@ai-ecoverse/slicc-kernel 1.58.1 → 1.59.1

package/dist/node.js

@@ -1323,6 +1323,11 @@ function blockedReason(url, e) {
   }
   return `${url}: ${e instanceof Error ? e.message : String(e)}`;
 }
+function unopened(url, code) {
+  return Object.assign(new Error(`${url}: the WebSocket closed (${code}) before it opened`), {
+    status: 502
+  });
+}
 function openWebSocket(Socket, request, withHeaders) {
   const { url, protocols, signal } = request;
   signal.throwIfAborted();
@@ -1336,13 +1341,22 @@ function openWebSocket(Socket, request, withHeaders) {
   const queue = new MessageQueue(() => socket.close(1e3, "too many waiting messages"));
   return new Promise((resolve, reject) => {
     let open = false;
+    let settled = false;
+    const fail3 = (error) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", abort);
+      reject(error);
+    };
     const abort = () => {
       socket.close(1e3, "aborted");
-      reject(signal.reason);
+      fail3(signal.reason);
     };
     signal.addEventListener("abort", abort, { once: true });
     socket.addEventListener("open", () => {
+      if (settled) return;
       open = true;
+      settled = true;
       signal.removeEventListener("abort", abort);
       resolve({
         protocol: socket.protocol,
@@ -1358,15 +1372,19 @@ function openWebSocket(Socket, request, withHeaders) {
     socket.addEventListener("message", (event) => {
       queue.push(typeof event.data === "string" ? event.data : new Uint8Array(event.data));
     });
+    socket.addEventListener("error", () => {
+      if (open || settled) return;
+      try {
+        socket.close();
+      } catch {
+      }
+      queue.end({ code: 1006, reason: "" });
+      fail3(unopened(url, 1006));
+    });
     socket.addEventListener("close", (event) => {
       queue.end({ code: event.code, reason: event.reason });
       if (open) return;
-      signal.removeEventListener("abort", abort);
-      reject(
-        Object.assign(new Error(`${url}: the WebSocket closed (${event.code}) before it opened`), {
-          status: 502
-        })
-      );
+      fail3(unopened(url, event.code));
     });
   });
 }
@@ -1774,12 +1792,22 @@ var UserDb = class {
   async stampHome(row, shared) {
     const home = this.fs.resolvePath("/", row.home);
     if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
-    if (await this.fs.realpath?.(home, false).catch(() => void 0) !== home) return;
-    if (!(await this.fs.lstat(home)).isDirectory) return;
+    if (!await this.realDir(home)) return;
     const gid = shared?.gid ?? row.gid;
     await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
-    const mode = shared ? 1512 : row.name.startsWith("scoop-") ? 488 : 448;
-    await this.fs.chmod(home, mode);
+    const scoop = row.name.startsWith("scoop-");
+    await this.fs.chmod(home, shared ? 1512 : scoop ? 488 : 448);
+    const pnpm = `${home}/.local/share/pnpm`;
+    if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
+  }
+  async realDir(path) {
+    const parts = path.split("/").filter(Boolean);
+    for (let n = 1; n <= parts.length; n++) {
+      const at = `/${parts.slice(0, n).join("/")}`;
+      const st = await this.fs.lstat(at).catch(() => void 0);
+      if (!st?.isDirectory) return false;
+    }
+    return true;
   }
   async read(path, fallback) {
     try {
@@ -1796,15 +1824,17 @@ var UserDb = class {
     };
   }
   async provision(row) {
+    const owner = this.owners ? { uid: row.uid, gid: row.gid } : void 0;
+    const made2 = owner ? { recursive: true, owner } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
     if (!await this.fs.exists(pnpm)) {
-      await this.fs.mkdir(pnpm, { recursive: true });
+      await this.fs.mkdir(pnpm, made2);
       await this.fs.chmod(pnpm, row.name.startsWith("scoop-") ? 488 : 448);
     }
     const config = `${row.home}/.config/pnpm/config.yaml`;
     if (!await this.fs.exists(config)) {
-      await this.fs.mkdir(`${row.home}/.config/pnpm`, { recursive: true });
-      await this.fs.writeFile(config, PNPM_CONFIG);
+      await this.fs.mkdir(`${row.home}/.config/pnpm`, made2);
+      await this.fs.writeFile(config, PNPM_CONFIG, owner);
     }
   }
   async commit(passwd, group, then) {
@@ -2008,7 +2038,7 @@ async function fsCall(fs, method, args, owner) {
       return { result: bytes, transfer: [bytes.buffer] };
     }
     case "writeFile":
-      await fs.writeFile(path(0), args[1], owner);
+      await fs.writeFile(path(0), args[1], created(owner, 438));
       return { result: true };
     case "stat":
       return { result: await fs.stat(path(0)) };
@@ -2017,7 +2047,10 @@ async function fsCall(fs, method, args, owner) {
     case "readdir":
       return { result: await fs.readdir(path(0)) };
     case "mkdir":
-      await fs.mkdir(path(0), owner ? { recursive: true, owner } : { recursive: true });
+      await fs.mkdir(
+        path(0),
+        owner ? { recursive: true, owner: made(owner) } : { recursive: true }
+      );
       return { result: true };
     case "rm":
       await fs.rm(path(0), { recursive: true, force: args[1] === true });
@@ -2028,7 +2061,7 @@ async function fsCall(fs, method, args, owner) {
     case "realpath":
       return { result: await realpath(fs, String(args[0])) };
     case "symlink":
-      await fs.symlink(String(args[0]), path(1), owner);
+      await fs.symlink(String(args[0]), path(1), owner && { uid: owner.uid, gid: owner.gid });
       return { result: true };
     case "readlink":
       return { result: await fs.readlink(path(0)) };
@@ -2050,8 +2083,16 @@ function dialFor(l, req, open) {
   );
   return { result: port2, transfer: [port2] };
 }
+function created(owner, mode) {
+  return owner && { uid: owner.uid, gid: owner.gid, mode: mode & ~owner.umask };
+}
+function made(owner) {
+  const mode = 511 & ~owner.umask;
+  return { uid: owner.uid, gid: owner.gid, mode, parents: mode | 192 };
+}
 function ownerFor(l, self) {
-  return l.owners && self ? { uid: self.uid, gid: self.gid } : void 0;
+  if (!l.owners || !self) return void 0;
+  return { uid: self.uid, gid: self.gid, umask: self.umask ?? 18 };
 }
 async function accountOf(l, user) {
   const found = await l.users.lookup(user);
@@ -2925,12 +2966,12 @@ var OpfsFs = class {
     const base = dir === "/" ? "" : dir;
     const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
     const handed2 = this.owners ? await this.handedTo(dir) : void 0;
-    const owned2 = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
+    const owned3 = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
     return Promise.all(
       children2.map(async ([name2, child], i) => {
-        if (!isHandle(child)) return [name2, owned2(this.linkStat(child), child)];
+        if (!isHandle(child)) return [name2, owned3(this.linkStat(child), child)];
         const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
-        return [name2, stat && owned2(stat, metas[i])];
+        return [name2, stat && owned3(stat, metas[i])];
       })
     );
   }
@@ -2961,9 +3002,9 @@ var OpfsFs = class {
     const parent = await this.locate(parentOf2(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
-    const made = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
-    await this.stampNew(made, owner, true);
-    this.touch(parent.path, made);
+    const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
+    await this.stampNew(made2, owner, true);
+    this.touch(parent.path, made2);
   }
   async rm(path, options = {}) {
     let found;
@@ -4408,7 +4449,17 @@ async function followLinks(fs, path) {
   }
   return current;
 }
-function withCommandDirs(fs, names, userDir = async () => void 0) {
+function withCommandDirs(fs, names, userDir = async () => void 0, owners = false) {
+  async function nearest(path) {
+    const st = await fs.stat(path).catch(() => void 0);
+    if (st || path === "/") return st ?? {};
+    return nearest(path.slice(0, path.lastIndexOf("/")) || "/");
+  }
+  async function owned3(stat2, dir) {
+    if (!owners) return stat2;
+    const { uid = 0, gid = 0 } = dir === void 0 ? {} : await nearest(dir);
+    return { ...stat2, uid, gid };
+  }
   async function children2(path) {
     if (path === "/") return ["bin", "usr"];
     if (path === "/usr") return ["bin"];
@@ -4417,13 +4468,18 @@ function withCommandDirs(fs, names, userDir = async () => void 0) {
     return own?.size ? [...own] : void 0;
   }
   async function virtual(path) {
-    if (path === "/usr" || path === "/bin" || path === "/usr/bin") return synthetic(true, path);
+    if (path === "/usr" || path === "/bin" || path === "/usr/bin") {
+      return owned3(synthetic(true, path));
+    }
     const name2 = COMMAND.exec(path)?.[1];
-    if (name2 !== void 0) return (await names()).has(name2) ? synthetic(false, path) : void 0;
-    if ((await userDir(path))?.size) return synthetic(true, path);
+    if (name2 !== void 0) {
+      return (await names()).has(name2) ? owned3(synthetic(false, path)) : void 0;
+    }
+    if ((await userDir(path))?.size) return owned3(synthetic(true, path), path);
     const slash = path.lastIndexOf("/");
-    const own = await userDir(path.slice(0, slash));
-    return own?.has(path.slice(slash + 1)) ? synthetic(false, path) : void 0;
+    const dir = path.slice(0, slash);
+    const own = await userDir(dir);
+    return own?.has(path.slice(slash + 1)) ? owned3(synthetic(false, path), dir) : void 0;
   }
   async function linked(path) {
     return await virtual(path) ?? virtual(await followLinks(fs, path));
@@ -4599,18 +4655,18 @@ var FsWatchers = class {
     const overrides = {
       writeFile: after(fs.writeFile.bind(fs), (path) => [path]),
       mkdir: async (path, options) => {
-        const created = [];
+        const created3 = [];
         if (options?.recursive) {
           const parts = normalizePath(path).split("/").filter(Boolean);
           for (let at = 1; at < parts.length; at++) {
             const ancestor = `/${parts.slice(0, at).join("/")}`;
-            if (created.length > 0 || !await fs.exists(ancestor)) created.push(ancestor);
+            if (created3.length > 0 || !await fs.exists(ancestor)) created3.push(ancestor);
           }
         }
         try {
           await fs.mkdir(path, options);
         } finally {
-          this.changed(...created, path);
+          this.changed(...created3, path);
         }
       },
       rm: after(fs.rm.bind(fs), (path) => [path]),
@@ -4889,7 +4945,7 @@ async function realTarget(fs, path) {
 }
 
 // src/mount/protocol.ts
-var DRIVER_PROTOCOL = [1, 1];
+var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
   const major = Array.isArray(theirs) ? theirs[0] : void 0;
   if (major === DRIVER_PROTOCOL[0]) return void 0;
@@ -4991,6 +5047,19 @@ var DriverConnection = class _DriverConnection {
 };
 
 // src/mount/mount-fs.ts
+var S_ISGID3 = 1024;
+var ID = /^\d{1,10}$/;
+var MAX_ID2 = 4294967294;
+function idOption(value) {
+  return value === void 0 ? 0 : Number(value);
+}
+function checkIds(options) {
+  for (const key of ["uid", "gid"]) {
+    const value = options[key];
+    if (value === void 0) continue;
+    if (!ID.test(value) || Number(value) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value}`);
+  }
+}
 var MAX_LINKS5 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
@@ -5157,31 +5226,35 @@ var HeldPaths = class extends Map {
 };
 var parentOf6 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var readonly = (mount) => mount.caps.readonly === true || mount.options.ro !== void 0;
-function inodeless(mount, attr) {
-  if (attr.ino !== void 0) return false;
+function inodeless(mount, attr2) {
+  if (attr2.ino !== void 0) return false;
   if (mount.caps.links) mount.caps = { ...mount.caps, links: false };
   return true;
 }
-function statOf(attr, path, mount) {
-  const mtime = new Date(attr.mtime);
-  const fallback = attr.kind === "directory" ? 16877 : attr.kind === "symlink" ? 41471 : 33188;
+function statOf(attr2, path, mount) {
+  const mtime = new Date(attr2.mtime);
+  const fallback = attr2.kind === "directory" ? 16877 : attr2.kind === "symlink" ? 41471 : 33188;
   return {
-    isFile: attr.kind === "file",
-    isDirectory: attr.kind === "directory",
-    isSymbolicLink: attr.kind === "symlink",
-    size: attr.size,
-    mode: attr.mode ?? fallback,
+    isFile: attr2.kind === "file",
+    isDirectory: attr2.kind === "directory",
+    isSymbolicLink: attr2.kind === "symlink",
+    size: attr2.size,
+    mode: attr2.mode ?? fallback,
     mtime,
     atime: mtime,
     ctime: mtime,
-    ino: attr.ino ?? inodeOf(path),
-    ...!inodeless(mount, attr) && attr.nlink !== void 0 ? { nlink: attr.nlink } : {},
+    ino: attr2.ino ?? inodeOf(path),
+    ...!inodeless(mount, attr2) && attr2.nlink !== void 0 ? { nlink: attr2.nlink } : {},
     dev: mount.dev,
     ...readonly(mount) ? { readonly: true } : {},
     ...mount.maxFile > 0 ? { maxFile: mount.maxFile } : {},
     ...mount.caps.ranges ? { ranged: true } : {},
     ...mount.caps.links ? { linkable: true } : {},
-    ...attr.etag !== void 0 ? { version: attr.etag } : {}
+    ...attr2.etag !== void 0 ? { version: attr2.etag } : {},
+    ...mount.owners ? {
+      uid: (mount.caps.owners ? attr2.uid : void 0) ?? idOption(mount.options.uid),
+      gid: (mount.caps.owners ? attr2.gid : void 0) ?? idOption(mount.options.gid)
+    } : {}
   };
 }
 function concat3(chunks2, total) {
@@ -5274,6 +5347,7 @@ var MountTable = class {
     const st = await fs.stat(target);
     if (!st.isDirectory) throw errnoError("ENOTDIR", target);
     const options = { ...spec.options };
+    if (this.deps.owners) checkIds(options);
     const maxFile = options.maxfile !== void 0 ? parseSize(options.maxfile) : void 0;
     const opened2 = await this.deps.open(spec.type, { ...spec, target, options });
     let mounted;
@@ -5319,6 +5393,7 @@ var MountTable = class {
       attrs: /* @__PURE__ */ new Map(),
       lists: /* @__PURE__ */ new Map(),
       epoch: 0,
+      owners: this.deps.owners === true,
       dispose: () => opened2.dispose(),
       ...opened2.present ? { present: opened2.present } : {}
     };
@@ -5440,15 +5515,15 @@ var MountTable = class {
       if (cached && cached.expires > Date.now()) return cached.value;
       const seen = mount.epoch;
       const session = this.sessions.get(path);
-      const attr = await mount.conn.call({ op: "getattr", path: rel2 });
+      const attr2 = await mount.conn.call({ op: "getattr", path: rel2 });
       if (mount.epoch !== seen) {
         const moved2 = this.sessions.get(path) !== session || this.committing.has(path);
         if (settled && moved2 && round < SETTLE_ROUNDS) continue;
-        return attr;
+        return attr2;
       }
       const ttl = mount.caps.attrTtl ?? 1e3;
-      if (ttl > 0) mount.attrs.set(path, { value: attr, expires: Date.now() + ttl });
-      return attr;
+      if (ttl > 0) mount.attrs.set(path, { value: attr2, expires: Date.now() + ttl });
+      return attr2;
     }
   }
   async readdir(mount, path, rel2) {
@@ -5495,28 +5570,43 @@ var MountFs = class {
     const found = this.at(path);
     if (!found) return path;
     const real = normalizePath(path);
-    let attr;
+    let attr2;
     try {
-      attr = await this.table.getattr(found.mount, real, found.rel);
+      attr2 = await this.table.getattr(found.mount, real, found.rel);
     } catch (err) {
       if (create && err.code === "ENOENT") return real;
       throw err;
     }
-    if (attr.kind !== "symlink") return real;
+    if (attr2.kind !== "symlink") return real;
     if (hops >= MAX_LINKS5) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
     return this.follow(this.base.resolvePath(parentOf6(real), target), hops + 1, create);
   }
-  async open(mount, rel2, write) {
+  async open(mount, rel2, write, owner) {
     return await mount.conn.call({
       op: "open",
       path: rel2,
       write,
       create: write,
       truncate: write,
-      exclusive: false
+      exclusive: false,
+      ...owner
     });
   }
+  async driverOwner(found, real, owner, directory) {
+    const { mount, rel: rel2 } = found;
+    if (!owner || !mount.owners || !mount.caps.owners) return void 0;
+    const dir = parentOf6(real);
+    const above = statOf(await this.table.getattr(mount, dir, parentOf6(rel2)), dir, mount);
+    const setgid = (above.mode & S_ISGID3) !== 0;
+    let mode = owner.mode;
+    if (directory && setgid) mode = (mode ?? 493) | S_ISGID3;
+    return {
+      uid: owner.uid,
+      gid: setgid ? above.gid : owner.gid,
+      ...mode !== void 0 ? { mode } : {}
+    };
+  }
   resolvePath(base, path) {
     return this.base.resolvePath(base, path);
   }
@@ -5538,9 +5628,9 @@ var MountFs = class {
   }
   async readWhole(mount, real, rel2) {
     await this.table.commit(real);
-    const attr = await this.table.getattr(mount, real, rel2);
-    if (attr.kind === "directory") throw errnoError("EISDIR", real);
-    if (mount.maxFile > 0 && attr.size > mount.maxFile) {
+    const attr2 = await this.table.getattr(mount, real, rel2);
+    if (attr2.kind === "directory") throw errnoError("EISDIR", real);
+    if (mount.maxFile > 0 && attr2.size > mount.maxFile) {
       throw errnoError("EFBIG", `${real} is larger than this mount's maxfile (${mount.maxFile})`);
     }
     const fh = await this.open(mount, rel2, false);
@@ -5558,7 +5648,7 @@ var MountFs = class {
         if (bytes.length === 0) break;
         chunks2.push(bytes);
         total += bytes.length;
-        if (bytes.length < chunk2 && total >= attr.size) break;
+        if (bytes.length < chunk2 && total >= attr2.size) break;
       }
     } finally {
       await mount.conn.call({ op: "release", fh });
@@ -5578,18 +5668,19 @@ var MountFs = class {
         `${real} would be larger than this mount's maxfile (${mount.maxFile})`
       );
     }
+    const made2 = await this.driverOwner(found, real, owner, false);
     for (let attempt = 1; ; attempt++) {
       try {
-        return await this.writeWhole(mount, real, rel2, bytes);
+        return await this.writeWhole(mount, real, rel2, bytes, made2);
       } catch (err) {
         if (err.code !== "ESTALE" || attempt >= STALE_RETRIES) throw err;
       }
     }
   }
-  async writeWhole(mount, real, rel2, bytes) {
+  async writeWhole(mount, real, rel2, bytes, owner) {
     await this.table.commit(real);
     this.table.forget(mount, real);
-    const fh = await this.open(mount, rel2, true);
+    const fh = await this.open(mount, rel2, true, owner);
     const chunk2 = mount.caps.maxIo ?? DEFAULT_IO;
     try {
       for (let offset = 0; offset < bytes.length; offset += chunk2) {
@@ -5735,9 +5826,9 @@ var MountFs = class {
       found.mount
     );
   }
-  statWriting(attr, real, mount) {
+  statWriting(attr2, real, mount) {
     const ends = (this.table.writing(real)?.extents ?? []).map(([, end]) => end);
-    return statOf({ ...attr, size: Math.max(attr.size, ...ends) }, real, mount);
+    return statOf({ ...attr2, size: Math.max(attr2.size, ...ends) }, real, mount);
   }
   async stat(path) {
     const real = await this.follow(path);
@@ -5776,10 +5867,12 @@ var MountFs = class {
     const { mount, rel: rel2 } = found;
     const real = normalizePath(path);
     this.writable(mount, real);
+    const { owner } = options;
     if (!options.recursive) {
       if (rel2 === "/") throw errnoError("EEXIST", real);
+      const made2 = await this.driverOwner(found, real, owner, true);
       this.table.forget(mount, real);
-      await mount.conn.call({ op: "mkdir", path: rel2 });
+      await mount.conn.call({ op: "mkdir", path: rel2, ...made2 });
       return;
     }
     const parts = rel2.split("/").filter(Boolean);
@@ -5789,8 +5882,10 @@ var MountFs = class {
       const exists = await this.table.getattr(mount, full, sub).catch(() => void 0);
       if (exists?.kind === "directory") continue;
       if (exists) throw errnoError("ENOTDIR", full);
+      const own = n === parts.length ? owner : owner && { ...owner, mode: owner.parents };
+      const made2 = await this.driverOwner({ mount, rel: sub }, full, own, true);
       this.table.forget(mount, full);
-      await mount.conn.call({ op: "mkdir", path: sub });
+      await mount.conn.call({ op: "mkdir", path: sub, ...made2 });
     }
   }
   async rm(path, options = {}) {
@@ -5801,21 +5896,21 @@ var MountFs = class {
     if (rel2 === "/") throw errnoError("EBUSY", `${real} is a mount point`);
     this.writable(mount, real);
     await this.table.commitUnder(real);
-    let attr;
+    let attr2;
     try {
-      attr = await this.table.getattr(mount, real, rel2);
+      attr2 = await this.table.getattr(mount, real, rel2);
     } catch (err) {
       if (options.force && err.code === "ENOENT") return;
       throw err;
     }
     this.table.forget(mount, real);
-    if (attr.kind === "directory" && options.recursive) {
+    if (attr2.kind === "directory" && options.recursive) {
       for (const entry of await this.table.readdir(mount, real, rel2)) {
         await this.rm(`${real}/${entry.name}`, { recursive: true, force: options.force ?? false });
       }
       this.table.forget(mount, real);
     }
-    await mount.conn.call({ op: attr.kind === "directory" ? "rmdir" : "unlink", path: rel2 });
+    await mount.conn.call({ op: attr2.kind === "directory" ? "rmdir" : "unlink", path: rel2 });
     this.table.forget(mount, real);
   }
   async rename(from, to) {
@@ -5869,8 +5964,10 @@ var MountFs = class {
     this.writable(found.mount, normalizePath(path));
     if (!found.mount.caps.symlinks)
       throw errnoError("EPERM", `${path}: this file system has no symlinks`);
+    const link2 = owner && { uid: owner.uid, gid: owner.gid };
+    const made2 = await this.driverOwner(found, normalizePath(path), link2, false);
     this.table.forget(found.mount, normalizePath(path));
-    await found.mount.conn.call({ op: "symlink", target, path: found.rel });
+    await found.mount.conn.call({ op: "symlink", target, path: found.rel, ...made2 });
   }
   async realpath(path, follow2) {
     if (this.at(path) || !this.base.realpath) throw errnoError("ENOSYS", path);
@@ -5885,13 +5982,29 @@ var MountFs = class {
   }
   async chown(path, change) {
     const real = change.follow === false || change.kind === "new" ? path : await this.follow(path);
-    if (this.at(real)) {
-      if (change.kind === "new") return;
-      throw errnoError("EPERM", `${path}: this file system keeps no owners`);
-    }
+    const found = this.at(real);
+    if (found) return this.chownMounted(found, normalizePath(real), change);
     if (!this.base.chown) throw errnoError("EPERM", path);
     return this.base.chown(real, change);
   }
+  async chownMounted(found, real, change) {
+    const { mount, rel: rel2 } = found;
+    if (!mount.owners || !mount.caps.owners) {
+      if (change.kind === "new") return;
+      throw errnoError("EPERM", `${real}: this file system keeps no owners`);
+    }
+    this.writable(mount, real);
+    const { uid, gid, mode } = change;
+    const fresh = change.kind === "new" && { uid, gid, mode };
+    const set2 = fresh ? await this.driverOwner(found, real, fresh, false) : change;
+    this.table.forget(mount, real);
+    const attrs = Object.entries({ uid: set2.uid, gid: set2.gid, mode: set2.mode });
+    await mount.conn.call({
+      op: "setattr",
+      path: rel2,
+      ...Object.fromEntries(attrs.filter(([, value]) => value !== void 0))
+    });
+  }
   async chmod(path, mode) {
     const found = this.at(path);
     if (!found) return this.base.chmod(path, mode);
@@ -5998,7 +6111,10 @@ function mkdirOptions(entry, mode = 511) {
 }
 async function chown(entry, path, req) {
   const cred = entry.cred?.();
-  if (!cred) return done;
+  if (!cred) {
+    await (req.op === "chown" ? entry.fs.stat(path) : entry.fs.lstat(path));
+    return done;
+  }
   await chownAs(entry.fs, cred, path, {
     ...req.uid !== void 0 ? { uid: req.uid } : {},
     ...req.gid !== void 0 ? { gid: req.gid } : {},
@@ -8301,7 +8417,7 @@ function enableNetwork(net, options) {
   let proxy;
   const transport = options.transport ?? missingTransport();
   net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, () => {
-    const tls = new TlsTerminator({
+    const tls2 = new TlsTerminator({
       ca: options.ca,
       engine: options.engine,
       ...options.now ? { now: options.now } : {}
@@ -8309,7 +8425,7 @@ function enableNetwork(net, options) {
     const started = new RealmProxy({
       net,
       transport,
-      tunnel: tls.handler,
+      tunnel: tls2.handler,
       tunnelReady: async () => {
         await options.engine();
       }
@@ -8317,7 +8433,7 @@ function enableNetwork(net, options) {
     proxy = started;
     void started.closed.then(async () => {
       if (proxy === started) proxy = void 0;
-      await tls.close();
+      await tls2.close();
     });
   });
   return () => proxy;
@@ -8336,6 +8452,11 @@ var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 function message(e) {
   return e instanceof Error ? e.message : String(e);
 }
+var ERRNO = /^E[A-Z]+$|^EAI_[A-Z]+$/;
+function errnoOf(e) {
+  const code = e?.code;
+  return typeof code === "string" && ERRNO.test(code) ? code : "ECONNREFUSED";
+}
 function fail(errno, text) {
   return { ok: false, errno, message: text };
 }
@@ -8379,13 +8500,13 @@ var WsHandles = class {
     let socket;
     try {
       socket = await transport.websocket({
-        url: req.url,
+        url: toHostLoopback(req.url),
         protocols: req.protocols,
         headers: req.headers,
         signal: entry.abort.signal
       });
     } catch (e) {
-      return fail("ECONNREFUSED", message(e));
+      return fail(errnoOf(e), message(e));
     }
     if (!this.open.has(handle)) {
       socket.close(1001, "the program went away");
@@ -8740,14 +8861,14 @@ var Resolver = class {
     if (hit && hit.expires > this.now()) return hit.addresses;
     const signal = blocking?.();
     if (signal?.aborted) throw new KernelError("EINTR");
-    let lookup = this.pending.get(id2);
-    if (!lookup) {
+    let lookup2 = this.pending.get(id2);
+    if (!lookup2) {
       const abort = new AbortController();
-      lookup = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
-      this.pending.set(id2, lookup);
-      void lookup.work.then(() => this.pending.delete(id2));
+      lookup2 = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
+      this.pending.set(id2, lookup2);
+      void lookup2.work.then(() => this.pending.delete(id2));
     }
-    return waitFor(lookup, signal);
+    return waitFor(lookup2, signal);
   }
   async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
@@ -8788,17 +8909,17 @@ var Resolver = class {
     }
   }
 };
-function waitFor(lookup, signal) {
-  lookup.waiters++;
+function waitFor(lookup2, signal) {
+  lookup2.waiters++;
   return new Promise((resolve, reject) => {
     const abort = () => {
-      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      if (--lookup2.waiters === 0) lookup2.abort.abort(new KernelError("EINTR"));
       reject(new KernelError("EINTR"));
     };
     signal?.addEventListener("abort", abort, { once: true });
-    void lookup.work.then((value) => {
+    void lookup2.work.then((value) => {
       if (signal?.aborted) return;
-      lookup.waiters--;
+      lookup2.waiters--;
       signal?.removeEventListener("abort", abort);
       resolve(value);
     });
@@ -11170,6 +11291,7 @@ function spawnWasmProcess(opts) {
       cwd: opts.cwd,
       sab: tsab,
       cred: copyCred(process2.cred),
+      owners: opts.owners === true,
       ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {},
       thread
     };
@@ -11563,6 +11685,17 @@ var SettlingChildren = class {
 };
 
 // src/mount/driver.ts
+function ownerOf2(req) {
+  const owner = {
+    ...req.uid !== void 0 ? { uid: req.uid } : {},
+    ...req.gid !== void 0 ? { gid: req.gid } : {},
+    ...req.mode !== void 0 ? { mode: req.mode } : {}
+  };
+  return Object.keys(owner).length > 0 ? owner : void 0;
+}
+function withOwner(base, owner) {
+  return owner ? { ...base, owner } : base;
+}
 function fsError2(code, message3 = code) {
   return Object.assign(new Error(message3), { code });
 }
@@ -11573,13 +11706,19 @@ async function dispatch(h, req) {
     case "readdir":
       return h.readdir(req.path);
     case "open":
-      return h.open(req.path, {
-        write: req.write,
-        create: req.create,
-        truncate: req.truncate,
-        exclusive: req.exclusive,
-        ...req.ifMatch !== void 0 ? { ifMatch: req.ifMatch } : {}
-      });
+      return h.open(
+        req.path,
+        withOwner(
+          {
+            write: req.write,
+            create: req.create,
+            truncate: req.truncate,
+            exclusive: req.exclusive,
+            ...req.ifMatch !== void 0 ? { ifMatch: req.ifMatch } : {}
+          },
+          ownerOf2(req)
+        )
+      );
     case "read":
       return h.read(req.fh, req.offset, req.size);
     case "write":
@@ -11587,7 +11726,7 @@ async function dispatch(h, req) {
     case "release":
       return h.release(req.fh);
     case "mkdir":
-      return h.mkdir(req.path);
+      return ownerOf2(req) ? h.mkdir(req.path, ownerOf2(req)) : h.mkdir(req.path);
     case "rmdir":
       return h.rmdir(req.path);
     case "unlink":
@@ -11599,7 +11738,7 @@ async function dispatch(h, req) {
       return h.link(req.from, req.to);
     case "symlink":
       if (!h.symlink) throw fsError2("EPERM", "this file system has no symlinks");
-      return h.symlink(req.target, req.path);
+      return ownerOf2(req) ? h.symlink(req.target, req.path, ownerOf2(req)) : h.symlink(req.target, req.path);
     case "readlink":
       if (!h.readlink) throw fsError2("EINVAL", `${req.path} is not a symlink`);
       return h.readlink(req.path);
@@ -11607,7 +11746,9 @@ async function dispatch(h, req) {
       return h.setattr?.(req.path, {
         ...req.mode !== void 0 ? { mode: req.mode } : {},
         ...req.mtime !== void 0 ? { mtime: req.mtime } : {},
-        ...req.size !== void 0 ? { size: req.size } : {}
+        ...req.size !== void 0 ? { size: req.size } : {},
+        ...req.uid !== void 0 ? { uid: req.uid } : {},
+        ...req.gid !== void 0 ? { gid: req.gid } : {}
       });
     case "statfs":
       return h.statfs?.() ?? null;
@@ -11758,8 +11899,8 @@ function kernelFsHandlers(fs) {
     getattr: async (path) => attrOf(await fs.lstat(path)),
     readdir: async (path) => (await fs.readdirStat(path)).flatMap(([name2, st]) => {
       if (!st) return [];
-      const attr = attrOf(st);
-      return [{ name: name2, kind: attr.kind, attr }];
+      const attr2 = attrOf(st);
+      return [{ name: name2, kind: attr2.kind, attr: attr2 }];
     }),
     async open(path, flags) {
       const st = await existing(path);
@@ -12189,7 +12330,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
         "list",
         { path: rel(path) }
       );
-      return entries.map(({ name: name2, attr }) => ({ name: name2, kind: attr.kind, attr }));
+      return entries.map(({ name: name2, attr: attr2 }) => ({ name: name2, kind: attr2.kind, attr: attr2 }));
     },
     async open(path, flags) {
       const client = current();
@@ -12782,8 +12923,8 @@ var ChunkedBytes = class {
     }
     return out;
   }
-  write(offset, bytes, owned2 = false) {
-    const whole = owned2 && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
+  write(offset, bytes, owned3 = false) {
+    const whole = owned3 && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
     for (let done4 = 0; done4 < bytes.length; ) {
       const at = offset + done4;
       const index = Math.floor(at / CHUNK3);
@@ -12816,18 +12957,42 @@ var ChunkedBytes = class {
 };
 
 // src/mount/tmpfs.ts
-function tmpfs() {
-  let inodes = 0;
-  const make = (kind, mode) => ({
+function idOption2(value) {
+  return value !== void 0 && /^\d+$/.test(value) ? Number(value) : 0;
+}
+function created2(ino, kind, mode, from, owner) {
+  return {
     kind,
-    ino: ++inodes,
-    mode,
+    ino,
+    mode: owner?.mode === void 0 ? mode : mode & ~4095 | owner.mode & 4095,
     mtime: Date.now(),
     data: new ChunkedBytes(),
     target: "",
     children: /* @__PURE__ */ new Map(),
-    links: 1
-  });
+    links: 1,
+    uid: owner?.uid ?? from?.uid ?? 0,
+    gid: owner?.gid ?? from?.gid ?? 0
+  };
+}
+function owned2(node, change) {
+  if (change.uid !== void 0) node.uid = change.uid;
+  if (change.gid !== void 0) node.gid = change.gid;
+}
+function attr(node) {
+  return {
+    kind: node.kind,
+    size: node.kind === "file" ? node.data.size : node.kind === "symlink" ? node.target.length : 4096,
+    mtime: node.mtime,
+    mode: node.mode,
+    ino: node.ino,
+    ...node.kind === "directory" ? {} : { nlink: node.links },
+    uid: node.uid,
+    gid: node.gid
+  };
+}
+function tmpfs() {
+  let inodes = 0;
+  const make = (kind, mode, from, owner) => created2(++inodes, kind, mode, from, owner);
   const root = make("directory", 16877);
   const handles = /* @__PURE__ */ new Map();
   let nextFh = 0;
@@ -12854,14 +13019,6 @@ function tmpfs() {
     if (dir.kind !== "directory") throw fsError2("ENOTDIR", path);
     return { dir, name: name2 };
   }
-  const attr = (node) => ({
-    kind: node.kind,
-    size: node.kind === "file" ? node.data.size : node.kind === "symlink" ? node.target.length : 4096,
-    mtime: node.mtime,
-    mode: node.mode,
-    ino: node.ino,
-    ...node.kind === "directory" ? {} : { nlink: node.links }
-  });
   const handle = (fh) => {
     const found = handles.get(fh);
     if (!found) throw fsError2("EBADF", `handle ${fh}`);
@@ -12874,11 +13031,16 @@ function tmpfs() {
     if (existing?.kind === "directory" && flags.write) throw fsError2("EISDIR", path);
     if (existing) return existing;
     if (!flags.create) throw fsError2("ENOENT", path);
-    const node = make("file", 33188);
+    const node = make("file", 33188, dir, flags.owner);
     place(dir, name2, node);
     return node;
   }
   return {
+    mount(info) {
+      root.uid = idOption2(info.options.uid);
+      root.gid = idOption2(info.options.gid);
+      return void 0;
+    },
     async getattr(path) {
       return attr(find(path));
     },
@@ -12911,10 +13073,10 @@ function tmpfs() {
       handle(fh);
       handles.delete(fh);
     },
-    async mkdir(path) {
+    async mkdir(path, owner) {
       const { dir, name: name2 } = parent(path);
       if (dir.children.has(name2)) throw fsError2("EEXIST", path);
-      place(dir, name2, make("directory", 16877));
+      place(dir, name2, make("directory", 16877, dir, owner));
     },
     async rmdir(path) {
       const { dir, name: name2 } = parent(path);
@@ -12961,10 +13123,10 @@ function tmpfs() {
       place(dir, name2, node);
       node.links++;
     },
-    async symlink(target, path) {
+    async symlink(target, path, owner) {
       const { dir, name: name2 } = parent(path);
       if (dir.children.has(name2)) throw fsError2("EEXIST", path);
-      const node = make("symlink", 41471);
+      const node = make("symlink", 41471, dir, owner && { ...owner, mode: 511 });
       node.target = target;
       place(dir, name2, node);
     },
@@ -12983,6 +13145,7 @@ function tmpfs() {
         node.mtime = Date.now();
       }
       if (change.mtime !== void 0) node.mtime = change.mtime;
+      owned2(node, change);
     },
     async statfs() {
       return { bsize: 4096, blocks: 262144, bfree: 262144 };
@@ -13303,7 +13466,8 @@ var Launcher = class {
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
       busy: (target) => [...this.openFiles].some((nodes) => nodes.holds(target)) || heldUnder(this.held, target),
-      changed: this.watchers.changed.bind(this.watchers)
+      changed: this.watchers.changed.bind(this.watchers),
+      owners: this.owners
     });
     this.base = this.watchers.wrap(this.mounts.wrap(options.fs));
     this.createWorker = options.createWorker;
@@ -13336,7 +13500,8 @@ var Launcher = class {
     const fs = withCommandDirs(
       this.base,
       async () => new Set((await this.commands()).keys()),
-      (dir) => this.userCommandDir(dir)
+      (dir) => this.userCommandDir(dir),
+      this.owners
     );
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.nodes.keepsOnDisk = true;
@@ -13866,7 +14031,15 @@ var Launcher = class {
       serveFilesystem(
         port2,
         tmpfs(),
-        { symlinks: true, links: true, chmod: true, linkTimes: true, ranges: true, attrTtl: 0 },
+        {
+          symlinks: true,
+          links: true,
+          chmod: true,
+          owners: true,
+          linkTimes: true,
+          ranges: true,
+          attrTtl: 0
+        },
         { owned: true }
       );
       return {
@@ -13939,6 +14112,11 @@ var Launcher = class {
     void this.unlinked.sweep(entry.target);
     return entry;
   }
+  mountedBy(spec, cred) {
+    if (!this.owners || cred.euid === 0 && cred.egid === 0) return spec;
+    const ids = { uid: String(cred.euid), gid: String(cred.egid) };
+    return { ...spec, options: { ...ids, ...spec.options } };
+  }
   mountRoot(path) {
     let root = "/";
     for (const { target } of this.mounts.list()) {
@@ -13982,7 +14160,7 @@ var Launcher = class {
   async processMount(pid, call, signal) {
     const spec = mountCall(call);
     await this.permit({ op: "mount", pid, ...spec, options: { ...spec.options } });
-    const entry = await this.mount(spec);
+    const entry = await this.mount(this.mountedBy(spec, this.credOf(pid)));
     if (signal.aborted) this.umount(entry.target, true);
   }
   async processUmount(pid, target, flags) {
@@ -14335,6 +14513,62 @@ function isMemoryRoot(handle) {
   return handle instanceof MemoryDirectory;
 }
 
+// src/node/ws-diagnose.ts
+import { lookup } from "node:dns/promises";
+import { isIP, connect as tcp } from "node:net";
+import { connect as tls } from "node:tls";
+var PROBE_MS = 3e3;
+var PASSED = /* @__PURE__ */ new Set(["ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ETIMEDOUT", "ECONNRESET"]);
+var NO_NAME = /* @__PURE__ */ new Set(["ENOTFOUND", "EAI_AGAIN", "EAI_NONAME", "EAI_FAIL", "ENODATA"]);
+function codeOf5(e) {
+  const code = e?.code;
+  return typeof code === "string" ? code : void 0;
+}
+function probe(secure, host, port, ms) {
+  return new Promise((resolve) => {
+    const socket = secure ? tls({ host, port, ...isIP(host) ? {} : { servername: host } }) : tcp({ host, port });
+    const done4 = (code) => {
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(code);
+    };
+    const timer = setTimeout(() => done4("ETIMEDOUT"), ms);
+    socket.once(secure ? "secureConnect" : "connect", () => done4("EPROTO"));
+    socket.once("error", (e) => {
+      const code = codeOf5(e) ?? "";
+      done4(PASSED.has(code) ? code : "EPROTO");
+    });
+  });
+}
+async function diagnose(url, ms = PROBE_MS) {
+  const at = new URL(url);
+  const host = at.hostname.replace(/^\[(.*)\]$/, "$1");
+  const secure = at.protocol === "wss:";
+  const port = Number(at.port) || (secure ? 443 : 80);
+  try {
+    await lookup(host);
+  } catch (e) {
+    return NO_NAME.has(codeOf5(e) ?? "") ? "EAI_NONAME" : void 0;
+  }
+  return probe(secure, host, port, ms);
+}
+function diagnosing(transport, check = diagnose) {
+  const open = transport.websocket;
+  if (!open) return transport;
+  return {
+    ...transport,
+    websocket: async (request) => {
+      try {
+        return await open(request);
+      } catch (e) {
+        if (request.signal.aborted || !(e instanceof Error) || codeOf5(e)) throw e;
+        const code = await check(request.url).catch(() => void 0);
+        throw code ? Object.assign(e, { code }) : e;
+      }
+    }
+  };
+}
+
 // src/kernel/net/remote-transport.ts
 var TransportError = class extends Error {
   status;
@@ -15129,7 +15363,7 @@ function hostfsFetchOf(options) {
 }
 function nodeTransport() {
   const transport = fetchTransport({ webSocket: true, webSocketHeaders: true, redirect: "manual" });
-  return { ...transport, traits: { ...transport.traits, crossOrigin: "any" } };
+  return diagnosing({ ...transport, traits: { ...transport.traits, crossOrigin: "any" } });
 }
 var TERMINATED = "the kernel is terminated";
 var EXIT_GRACE_MS = 50;