npm - @ai-ecoverse/slicc-kernel - Versions diffs - 1.61.2 → 1.62.0 - Mend

@ai-ecoverse/slicc-kernel 1.61.2 → 1.62.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.md +19 -5
package/dist/index.js +12 -9
package/dist/index.js.map +2 -2
package/dist/kernel-worker.js +616 -260
package/dist/kernel-worker.js.map +4 -4
package/dist/node-process-worker.js +14 -4
package/dist/node-process-worker.js.map +2 -2
package/dist/node.js +711 -355
package/dist/node.js.map +4 -4
package/dist/process-worker.js +14 -4
package/dist/process-worker.js.map +2 -2
package/package.json +2 -2

package/dist/node.js CHANGED Viewed

@@ -105,13 +105,13 @@ function fsError(code, path) {
   return Object.assign(new Error(`${code}: ${path}`), { code });
 }
 function normalizePath(path) {
-  const parts = [];
+  const parts2 = [];
   for (const part of path.split("/")) {
     if (part === "" || part === ".") continue;
-    if (part === "..") parts.pop();
-    else parts.push(part);
+    if (part === "..") parts2.pop();
+    else parts2.push(part);
   }
-  return `/${parts.join("/")}`;
+  return `/${parts2.join("/")}`;
 }
 function resolvePath(base, path) {
   return normalizePath(path.startsWith("/") ? path : `${base}/${path}`);
@@ -129,6 +129,355 @@ function inodeOf(path) {
   return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
 }
+// src/fs/owners.ts
+var ROOT_OWNER = Object.freeze({ uid: 0, gid: 0 });
+var S_ISUID = 2048;
+var S_ISGID = 1024;
+var S_IXGRP = 8;
+function ownOf(entry) {
+  if (entry?.uid === void 0 || entry.gid === void 0) return void 0;
+  return { uid: entry.uid, gid: entry.gid };
+}
+function handedBy(entry) {
+  return entry?.heir ? { uid: entry.heir[0], gid: entry.heir[1] } : ownOf(entry);
+}
+function inherit(entries) {
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const found = handedBy(entries[i]);
+    if (found) return found;
+  }
+  return { ...ROOT_OWNER };
+}
+function chain(path) {
+  const parts2 = path.split("/").filter(Boolean);
+  return ["/", ...parts2.map((_, i) => `/${parts2.slice(0, i + 1).join("/")}`)];
+}
+function sameOwner(a, b) {
+  return a.uid === b.uid && a.gid === b.gid;
+}
+function ownerOf(cred, mode) {
+  return { uid: cred.euid, gid: cred.egid, ...mode !== void 0 ? { mode } : {} };
+}
+function inGroup(cred, gid) {
+  return cred.egid === gid || cred.groups.includes(gid);
+}
+function mayChown(cred, current, uid, gid) {
+  if (cred.euid === 0) return true;
+  const owner = cred.euid === current.uid;
+  if (uid !== void 0 && !(owner && uid === current.uid)) return false;
+  if (gid !== void 0 && !(owner && (gid === current.gid || inGroup(cred, gid)))) return false;
+  return true;
+}
+function clearedSetId(mode) {
+  const bits2 = S_ISUID | (mode & S_IXGRP ? S_ISGID : 0);
+  return mode & 4095 & ~bits2;
+}
+async function chownAs(fs, cred, path, change) {
+  const { uid, gid, follow: follow2 } = change;
+  const st = follow2 ? await fs.stat(path) : await fs.lstat(path);
+  const current = { uid: st.uid ?? 0, gid: st.gid ?? 0 };
+  if (!fs.chown || !mayChown(cred, current, uid, gid)) throw fsError("EPERM", path);
+  const clear = st.isFile && (uid !== void 0 || gid !== void 0) ? clearedSetId(st.mode) : void 0;
+  await fs.chown(path, {
+    ...uid !== void 0 ? { uid } : {},
+    ...gid !== void 0 ? { gid } : {},
+    follow: follow2,
+    ...clear !== void 0 && clear !== (st.mode & 4095) ? { mode: clear } : {}
+  });
+}
+// src/fs/walk.ts
+var MAX_LINKS = 40;
+function parentOf(path) {
+  return path.slice(0, path.lastIndexOf("/")) || "/";
+}
+async function mustBeDir(fs, path) {
+  if (!fs.lstat) return;
+  const st = await fs.lstat(path);
+  if (st.isDirectory !== true) throw fsError("ENOTDIR", path);
+}
+async function linkOf(fs, path) {
+  return fs.readlink?.(path).catch(() => void 0);
+}
+async function realDir(fs, dir, budget = { hops: 0 }) {
+  const queue = dir.split("/").filter(Boolean);
+  let at = "/";
+  while (queue.length > 0) {
+    const part = queue.shift();
+    if (part === ".") continue;
+    if (part === "..") {
+      at = parentOf(at);
+      continue;
+    }
+    const next2 = at === "/" ? `/${part}` : `${at}/${part}`;
+    const link2 = await linkOf(fs, next2);
+    if (link2 === void 0) {
+      if (queue.find((p) => p !== ".") === "..") await mustBeDir(fs, next2);
+      at = next2;
+      continue;
+    }
+    if (budget.hops >= MAX_LINKS) throw fsError("ELOOP", dir);
+    budget.hops++;
+    queue.unshift(...link2.split("/").filter(Boolean));
+    if (link2.startsWith("/")) at = "/";
+  }
+  return at;
+}
+function joinName(dir, name2) {
+  return dir === "/" ? `/${name2}` : `${dir}/${name2}`;
+}
+async function realTarget(fs, path) {
+  const budget = { hops: 0 };
+  let dir = await realDir(fs, parentOf(path), budget);
+  let name2 = path.slice(path.lastIndexOf("/") + 1);
+  for (; ; ) {
+    const link2 = await linkOf(fs, joinName(dir, name2));
+    if (link2 === void 0) break;
+    if (budget.hops >= MAX_LINKS) throw fsError("ELOOP", path);
+    budget.hops++;
+    const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
+    dir = await realDir(fs, parentOf(target), budget);
+    name2 = target.slice(target.lastIndexOf("/") + 1);
+  }
+  return joinName(dir, name2);
+}
+// src/fs/access.ts
+var R_OK = 4;
+var W_OK = 2;
+var X_OK = 1;
+var MAX_LINKS2 = 40;
+var S_ISVTX = 512;
+function permOf(st, link2) {
+  return {
+    uid: st.uid ?? 0,
+    gid: st.gid ?? 0,
+    mode: st.mode & 4095,
+    ...link2 !== void 0 ? { link: link2 } : {}
+  };
+}
+function permits(cred, perm, want, directory = true) {
+  const mode = perm.mode ?? (directory ? 493 : 420);
+  if (cred.euid === 0) return (want & X_OK) === 0 || directory || (mode & 73) !== 0;
+  const shift = cred.euid === perm.uid ? 6 : inGroup(cred, perm.gid) ? 3 : 0;
+  return (mode >> shift & want) === want;
+}
+function sticky(cred, dir, entry) {
+  if (cred.euid === 0 || ((dir.mode ?? 0) & S_ISVTX) === 0) return true;
+  return cred.euid === dir.uid || cred.euid === (entry ?? dir).uid;
+}
+async function ancestryOf(fs, path) {
+  if (fs.ancestry) return fs.ancestry(path);
+  const out = [];
+  for (const at of chain(path)) {
+    const st = await fs.lstat(at).catch(() => void 0);
+    if (!st) break;
+    out.push(permOf(st, st.isSymbolicLink ? await fs.readlink(at) : void 0));
+  }
+  return out;
+}
+var Perms = class {
+  known = /* @__PURE__ */ new Map();
+  fs;
+  constructor(fs) {
+    this.fs = fs;
+  }
+  async learn(path) {
+    const names = chain(path);
+    const perms = await ancestryOf(this.fs, path);
+    for (let i = 0; i < names.length; i++) {
+      const perm = perms[i];
+      this.known.set(names[i], perm);
+      if (perm === void 0 || perm.link !== void 0) break;
+    }
+  }
+  async at(path) {
+    if (!this.known.has(path)) await this.learn(path);
+    return this.known.get(path);
+  }
+};
+function parts(path) {
+  return path.split("/").filter((part) => part !== "" && part !== ".");
+}
+async function walk(fs, cred, path, follow2) {
+  const perms = new Perms(fs);
+  await perms.learn(path);
+  const queue = parts(path);
+  let at = "/";
+  for (let hops = 0; queue.length > 0; ) {
+    const part = queue.shift();
+    const dir = await perms.at(at);
+    if (!dir) return { path: joinName(at, [part, ...queue].join("/")), perm: void 0 };
+    if (!permits(cred, dir, X_OK)) return { path, perm: void 0, denied: at };
+    if (part === "..") {
+      at = parentOf(at);
+      continue;
+    }
+    const next2 = joinName(at, part);
+    const perm = await perms.at(next2);
+    const last = queue.length === 0;
+    if (perm?.link !== void 0 && (!last || follow2)) {
+      if (++hops > MAX_LINKS2) return { path: next2, perm: void 0 };
+      queue.unshift(...parts(perm.link));
+      if (perm.link.startsWith("/")) at = "/";
+      continue;
+    }
+    if (last) return { path: next2, perm };
+    at = next2;
+  }
+  return { path: at, perm: await perms.at(at) };
+}
+async function present(fs, path, directory) {
+  const st = await fs.lstat(path).catch(() => void 0);
+  return st !== void 0 && (!directory || st.isDirectory);
+}
+async function access(fs, cred, path, want, options = {}) {
+  const walked = await walk(fs, cred, path, options.follow !== false);
+  if (walked.denied !== void 0) {
+    if (await present(fs, walked.denied, true)) return walked;
+    return { path, perm: void 0, missing: true };
+  }
+  const { perm } = walked;
+  if (!perm) return { ...walked, missing: true };
+  if (want === 0 || permits(cred, perm, want, options.directory !== false)) return walked;
+  if (await present(fs, walked.path, false)) return { ...walked, denied: walked.path };
+  return { ...walked, missing: true };
+}
+function refused(path, errno = "EACCES") {
+  return fsError(errno, path);
+}
+// src/fs/dac.ts
+var MAX_DENIAL_KEYS = 1e4;
+var S_ISGID2 = 1024;
+var Dac = class {
+  mode;
+  hook;
+  log;
+  seen = /* @__PURE__ */ new Set();
+  suppressed = false;
+  constructor(mode, hook, log = (line) => console.warn(line)) {
+    this.mode = mode;
+    this.hook = hook;
+    this.log = log;
+  }
+  get enforcing() {
+    return this.mode === "enforce";
+  }
+  denied(denial) {
+    try {
+      this.hook?.({ ...denial });
+    } catch {
+    }
+    if (this.mode === "report") this.note(denial);
+    else throw refused(denial.path, denial.errno);
+  }
+  note(d) {
+    const key = `${d.uid}\0${d.op}\0${d.errno}\0${d.path}`;
+    if (this.seen.has(key)) return;
+    if (this.seen.size >= MAX_DENIAL_KEYS) {
+      if (!this.suppressed) this.log("slicc-kernel users report: more denials suppressed");
+      this.suppressed = true;
+      return;
+    }
+    this.seen.add(key);
+    this.log(
+      `slicc-kernel users report: ${d.errno} ${d.op} ${d.path} (uid ${d.uid}, pid ${d.pid})`
+    );
+  }
+};
+function deny(g, op, path, errno = "EACCES") {
+  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno });
+}
+async function need(g, op, path, want, options = {}, shown = path) {
+  const walked = await access(g.fs, g.cred, path, want, options);
+  if (walked.denied !== void 0) deny(g, op, shown);
+  return walked;
+}
+async function stickyEntry(g, op, path, dir) {
+  const perm = dir.perm;
+  if (!perm || sticky(g.cred, perm, perm)) return;
+  const entry = joinName(dir.path, path.slice(path.lastIndexOf("/") + 1));
+  if (sticky(g.cred, perm, (await ancestryOf(g.fs, entry)).at(-1))) return;
+  if (await present(g.fs, entry, false)) deny(g, op, path, "EPERM");
+}
+async function inParent(g, op, path, old = false) {
+  const dir = await need(g, op, parentOf(path), W_OK | X_OK, {}, path);
+  if (old && dir.denied === void 0) await stickyEntry(g, op, path, dir);
+}
+async function makeIn(g, op, path) {
+  for (let dir = parentOf(path); ; dir = parentOf(dir)) {
+    const walked = await access(g.fs, g.cred, dir, W_OK | X_OK);
+    if (walked.denied !== void 0) {
+      if (!await present(g.fs, path, true)) deny(g, op, path);
+      return;
+    }
+    if (!walked.missing || dir === "/") return;
+  }
+}
+async function tree(g, op, dir, perm) {
+  if (!permits(g.cred, perm, R_OK | W_OK | X_OK)) return deny(g, op, dir);
+  for (const [name2, st] of await g.fs.readdirStat(dir)) {
+    if (!st) continue;
+    const child = joinName(dir, name2);
+    if (!sticky(g.cred, perm, permOf(st))) deny(g, op, child, "EPERM");
+    if (st.isDirectory) await tree(g, op, child, permOf(st));
+  }
+}
+async function removable(g, op, path) {
+  await inParent(g, op, path, true);
+  if (g.cred.euid === 0) return;
+  const st = await g.fs.lstat(path).catch(() => void 0);
+  if (st?.isDirectory) await tree(g, op, path, permOf(st));
+}
+async function renamable(g, from, to) {
+  if (from === to) return void await need(g, "rename", from, 0, { follow: false });
+  await inParent(g, "rename", from, true);
+  await inParent(g, "rename", to, true);
+  if (g.cred.euid === 0 || parentOf(from) === parentOf(to)) return;
+  const st = await g.fs.lstat(from).catch(() => void 0);
+  if (st?.isDirectory && !permits(g.cred, permOf(st), W_OK)) deny(g, "rename", from);
+}
+async function linkable(g, from, to, follow2) {
+  const source = await need(g, "link", from, 0, { follow: follow2 });
+  const perm = source.perm;
+  if (perm && g.cred.euid !== 0 && perm.uid !== g.cred.euid) {
+    const safe = permits(g.cred, perm, R_OK | W_OK, false);
+    if (!safe && await present(g.fs, source.path, false)) deny(g, "link", from, "EPERM");
+  }
+  await inParent(g, "link", to);
+}
+async function ownerOnly(g, op, path, follow2) {
+  const walked = await need(g, op, path, 0, { follow: follow2 });
+  const perm = walked.perm;
+  if (!perm || g.cred.euid === 0 || perm.uid === g.cred.euid) return walked;
+  if (await present(g.fs, walked.path, false)) deny(g, op, path, "EPERM");
+  return walked;
+}
+async function chmodMode(g, path, mode) {
+  const perm = (await ownerOnly(g, "chmod", path, true)).perm;
+  if (!g.dac.enforcing || !perm || g.cred.euid === 0 || inGroup(g.cred, perm.gid)) return mode;
+  return mode & ~S_ISGID2;
+}
+async function retimable(g, op, path) {
+  await ownerOnly(g, op, path, op !== "lutimes");
+}
+async function listable(g, op, path) {
+  await need(g, op, path, R_OK | X_OK, { directory: true });
+}
+async function searchable(g, op, path, follow2) {
+  await need(g, op, path, 0, { follow: follow2 });
+}
+async function readable(g, op, path) {
+  await need(g, op, path, R_OK, { directory: false });
+}
+async function writable(g, op, path) {
+  const st = await g.fs.stat(path).catch(() => void 0);
+  if (st) return void await need(g, op, path, W_OK, { directory: st.isDirectory });
+  const target = await need(g, op, path, 0);
+  if (target.denied === void 0) await need(g, op, parentOf(target.path), W_OK | X_OK, {}, path);
+}
 // src/kernel/pipe.ts
 var PIPE_CAPACITY = 64 * 1024;
 var PipeError = class extends Error {
@@ -372,7 +721,7 @@ function written(device, bytes) {
   if (device === "full" && bytes.length > 0) throw new KernelError("ENOSPC");
   return bytes.length;
 }
-function deviceFile(device, access) {
+function deviceFile(device, access2) {
   const read = async (max) => {
     if (device === "null") return new Uint8Array(0);
     const out = new Uint8Array(max);
@@ -384,10 +733,10 @@ function deviceFile(device, access) {
     return out;
   };
   return new OpenFile({
-    ...access !== "write" ? { read } : {},
-    ...access !== "read" ? { write: async (bytes) => written(device, bytes) } : {},
+    ...access2 !== "write" ? { read } : {},
+    ...access2 !== "read" ? { write: async (bytes) => written(device, bytes) } : {},
     seek: async () => 0,
-    heldMeta: { device, ...access ? { access } : {} },
+    heldMeta: { device, ...access2 ? { access: access2 } : {} },
     close: () => {
     }
   });
@@ -1824,9 +2173,9 @@ var UserDb = class {
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
   async realDir(path) {
-    const parts = path.split("/").filter(Boolean);
-    for (let n = 1; n <= parts.length; n++) {
-      const at = `/${parts.slice(0, n).join("/")}`;
+    const parts2 = path.split("/").filter(Boolean);
+    for (let n = 1; n <= parts2.length; n++) {
+      const at = `/${parts2.slice(0, n).join("/")}`;
       const st = await this.fs.lstat(at).catch(() => void 0);
       if (!st?.isDirectory) return false;
     }
@@ -2054,7 +2403,7 @@ function versionError(theirs) {
 }
 // src/client/serve-client.ts
-var MAX_LINKS = 40;
+var MAX_LINKS3 = 40;
 function act(session, req, signal) {
   if (req.action === "write") session.write(req.bytes);
   else if (req.action === "resize") session.resize(req.cols, req.rows);
@@ -2062,26 +2411,50 @@ function act(session, req, signal) {
   else session.close();
 }
 async function realpath(fs, path) {
-  let parts = fs.resolvePath("/", path).split("/").filter(Boolean);
+  let parts2 = fs.resolvePath("/", path).split("/").filter(Boolean);
   let resolved = "";
-  for (let hops = 0; parts.length > 0; ) {
-    const [name2, ...rest2] = parts;
+  for (let hops = 0; parts2.length > 0; ) {
+    const [name2, ...rest2] = parts2;
     const next2 = `${resolved}/${name2}`;
     if (!(await fs.lstat(next2)).isSymbolicLink) {
       resolved = next2;
-      parts = rest2;
+      parts2 = rest2;
       continue;
     }
-    if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
+    if (++hops > MAX_LINKS3) throw fsError("ELOOP", path);
     const target = await fs.readlink(next2);
     const base = target.startsWith("/") ? "/" : resolved || "/";
-    parts = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest2];
+    parts2 = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest2];
     resolved = "";
   }
   return resolved || "/";
 }
-async function fsCall(fs, method, args, owner) {
+var CLIENT_CHECKS = {
+  readFile: (g, at) => readable(g, "read", at(0)),
+  writeFile: (g, at) => writable(g, "write", at(0)),
+  stat: (g, at) => searchable(g, "stat", at(0), true),
+  lstat: (g, at) => searchable(g, "lstat", at(0), false),
+  readdir: (g, at) => listable(g, "readdir", at(0)),
+  mkdir: (g, at) => makeIn(g, "mkdir", at(0)),
+  rm: (g, at) => removable(g, "rm", at(0)),
+  rename: (g, at) => renamable(g, at(0), at(1)),
+  realpath: (g, at) => searchable(g, "realpath", at(0), true),
+  symlink: (g, at) => inParent(g, "symlink", at(1)),
+  readlink: (g, at) => searchable(g, "readlink", at(0), false),
+  exists: (g, at) => searchable(g, "exists", at(0), true)
+};
+async function fsCall(fs, method, args, owner, g) {
   const path = (i) => fs.resolvePath("/", String(args[i]));
+  if (g) {
+    const denied2 = await Promise.resolve(CLIENT_CHECKS[method](g, path)).then(
+      () => false,
+      (err) => {
+        if (method === "exists") return true;
+        throw err;
+      }
+    );
+    if (denied2) return { result: false };
+  }
   switch (method) {
     case "readFile": {
       const bytes = (await fs.readFileBuffer(path(0))).slice();
@@ -2144,6 +2517,10 @@ function ownerFor(l, self) {
   if (!l.owners || !self) return void 0;
   return { uid: self.uid, gid: self.gid, umask: self.umask ?? 18 };
 }
+function guardFor(l, self) {
+  if (!l.dac || !self) return void 0;
+  return { fs: l.fs, cred: credOf(self), pid: 0, dac: l.dac };
+}
 async function accountOf(l, user) {
   const found = await l.users.lookup(user);
   if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
@@ -2212,17 +2589,28 @@ function cdpRegistry(send, gone) {
     }
   };
 }
-function watchOp(l, req, watches, send) {
+function visibleTo(g, notify) {
+  if (!g?.dac.enforcing) return notify;
+  let queue = Promise.resolve();
+  const seen = async (path) => (await access(g.fs, g.cred, parentOf(path), R_OK | X_OK, { directory: true })).denied === void 0;
+  return (change) => {
+    queue = queue.then(async () => {
+      if (!("paths" in change)) return notify(change);
+      const paths = [];
+      for (const path of change.paths) if (await seen(path)) paths.push(path);
+      if (paths.length > 0) notify({ paths });
+    });
+  };
+}
+async function watchOp(l, req, watches, send, g) {
   if (req.op === "unwatch") {
     watches.get(req.watch)?.();
     watches.delete(req.watch);
     return { result: true };
   }
-  const unwatch = l.watchers.watch(
-    req.paths,
-    { recursive: req.recursive },
-    (change) => send({ watch: req.id, change })
-  );
+  if (g) for (const path of req.paths) await readable(g, "watch", l.fs.resolvePath("/", path));
+  const notify = visibleTo(g, (change) => send({ watch: req.id, change }));
+  const unwatch = l.watchers.watch(req.paths, { recursive: req.recursive }, notify);
   watches.set(req.id, unwatch);
   return { result: req.id };
 }
@@ -2256,9 +2644,9 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused = versionError(message3.protocol);
-    if (refused) {
-      send({ hello: { protocol: PROTOCOL, error: refused } });
+    const refused2 = versionError(message3.protocol);
+    if (refused2) {
+      send({ hello: { protocol: PROTOCOL, error: refused2 } });
       detach();
       return;
     }
@@ -2338,10 +2726,10 @@ function serveClient(port, host) {
         if (!FS_METHODS.includes(req.method)) {
           throw new Error(`unknown file system call ${req.method}`);
         }
-        return fsCall(l.fs, req.method, req.args, ownerFor(l, self));
+        return fsCall(l.fs, req.method, req.args, ownerFor(l, self), guardFor(l, self));
       case "watch":
       case "unwatch":
-        return watchOp(l, req, watches, send);
+        return watchOp(l, req, watches, send, guardFor(l, self));
       case "mount":
         return { result: await l.mount(req.spec) };
       case "umount":
@@ -2399,11 +2787,11 @@ function serveClient(port, host) {
 }
 // src/fs/meta.ts
-function parentOf(path) {
+function parentOf2(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
 function moved(entry, path) {
-  return entry.link === void 0 ? { ...entry, path } : { ...entry, path, dir: parentOf(path) };
+  return entry.link === void 0 ? { ...entry, path } : { ...entry, path, dir: parentOf2(path) };
 }
 function under(path, root) {
   return path === root || path.startsWith(`${root}/`);
@@ -2446,71 +2834,14 @@ var MemoryMeta = class {
   }
 };
-// src/fs/owners.ts
-var ROOT_OWNER = Object.freeze({ uid: 0, gid: 0 });
-var S_ISUID = 2048;
-var S_ISGID = 1024;
-var S_IXGRP = 8;
-function ownOf(entry) {
-  if (entry?.uid === void 0 || entry.gid === void 0) return void 0;
-  return { uid: entry.uid, gid: entry.gid };
-}
-function handedBy(entry) {
-  return entry?.heir ? { uid: entry.heir[0], gid: entry.heir[1] } : ownOf(entry);
-}
-function inherit(entries) {
-  for (let i = entries.length - 1; i >= 0; i--) {
-    const found = handedBy(entries[i]);
-    if (found) return found;
-  }
-  return { ...ROOT_OWNER };
-}
-function chain(path) {
-  const parts = path.split("/").filter(Boolean);
-  return ["/", ...parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`)];
-}
-function sameOwner(a, b) {
-  return a.uid === b.uid && a.gid === b.gid;
-}
-function ownerOf(cred, mode) {
-  return { uid: cred.euid, gid: cred.egid, ...mode !== void 0 ? { mode } : {} };
-}
-function inGroup(cred, gid) {
-  return cred.egid === gid || cred.groups.includes(gid);
-}
-function mayChown(cred, current, uid, gid) {
-  if (cred.euid === 0) return true;
-  const owner = cred.euid === current.uid;
-  if (uid !== void 0 && !(owner && uid === current.uid)) return false;
-  if (gid !== void 0 && !(owner && (gid === current.gid || inGroup(cred, gid)))) return false;
-  return true;
-}
-function clearedSetId(mode) {
-  const bits2 = S_ISUID | (mode & S_IXGRP ? S_ISGID : 0);
-  return mode & 4095 & ~bits2;
-}
-async function chownAs(fs, cred, path, change) {
-  const { uid, gid, follow: follow2 } = change;
-  const st = follow2 ? await fs.stat(path) : await fs.lstat(path);
-  const current = { uid: st.uid ?? 0, gid: st.gid ?? 0 };
-  if (!fs.chown || !mayChown(cred, current, uid, gid)) throw fsError("EPERM", path);
-  const clear = st.isFile && (uid !== void 0 || gid !== void 0) ? clearedSetId(st.mode) : void 0;
-  await fs.chown(path, {
-    ...uid !== void 0 ? { uid } : {},
-    ...gid !== void 0 ? { gid } : {},
-    follow: follow2,
-    ...clear !== void 0 && clear !== (st.mode & 4095) ? { mode: clear } : {}
-  });
-}
 // src/fs/opfs.ts
 var S_IFDIR = 16384;
 var S_IFREG = 32768;
 var S_IFLNK = 40960;
 var PERM_MASK = 4095;
-var S_ISGID2 = 1024;
+var S_ISGID3 = 1024;
 var READ_ATTEMPTS = 3;
-var MAX_LINKS2 = 40;
+var MAX_LINKS4 = 40;
 var CHECK_MS = 1e3;
 var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
 var ERRNO_BY_DOM_ERROR = {
@@ -2542,10 +2873,10 @@ function translate(err, path, op = "lookup", mapped = true) {
 var META_OPS = ["get", "update", "move", "remove", "links", "under", "all"];
 function sidecar(meta) {
   const pathOf = ([first]) => [first, "/"].flat().find((p) => typeof p === "string");
-  const guarded = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
+  const guarded2 = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
     throw translate(err, pathOf(args), "sidecar", false);
   });
-  return Object.fromEntries(META_OPS.map((op) => [op, guarded(op)]));
+  return Object.fromEntries(META_OPS.map((op) => [op, guarded2(op)]));
 }
 function missing(err) {
   const code = err?.code;
@@ -2554,15 +2885,15 @@ function missing(err) {
 function split(path) {
   return path.split("/").filter(Boolean);
 }
-function parentOf2(path) {
+function parentOf3(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
 function baseOf(path) {
   return path.slice(path.lastIndexOf("/") + 1);
 }
 function prefixes(path) {
-  const parts = split(path);
-  return parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`);
+  const parts2 = split(path);
+  return parts2.map((_, i) => `/${parts2.slice(0, i + 1).join("/")}`);
 }
 function within(path, root) {
   return path === root || path.startsWith(`${root}/`);
@@ -2583,39 +2914,39 @@ async function openSync(handle) {
     }
   }
 }
-function writeAll(access, at, bytes) {
+function writeAll(access2, at, bytes) {
   for (let done4 = 0; done4 < bytes.length; ) {
-    const n = access.write(bytes.subarray(done4), { at: at + done4 });
+    const n = access2.write(bytes.subarray(done4), { at: at + done4 });
     if (!(n > 0))
       throw Object.assign(new Error("the file system took no more bytes"), { code: "ENOSPC" });
     done4 += n;
   }
 }
 async function positioned(handle, op) {
-  const access = await openSync(handle);
-  if (access) {
+  const access2 = await openSync(handle);
+  if (access2) {
     try {
       op({
-        write: (at, bytes) => writeAll(access, at, bytes),
-        truncate: (n) => access.truncate(n)
+        write: (at, bytes) => writeAll(access2, at, bytes),
+        truncate: (n) => access2.truncate(n)
       });
-      access.flush();
+      access2.flush();
     } finally {
-      access.close();
+      access2.close();
     }
     return;
   }
-  const writable = await handle.createWritable({ keepExistingData: true });
+  const writable2 = await handle.createWritable({ keepExistingData: true });
   try {
     await op({
-      write: (at, bytes) => writable.write({ type: "write", position: at, data: bytes }),
-      truncate: (n) => writable.truncate(n)
+      write: (at, bytes) => writable2.write({ type: "write", position: at, data: bytes }),
+      truncate: (n) => writable2.truncate(n)
     });
   } catch (err) {
-    await writable.abort();
+    await writable2.abort();
     throw err;
   }
-  await writable.close();
+  await writable2.close();
 }
 function isHandle(child) {
   return "kind" in child;
@@ -2650,13 +2981,21 @@ var OpfsFs = class {
   trackOwners() {
     this.owners = true;
   }
+  async ancestry(path) {
+    const entries = await this.meta.get(chain(path));
+    return entries.map((entry, i) => ({
+      ...ownOf(entry) ?? (i === 0 ? ROOT_OWNER : inherit(entries.slice(0, i))),
+      ...entry?.mode !== void 0 ? { mode: entry.mode } : {},
+      ...entry?.link !== void 0 ? { link: entry.link } : {}
+    }));
+  }
   async handedTo(dir) {
     return inherit(await this.meta.get(chain(dir)));
   }
   async ownerAt(path, entry) {
     const own = ownOf(entry);
     if (own) return own;
-    return path === "/" ? { ...ROOT_OWNER } : this.handedTo(parentOf2(path));
+    return path === "/" ? { ...ROOT_OWNER } : this.handedTo(parentOf3(path));
   }
   async owned(stat, path, entry) {
     return this.owners ? { ...stat, ...await this.ownerAt(path, entry) } : stat;
@@ -2666,11 +3005,11 @@ var OpfsFs = class {
     const entries = await this.meta.get(chain(path));
     const self = entries.pop();
     const parent = entries.at(-1);
-    const setgid = ((parent?.mode ?? 0) & S_ISGID2) !== 0;
+    const setgid = ((parent?.mode ?? 0) & S_ISGID3) !== 0;
     const parentGid = (ownOf(parent) ?? inherit(entries.slice(0, -1))).gid;
     const want = { uid: owner.uid, gid: setgid ? parentGid : owner.gid };
     let mode = owner.mode === void 0 ? void 0 : owner.mode & PERM_MASK;
-    if (directory && setgid) mode = (mode ?? 493) | S_ISGID2;
+    if (directory && setgid) mode = (mode ?? 493) | S_ISGID3;
     const fields = {};
     if (mode !== void 0 && mode !== (this.mode(path, directory, void 0) & PERM_MASK)) {
       fields.mode = mode;
@@ -2686,7 +3025,7 @@ var OpfsFs = class {
   async chown(path, change) {
     if (!this.owners) return;
     if (change.kind === "new") {
-      const at = resolvePath((await this.locate(parentOf2(path), true)).path, baseOf(path));
+      const at = resolvePath((await this.locate(parentOf3(path), true)).path, baseOf(path));
       const { uid = 0, gid = 0, mode } = change;
       return this.stampNew(at, { uid, gid, ...mode !== void 0 ? { mode } : {} }, false);
     }
@@ -2714,30 +3053,30 @@ var OpfsFs = class {
     const [stored] = source.link ? [source.link] : await this.meta.get([source.path]);
     return ownOf(stored) ? void 0 : this.ownerAt(source.path, stored);
   }
-  async walk(parts, from, start2) {
+  async walk(parts2, from, start2) {
     let dir = start2;
-    for (let at = from; at < parts.length; at++) {
-      dir = await dir.getDirectoryHandle(parts[at]);
-      this.dirs.set(`/${parts.slice(0, at + 1).join("/")}`, dir);
+    for (let at = from; at < parts2.length; at++) {
+      dir = await dir.getDirectoryHandle(parts2[at]);
+      this.dirs.set(`/${parts2.slice(0, at + 1).join("/")}`, dir);
       this.checked.set(dir, performance.now());
     }
     return dir;
   }
   async dir(path) {
-    const parts = split(path);
-    let from = parts.length;
+    const parts2 = split(path);
+    let from = parts2.length;
     let cached;
     for (; from > 0 && !cached; from--)
-      cached = this.dirs.get(`/${parts.slice(0, from).join("/")}`);
+      cached = this.dirs.get(`/${parts2.slice(0, from).join("/")}`);
     if (cached) from++;
-    const at = `/${parts.slice(0, from).join("/")}`;
+    const at = `/${parts2.slice(0, from).join("/")}`;
     if (cached && !await this.current(at, cached)) {
       this.forget(at);
       cached = void 0;
       from = 0;
     }
     try {
-      return await this.walk(parts, from, cached ?? this.root);
+      return await this.walk(parts2, from, cached ?? this.root);
     } catch (err) {
       throw translate(err, path);
     }
@@ -2767,10 +3106,10 @@ var OpfsFs = class {
     return kind === "file" ? parent.getFileHandle(name2) : parent.getDirectoryHandle(name2);
   }
   async parent(path) {
-    const parts = split(path);
-    const name2 = parts.pop();
+    const parts2 = split(path);
+    const name2 = parts2.pop();
     if (name2 === void 0) throw fsError("EBUSY", path);
-    return [`/${parts.join("/")}`, name2];
+    return [`/${parts2.join("/")}`, name2];
   }
   async handle(path) {
     if (split(path).length === 0) return this.root;
@@ -2797,13 +3136,13 @@ var OpfsFs = class {
   async linkAlong(path) {
     for (const entry of await this.meta.get(prefixes(path))) {
       if (entry?.link === void 0) continue;
-      if (!await this.real(entry.path) && await this.real(parentOf2(entry.path))) return entry;
+      if (!await this.real(entry.path) && await this.real(parentOf3(entry.path))) return entry;
     }
     return void 0;
   }
   async locate(path, follow2) {
     let current = path;
-    for (let hops = 0; hops <= MAX_LINKS2; hops++) {
+    for (let hops = 0; hops <= MAX_LINKS4; hops++) {
       try {
         return { path: current, handle: await this.handle(current) };
       } catch (err) {
@@ -2812,7 +3151,7 @@ var OpfsFs = class {
         if (!link2) throw err;
         if (link2.path === current && !follow2) return { path: current, link: link2 };
         const target = `${link2.link}${current.slice(link2.path.length)}`;
-        current = target.split("/").includes("..") ? await this.physical(parentOf2(link2.path), target, hops + 1) : resolvePath(parentOf2(link2.path), target);
+        current = target.split("/").includes("..") ? await this.physical(parentOf3(link2.path), target, hops + 1) : resolvePath(parentOf3(link2.path), target);
       }
     }
     throw fsError("ELOOP", path);
@@ -2829,7 +3168,7 @@ var OpfsFs = class {
         const st = await this.lstat(at);
         if (!st.isSymbolicLink && !st.isDirectory) throw fsError("ENOTDIR", at);
         if (!st.isSymbolicLink) done4.push(part);
-        else if (++hops > MAX_LINKS2) throw fsError("ELOOP", path);
+        else if (++hops > MAX_LINKS4) throw fsError("ELOOP", path);
         else {
           const link2 = await this.readlink(at);
           if (link2.startsWith("/")) done4 = [];
@@ -2972,19 +3311,19 @@ var OpfsFs = class {
   }
   async writeSession(path, truncate) {
     const handle = (await this.fileFor(path))[0];
-    const writable = await this.retrying(
+    const writable2 = await this.retrying(
       path,
       () => handle.createWritable({ keepExistingData: !truncate }),
       true
     );
     return {
-      write: (at, bytes) => writable.write({ type: "write", position: at, data: bytes }).catch((err) => {
+      write: (at, bytes) => writable2.write({ type: "write", position: at, data: bytes }).catch((err) => {
         throw translate(err, path, "write", false);
       }),
-      truncate: (size) => writable.truncate(size).catch((err) => {
+      truncate: (size) => writable2.truncate(size).catch((err) => {
         throw translate(err, path, "write", false);
       }),
-      close: () => writable.close().catch((err) => {
+      close: () => writable2.close().catch((err) => {
         throw translate(err, path, "commit", false);
       })
     };
@@ -2999,8 +3338,8 @@ var OpfsFs = class {
       if (!missing(err)) throw err;
     }
     const [entry] = await this.meta.get([path]);
-    const wanted = entry?.link === void 0 ? path : resolvePath(parentOf2(path), entry.link);
-    return [resolvePath((await this.locate(parentOf2(wanted), true)).path, baseOf(wanted)), false];
+    const wanted = entry?.link === void 0 ? path : resolvePath(parentOf3(path), entry.link);
+    return [resolvePath((await this.locate(parentOf3(wanted), true)).path, baseOf(wanted)), false];
   }
   async fileFor(path) {
     const [target, existed] = await this.writeTarget(path);
@@ -3010,7 +3349,7 @@ var OpfsFs = class {
         dir,
         (parent) => parent.getFileHandle(name2, { create: true })
       );
-      if (!existed) this.touch(parentOf2(target));
+      if (!existed) this.touch(parentOf3(target));
       return [handle, existed, target];
     } catch (err) {
       const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
@@ -3022,9 +3361,9 @@ var OpfsFs = class {
     if (!existed) await this.stampNew(target, owner, false);
     if (!existed && content.length === 0) return;
     try {
-      const writable = await file.createWritable();
-      await writable.write(content);
-      await writable.close();
+      const writable2 = await file.createWritable();
+      await writable2.write(content);
+      await writable2.close();
     } catch (err) {
       throw translate(err, path, "commit", false);
     }
@@ -3080,9 +3419,9 @@ var OpfsFs = class {
         gid: owner.gid,
         ...mode ? { mode, parents: mode } : {}
       };
-      await this.mkdir(parentOf2(path), { recursive: true, ...above ? { owner: above } : {} });
+      await this.mkdir(parentOf3(path), { recursive: true, ...above ? { owner: above } : {} });
     }
-    const parent = await this.locate(parentOf2(path), true);
+    const parent = await this.locate(parentOf3(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
     const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
@@ -3111,7 +3450,7 @@ var OpfsFs = class {
       this.changed(found.path);
     }
     await this.meta.remove([found.path]);
-    this.touch(parentOf2(found.path));
+    this.touch(parentOf3(found.path));
   }
   links() {
     return false;
@@ -3123,7 +3462,7 @@ var OpfsFs = class {
     if (from === to) return;
     const source = await this.locate(from, false);
     this.forget(source.path);
-    const parent = await this.locate(parentOf2(to), true);
+    const parent = await this.locate(parentOf3(to), true);
     const destination = resolvePath(parent.path, baseOf(to));
     const sourceStat = await this.describe(source);
     if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
@@ -3151,7 +3490,7 @@ var OpfsFs = class {
     if (source.link) {
       if (target?.handle) await this.rm(destination);
       await this.meta.move(source.path, destination, carry);
-      this.touch(parentOf2(source.path), parent.path);
+      this.touch(parentOf3(source.path), parent.path);
       return;
     }
     const dir = parent.handle;
@@ -3173,7 +3512,7 @@ var OpfsFs = class {
     }
     if (copied) await this.restamp(destination, timed2);
     this.changed(source.path, destination);
-    this.touch(parentOf2(source.path), parent.path);
+    this.touch(parentOf3(source.path), parent.path);
   }
   async modified(path) {
     const handle = await this.handle(path);
@@ -3210,16 +3549,16 @@ var OpfsFs = class {
   }
   async copy(handle, dir, name2) {
     if (handle.kind === "file") {
-      const writable = await (await dir.getFileHandle(name2, { create: true })).createWritable();
-      await writable.write(await handle.getFile());
-      await writable.close();
+      const writable2 = await (await dir.getFileHandle(name2, { create: true })).createWritable();
+      await writable2.write(await handle.getFile());
+      await writable2.close();
       return;
     }
     const target = await dir.getDirectoryHandle(name2, { create: true });
     for await (const child of handle.values()) await this.copy(child, target, child.name);
   }
   async symlink(target, path, owner) {
-    const parent = await this.locate(parentOf2(path), true);
+    const parent = await this.locate(parentOf3(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const at = resolvePath(parent.path, baseOf(path));
     if (await this.locate(at, false).then(
@@ -3295,7 +3634,7 @@ var OpfsFs = class {
     let removed = 0;
     for (const entry of await this.meta.all()) {
       const real = await this.real(entry.path);
-      const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf2(entry.path));
+      const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf3(entry.path));
       if (!stale) continue;
       await this.meta.update(entry.path, () => void 0);
       removed++;
@@ -3366,7 +3705,7 @@ function webLocks() {
   return globalThis.navigator?.locks;
 }
 var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
-var parentOf3 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var lockName = (instance) => `slicc-unlinked:${instance}`;
 var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
 var PathGate = class {
@@ -3497,7 +3836,7 @@ var UnlinkedKeeper = class {
           await this.serial(async () => {
             await Promise.allSettled([this.fs.rename(file.hidden, path)]);
             this.unlinkedName(file.hidden);
-            await this.tidy(parentOf3(file.hidden));
+            await this.tidy(parentOf4(file.hidden));
           });
         }
         done4();
@@ -3537,7 +3876,7 @@ var UnlinkedKeeper = class {
     }
     await this.fs.rm(hidden).catch(() => void 0);
     this.unlinkedName(hidden);
-    await this.tidy(parentOf3(hidden));
+    await this.tidy(parentOf4(hidden));
   }
   async linkedName(hidden) {
     if (!mayLink(this.fs, hidden)) return;
@@ -4547,7 +4886,7 @@ function binfmtOf(binfmts, path) {
 var S_IFDIR2 = 16384;
 var S_IFREG2 = 32768;
 var COMMAND = /^\/(?:usr\/)?bin\/([^/]+)$/;
-var MAX_LINKS3 = 40;
+var MAX_LINKS5 = 40;
 function missing2(err) {
   return err?.code === "ENOENT";
 }
@@ -4567,7 +4906,7 @@ function synthetic(directory, path) {
 }
 async function followLinks(fs, path) {
   let current = path;
-  for (let hops = 0; hops < MAX_LINKS3; hops++) {
+  for (let hops = 0; hops < MAX_LINKS5; hops++) {
     const st = await fs.lstat(current).catch(() => void 0);
     if (!st?.isSymbolicLink) return current;
     const parent = current.slice(0, current.lastIndexOf("/")) || "/";
@@ -4674,6 +5013,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     readlink: (path) => fs.readlink(path),
     ...fs.realpath ? { realpath: fs.realpath.bind(fs) } : {},
     ...fs.chown ? { chown: fs.chown.bind(fs) } : {},
+    ...fs.ancestry ? { ancestry: fs.ancestry.bind(fs) } : {},
     chmod: (path, mode) => fs.chmod(path, mode),
     utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime),
     lutimes: (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
@@ -4686,12 +5026,12 @@ var MAX_HOPS = 40;
 function start(path) {
   return { done: [], todo: path.split("/").filter((p) => p !== ""), hops: 0 };
 }
-function next(walk) {
-  while (walk.todo.length > 0) {
-    const part = walk.todo.shift();
+function next(walk2) {
+  while (walk2.todo.length > 0) {
+    const part = walk2.todo.shift();
     if (part === ".") continue;
     if (part === "..") {
-      walk.done.pop();
+      walk2.done.pop();
       continue;
     }
     return part;
@@ -4699,42 +5039,42 @@ function next(walk) {
   return void 0;
 }
 function lexical(path) {
-  const walk = start(path);
-  for (let part = next(walk); part !== void 0; part = next(walk)) walk.done.push(part);
-  return `/${walk.done.join("/")}`;
+  const walk2 = start(path);
+  for (let part = next(walk2); part !== void 0; part = next(walk2)) walk2.done.push(part);
+  return `/${walk2.done.join("/")}`;
 }
-function rest(walk, part) {
-  return lexical(`/${[...walk.done, part, ...walk.todo].join("/")}`);
+function rest(walk2, part) {
+  return lexical(`/${[...walk2.done, part, ...walk2.todo].join("/")}`);
 }
-function follow(walk, target) {
-  if (++walk.hops > MAX_HOPS) return false;
-  if (target.startsWith("/")) walk.done.length = 0;
-  walk.todo = [...target.split("/").filter((p) => p !== ""), ...walk.todo];
+function follow(walk2, target) {
+  if (++walk2.hops > MAX_HOPS) return false;
+  if (target.startsWith("/")) walk2.done.length = 0;
+  walk2.todo = [...target.split("/").filter((p) => p !== ""), ...walk2.todo];
   return true;
 }
 async function physicalPathAsync(fs, path) {
-  const walk = start(path);
-  for (let part = next(walk); part !== void 0; part = next(walk)) {
-    const at = `/${[...walk.done, part].join("/")}`;
+  const walk2 = start(path);
+  for (let part = next(walk2); part !== void 0; part = next(walk2)) {
+    const at = `/${[...walk2.done, part].join("/")}`;
     let target;
     try {
       target = (await fs.lstat(at)).isSymbolicLink ? await fs.readlink(at) : void 0;
     } catch {
-      return rest(walk, part);
+      return rest(walk2, part);
     }
-    if (target === void 0) walk.done.push(part);
-    else if (!follow(walk, target)) return lexical(path);
+    if (target === void 0) walk2.done.push(part);
+    else if (!follow(walk2, target)) return lexical(path);
   }
-  return `/${walk.done.join("/")}`;
+  return `/${walk2.done.join("/")}`;
 }
 // src/fs/watch.ts
 var WATCH_BATCH_LIMIT = 1e3;
 var under2 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
-var parentOf4 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 function touches(watcher, changed) {
   return watcher.paths.some(
-    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf4(changed) === watched)
+    (watched) => changed === watched || under2(watched, changed) || (watcher.recursive ? under2(changed, watched) : parentOf5(changed) === watched)
   );
 }
 var FsWatchers = class {
@@ -4783,9 +5123,9 @@ var FsWatchers = class {
       mkdir: async (path, options) => {
         const created3 = [];
         if (options?.recursive) {
-          const parts = normalizePath(path).split("/").filter(Boolean);
-          for (let at = 1; at < parts.length; at++) {
-            const ancestor = `/${parts.slice(0, at).join("/")}`;
+          const parts2 = normalizePath(path).split("/").filter(Boolean);
+          for (let at = 1; at < parts2.length; at++) {
+            const ancestor = `/${parts2.slice(0, at).join("/")}`;
             if (created3.length > 0 || !await fs.exists(ancestor)) created3.push(ancestor);
           }
         }
@@ -5014,62 +5354,6 @@ var ChildTable = class {
   }
 };
-// src/fs/walk.ts
-var MAX_LINKS4 = 40;
-function parentOf5(path) {
-  return path.slice(0, path.lastIndexOf("/")) || "/";
-}
-async function mustBeDir(fs, path) {
-  if (!fs.lstat) return;
-  const st = await fs.lstat(path);
-  if (st.isDirectory !== true) throw fsError("ENOTDIR", path);
-}
-async function linkOf(fs, path) {
-  return fs.readlink?.(path).catch(() => void 0);
-}
-async function realDir(fs, dir, budget = { hops: 0 }) {
-  const queue = dir.split("/").filter(Boolean);
-  let at = "/";
-  while (queue.length > 0) {
-    const part = queue.shift();
-    if (part === ".") continue;
-    if (part === "..") {
-      at = parentOf5(at);
-      continue;
-    }
-    const next2 = at === "/" ? `/${part}` : `${at}/${part}`;
-    const link2 = await linkOf(fs, next2);
-    if (link2 === void 0) {
-      if (queue.find((p) => p !== ".") === "..") await mustBeDir(fs, next2);
-      at = next2;
-      continue;
-    }
-    if (budget.hops >= MAX_LINKS4) throw fsError("ELOOP", dir);
-    budget.hops++;
-    queue.unshift(...link2.split("/").filter(Boolean));
-    if (link2.startsWith("/")) at = "/";
-  }
-  return at;
-}
-function joinName(dir, name2) {
-  return dir === "/" ? `/${name2}` : `${dir}/${name2}`;
-}
-async function realTarget(fs, path) {
-  const budget = { hops: 0 };
-  let dir = await realDir(fs, parentOf5(path), budget);
-  let name2 = path.slice(path.lastIndexOf("/") + 1);
-  for (; ; ) {
-    const link2 = await linkOf(fs, joinName(dir, name2));
-    if (link2 === void 0) break;
-    if (budget.hops >= MAX_LINKS4) throw fsError("ELOOP", path);
-    budget.hops++;
-    const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
-    dir = await realDir(fs, parentOf5(target), budget);
-    name2 = target.slice(target.lastIndexOf("/") + 1);
-  }
-  return joinName(dir, name2);
-}
 // src/mount/protocol.ts
 var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
@@ -5132,8 +5416,8 @@ var DriverConnection = class _DriverConnection {
     } finally {
       clearTimeout(timer);
     }
-    const refused = driverVersionError(hello.protocol);
-    if (refused) throw errnoError("EPROTO", refused);
+    const refused2 = driverVersionError(hello.protocol);
+    if (refused2) throw errnoError("EPROTO", refused2);
     if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
     return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options.onFail);
   }
@@ -5173,7 +5457,7 @@ var DriverConnection = class _DriverConnection {
 };
 // src/mount/mount-fs.ts
-var S_ISGID3 = 1024;
+var S_ISGID4 = 1024;
 var ID = /^\d{1,10}$/;
 var MAX_ID2 = 4294967294;
 function idOption(value) {
@@ -5186,7 +5470,7 @@ function checkIds(options) {
     if (!ID.test(value) || Number(value) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value}`);
   }
 }
-var MAX_LINKS5 = 40;
+var MAX_LINKS6 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
 var DEFAULT_IO = 8 * 1024 * 1024;
@@ -5424,12 +5708,12 @@ var MountTable = class {
   }
   list() {
     const mounted = [...this.mounts.values()].map(
-      ({ type, source, target, options, state, error, present: present2 }) => ({
+      ({ type, source, target, options, state, error, present: present3 }) => ({
         type,
         source,
         target,
         options: { ...options },
-        state: state === "ok" && present2?.() === false ? "nomedium" : state,
+        state: state === "ok" && present3?.() === false ? "nomedium" : state,
         ...error ? { error } : {}
       })
     );
@@ -5704,7 +5988,7 @@ var MountFs = class {
       throw err;
     }
     if (attr2.kind !== "symlink") return real;
-    if (hops >= MAX_LINKS5) throw errnoError("ELOOP", path);
+    if (hops >= MAX_LINKS6) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
     return this.follow(this.base.resolvePath(parentOf6(real), target), hops + 1, create);
   }
@@ -5724,9 +6008,9 @@ var MountFs = class {
     if (!owner || !mount.owners || !mount.caps.owners) return void 0;
     const dir = parentOf6(real);
     const above = statOf(await this.table.getattr(mount, dir, parentOf6(rel2)), dir, mount);
-    const setgid = (above.mode & S_ISGID3) !== 0;
+    const setgid = (above.mode & S_ISGID4) !== 0;
     let mode = owner.mode;
-    if (directory && setgid) mode = (mode ?? 493) | S_ISGID3;
+    if (directory && setgid) mode = (mode ?? 493) | S_ISGID4;
     return {
       uid: owner.uid,
       gid: setgid ? above.gid : owner.gid,
@@ -6001,14 +6285,14 @@ var MountFs = class {
       await mount.conn.call({ op: "mkdir", path: rel2, ...made2 });
       return;
     }
-    const parts = rel2.split("/").filter(Boolean);
-    for (let n = 1; n <= parts.length; n++) {
-      const sub = `/${parts.slice(0, n).join("/")}`;
+    const parts2 = rel2.split("/").filter(Boolean);
+    for (let n = 1; n <= parts2.length; n++) {
+      const sub = `/${parts2.slice(0, n).join("/")}`;
       const full = normalizePath(`${mount.target}${sub}`);
       const exists = await this.table.getattr(mount, full, sub).catch(() => void 0);
       if (exists?.kind === "directory") continue;
       if (exists) throw errnoError("ENOTDIR", full);
-      const own = n === parts.length ? owner : owner && { ...owner, mode: owner.parents };
+      const own = n === parts2.length ? owner : owner && { ...owner, mode: owner.parents };
       const made2 = await this.driverOwner({ mount, rel: sub }, full, own, true);
       this.table.forget(mount, full);
       await mount.conn.call({ op: "mkdir", path: sub, ...made2 });
@@ -6101,6 +6385,20 @@ var MountFs = class {
     if (this.at(real)) throw errnoError("ENOSYS", path);
     return real;
   }
+  async ancestry(path) {
+    const names = chain(normalizePath(path));
+    const first = names.findIndex((name2) => this.at(name2));
+    if (first < 0) return ancestryOf(this.base, path);
+    const out = first === 0 ? [] : await ancestryOf(this.base, names[first - 1]);
+    if (out.length < first || out.some((perm) => perm?.link !== void 0)) return out;
+    for (const name2 of names.slice(first)) {
+      const st = await this.lstat(name2).catch(() => void 0);
+      if (!st) break;
+      out.push(permOf(st, st.isSymbolicLink ? await this.readlink(name2) : void 0));
+      if (st.isSymbolicLink) break;
+    }
+    return out;
+  }
   async readlink(path) {
     const found = this.at(path);
     if (!found) return this.base.readlink(path);
@@ -6311,9 +6609,11 @@ async function run(entry, path, req) {
       return done;
     case "readlink":
       return json2(await fs.readlink(path));
-    case "chmod":
-      await fs.chmod(path, req.mode ?? 0);
+    case "chmod": {
+      const g = guardOf(entry);
+      await fs.chmod(path, g ? await chmodMode(g, path, req.mode ?? 0) : req.mode ?? 0);
       return done;
+    }
     case "utimes":
       await fs.utimes(path, new Date(req.atimeMs ?? 0), new Date(req.mtimeMs ?? 0));
       return done;
@@ -6331,6 +6631,53 @@ async function run(entry, path, req) {
       return { ok: false, errno: "EINVAL", message: `sync-fs: unknown op '${req.op}'` };
   }
 }
+function guardOf(entry) {
+  const cred = entry.dac && entry.cred?.();
+  if (!cred || !entry.dac) return void 0;
+  return { fs: entry.fs, cred, pid: entry.pid ?? 0, dac: entry.dac };
+}
+var FOLLOWING = /* @__PURE__ */ new Set(["exists", "stat", "chown", "statfs"]);
+var NOT_FOLLOWING = /* @__PURE__ */ new Set(["lstat", "readlink", "lchown"]);
+async function guard(g, path, req, cwd) {
+  const { op } = req;
+  if (FOLLOWING.has(op) || NOT_FOLLOWING.has(op)) return searchable(g, op, path, FOLLOWING.has(op));
+  const other = () => g.fs.resolvePath(cwd, req.arg2 ?? "");
+  switch (op) {
+    case "readdir":
+    case "readdir-stat":
+      return listable(g, op, path);
+    case "mkdir":
+      return makeIn(g, op, path);
+    case "create":
+    case "symlink":
+      return inParent(g, op, path);
+    case "unlink":
+    case "rmdir":
+      return inParent(g, op, path, true);
+    case "rm":
+      return removable(g, op, path);
+    case "rename":
+      return renamable(g, path, other());
+    case "link":
+      return linkable(g, path, other(), req.mode === 1);
+    case "utimes":
+    case "lutimes":
+      return retimable(g, op, path);
+    default:
+      return void 0;
+  }
+}
+async function guarded(entry, path, req) {
+  const g = guardOf(entry);
+  if (!g) return void 0;
+  try {
+    await guard(g, path, req, entry.cwd);
+    return void 0;
+  } catch (err) {
+    const refusal = err.code === "EACCES";
+    return req.op === "exists" && refusal ? json2(false) : toErrno(err);
+  }
+}
 async function createExclusive(fs, path, owner) {
   if (fs.createExclusive) return fs.createExclusive(path, owner);
   if (await fs.lstat(path).then(
@@ -6383,6 +6730,16 @@ async function owned(entry, own, req, path, target) {
   }
   return own(target, () => run(entry, path, req));
 }
+async function holdOp(entry, path, req) {
+  const mode = req.mode ?? 0;
+  const [on, open] = [(mode & 1) === 1, (mode & 2) === 2];
+  if (on && open) {
+    const real = await entry.fs.realpath?.(path, true).catch(() => path);
+    return json2(entry.hold?.(path, on, open, real) ?? null);
+  }
+  entry.hold?.(path, on, open, void 0, req.handle);
+  return done;
+}
 async function dispatchSyncFs(req) {
   const entry = resolveSyncFsToken(req.token);
   if (!entry) return { ok: false, errno: "EACCES", message: "sync-fs: unknown or revoked token" };
@@ -6391,16 +6748,10 @@ async function dispatchSyncFs(req) {
     const path = fs.resolvePath(cwd, req.path);
     if (req.op === "kept") return json2(entry.keptFor?.(req.handle ?? -1) !== void 0);
     if (req.op === "stat" && req.handle !== void 0) return await keptStat(entry, req);
+    if (req.op === "hold") return holdOp(entry, path, req);
+    const refused2 = await guarded(entry, path, req);
+    if (refused2) return refused2;
     if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
-    if (req.op === "hold") {
-      const [on, open] = [((req.mode ?? 0) & 1) === 1, ((req.mode ?? 0) & 2) === 2];
-      if (on && open) {
-        const real = await fs.realpath?.(path, true).catch(() => path);
-        return json2(entry.hold?.(path, on, open, real) ?? null);
-      }
-      entry.hold?.(path, on, open, void 0, req.handle);
-      return done;
-    }
     if (entry.revoked?.(path)) return { ok: false, errno: "EIO", message: `${path} was unmounted` };
     if (req.op === "write" && req.mode === 1 || UNLINKED_OPS.has(req.op)) {
       const serve = async () => run(entry, await keptOr(entry, path, req.handle), req);
@@ -6601,9 +6952,9 @@ function mountTable(mounts = []) {
   for (const m of mounts) {
     const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
     if (m.state !== "ok") options.push(m.state);
-    const access = options.includes("ro") ? [] : ["rw"];
+    const access2 = options.includes("ro") ? [] : ["rw"];
     lines2.push(
-      `${field2(m.source)} ${field2(m.target)} ${m.type} ${[...access, ...options].join(",")} 0 0`
+      `${field2(m.source)} ${field2(m.target)} ${m.type} ${[...access2, ...options].join(",")} 0 0`
     );
   }
   return `${lines2.join("\n")}
@@ -7039,8 +7390,8 @@ var ProcTree = class {
   alive(pid) {
     return this.listing().processes.some((p) => p.pid === pid);
   }
-  node(parts) {
-    const [top, leaf, ...rest2] = parts;
+  node(parts2) {
+    const [top, leaf, ...rest2] = parts2;
     if (top === void 0) {
       return {
         kind: "dir",
@@ -7078,9 +7429,9 @@ var ProcTree = class {
     };
   }
   parts(path, follow2) {
-    const parts = path.split("/").filter((p) => p !== "").slice(1);
-    if (parts[0] === "self" && (follow2 || parts.length > 1)) parts[0] = String(this.pid);
-    return parts;
+    const parts2 = path.split("/").filter((p) => p !== "").slice(1);
+    if (parts2[0] === "self" && (follow2 || parts2.length > 1)) parts2[0] = String(this.pid);
+    return parts2;
   }
   find(path, follow2) {
     const node = this.node(this.parts(path, follow2));
@@ -7166,8 +7517,8 @@ function refusalOf(found) {
   return found === false ? { refused: "ENOTDIR" } : found;
 }
 function throughLink(target, done4, todo) {
-  const parts = target.split("/").filter((part) => part !== "");
-  return [target.startsWith("/") ? [] : done4, [...parts, ...todo]];
+  const parts2 = target.split("/").filter((part) => part !== "");
+  return [target.startsWith("/") ? [] : done4, [...parts2, ...todo]];
 }
 async function procAlias(fs, path, follow2) {
   const { readlink, lstat } = fs;
@@ -7177,14 +7528,14 @@ async function procAlias(fs, path, follow2) {
     () => false
   );
   if (!physical) return void 0;
-  const walk = procWalk(path, follow2);
-  let step = walk.next();
+  const walk2 = procWalk(path, follow2);
+  let step = walk2.next();
   while (!step.done) {
     const { at, check } = step.value;
     const link2 = await readlink.call(fs, at).catch(() => void 0);
     const isDir = (st) => st.isDirectory === true;
     const target = link2 ?? (check ? await lstat.call(fs, at).then(isDir, failed) : true);
-    step = walk.next(target);
+    step = walk2.next(target);
   }
   return step.value;
 }
@@ -7778,8 +8129,8 @@ var RealmProxy = class {
   }
   async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const refused = target.port === 443 ? await this.tunnelReady(target) : void 0;
-    if (refused) throw refused;
+    const refused2 = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused2) throw refused2;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
       const first = await incoming.peek(this.stop.signal);
@@ -7922,10 +8273,10 @@ var RealmProxy = class {
 };
 // src/kernel/net/x509.ts
-function concat4(parts) {
-  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+function concat4(parts2) {
+  const out = new Uint8Array(parts2.reduce((n, p) => n + p.length, 0));
   let at = 0;
-  for (const p of parts) {
+  for (const p of parts2) {
     out.set(p, at);
     at += p.length;
   }
@@ -7941,8 +8292,8 @@ function tlv(tag, ...contents2) {
   const body = concat4(contents2);
   return concat4([Uint8Array.of(tag), length(body.length), body]);
 }
-var seq = (...parts) => tlv(48, ...parts);
-var set = (...parts) => tlv(49, ...parts);
+var seq = (...parts2) => tlv(48, ...parts2);
+var set = (...parts2) => tlv(49, ...parts2);
 var octets = (bytes) => tlv(4, bytes);
 var bits = (bytes, unused = 0) => tlv(3, Uint8Array.of(unused), bytes);
 var TRUE = tlv(1, Uint8Array.of(255));
@@ -8030,8 +8381,8 @@ function randomSerial() {
 function ipv4(host) {
   const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
   if (!m) return void 0;
-  const parts = m.slice(1).map(Number);
-  return parts.every((p) => p <= 255) ? Uint8Array.from(parts) : void 0;
+  const parts2 = m.slice(1).map(Number);
+  return parts2.every((p) => p <= 255) ? Uint8Array.from(parts2) : void 0;
 }
 function ipv6(host) {
   if (!host.includes(":") || !/^[0-9A-Fa-f:.]+$/.test(host)) return void 0;
@@ -8860,9 +9211,9 @@ var HttpHandles = class {
 // src/kernel/net/routes.ts
 var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
 function ipv4Bytes(text) {
-  const parts = text.split(".");
-  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
-  const bytes = parts.map(Number);
+  const parts2 = text.split(".");
+  if (parts2.length !== 4 || !parts2.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts2.map(Number);
   return bytes.every((b) => b <= 255) ? bytes : void 0;
 }
 function ipv6Groups(text) {
@@ -8889,9 +9240,9 @@ function addressBits(host) {
   return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
 }
 function parsePrefix(text) {
-  const parts = text.trim().split("/");
-  if (parts.length > 2) return void 0;
-  const [address = "", size] = parts;
+  const parts2 = text.trim().split("/");
+  if (parts2.length > 2) return void 0;
+  const [address = "", size] = parts2;
   const parsed2 = addressBits(address);
   if (!parsed2) return void 0;
   const max = parsed2.v6 ? 128 : 32;
@@ -9852,10 +10203,10 @@ var VfsNode = class {
       this.serial(() => this.flush()).catch(() => void 0);
     }, delay);
   }
-  ensure(need) {
+  ensure(need2) {
     const cur = this.data ?? new Uint8Array(0);
-    if (cur.length >= need) return cur;
-    const grown = new Uint8Array(Math.max(need, cur.length * 2, 256));
+    if (cur.length >= need2) return cur;
+    const grown = new Uint8Array(Math.max(need2, cur.length * 2, 256));
     grown.set(cur.subarray(0, this.length));
     this.data = grown;
     return grown;
@@ -9898,14 +10249,14 @@ var VfsNodes = class {
     return run2;
   }
   async entryKey(path) {
-    const parent = parentOf5(path);
+    const parent = parentOf(path);
     const dir = await this.real(parent, true, () => realDir(this.fs, parent));
     return joinName(dir, path.slice(path.lastIndexOf("/") + 1));
   }
   targetKey(path) {
     return this.real(path, true, () => realTarget(this.fs, path));
   }
-  async real(path, follow2, walk) {
+  async real(path, follow2, walk2) {
     if (this.fs.realpath) {
       try {
         return await this.fs.realpath(path, follow2);
@@ -9913,13 +10264,13 @@ var VfsNodes = class {
         if (errCode(err) === "ELOOP") throw err;
       }
     }
-    return walk();
+    return walk2();
   }
   createExclusive(path, owner) {
     return this.onEntry(path, async () => {
       const node = this.byPath.get(path);
       const held = node ? await node.serial(async () => node.holds()) : false;
-      if (held || await present(this.fs, path)) throw fsError("EEXIST", path);
+      if (held || await present2(this.fs, path)) throw fsError("EEXIST", path);
       await this.fs.writeFile(path, new Uint8Array(0), owner);
     });
   }
@@ -9979,13 +10330,13 @@ var VfsNodes = class {
     if (id2 !== void 0) this.know(node, id2);
     return node;
   }
-  open(path, pin, writable = false, id2) {
+  open(path, pin, writable2 = false, id2) {
     const node = this.named(path, id2) ?? this.create(path, id2, new VfsNode(this.fs, path, void 0, false, false, pin));
     node.opens++;
-    if (writable) node.writers++;
+    if (writable2) node.writers++;
     return node;
   }
-  adopt(path, contents2, dirty, writable = false, id2) {
+  adopt(path, contents2, dirty, writable2 = false, id2) {
     let node = this.named(path, id2);
     if (!node) {
       node = this.create(path, id2, new VfsNode(this.fs, path, contents2, false, dirty));
@@ -9993,7 +10344,7 @@ var VfsNodes = class {
       node.replace(contents2);
     }
     node.opens++;
-    if (writable) node.writers++;
+    if (writable2) node.writers++;
     return node;
   }
   holds(prefix) {
@@ -10005,11 +10356,11 @@ var VfsNodes = class {
       if (node.writers > 0 && within5(path, prefix)) return true;
     return false;
   }
-  closed(node, writable = false) {
+  closed(node, writable2 = false) {
     node.opens--;
-    if (writable) node.writers--;
+    if (writable2) node.writers--;
     if (node.opens > 0) {
-      if (writable && node.writers === 0) this.onClosed?.(node.path);
+      if (writable2 && node.writers === 0) this.onClosed?.(node.path);
       return;
     }
     this.forget(node);
@@ -10086,7 +10437,7 @@ var VfsNodes = class {
     }
   }
 };
-async function present(fs, path, follow2 = false) {
+async function present2(fs, path, follow2 = false) {
   const look = (follow2 ? void 0 : fs.lstat) ?? fs.stat;
   try {
     await (look ? look.call(fs, path) : fs.readFileBuffer(path));
@@ -10100,7 +10451,7 @@ function errCode(err) {
   return err?.code;
 }
 async function targetDir(fs, path) {
-  return parentOf5(await realTarget(fs, path).catch(() => path));
+  return parentOf(await realTarget(fs, path).catch(() => path));
 }
 async function refuseReadonly(fs, path, flags, opts = {}) {
   const writes = (flags & O_ACCMODE) !== 0 || opts.truncate === true;
@@ -10150,10 +10501,10 @@ function keepingOpen(fs, nodes) {
   };
 }
 function vfsFile(fs, opts, nodes) {
-  const access = opts.flags & O_ACCMODE;
-  const readable = access !== O_WRONLY;
-  const writable = access === O_WRONLY || access === O_RDWR;
-  const node = !nodes || opts.orphan ? new VfsNode(fs, opts.path, opts.contents, opts.orphan === true, opts.dirty === true) : opts.contents !== void 0 ? nodes.adopt(opts.path, opts.contents, opts.dirty === true, writable, opts.id) : nodes.open(opts.path, opts.pin, writable, opts.id);
+  const access2 = opts.flags & O_ACCMODE;
+  const readable2 = access2 !== O_WRONLY;
+  const writable2 = access2 === O_WRONLY || access2 === O_RDWR;
+  const node = !nodes || opts.orphan ? new VfsNode(fs, opts.path, opts.contents, opts.orphan === true, opts.dirty === true) : opts.contents !== void 0 ? nodes.adopt(opts.path, opts.contents, opts.dirty === true, writable2, opts.id) : nodes.open(opts.path, opts.pin, writable2, opts.id);
   let openError;
   const atOpen = (op) => {
     void node.serial(op).catch((err) => {
@@ -10174,12 +10525,12 @@ function vfsFile(fs, opts, nodes) {
     return op();
   });
   return new OpenFile({
-    read: readable ? (max) => serial(async () => {
+    read: readable2 ? (max) => serial(async () => {
       const out = await node.pread(max, offset);
       offset += out.length;
       return out;
     }) : void 0,
-    write: writable ? (bytes) => serial(async () => {
+    write: writable2 ? (bytes) => serial(async () => {
       if (opts.flags & O_APPEND) offset = await node.size();
       offset += await node.pwrite(bytes, offset);
       return bytes.length;
@@ -10194,15 +10545,15 @@ function vfsFile(fs, opts, nodes) {
       return offset;
     }),
     pread: (max, at) => serial(() => {
-      if (!readable) throw new KernelError("EBADF");
+      if (!readable2) throw new KernelError("EBADF");
       return node.pread(max, at);
     }),
     pwrite: (bytes, at) => serial(() => {
-      if (!writable) throw new KernelError("EBADF");
+      if (!writable2) throw new KernelError("EBADF");
       return node.pwrite(bytes, at);
     }),
     resize: (size) => serial(() => {
-      if (!writable) throw new KernelError("EBADF");
+      if (!writable2) throw new KernelError("EBADF");
       return node.truncate(size);
     }),
     stat: () => serial(async () => ({
@@ -10216,7 +10567,7 @@ function vfsFile(fs, opts, nodes) {
         takeOpenError();
         await node.flush();
       } finally {
-        nodes?.closed(node, writable);
+        nodes?.closed(node, writable2);
       }
     })
   });
@@ -10587,7 +10938,7 @@ var WasmProcess = class {
         this.fds.installAt(fd, this.openVfsFile(open));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const fresh = this.options.owners && !await present(this.options.fs, path, true);
+          const fresh = this.options.owners && !await present2(this.options.fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path)));
           await this.fds.get(fd).file.stat?.();
           if (fresh) await this.options.fs.chown?.(path, { ...this.newOwner(), kind: "new" });
@@ -10595,7 +10946,7 @@ var WasmProcess = class {
       } else {
         this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path)));
       }
-      if (req.existing && !await present(this.options.fs, path, true)) {
+      if (req.existing && !await present2(this.options.fs, path, true)) {
         throw new KernelError("ENOENT");
       }
     } catch (err) {
@@ -10615,14 +10966,14 @@ var WasmProcess = class {
     if (req.flags & WRITE_ACCESS || req.create || req.truncate || req.exclusive) {
       throw new KernelError("EROFS");
     }
-    const tree = new ProcTree(
+    const tree2 = new ProcTree(
       {
         procList: () => this.options.processes?.() ?? { boot: 0, processes: [] },
         mountList: () => this.options.mounts?.() ?? []
       },
       (await this.options.identity?.())?.pid ?? this.pid
     );
-    return memoryFile(tree.read(path), path, req.position);
+    return memoryFile(tree2.read(path), path, req.position);
   }
   openVfsFile(req, id2) {
     return vfsFile(
@@ -10774,7 +11125,7 @@ var WasmProcess = class {
     const held = handle === void 0 ? void 0 : this.keptHandle?.(handle);
     if (held !== void 0) return held;
     const kept = this.keptPath?.(path);
-    return kept !== void 0 && !await present(this.options.fs, path, true) ? kept : path;
+    return kept !== void 0 && !await present2(this.options.fs, path, true) ? kept : path;
   }
   async promote(req) {
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
@@ -11284,6 +11635,7 @@ function inherited(opts) {
 function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
     ...opts.owners ? caller : {},
+    ...opts.dac ? { dac: opts.dac, pid: opts.pid } : {},
     fs: opts.fs,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
@@ -11913,9 +12265,9 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
-    const refused = driverVersionError(message3.protocol);
-    if (refused) {
-      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused, errno: "EPROTO" } });
+    const refused2 = driverVersionError(message3.protocol);
+    if (refused2) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused2, errno: "EPROTO" } });
       return;
     }
     try {
@@ -12457,7 +12809,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     }, againMs);
     timer.unref?.();
   });
-  async function writable(client, path, flags) {
+  async function writable2(client, path, flags) {
     const { ifMatch: _, ...asked } = flags;
     const opening = () => client.call("open", { path: rel(path), ...asked });
     try {
@@ -12488,7 +12840,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     async open(path, flags) {
       const client = current();
       const token = client.token;
-      const { opened: opened2, restore } = await writable(client, path, flags);
+      const { opened: opened2, restore } = await writable2(client, path, flags);
       if (flags.ifMatch !== void 0 && opened2.attr?.etag !== flags.ifMatch) {
         await client.call("release", { fh: opened2.fh }, true);
         throw fsError2("ESTALE", `${path} changed on the host while it was being read`);
@@ -12661,7 +13013,7 @@ var PORT_DEAD_MS = 1e4;
 var PORT_LINGER_MS = 1e3;
 function timed(transport, ms) {
   const inflight = /* @__PURE__ */ new Set();
-  const guard = (name2, run2, late, expire) => new Promise((resolve, reject) => {
+  const guard2 = (name2, run2, late, expire) => new Promise((resolve, reject) => {
     let expired = false;
     const running = run2();
     inflight.add(running);
@@ -12710,15 +13062,15 @@ function timed(transport, ms) {
     },
     retire: (why) => transport.retire?.(why),
     ...transport.cleanup ? { cleanup } : {},
-    call: (op, body, handle) => guard(
+    call: (op, body, handle) => guard2(
       op,
       () => transport.call(op, body, handle),
       op === "open" ? release : void 0,
       op === "release" ? (running) => void cleanup("release", body ?? {}, running).catch(() => {
       }) : void 0
     ),
-    read: (fh, offset, size, ifMatch) => guard("read", () => transport.read(fh, offset, size, ifMatch)),
-    write: (fh, offset, bytes) => guard("write", () => transport.write(fh, offset, bytes)),
+    read: (fh, offset, size, ifMatch) => guard2("read", () => transport.read(fh, offset, size, ifMatch)),
+    write: (fh, offset, bytes) => guard2("write", () => transport.write(fh, offset, bytes)),
     watch: (signal, onEvent, onOpen) => transport.watch(signal, onEvent, onOpen)
   };
 }
@@ -13099,10 +13451,10 @@ var ChunkedBytes = class {
     }
     this.size = size;
   }
-  room(index, need) {
+  room(index, need2) {
     const chunk2 = this.chunks[index];
-    if (chunk2 && chunk2.length >= need) return chunk2;
-    const grown = new Uint8Array(Math.min(CHUNK3, Math.max(need, (chunk2?.length ?? 0) * 2)));
+    if (chunk2 && chunk2.length >= need2) return chunk2;
+    const grown = new Uint8Array(Math.min(CHUNK3, Math.max(need2, (chunk2?.length ?? 0) * 2)));
     if (chunk2) grown.set(chunk2);
     this.chunks[index] = grown;
     return grown;
@@ -13149,14 +13501,14 @@ function tmpfs() {
   const root = make("directory", 16877);
   const handles = /* @__PURE__ */ new Map();
   let nextFh = 0;
-  const parts = (path) => path.split("/").filter(Boolean);
+  const parts2 = (path) => path.split("/").filter(Boolean);
   const place = (dir, name2, node) => {
     dir.children.set(name2, node);
     dir.mtime = Date.now();
   };
   function find(path) {
     let node = root;
-    for (const name2 of parts(path)) {
+    for (const name2 of parts2(path)) {
       if (node.kind !== "directory") throw fsError2("ENOTDIR", path);
       const next2 = node.children.get(name2);
       if (!next2) throw fsError2("ENOENT", path);
@@ -13165,7 +13517,7 @@ function tmpfs() {
     return node;
   }
   function parent(path) {
-    const names = parts(path);
+    const names = parts2(path);
     const name2 = names.pop();
     if (name2 === void 0) throw fsError2("EBUSY", "the root of a mount");
     const dir = find(`/${names.join("/")}`);
@@ -13250,8 +13602,8 @@ function tmpfs() {
       dir.mtime = Date.now();
     },
     async rename(from, to) {
-      const a = `/${parts(from).join("/")}`;
-      const b = `/${parts(to).join("/")}`;
+      const a = `/${parts2(from).join("/")}`;
+      const b = `/${parts2(to).join("/")}`;
       if (b !== a && b.startsWith(`${a}/`)) throw fsError2("EINVAL", `${to} is inside ${from}`);
       const source = parent(from);
       const node = source.dir.children.get(source.name);
@@ -13610,11 +13962,13 @@ var Launcher = class {
   booting = new AbortController();
   fstab = Promise.resolve([]);
   usersMode;
+  dac;
   nextPid = 1e3;
   boot = Date.now();
   terminals = 0;
   constructor(options) {
     this.usersMode = usersMode(options.users);
+    this.dac = this.usersMode === "off" ? void 0 : new Dac(this.usersMode, options.onDenial);
     if (this.owners) options.fs.trackOwners?.();
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
@@ -13945,6 +14299,7 @@ var Launcher = class {
       ...req.umask !== void 0 ? { umask: req.umask } : {},
       cred: req.cred,
       ...this.owners ? { owners: true } : {},
+      ...this.dac ? { dac: this.dac } : {},
       program: req.program,
       argv0: req.argv0,
       args: req.args,
@@ -14908,7 +15263,7 @@ function dialStream(port, onClose) {
   let closed = false;
   let reader;
   const acks = [];
-  const readable = new ReadableStream({
+  const readable2 = new ReadableStream({
     start(controller) {
       reader = controller;
     },
@@ -14949,7 +15304,7 @@ function dialStream(port, onClose) {
     else finish(errorWithCode(data.error));
   });
   port.start?.();
-  const writable = new WritableStream({
+  const writable2 = new WritableStream({
     write(chunk2) {
       if (closed) throw errorWithCode("EPIPE: the connection is closed");
       const copy = chunk2.slice();
@@ -14968,7 +15323,7 @@ function dialStream(port, onClose) {
     shut();
     finish(error);
   };
-  return { readable, writable, close, fail: fail3 };
+  return { readable: readable2, writable: writable2, close, fail: fail3 };
 }
 // src/client/loopback-fetch.ts
@@ -15452,9 +15807,9 @@ async function greet(channel, lock, timeoutMs) {
   } finally {
     clearTimeout(timer);
   }
-  const refused = hello.error ?? versionError(hello.protocol);
-  if (refused) {
-    const error = new Error(refused);
+  const refused2 = hello.error ?? versionError(hello.protocol);
+  if (refused2) {
+    const error = new Error(refused2);
     channel.end(error);
     throw error;
   }
@@ -15604,10 +15959,11 @@ async function createNodeKernel(options = {}) {
     ...hostfsFetchOf(options),
     ...options.cdp ? { cdp: options.cdp } : {},
     ...options.hostname !== void 0 ? { hostname: options.hostname } : {},
-    ...options.users !== void 0 ? { users: options.users } : {}
+    ...options.users !== void 0 ? { users: options.users } : {},
+    ...options.onDenial ? { onDenial: options.onDenial } : {}
   });
   await launcher.prepare();
-  const guard = (work) => new Promise((resolve, reject) => {
+  const guard2 = (work) => new Promise((resolve, reject) => {
     if (terminated) return reject(new Error(TERMINATED));
     pending.add(reject);
     work().then(resolve, reject).finally(() => pending.delete(reject));
@@ -15619,7 +15975,7 @@ async function createNodeKernel(options = {}) {
       const { stdin, onStdout, onStderr, ...rest2 } = opts;
       const onOut = textOf(onStdout);
       const onErr = textOf(onStderr);
-      const result = await guard(
+      const result = await guard2(
         () => launcher.run(argv, {
           ...rest2,
           ...stdin !== void 0 ? { stdin: typeof stdin === "string" ? new TextEncoder().encode(stdin) : stdin } : {},
@@ -15637,7 +15993,7 @@ async function createNodeKernel(options = {}) {
       const { onData, ...rest2 } = opts;
       let listener = onData ?? null;
       const backlog = [];
-      const session = await guard(
+      const session = await guard2(
         () => launcher.openTerminal(argv, {
           ...rest2,
           onData: (bytes) => listener ? listener(bytes) : backlog.push(bytes)
@@ -15645,7 +16001,7 @@ async function createNodeKernel(options = {}) {
       );
       return {
         pid: session.pid,
-        exited: guard(() => session.exited),
+        exited: guard2(() => session.exited),
         get onData() {
           return listener;
         },
@@ -15665,20 +16021,20 @@ async function createNodeKernel(options = {}) {
       await launcher.fs.writeFile(path, data);
     },
     readFile: async (path) => launcher.fs.readFileBuffer(path),
-    mount: (spec) => guard(() => launcher.mount(spec)),
-    umount: (target) => guard(async () => launcher.umount(target)),
+    mount: (spec) => guard2(() => launcher.mount(spec)),
+    umount: (target) => guard2(async () => launcher.umount(target)),
     mounts: async () => launcher.mounts.list(),
-    setRoutes: (routes) => guard(async () => launcher.setRoutes(routes)),
+    setRoutes: (routes) => guard2(async () => launcher.setRoutes(routes)),
     users: {
       mode: launcher.usersMode,
-      add: (user) => guard(() => launcher.users.add(user)),
-      remove: (name2, options2) => guard(() => launcher.users.remove(name2, options2)),
-      list: () => guard(() => launcher.users.list())
+      add: (user) => guard2(() => launcher.users.add(user)),
+      remove: (name2, options2) => guard2(() => launcher.users.remove(name2, options2)),
+      list: () => guard2(() => launcher.users.list())
     },
     groups: {
-      list: () => guard(() => launcher.users.groups()),
-      addMember: (group, user) => guard(() => launcher.users.addMember(group, user)),
-      removeMember: (group, user) => guard(() => launcher.users.removeMember(group, user))
+      list: () => guard2(() => launcher.users.groups()),
+      addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
+      removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
     },
     async connect({ user } = {}) {
       if (terminated) throw new Error(TERMINATED);