed(...created, path);
+          this.changed(...created3, path);
         }
       },
       rm: after(fs.rm.bind(fs), (path) => [path]),
@@ -6482,7 +6520,7 @@ async function realTarget(fs, path) {
 }
 
 // src/mount/protocol.ts
-var DRIVER_PROTOCOL = [1, 1];
+var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
   const major = Array.isArray(theirs) ? theirs[0] : void 0;
   if (major === DRIVER_PROTOCOL[0]) return void 0;
@@ -6584,6 +6622,19 @@ var DriverConnection = class _DriverConnection {
 };
 
 // src/mount/mount-fs.ts
+var S_ISGID3 = 1024;
+var ID = /^\d{1,10}$/;
+var MAX_ID2 = 4294967294;
+function idOption(value) {
+  return value === void 0 ? 0 : Number(value);
+}
+function checkIds(options) {
+  for (const key of ["uid", "gid"]) {
+    const value = options[key];
+    if (value === void 0) continue;
+    if (!ID.test(value) || Number(value) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value}`);
+  }
+}
 var MAX_LINKS5 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
@@ -6750,31 +6801,35 @@ var HeldPaths = class extends Map {
 };
 var parentOf6 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var readonly = (mount) => mount.caps.readonly === true || mount.options.ro !== void 0;
-function inodeless(mount, attr) {
-  if (attr.ino !== void 0) return false;
+function inodeless(mount, attr2) {
+  if (attr2.ino !== void 0) return false;
   if (mount.caps.links) mount.caps = { ...mount.caps, links: false };
   return true;
 }
-function statOf(attr, path, mount) {
-  const mtime = new Date(attr.mtime);
-  const fallback = attr.kind === "directory" ? 16877 : attr.kind === "symlink" ? 41471 : 33188;
+function statOf(attr2, path, mount) {
+  const mtime = new Date(attr2.mtime);
+  const fallback = attr2.kind === "directory" ? 16877 : attr2.kind === "symlink" ? 41471 : 33188;
   return {
-    isFile: attr.kind === "file",
-    isDirectory: attr.kind === "directory",
-    isSymbolicLink: attr.kind === "symlink",
-    size: attr.size,
-    mode: attr.mode ?? fallback,
+    isFile: attr2.kind === "file",
+    isDirectory: attr2.kind === "directory",
+    isSymbolicLink: attr2.kind === "symlink",
+    size: attr2.size,
+    mode: attr2.mode ?? fallback,
     mtime,
     atime: mtime,
     ctime: mtime,
-    ino: attr.ino ?? inodeOf(path),
-    ...!inodeless(mount, attr) && attr.nlink !== void 0 ? { nlink: attr.nlink } : {},
+    ino: attr2.ino ?? inodeOf(path),
+    ...!inodeless(mount, attr2) && attr2.nlink !== void 0 ? { nlink: attr2.nlink } : {},
     dev: mount.dev,
     ...readonly(mount) ? { readonly: true } : {},
     ...mount.maxFile > 0 ? { maxFile: mount.maxFile } : {},
     ...mount.caps.ranges ? { ranged: true } : {},
     ...mount.caps.links ? { linkable: true } : {},
-    ...attr.etag !== void 0 ? { version: attr.etag } : {}
+    ...attr2.etag !== void 0 ? { version: attr2.etag } : {},
+    ...mount.owners ? {
+      uid: (mount.caps.owners ? attr2.uid : void 0) ?? idOption(mount.options.uid),
+      gid: (mount.caps.owners ? attr2.gid : void 0) ?? idOption(mount.options.gid)
+    } : {}
   };
 }
 function concat4(chunks, total) {
@@ -6867,6 +6922,7 @@ var MountTable = class {
     const st = await fs.stat(target);
     if (!st.isDirectory) throw errnoError("ENOTDIR", target);
     const options = { ...spec.options };
+    if (this.deps.owners) checkIds(options);
     const maxFile = options.maxfile !== void 0 ? parseSize(options.maxfile) : void 0;
     const opened2 = await this.deps.open(spec.type, { ...spec, target, options });
     let mounted;
@@ -6912,6 +6968,7 @@ var MountTable = class {
       attrs: /* @__PURE__ */ new Map(),
       lists: /* @__PURE__ */ new Map(),
       epoch: 0,
+      owners: this.deps.owners === true,
       dispose: () => opened2.dispose(),
       ...opened2.present ? { present: opened2.present } : {}
     };
@@ -7033,15 +7090,15 @@ var MountTable = class {
       if (cached && cached.expires > Date.now()) return cached.value;
       const seen = mount.epoch;
       const session = this.sessions.get(path);
-      const attr = await mount.conn.call({ op: "getattr", path: rel2 });
+      const attr2 = await mount.conn.call({ op: "getattr", path: rel2 });
       if (mount.epoch !== seen) {
         const moved2 = this.sessions.get(path) !== session || this.committing.has(path);
         if (settled && moved2 && round < SETTLE_ROUNDS) continue;
-        return attr;
+        return attr2;
       }
       const ttl = mount.caps.attrTtl ?? 1e3;
-      if (ttl > 0) mount.attrs.set(path, { value: attr, expires: Date.now() + ttl });
-      return attr;
+      if (ttl > 0) mount.attrs.set(path, { value: attr2, expires: Date.now() + ttl });
+      return attr2;
     }
   }
   async readdir(mount, path, rel2) {
@@ -7088,28 +7145,43 @@ var MountFs = class {
     const found = this.at(path);
     if (!found) return path;
     const real = normalizePath(path);
-    let attr;
+    let attr2;
     try {
-      attr = await this.table.getattr(found.mount, real, found.rel);
+      attr2 = await this.table.getattr(found.mount, real, found.rel);
     } catch (err) {
       if (create && err.code === "ENOENT") return real;
       throw err;
     }
-    if (attr.kind !== "symlink") return real;
+    if (attr2.kind !== "symlink") return real;
     if (hops >= MAX_LINKS5) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
     return this.follow(this.base.resolvePath(parentOf6(real), target), hops + 1, create);
   }
-  async open(mount, rel2, write) {
+  async open(mount, rel2, write, owner) {
     return await mount.conn.call({
       op: "open",
       path: rel2,
       write,
       create: write,
       truncate: write,
-      exclusive: false
+      exclusive: false,
+      ...owner
     });
   }
+  async driverOwner(found, real, owner, directory) {
+    const { mount, rel: rel2 } = found;
+    if (!owner || !mount.owners || !mount.caps.owners) return void 0;
+    const dir = parentOf6(real);
+    const above = statOf(await this.table.getattr(mount, dir, parentOf6(rel2)), dir, mount);
+    const setgid = (above.mode & S_ISGID3) !== 0;
+    let mode = owner.mode;
+    if (directory && setgid) mode = (mode ?? 493) | S_ISGID3;
+    return {
+      uid: owner.uid,
+      gid: setgid ? above.gid : owner.gid,
+      ...mode !== void 0 ? { mode } : {}
+    };
+  }
   resolvePath(base, path) {
     return this.base.resolvePath(base, path);
   }
@@ -7131,9 +7203,9 @@ var MountFs = class {
   }
   async readWhole(mount, real, rel2) {
     await this.table.commit(real);
-    const attr = await this.table.getattr(mount, real, rel2);
-    if (attr.kind === "directory") throw errnoError("EISDIR", real);
-    if (mount.maxFile > 0 && attr.size > mount.maxFile) {
+    const attr2 = await this.table.getattr(mount, real, rel2);
+    if (attr2.kind === "directory") throw errnoError("EISDIR", real);
+    if (mount.maxFile > 0 && attr2.size > mount.maxFile) {
       throw errnoError("EFBIG", `${real} is larger than this mount's maxfile (${mount.maxFile})`);
     }
     const fh = await this.open(mount, rel2, false);
@@ -7151,7 +7223,7 @@ var MountFs = class {
         if (bytes.length === 0) break;
         chunks.push(bytes);
         total += bytes.length;
-        if (bytes.length < chunk2 && total >= attr.size) break;
+        if (bytes.length < chunk2 && total >= attr2.size) break;
       }
     } finally {
       await mount.conn.call({ op: "release", fh });
@@ -7171,18 +7243,19 @@ var MountFs = class {
         `${real} would be larger than this mount's maxfile (${mount.maxFile})`
       );
     }
+    const made2 = await this.driverOwner(found, real, owner, false);
     for (let attempt = 1; ; attempt++) {
       try {
-        return await this.writeWhole(mount, real, rel2, bytes);
+        return await this.writeWhole(mount, real, rel2, bytes, made2);
       } catch (err) {
         if (err.code !== "ESTALE" || attempt >= STALE_RETRIES) throw err;
       }
     }
   }
-  async writeWhole(mount, real, rel2, bytes) {
+  async writeWhole(mount, real, rel2, bytes, owner) {
     await this.table.commit(real);
     this.table.forget(mount, real);
-    const fh = await this.open(mount, rel2, true);
+    const fh = await this.open(mount, rel2, true, owner);
     const chunk2 = mount.caps.maxIo ?? DEFAULT_IO;
     try {
       for (let offset = 0; offset < bytes.length; offset += chunk2) {
@@ -7328,9 +7401,9 @@ var MountFs = class {
       found.mount
     );
   }
-  statWriting(attr, real, mount) {
+  statWriting(attr2, real, mount) {
     const ends = (this.table.writing(real)?.extents ?? []).map(([, end]) => end);
-    return statOf({ ...attr, size: Math.max(attr.size, ...ends) }, real, mount);
+    return statOf({ ...attr2, size: Math.max(attr2.size, ...ends) }, real, mount);
   }
   async stat(path) {
     const real = await this.follow(path);
@@ -7369,10 +7442,12 @@ var MountFs = class {
     const { mount, rel: rel2 } = found;
     const real = normalizePath(path);
     this.writable(mount, real);
+    const { owner } = options;
     if (!options.recursive) {
       if (rel2 === "/") throw errnoError("EEXIST", real);
+      const made2 = await this.driverOwner(found, real, owner, true);
       this.table.forget(mount, real);
-      await mount.conn.call({ op: "mkdir", path: rel2 });
+      await mount.conn.call({ op: "mkdir", path: rel2, ...made2 });
       return;
     }
     const parts = rel2.split("/").filter(Boolean);
@@ -7382,8 +7457,10 @@ var MountFs = class {
       const exists = await this.table.getattr(mount, full, sub).catch(() => void 0);
       if (exists?.kind === "directory") continue;
       if (exists) throw errnoError("ENOTDIR", full);
+      const own = n === parts.length ? owner : owner && { ...owner, mode: owner.parents };
+      const made2 = await this.driverOwner({ mount, rel: sub }, full, own, true);
       this.table.forget(mount, full);
-      await mount.conn.call({ op: "mkdir", path: sub });
+      await mount.conn.call({ op: "mkdir", path: sub, ...made2 });
     }
   }
   async rm(path, options = {}) {
@@ -7394,21 +7471,21 @@ var MountFs = class {
     if (rel2 === "/") throw errnoError("EBUSY", `${real} is a mount point`);
     this.writable(mount, real);
     await this.table.commitUnder(real);
-    let attr;
+    let attr2;
     try {
-      attr = await this.table.getattr(mount, real, rel2);
+      attr2 = await this.table.getattr(mount, real, rel2);
     } catch (err) {
       if (options.force && err.code === "ENOENT") return;
       throw err;
     }
     this.table.forget(mount, real);
-    if (attr.kind === "directory" && options.recursive) {
+    if (attr2.kind === "directory" && options.recursive) {
       for (const entry of await this.table.readdir(mount, real, rel2)) {
         await this.rm(`${real}/${entry.name}`, { recursive: true, force: options.force ?? false });
       }
       this.table.forget(mount, real);
     }
-    await mount.conn.call({ op: attr.kind === "directory" ? "rmdir" : "unlink", path: rel2 });
+    await mount.conn.call({ op: attr2.kind === "directory" ? "rmdir" : "unlink", path: rel2 });
     this.table.forget(mount, real);
   }
   async rename(from, to) {
@@ -7462,8 +7539,10 @@ var MountFs = class {
     this.writable(found.mount, normalizePath(path));
     if (!found.mount.caps.symlinks)
       throw errnoError("EPERM", `${path}: this file system has no symlinks`);
+    const link2 = owner && { uid: owner.uid, gid: owner.gid };
+    const made2 = await this.driverOwner(found, normalizePath(path), link2, false);
     this.table.forget(found.mount, normalizePath(path));
-    await found.mount.conn.call({ op: "symlink", target, path: found.rel });
+    await found.mount.conn.call({ op: "symlink", target, path: found.rel, ...made2 });
   }
   async realpath(path, follow2) {
     if (this.at(path) || !this.base.realpath) throw errnoError("ENOSYS", path);
@@ -7478,13 +7557,29 @@ var MountFs = class {
   }
   async chown(path, change) {
     const real = change.follow === false || change.kind === "new" ? path : await this.follow(path);
-    if (this.at(real)) {
-      if (change.kind === "new") return;
-      throw errnoError("EPERM", `${path}: this file system keeps no owners`);
-    }
+    const found = this.at(real);
+    if (found) return this.chownMounted(found, normalizePath(real), change);
     if (!this.base.chown) throw errnoError("EPERM", path);
     return this.base.chown(real, change);
   }
+  async chownMounted(found, real, change) {
+    const { mount, rel: rel2 } = found;
+    if (!mount.owners || !mount.caps.owners) {
+      if (change.kind === "new") return;
+      throw errnoError("EPERM", `${real}: this file system keeps no owners`);
+    }
+    this.writable(mount, real);
+    const { uid, gid, mode } = change;
+    const fresh = change.kind === "new" && { uid, gid, mode };
+    const set2 = fresh ? await this.driverOwner(found, real, fresh, false) : change;
+    this.table.forget(mount, real);
+    const attrs = Object.entries({ uid: set2.uid, gid: set2.gid, mode: set2.mode });
+    await mount.conn.call({
+      op: "setattr",
+      path: rel2,
+      ...Object.fromEntries(attrs.filter(([, value]) => value !== void 0))
+    });
+  }
   async chmod(path, mode) {
     const found = this.at(path);
     if (!found) return this.base.chmod(path, mode);
@@ -7591,7 +7686,10 @@ function mkdirOptions(entry, mode = 511) {
 }
 async function chown(entry, path, req) {
   const cred = entry.cred?.();
-  if (!cred) return done;
+  if (!cred) {
+    await (req.op === "chown" ? entry.fs.stat(path) : entry.fs.lstat(path));
+    return done;
+  }
   await chownAs(entry.fs, cred, path, {
     ...req.uid !== void 0 ? { uid: req.uid } : {},
     ...req.gid !== void 0 ? { gid: req.gid } : {},
@@ -11415,6 +11513,7 @@ function spawnWasmProcess(opts) {
       cwd: opts.cwd,
       sab: tsab,
       cred: copyCred(process.cred),
+      owners: opts.owners === true,
       ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {},
       thread
     };
@@ -11808,6 +11907,17 @@ var SettlingChildren = class {
 };
 
 // src/mount/driver.ts
+function ownerOf2(req) {
+  const owner = {
+    ...req.uid !== void 0 ? { uid: req.uid } : {},
+    ...req.gid !== void 0 ? { gid: req.gid } : {},
+    ...req.mode !== void 0 ? { mode: req.mode } : {}
+  };
+  return Object.keys(owner).length > 0 ? owner : void 0;
+}
+function withOwner(base, owner) {
+  return owner ? { ...base, owner } : base;
+}
 function fsError2(code, message3 = code) {
   return Object.assign(new Error(message3), { code });
 }
@@ -11818,13 +11928,19 @@ async function dispatch(h, req) {
     case "readdir":
       return h.readdir(req.path);
     case "open":
-      return h.open(req.path, {
-        write: req.write,
-        create: req.create,
-        truncate: req.truncate,
-        exclusive: req.exclusive,
-        ...req.ifMatch !== void 0 ? { ifMatch: req.ifMatch } : {}
-      });
+      return h.open(
+        req.path,
+        withOwner(
+          {
+            write: req.write,
+            create: req.create,
+            truncate: req.truncate,
+            exclusive: req.exclusive,
+            ...req.ifMatch !== void 0 ? { ifMatch: req.ifMatch } : {}
+          },
+          ownerOf2(req)
+        )
+      );
     case "read":
       return h.read(req.fh, req.offset, req.size);
     case "write":
@@ -11832,7 +11948,7 @@ async function dispatch(h, req) {
     case "release":
       return h.release(req.fh);
     case "mkdir":
-      return h.mkdir(req.path);
+      return ownerOf2(req) ? h.mkdir(req.path, ownerOf2(req)) : h.mkdir(req.path);
     case "rmdir":
       return h.rmdir(req.path);
     case "unlink":
@@ -11844,7 +11960,7 @@ async function dispatch(h, req) {
       return h.link(req.from, req.to);
     case "symlink":
       if (!h.symlink) throw fsError2("EPERM", "this file system has no symlinks");
-      return h.symlink(req.target, req.path);
+      return ownerOf2(req) ? h.symlink(req.target, req.path, ownerOf2(req)) : h.symlink(req.target, req.path);
     case "readlink":
       if (!h.readlink) throw fsError2("EINVAL", `${req.path} is not a symlink`);
       return h.readlink(req.path);
@@ -11852,7 +11968,9 @@ async function dispatch(h, req) {
       return h.setattr?.(req.path, {
         ...req.mode !== void 0 ? { mode: req.mode } : {},
         ...req.mtime !== void 0 ? { mtime: req.mtime } : {},
-        ...req.size !== void 0 ? { size: req.size } : {}
+        ...req.size !== void 0 ? { size: req.size } : {},
+        ...req.uid !== void 0 ? { uid: req.uid } : {},
+        ...req.gid !== void 0 ? { gid: req.gid } : {}
       });
     case "statfs":
       return h.statfs?.() ?? null;
@@ -12003,8 +12121,8 @@ function kernelFsHandlers(fs) {
     getattr: async (path) => attrOf(await fs.lstat(path)),
     readdir: async (path) => (await fs.readdirStat(path)).flatMap(([name2, st]) => {
       if (!st) return [];
-      const attr = attrOf(st);
-      return [{ name: name2, kind: attr.kind, attr }];
+      const attr2 = attrOf(st);
+      return [{ name: name2, kind: attr2.kind, attr: attr2 }];
     }),
     async open(path, flags) {
       const st = await existing(path);
@@ -12434,7 +12552,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
         "list",
         { path: rel(path) }
       );
-      return entries.map(({ name: name2, attr }) => ({ name: name2, kind: attr.kind, attr }));
+      return entries.map(({ name: name2, attr: attr2 }) => ({ name: name2, kind: attr2.kind, attr: attr2 }));
     },
     async open(path, flags) {
       const client = current();
@@ -12924,8 +13042,8 @@ var ChunkedBytes = class {
     }
     return out;
   }
-  write(offset, bytes, owned2 = false) {
-    const whole = owned2 && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
+  write(offset, bytes, owned3 = false) {
+    const whole = owned3 && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
     for (let done4 = 0; done4 < bytes.length; ) {
       const at = offset + done4;
       const index = Math.floor(at / CHUNK3);
@@ -12958,18 +13076,42 @@ var ChunkedBytes = class {
 };
 
 // src/mount/tmpfs.ts
-function tmpfs() {
-  let inodes = 0;
-  const make = (kind, mode) => ({
+function idOption2(value) {
+  return value !== void 0 && /^\d+$/.test(value) ? Number(value) : 0;
+}
+function created2(ino, kind, mode, from, owner) {
+  return {
     kind,
-    ino: ++inodes,
-    mode,
+    ino,
+    mode: owner?.mode === void 0 ? mode : mode & ~4095 | owner.mode & 4095,
     mtime: Date.now(),
     data: new ChunkedBytes(),
     target: "",
     children: /* @__PURE__ */ new Map(),
-    links: 1
-  });
+    links: 1,
+    uid: owner?.uid ?? from?.uid ?? 0,
+    gid: owner?.gid ?? from?.gid ?? 0
+  };
+}
+function owned2(node, change) {
+  if (change.uid !== void 0) node.uid = change.uid;
+  if (change.gid !== void 0) node.gid = change.gid;
+}
+function attr(node) {
+  return {
+    kind: node.kind,
+    size: node.kind === "file" ? node.data.size : node.kind === "symlink" ? node.target.length : 4096,
+    mtime: node.mtime,
+    mode: node.mode,
+    ino: node.ino,
+    ...node.kind === "directory" ? {} : { nlink: node.links },
+    uid: node.uid,
+    gid: node.gid
+  };
+}
+function tmpfs() {
+  let inodes = 0;
+  const make = (kind, mode, from, owner) => created2(++inodes, kind, mode, from, owner);
   const root = make("directory", 16877);
   const handles = /* @__PURE__ */ new Map();
   let nextFh = 0;
@@ -12996,14 +13138,6 @@ function tmpfs() {
     if (dir.kind !== "directory") throw fsError2("ENOTDIR", path);
     return { dir, name: name2 };
   }
-  const attr = (node) => ({
-    kind: node.kind,
-    size: node.kind === "file" ? node.data.size : node.kind === "symlink" ? node.target.length : 4096,
-    mtime: node.mtime,
-    mode: node.mode,
-    ino: node.ino,
-    ...node.kind === "directory" ? {} : { nlink: node.links }
-  });
   const handle = (fh) => {
     const found = handles.get(fh);
     if (!found) throw fsError2("EBADF", `handle ${fh}`);
@@ -13016,11 +13150,16 @@ function tmpfs() {
     if (existing?.kind === "directory" && flags.write) throw fsError2("EISDIR", path);
     if (existing) return existing;
     if (!flags.create) throw fsError2("ENOENT", path);
-    const node = make("file", 33188);
+    const node = make("file", 33188, dir, flags.owner);
     place(dir, name2, node);
     return node;
   }
   return {
+    mount(info) {
+      root.uid = idOption2(info.options.uid);
+      root.gid = idOption2(info.options.gid);
+      return void 0;
+    },
     async getattr(path) {
       return attr(find(path));
     },
@@ -13053,10 +13192,10 @@ function tmpfs() {
       handle(fh);
       handles.delete(fh);
     },
-    async mkdir(path) {
+    async mkdir(path, owner) {
       const { dir, name: name2 } = parent(path);
       if (dir.children.has(name2)) throw fsError2("EEXIST", path);
-      place(dir, name2, make("directory", 16877));
+      place(dir, name2, make("directory", 16877, dir, owner));
     },
     async rmdir(path) {
       const { dir, name: name2 } = parent(path);
@@ -13103,10 +13242,10 @@ function tmpfs() {
       place(dir, name2, node);
       node.links++;
     },
-    async symlink(target, path) {
+    async symlink(target, path, owner) {
       const { dir, name: name2 } = parent(path);
       if (dir.children.has(name2)) throw fsError2("EEXIST", path);
-      const node = make("symlink", 41471);
+      const node = make("symlink", 41471, dir, owner && { ...owner, mode: 511 });
       node.target = target;
       place(dir, name2, node);
     },
@@ -13125,6 +13264,7 @@ function tmpfs() {
         node.mtime = Date.now();
       }
       if (change.mtime !== void 0) node.mtime = change.mtime;
+      owned2(node, change);
     },
     async statfs() {
       return { bsize: 4096, blocks: 262144, bfree: 262144 };
@@ -13445,7 +13585,8 @@ var Launcher = class {
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
       busy: (target) => [...this.openFiles].some((nodes) => nodes.holds(target)) || heldUnder(this.held, target),
-      changed: this.watchers.changed.bind(this.watchers)
+      changed: this.watchers.changed.bind(this.watchers),
+      owners: this.owners
     });
     this.base = this.watchers.wrap(this.mounts.wrap(options.fs));
     this.createWorker = options.createWorker;
@@ -13478,7 +13619,8 @@ var Launcher = class {
     const fs = withCommandDirs(
       this.base,
       async () => new Set((await this.commands()).keys()),
-      (dir) => this.userCommandDir(dir)
+      (dir) => this.userCommandDir(dir),
+      this.owners
     );
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.nodes.keepsOnDisk = true;
@@ -14008,7 +14150,15 @@ var Launcher = class {
       serveFilesystem(
         port2,
         tmpfs(),
-        { symlinks: true, links: true, chmod: true, linkTimes: true, ranges: true, attrTtl: 0 },
+        {
+          symlinks: true,
+          links: true,
+          chmod: true,
+          owners: true,
+          linkTimes: true,
+          ranges: true,
+          attrTtl: 0
+        },
         { owned: true }
       );
       return {
@@ -14081,6 +14231,11 @@ var Launcher = class {
     void this.unlinked.sweep(entry.target);
     return entry;
   }
+  mountedBy(spec, cred) {
+    if (!this.owners || cred.euid === 0 && cred.egid === 0) return spec;
+    const ids = { uid: String(cred.euid), gid: String(cred.egid) };
+    return { ...spec, options: { ...ids, ...spec.options } };
+  }
   mountRoot(path) {
     let root = "/";
     for (const { target } of this.mounts.list()) {
@@ -14124,7 +14279,7 @@ var Launcher = class {
   async processMount(pid, call, signal) {
     const spec = mountCall(call);
     await this.permit({ op: "mount", pid, ...spec, options: { ...spec.options } });
-    const entry = await this.mount(spec);
+    const entry = await this.mount(this.mountedBy(spec, this.credOf(pid)));
     if (signal.aborted) this.umount(entry.target, true);
   }
   async processUmount(pid, target, flags) {