@ai-ecoverse/slicc-kernel 1.62.3 → 1.63.0

package/dist/process-worker.js

@@ -572,6 +572,82 @@ var init_wasi_errno = __esm({
   }
 });
 
+// src/realm/sync-fs-wire.ts
+function parseSyncFsUsage(json) {
+  const u = json;
+  if (!u || typeof u.quota !== "number" || typeof u.usage !== "number") return null;
+  return { quota: u.quota, usage: u.usage };
+}
+function syncError(code2, label) {
+  return Object.assign(new Error(`${code2}: ${label}`), { code: code2 });
+}
+function parseSyncFsStat(json) {
+  const s = json;
+  if (!s || typeof s.isFile !== "boolean" || typeof s.isDirectory !== "boolean" || typeof s.size !== "number") {
+    return null;
+  }
+  return {
+    isFile: s.isFile,
+    isDirectory: s.isDirectory,
+    isSymbolicLink: s.isSymbolicLink,
+    size: s.size,
+    ...typeof s.mode === "number" ? { mode: s.mode } : {},
+    ...typeof s.mtimeMs === "number" ? { mtimeMs: s.mtimeMs } : {},
+    ...typeof s.atimeMs === "number" ? { atimeMs: s.atimeMs } : {},
+    ...typeof s.ctimeMs === "number" ? { ctimeMs: s.ctimeMs } : {},
+    ...typeof s.ino === "number" ? { ino: s.ino } : {},
+    ...typeof s.nlink === "number" ? { nlink: s.nlink } : {},
+    ...typeof s.dev === "number" ? { dev: s.dev } : {},
+    ...s.readonly === true ? { readonly: true } : {},
+    ...typeof s.maxFile === "number" ? { maxFile: s.maxFile } : {},
+    ...s.ranged === true ? { ranged: true } : {},
+    ...s.linkable === true ? { linkable: true } : {},
+    ...typeof s.version === "string" ? { version: s.version } : {},
+    ...typeof s.uid === "number" ? { uid: s.uid } : {},
+    ...typeof s.gid === "number" ? { gid: s.gid } : {}
+  };
+}
+var SYNC_FS_OPS, HOLD_READ, HOLD_WRITE, HOLD_CREATED, SYNC_FS_REQUEST_TIMEOUT_MS;
+var init_sync_fs_wire = __esm({
+  "src/realm/sync-fs-wire.ts"() {
+    "use strict";
+    SYNC_FS_OPS = [
+      "read",
+      "write",
+      "exists",
+      "stat",
+      "lstat",
+      "readdir",
+      "readdir-stat",
+      "mkdir",
+      "rm",
+      "rename",
+      "link",
+      "unlink",
+      "rmdir",
+      "symlink",
+      "readlink",
+      "chmod",
+      "utimes",
+      "lutimes",
+      "statfs",
+      "hold",
+      "create",
+      "kept",
+      "pread",
+      "pwrite",
+      "truncate",
+      "chown",
+      "lchown",
+      "access"
+    ];
+    HOLD_READ = 4;
+    HOLD_WRITE = 8;
+    HOLD_CREATED = 16;
+    SYNC_FS_REQUEST_TIMEOUT_MS = 25e3;
+  }
+});
+
 // src/realm/live-vfs-fs.ts
 function toErrno(Fs, err) {
   if (err?.errno !== void 0 && err instanceof Fs.ErrnoError) {
@@ -600,6 +676,19 @@ function toMs(v) {
   if (v === void 0 || v === null) return void 0;
   return v instanceof Date ? v.getTime() : v;
 }
+function wantOf(flags) {
+  const mode = flags & O_ACCMODE;
+  const read2 = mode === 1 ? 0 : HOLD_READ;
+  const write2 = mode !== 0 || (flags & O_TRUNC) !== 0 ? HOLD_WRITE : 0;
+  return read2 | write2;
+}
+function accessOf(want) {
+  return (want & HOLD_READ ? 4 : 0) | (want & HOLD_WRITE ? 2 : 0);
+}
+function refusal(err) {
+  const code2 = err?.code;
+  return code2 === "EACCES" || code2 === "EPERM";
+}
 function linkedStates(bridgeOf) {
   const opens = /* @__PURE__ */ new Map();
   const byId = /* @__PURE__ */ new Map();
@@ -839,12 +928,13 @@ function createNodeOps(h) {
   const { Fs, bridgeOf, call: call2, metadataCall, makeNode, statOf, childPath, flushNode, truncate } = h;
   const { ensureLoaded } = h;
   const setTimes = (node, path, atime, mtime) => {
+    const now = Fs.sliccTouch === true;
     if (Fs.isLink(node.mode)) {
-      metadataCall(() => bridgeOf(node).lutimes(path, atime, mtime));
+      metadataCall(() => bridgeOf(node).lutimes(path, atime, mtime, now));
       return;
     }
     flushNode(node);
-    metadataCall(() => bridgeOf(node).utimes(path, atime, mtime));
+    metadataCall(() => bridgeOf(node).utimes(path, atime, mtime, now));
   };
   const timesOf = (node, attr2) => {
     const mtime = toMs(attr2.mtime) ?? attr2.timestamp;
@@ -934,6 +1024,7 @@ function createNodeOps(h) {
         mtimeMs: Date.now()
       });
       node.live.stat = void 0;
+      if (Fs.isFile(mode)) node.live.created = true;
       return node;
     },
     rename(oldNode, newDir, newName) {
@@ -1010,21 +1101,34 @@ function createStreamOps(h) {
       }
     }
   };
-  const opened = (node, on) => {
+  const opened = (node, on, want = 0) => {
     const s = node.live;
     try {
-      const handle = bridgeOf(node).hold?.(liveNodePath(node), on, true, s.handle);
+      const handle = bridgeOf(node).hold?.(liveNodePath(node), on, true, s.handle, want);
       s.handle = on ? handle : void 0;
       h.linked.opening(node, on);
       if (s.handle === void 0) h.handled.delete(node);
       else h.handled.add(node);
-    } catch {
+    } catch (err) {
+      if (refusal(err)) throw new Fs.ErrnoError(wasiErrno(err.code));
     }
   };
+  const permitted = (stream, created) => {
+    const s = stream.node.live;
+    const bridge = bridgeOf(stream.node);
+    if (!bridge.owners || s.orphan) return 0;
+    const want = wantOf(stream.flags) | (created ? HOLD_CREATED : 0);
+    if (s.openCount > 0 && !created) {
+      h.call(() => bridge.access?.(liveNodePath(stream.node), accessOf(want), "open"));
+    }
+    return want;
+  };
   return {
     open(stream) {
       if (!Fs.isFile(stream.node.mode)) return;
       const s = stream.node.live;
+      const created = s.created === true;
+      s.created = void 0;
       if (s.openCount === 0 && !s.orphan) {
         const bridge = bridgeOf(stream.node);
         s.ranges = !!(bridge.pread && bridge.pwrite && bridge.truncate && statOf(stream.node).ranged);
@@ -1042,8 +1146,18 @@ function createStreamOps(h) {
           throw err;
         }
       }
-      stream.node.live.openCount++;
-      if (stream.node.live.openCount === 1) opened(stream.node, true);
+      const live = stream.node.live;
+      let counted = false;
+      try {
+        const want = permitted(stream, created);
+        live.openCount++;
+        counted = true;
+        if (live.openCount === 1) opened(stream.node, true, want);
+      } catch (err) {
+        if (counted) live.openCount--;
+        if (stream.fd !== void 0) Fs.closeStream?.(stream.fd);
+        throw err;
+      }
       held(stream, 1);
     },
     dup(stream) {
@@ -1352,13 +1466,14 @@ function useLiveChown(Fs) {
     Fs.chown(target, uid, gid);
   };
 }
-var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, stale;
+var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, stale;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
     "use strict";
     init_ranged();
     init_types();
     init_wasi_errno();
+    init_sync_fs_wire();
     S_IFDIR = 16384;
     S_IFREG = 32768;
     S_IFLNK = 40960;
@@ -1368,6 +1483,8 @@ var init_live_vfs_fs = __esm({
     SEEK_CUR = 1;
     SEEK_END = 2;
     EARLY_WHOLE_FILE = 64 * 1024;
+    O_ACCMODE = 3;
+    O_TRUNC = 512;
     stale = (s) => !!s.orphan && !s.kept;
   }
 });
@@ -1420,78 +1537,6 @@ var init_emscripten_vfs_hook = __esm({
   }
 });
 
-// src/realm/sync-fs-wire.ts
-function parseSyncFsUsage(json) {
-  const u = json;
-  if (!u || typeof u.quota !== "number" || typeof u.usage !== "number") return null;
-  return { quota: u.quota, usage: u.usage };
-}
-function syncError(code2, label) {
-  return Object.assign(new Error(`${code2}: ${label}`), { code: code2 });
-}
-function parseSyncFsStat(json) {
-  const s = json;
-  if (!s || typeof s.isFile !== "boolean" || typeof s.isDirectory !== "boolean" || typeof s.size !== "number") {
-    return null;
-  }
-  return {
-    isFile: s.isFile,
-    isDirectory: s.isDirectory,
-    isSymbolicLink: s.isSymbolicLink,
-    size: s.size,
-    ...typeof s.mode === "number" ? { mode: s.mode } : {},
-    ...typeof s.mtimeMs === "number" ? { mtimeMs: s.mtimeMs } : {},
-    ...typeof s.atimeMs === "number" ? { atimeMs: s.atimeMs } : {},
-    ...typeof s.ctimeMs === "number" ? { ctimeMs: s.ctimeMs } : {},
-    ...typeof s.ino === "number" ? { ino: s.ino } : {},
-    ...typeof s.nlink === "number" ? { nlink: s.nlink } : {},
-    ...typeof s.dev === "number" ? { dev: s.dev } : {},
-    ...s.readonly === true ? { readonly: true } : {},
-    ...typeof s.maxFile === "number" ? { maxFile: s.maxFile } : {},
-    ...s.ranged === true ? { ranged: true } : {},
-    ...s.linkable === true ? { linkable: true } : {},
-    ...typeof s.version === "string" ? { version: s.version } : {},
-    ...typeof s.uid === "number" ? { uid: s.uid } : {},
-    ...typeof s.gid === "number" ? { gid: s.gid } : {}
-  };
-}
-var SYNC_FS_OPS, SYNC_FS_REQUEST_TIMEOUT_MS;
-var init_sync_fs_wire = __esm({
-  "src/realm/sync-fs-wire.ts"() {
-    "use strict";
-    SYNC_FS_OPS = [
-      "read",
-      "write",
-      "exists",
-      "stat",
-      "lstat",
-      "readdir",
-      "readdir-stat",
-      "mkdir",
-      "rm",
-      "rename",
-      "link",
-      "unlink",
-      "rmdir",
-      "symlink",
-      "readlink",
-      "chmod",
-      "utimes",
-      "lutimes",
-      "statfs",
-      "hold",
-      "create",
-      "kept",
-      "pread",
-      "pwrite",
-      "truncate",
-      "chown",
-      "lchown"
-    ];
-    SYNC_FS_REQUEST_TIMEOUT_MS = 25e3;
-  }
-});
-
 // src/realm/sync-sab-wire.ts
 function loadU53(header, lo, hi) {
   return (Atomics.load(header, lo) >>> 0) + Atomics.load(header, hi) * U32;
@@ -1749,15 +1794,15 @@ function createSyncFsSabBridge(transport, opts = {}) {
     chmod: (path, mode) => {
       changing({ op: "chmod", path, mode }, path);
     },
-    utimes: (path, atimeMs, mtimeMs) => {
-      changing({ op: "utimes", path, atimeMs, mtimeMs }, path);
+    utimes: (path, atimeMs, mtimeMs, now) => {
+      changing({ op: "utimes", path, atimeMs, mtimeMs, ...now ? { now } : {} }, path);
     },
     identify: () => {
       identity = { identity: true };
     },
     identified: () => last,
-    lutimes: (path, atimeMs, mtimeMs) => {
-      run({ op: "lutimes", path, atimeMs, mtimeMs }, path);
+    lutimes: (path, atimeMs, mtimeMs, now) => {
+      run({ op: "lutimes", path, atimeMs, mtimeMs, ...now ? { now } : {} }, path);
     },
     create: (path, mode) => {
       run({ op: "create", path, ...mode !== void 0 ? { mode } : {} }, path);
@@ -1767,9 +1812,12 @@ function createSyncFsSabBridge(transport, opts = {}) {
       changing({ op: follow2 ? "chown" : "lchown", path, ...ids }, path);
     },
     ...opts.owners ? { owners: true } : {},
-    hold: (path, held, open, handle) => {
+    access: (path, mode, kind = "access", nofollow) => {
+      run({ op: "access", path, mode, arg2: kind, ...nofollow ? { nofollow } : {} }, path);
+    },
+    hold: (path, held, open, handle, want = 0) => {
       const mode = (held ? 1 : 0) | (open ? 2 : 0);
-      if (mode === 3) return json({ op: "hold", path, mode }, path);
+      if (mode === 3) return json({ op: "hold", path, mode: mode | want }, path);
       run({ op: "hold", path, mode, ...handle !== void 0 ? { handle } : {} }, path);
       return void 0;
     },
@@ -1810,7 +1858,7 @@ function ptyStat(path) {
 function nonblocking(stream) {
   return (stream.flags & O_NONBLOCK) !== 0 ? { nonblock: true } : void 0;
 }
-var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
+var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
 var init_kernel_streams = __esm({
   "src/process/kernel-streams.ts"() {
     "use strict";
@@ -1830,7 +1878,7 @@ var init_kernel_streams = __esm({
     O_CREAT = 64;
     O_EXCL = 128;
     O_NOCTTY = 256;
-    O_TRUNC = 512;
+    O_TRUNC2 = 512;
     KILLED_BY_SIGPIPE = 128 + 13;
     ProcessExit = class extends Error {
       status;
@@ -2058,7 +2106,7 @@ var init_kernel_streams = __esm({
         );
         let stream;
         try {
-          stream = open("/dev/null", flags & ~(O_CREAT | O_EXCL | O_TRUNC), mode);
+          stream = open("/dev/null", flags & ~(O_CREAT | O_EXCL | O_TRUNC2), mode);
         } catch (e) {
           this.sys.close(kfd);
           throw e;
@@ -2451,7 +2499,23 @@ function kernelUmask(imports, deps) {
     }
   }
 }
-function noFollowUtimes(imports, fs, glue) {
+function touching(times, memory) {
+  if (times === 0) return true;
+  if (!memory) return false;
+  const heap = new Int32Array(memory.buffer);
+  const nsec = [heap[times + 8 >> 2], heap[times + 24 >> 2]];
+  return nsec.every((n) => n === UTIME_NOW || n === UTIME_OMIT);
+}
+function touch(Fs, on, run) {
+  if (!Fs || !on) return run();
+  Fs.sliccTouch = true;
+  try {
+    return run();
+  } finally {
+    Fs.sliccTouch = void 0;
+  }
+}
+function noFollowUtimes(imports, fs, glue, memory = () => void 0) {
   for (const namespace of namespaces(imports)) {
     const key = Object.keys(namespace).find(
       (name2) => glue !== void 0 && namespace[name2] === glue || name2 === "__syscall_utimensat"
@@ -2460,9 +2524,10 @@ function noFollowUtimes(imports, fs, glue) {
     if (key === void 0 || typeof utimensat !== "function") continue;
     namespace[key] = (dirfd, path, times, flags) => {
       const Fs = fs();
+      const on = touching(times, memory());
       const { utime, lookupPath, ErrnoError } = Fs ?? {};
       if (!Fs || !(flags & AT_SYMLINK_NOFOLLOW) || !utime || !lookupPath || !ErrnoError) {
-        return utimensat(dirfd, path, times, flags);
+        return touch(Fs, on, () => utimensat(dirfd, path, times, flags));
       }
       Fs.utime = (at, atime, mtime) => {
         const { node } = lookupPath.call(Fs, at, { follow: false });
@@ -2470,7 +2535,7 @@ function noFollowUtimes(imports, fs, glue) {
         node.node_ops.setattr(node, { atime, mtime });
       };
       try {
-        return utimensat(dirfd, path, times, flags);
+        return touch(Fs, on, () => utimensat(dirfd, path, times, flags));
       } finally {
         Fs.utime = utime;
       }
@@ -2589,7 +2654,7 @@ function useFileMmap(Fs, deps) {
     const shared = (flags & MAP_TYPE) !== MAP_PRIVATE && (prot & PROT_WRITE) !== 0;
     const kfd = stream.sliccKernelFile ? stream.sliccKernelFd : void 0;
     if (shared && kfd !== void 0) throw new Fs.ErrnoError(wasiErrno("ENODEV"));
-    if (stream.stream_ops.mmap && kfd === void 0 || !memalign || !memory || length <= 0 || shared || (stream.flags & O_ACCMODE) === O_WRONLY || !Fs.isFile(stream.node.mode)) {
+    if (stream.stream_ops.mmap && kfd === void 0 || !memalign || !memory || length <= 0 || shared || (stream.flags & O_ACCMODE2) === O_WRONLY || !Fs.isFile(stream.node.mode)) {
       return mmap.call(fs, stream, length, position, prot, flags);
     }
     const data = staging(Fs, length);
@@ -2800,7 +2865,7 @@ function useMounts(Fs, env = {}, live = false) {
   const open = Fs.open.bind(Fs);
   Fs.open = (path, flags, mode) => {
     const instead = backing[path];
-    if (!instead || (flags & (O_ACCMODE | O_CREAT2)) !== 0) return open(path, flags, mode);
+    if (!instead || (flags & (O_ACCMODE2 | O_CREAT2)) !== 0) return open(path, flags, mode);
     try {
       return open(path, flags, mode);
     } catch (e) {
@@ -2809,11 +2874,57 @@ function useMounts(Fs, env = {}, live = false) {
     }
   };
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE, O_CREAT2, field, NAME;
+function cString(memory, at) {
+  const bytes = new Uint8Array(memory.buffer, at);
+  return new TextDecoder().decode(bytes.subarray(0, bytes.indexOf(0)));
+}
+function baseOf(Fs, dirfd) {
+  return dirfd === AT_FDCWD ? Fs.cwd?.() ?? "/" : Fs.getStream?.(dirfd)?.path ?? "/";
+}
+function kernelChecks(Fs, memory, call2) {
+  const name2 = cString(memory, call2.path);
+  const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
+  const lookupPath = Fs.lookupPath;
+  const { node } = lookupPath.call(Fs, abs, { follow: (call2.flags & AT_SYMLINK_NOFOLLOW) === 0 });
+  const bridge = node.live ? node.mount.opts.bridge : void 0;
+  if (!bridge?.owners || !bridge.access) return 0;
+  const kind = call2.flags & AT_EACCESS ? "eaccess" : "access";
+  bridge.access(liveNodePath(node), call2.amode, kind, (call2.flags & AT_SYMLINK_NOFOLLOW) !== 0);
+  return 0;
+}
+function kernelAccess(imports, fs, memory) {
+  for (const ns of namespaces(imports)) {
+    const own = ns.__syscall_faccessat;
+    if (typeof own !== "function") continue;
+    ns.__syscall_faccessat = (dirfd, path, amode, flags) => {
+      const rc = own(dirfd, path, amode, flags);
+      const Fs = fs();
+      const heap = memory();
+      if (rc !== 0 || !Fs?.lookupPath || !heap) return rc;
+      try {
+        return kernelChecks(Fs, heap, { dirfd, path, amode: amode & 7, flags });
+      } catch (err) {
+        return -errnoOf(err);
+      }
+    };
+  }
+}
+function linuxDevices(Fs) {
+  const { chmod } = Fs;
+  if (!chmod) return;
+  for (const [path, mode] of DEVICE_MODES) {
+    try {
+      chmod.call(Fs, path, mode);
+    } catch {
+    }
+  }
+}
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, NAME, AT_FDCWD, AT_EACCESS, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
     init_loopback_names();
+    init_live_vfs_fs();
     init_process_pty();
     init_wasi_errno();
     O_CLOEXEC = 524288;
@@ -2837,6 +2948,8 @@ var init_process_fds = __esm({
     AT_SYMLINK_NOFOLLOW = 256;
     EMSCRIPTEN_EPERM = 63;
     O_PATH = 2097152;
+    UTIME_NOW = 1073741823;
+    UTIME_OMIT = 1073741822;
     PROT_WRITE = 2;
     MAP_PRIVATE = 2;
     MAP_TYPE = 15;
@@ -2845,10 +2958,22 @@ var init_process_fds = __esm({
     DIR_MODE = 16749;
     LINK_MODE = 41408;
     CHAR_DEVICE = 8630;
-    O_ACCMODE = 3;
+    O_ACCMODE2 = 3;
     O_CREAT2 = 64;
     field = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
     NAME = /^[a-z_][a-z0-9_-]*$/i;
+    AT_FDCWD = -100;
+    AT_EACCESS = 512;
+    DEVICE_MODES = [
+      ["/dev", 493],
+      ["/dev/null", 438],
+      ["/dev/zero", 438],
+      ["/dev/full", 438],
+      ["/dev/random", 438],
+      ["/dev/urandom", 438],
+      ["/dev/tty", 438],
+      ["/dev/shm", 1023]
+    ];
   }
 });
 
@@ -2936,7 +3061,7 @@ function describeInherited(Fs, sys, streams, livePath, actions = []) {
 function deviceOfStream(stream) {
   const device2 = stream.path === void 0 ? void 0 : DEVICES[stream.path];
   if (!device2 || stream.sliccKernelFd !== void 0) return void 0;
-  const access = ACCESS[stream.flags & O_ACCMODE2];
+  const access = ACCESS[stream.flags & O_ACCMODE3];
   return { device: device2, ...access ? { access } : {} };
 }
 function inheritedSlot(fd, stream) {
@@ -2996,7 +3121,7 @@ function restoreForkedStreams(Fs, streams, table) {
       } else {
         const placed = place(
           Fs,
-          Fs.open(entry.path, entry.flags & ~(O_CREAT3 | O_EXCL2 | O_TRUNC2)),
+          Fs.open(entry.path, entry.flags & ~(O_CREAT3 | O_EXCL2 | O_TRUNC3)),
           entry.fd
         );
         setCloseOnExec(placed, (entry.flags & O_CLOEXEC) !== 0);
@@ -3005,16 +3130,16 @@ function restoreForkedStreams(Fs, streams, table) {
     }
   }
 }
-var O_RDWR, O_ACCMODE2, O_CREAT3, O_EXCL2, O_TRUNC2, PLACEHOLDER_DIR, ACCESS, DEVICES, FIFO_MODE, nextStreamIno, streamInos;
+var O_RDWR, O_ACCMODE3, O_CREAT3, O_EXCL2, O_TRUNC3, PLACEHOLDER_DIR, ACCESS, DEVICES, FIFO_MODE, nextStreamIno, streamInos;
 var init_process_fork = __esm({
   "src/process/process-fork.ts"() {
     "use strict";
     init_process_fds();
     O_RDWR = 2;
-    O_ACCMODE2 = 3;
+    O_ACCMODE3 = 3;
     O_CREAT3 = 64;
     O_EXCL2 = 128;
-    O_TRUNC2 = 512;
+    O_TRUNC3 = 512;
     PLACEHOLDER_DIR = "/dev/slicc-fd";
     ACCESS = { 0: "read", 1: "write" };
     DEVICES = {
@@ -4060,6 +4185,7 @@ function kernelSys(transport) {
             ...opts?.orphan ? { orphan: true } : {},
             ...opts?.truncate ? { truncate: true } : {},
             ...opts?.create ? { create: true } : {},
+            ...opts?.created ? { created: true } : {},
             ...opts?.pin ? { pin: opts.pin } : {},
             ...opts?.handle !== void 0 ? { handle: opts.handle } : {}
           },
@@ -4183,7 +4309,7 @@ function wireKernelStdio(Fs, streams, sys) {
     const meta = kind === "device" || kind === "held" ? sys?.heldMeta?.(fd) : void 0;
     if (meta && openHeld(Fs, fd, meta)) continue;
     if (kind && PLACED.has(kind)) {
-      const flags = sys?.access ? stream.flags & ~O_ACCMODE3 | accessMode(sys.access(fd)) : stream.flags;
+      const flags = sys?.access ? stream.flags & ~O_ACCMODE4 | accessMode(sys.access(fd)) : stream.flags;
       Fs.closeStream(fd);
       const kernel = { fd, kernel: fd, kind, flags };
       placeKernelStream(Fs, streams, kernel).flags = flags;
@@ -4228,6 +4354,9 @@ function reportGrowth(imports, publish) {
 function callerOwner(Fs, init) {
   return init.owners ? {} : { owner: ownByCaller(Fs, init.cred, credAbi(init.program.glue)) };
 }
+function utimensatOf(module) {
+  return ownValue(module, "sliccSyscalls")?.utimensat;
+}
 async function runWasmProcess(init, port2, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port2, {
@@ -4295,11 +4424,9 @@ async function runWasmProcess(init, port2, deps = {}) {
           memory: () => memory,
           set: (mask) => void transport.call({ op: "proc-umask", mask }, Number.POSITIVE_INFINITY, "umask")
         });
-        noFollowUtimes(
-          imports,
-          () => ownValue(module, "FS"),
-          ownValue(module, "sliccSyscalls")?.utimensat
-        );
+        const fsOf = () => ownValue(module, "FS");
+        noFollowUtimes(imports, fsOf, utimensatOf(module), () => memory);
+        kernelAccess(imports, fsOf, () => memory);
         const glue = ownValue(module, "sliccFdImports");
         syncFsync(imports, () => ownValue(module, "FS"), glue);
         positionalIo(imports, {
@@ -4337,6 +4464,7 @@ async function runWasmProcess(init, port2, deps = {}) {
   await initialized;
   const running = module;
   if (!hasStreams(running)) return runStdioOnly(running, init);
+  if (init.owners) linuxDevices(running.FS);
   const vfs = mountVfsIntoEmscripten(running.FS, {
     bridge: createSyncFsSabBridge(transport, init.owners ? { owners: true } : {}),
     cwd: init.cwd,
@@ -4438,7 +4566,7 @@ function runMain(running, init) {
     return status2;
   }
 }
-var FS_OPS, O_RDONLY, O_WRONLY3, O_RDWR3, O_ACCMODE3, O_DIRECTORY, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
+var FS_OPS, O_RDONLY, O_WRONLY3, O_RDWR3, O_ACCMODE4, O_DIRECTORY, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
 var init_process_runtime = __esm({
   "src/process/process-runtime.ts"() {
     "use strict";
@@ -4463,7 +4591,7 @@ var init_process_runtime = __esm({
     O_RDONLY = 0;
     O_WRONLY3 = 1;
     O_RDWR3 = 2;
-    O_ACCMODE3 = 3;
+    O_ACCMODE4 = 3;
     O_DIRECTORY = 65536;
     accessMode = (access) => access === "read" ? O_RDONLY : access === "write" ? O_WRONLY3 : O_RDWR3;
     PLACED = /* @__PURE__ */ new Set(["stream", "file", "socket"]);
@@ -4791,9 +4919,10 @@ function cachingBridge(bridge, now = () => performance.now(), shared) {
     rmdir: (p) => mutating(() => bridge.rmdir(p)),
     symlink: (target, link) => mutating(() => bridge.symlink(target, link), ...entry(link)),
     chmod: (p, mode) => rewriting(p, () => bridge.chmod(p, mode)),
-    utimes: (p, a, m) => rewriting(p, () => bridge.utimes(p, a, m)),
-    lutimes: (p, a, m) => mutating(() => bridge.lutimes(p, a, m), p),
+    utimes: (p, a, m, now2) => rewriting(p, () => bridge.utimes(p, a, m, now2)),
+    lutimes: (p, a, m, now2) => mutating(() => bridge.lutimes(p, a, m, now2), p),
     ...bridge.hold ? { hold: bridge.hold.bind(bridge) } : {},
+    ...bridge.access ? { access: bridge.access.bind(bridge) } : {},
     ...bridge.kept ? { kept: bridge.kept.bind(bridge) } : {},
     ...bridge.keptStat ? { keptStat: bridge.keptStat.bind(bridge) } : {},
     ...bridge.pinned ? { pinned: (handle) => pinnedIo2(bridge, handle, rewriting) } : {},
@@ -5166,6 +5295,11 @@ function entryOf(info) {
     append: ((info.flags ?? 0) & O_APPEND) !== 0
   };
 }
+function wantOf2(oflags, rights) {
+  const write2 = (rights & RIGHTS.FD_WRITE) !== 0n || (oflags & OFLAGS.TRUNC) !== 0;
+  const read2 = (rights & RIGHTS.FD_READ) !== 0n || !write2;
+  return (read2 ? 4 : 0) | (write2 ? 2 : 0);
+}
 function openAccess(existing, oflags, rights) {
   const readonly = existing?.readonly === true;
   const mutating = readonly ? OFLAGS.TRUNC : OFLAGS.CREAT | OFLAGS.TRUNC;
@@ -5194,6 +5328,7 @@ var SYNTHETIC_DIRS2, O_NONBLOCK2, O_WRONLY4, O_RDWR4, O_APPEND, DEVICES2, WasiFd
 var init_wasi_fds = __esm({
   "src/process/wasi/wasi-fds.ts"() {
     "use strict";
+    init_sync_fs_wire();
     init_wasi_abi();
     init_wasi_files();
     SYNTHETIC_DIRS2 = ["usr", "bin"];
@@ -5734,32 +5869,42 @@ var init_wasi_fds = __esm({
           buffer = void 0;
         }
         buffer ??= this.sharing(path, existing);
+        const want = wantOf2(oflags, rights);
         if (buffer) {
+          if (this.fs.owners) this.fs.access?.(path, want, "open");
           if (oflags & OFLAGS.TRUNC) buffer.truncate(0);
         } else {
-          const made = !existing && this.createNew(path, oflags);
-          const empty = made || (oflags & OFLAGS.TRUNC) !== 0;
-          if (existing?.ranged) this.fs.invalidate?.();
-          const st = existing?.ranged || !existing ? this.fs.stat(path) : existing;
-          const ranged = st.ranged ? st.size : void 0;
-          const handle = this.fs.hold?.(path, true, true);
-          const io = handle !== void 0 && this.fs.pinned ? this.fs.pinned(handle) : this.fs;
-          buffer = new FileBuffer(io, path, empty, st.maxFile, ranged, st.version);
-          buffer.handle = handle;
-          this.buffers.set(path, buffer);
-          const id = this.identity(st);
-          if (id !== void 0) this.know(buffer, id);
+          buffer = this.freshBuffer(path, existing, oflags, want);
         }
         buffer.opens++;
         return new LocalFile(buffer, readable2, writable2, (fdflags & FDFLAGS.APPEND) !== 0);
       }
+      freshBuffer(path, existing, oflags, want) {
+        const made = !existing && this.createNew(path, oflags);
+        const empty = made || (oflags & OFLAGS.TRUNC) !== 0;
+        if (existing?.ranged) this.fs.invalidate?.();
+        const st = existing?.ranged || !existing ? this.fs.stat(path) : existing;
+        const ranged = st.ranged ? st.size : void 0;
+        const asked = (want & 4 ? HOLD_READ : 0) | (want & 2 ? HOLD_WRITE : 0) | (made ? HOLD_CREATED : 0);
+        const handle = this.fs.hold?.(path, true, true, void 0, this.fs.owners ? asked : 0);
+        const io = handle !== void 0 && this.fs.pinned ? this.fs.pinned(handle) : this.fs;
+        const buffer = new FileBuffer(io, path, empty, st.maxFile, ranged, st.version);
+        buffer.handle = handle;
+        this.buffers.set(path, buffer);
+        const id = this.identity(st);
+        if (id !== void 0) this.know(buffer, id);
+        return buffer;
+      }
       kernelFile(path, existing, oflags, rights, fdflags) {
         const { readable: readable2, writable: writable2 } = openAccess(existing, oflags, rights);
         const append = (fdflags & FDFLAGS.APPEND) !== 0;
         const flags = (writable2 ? readable2 ? O_RDWR4 : O_WRONLY4 : 0) | (append ? O_APPEND : 0);
         const made = !existing && this.createNew(path, oflags);
         const truncate = made || (oflags & OFLAGS.TRUNC) !== 0;
-        const fd = this.kernel.sys.openVfs(path, flags, 0, truncate ? { truncate } : {});
+        const fd = this.kernel.sys.openVfs(path, flags, 0, {
+          ...truncate ? { truncate } : {},
+          ...made ? { created: true } : {}
+        });
         const ino = writable2 ? this.openedIno(fd) ?? this.inoOf(path) : void 0;
         if (truncate) this.fs.touched?.(path, ino);
         this.table.set(fd, { type: "kernel", kind: "file", nonblock: false, append, path, ino });
@@ -6152,7 +6297,7 @@ function wrap(table) {
   }
   return out;
 }
-var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, WasiHost;
+var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, WasiHost;
 var init_wasi_host = __esm({
   "src/process/wasi/wasi-host.ts"() {
     "use strict";
@@ -6174,6 +6319,7 @@ var init_wasi_host = __esm({
     IDS = ["ruid", "euid", "suid", "rgid", "egid", "sgid"];
     NS_PER_MS = 1000000n;
     AT_SYMLINK_NOFOLLOW2 = 1;
+    AT_EACCESS2 = 2;
     ROOT_IDS = Object.freeze({ uid: 0, gid: 0 });
     GONE = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
     S_IFIFO = 4096;
@@ -6301,6 +6447,18 @@ var init_wasi_host = __esm({
             const path = at(dirfd, p, l);
             owner(pathOwned(path, (flags & AT_SYMLINK_NOFOLLOW2) === 0), out);
           },
+          path_access: (dirfd, p, l, amode, flags) => {
+            const path = at(dirfd, p, l);
+            const nofollow = (flags & AT_SYMLINK_NOFOLLOW2) !== 0;
+            if (deviceOf(path)) {
+              if (this.o.fs.owners && amode & 1) throw new WasiError("EACCES");
+              return;
+            }
+            pathOwned(path, !nofollow);
+            if (!this.o.fs.owners) return;
+            const kind = flags & AT_EACCESS2 ? "eaccess" : "access";
+            this.o.fs.access?.(path, amode & 7, kind, nofollow);
+          },
           fd_chmod: (fd, mode) => void this.o.fs.chmod(pathOf(fd), mode & 4095),
           path_chmod: (dirfd, p, l, mode, flags) => void this.o.fs.chmod(target(at(dirfd, p, l), flags), mode & 4095),
           umask: (mask, out) => {
@@ -6825,6 +6983,8 @@ var init_wasi_host = __esm({
         return filestatOf(path, follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path));
       }
       setTimes(path, atim, mtim, flags, follow2 = true) {
+        const asked = FSTFLAGS.ATIM | FSTFLAGS.ATIM_NOW | FSTFLAGS.MTIM | FSTFLAGS.MTIM_NOW;
+        if (this.o.fs.owners && (flags & asked) === 0) return;
         const now = Date.now();
         let current;
         const statOf = follow2 ? this.o.fs.stat.bind(this.o.fs) : this.o.fs.lstat.bind(this.o.fs);
@@ -6837,7 +6997,8 @@ var init_wasi_host = __esm({
           this.o.fs,
           path,
           pick(FSTFLAGS.ATIM, FSTFLAGS.ATIM_NOW, atim, "atimeMs"),
-          pick(FSTFLAGS.MTIM, FSTFLAGS.MTIM_NOW, mtim, "mtimeMs")
+          pick(FSTFLAGS.MTIM, FSTFLAGS.MTIM_NOW, mtim, "mtimeMs"),
+          (flags & (FSTFLAGS.ATIM | FSTFLAGS.MTIM)) === 0
         );
       }
       readdir(fd, buf, len, cookie, usedPtr) {
@@ -7601,10 +7762,10 @@ function procfsBridge(fs, tree) {
       ],
       () => fs.link(from, to, follow2)
     ),
-    hold: (p, held, open, handle) => {
+    hold: (p, held, open, handle, want) => {
       if (handle !== void 0 && snapshots.delete(handle)) return void 0;
       if (!held) return fs.hold?.(p, held, open, handle);
-      return via(p, snapshot, () => fs.hold?.(p, held, open) ?? late(p));
+      return via(p, snapshot, () => fs.hold?.(p, held, open, void 0, want) ?? late(p));
     },
     kept: (handle) => snapshots.has(handle) || fs.kept?.(handle) === true,
     pinned: (handle) => {