@ai-ecoverse/slicc-kernel 1.62.4 → 1.64.0

package/dist/kernel-worker.js

@@ -427,13 +427,21 @@ var OpfsFs = class {
   trackOwners() {
     this.owners = true;
   }
+  async hasOwner(path) {
+    return ownOf((await this.meta.get([path]))[0]) !== void 0;
+  }
   async ancestry(path) {
     const entries = await this.meta.get(chain(path));
-    return entries.map((entry, i) => ({
-      ...ownOf(entry) ?? (i === 0 ? ROOT_OWNER : inherit(entries.slice(0, i))),
-      ...entry?.mode !== void 0 ? { mode: entry.mode } : {},
-      ...entry?.link !== void 0 ? { link: entry.link } : {}
-    }));
+    const out = [];
+    for (const [i, entry] of entries.entries()) {
+      const link2 = entry?.link !== void 0 && !await this.real(entry.path);
+      out.push({
+        ...ownOf(entry) ?? (i === 0 ? ROOT_OWNER : inherit(entries.slice(0, i))),
+        ...entry?.mode !== void 0 ? { mode: entry.mode } : {},
+        ...link2 ? { link: entry.link } : {}
+      });
+    }
+    return out;
   }
   async handedTo(dir) {
     return inherit(await this.meta.get(chain(dir)));
@@ -1397,15 +1405,24 @@ async function present(fs, path, directory) {
   const st = await fs.lstat(path).catch(() => void 0);
   return st !== void 0 && (!directory || st.isDirectory);
 }
+async function finalOf(fs, walked, want, options) {
+  const perm = walked.perm;
+  if ((want & X_OK) === 0 || options.directory !== void 0) {
+    return [perm, options.directory !== false];
+  }
+  const look = options.follow === false ? fs.lstat : fs.stat;
+  const st = await look.call(fs, walked.path).catch(() => void 0);
+  return st ? [permOf(st), st.isDirectory] : [perm, false];
+}
 async function access(fs, cred, path, want, options = {}) {
   const walked = await walk(fs, cred, path, options.follow !== false);
   if (walked.denied !== void 0) {
     if (await present(fs, walked.denied, true)) return walked;
     return { path, perm: void 0, missing: true };
   }
-  const { perm } = walked;
-  if (!perm) return { ...walked, missing: true };
-  if (want === 0 || permits(cred, perm, want, options.directory !== false)) return walked;
+  if (!walked.perm) return { ...walked, missing: true };
+  const [perm, directory] = await finalOf(fs, walked, want, options);
+  if (want === 0 || permits(cred, perm, want, directory)) return walked;
   if (await present(fs, walked.path, false)) return { ...walked, denied: walked.path };
   return { ...walked, missing: true };
 }
@@ -1416,6 +1433,7 @@ function refused(path, errno = "EACCES") {
 // src/fs/dac.ts
 var MAX_DENIAL_KEYS = 1e4;
 var S_ISGID3 = 1024;
+var DIR = { directory: true };
 var Dac = class {
   mode;
   hook;
@@ -1452,6 +1470,17 @@ var Dac = class {
     );
   }
 };
+var MAX_CREATED = 1024;
+var Created = class {
+  paths = /* @__PURE__ */ new Set();
+  add(path) {
+    if (this.paths.size >= MAX_CREATED) this.paths.clear();
+    this.paths.add(normalizePath(path));
+  }
+  take(path) {
+    return this.paths.delete(normalizePath(path));
+  }
+};
 function deny(g, op, path, errno = "EACCES") {
   g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno });
 }
@@ -1460,20 +1489,30 @@ async function need(g, op, path, want, options = {}, shown = path) {
   if (walked.denied !== void 0) deny(g, op, shown);
   return walked;
 }
+function entryIn(dir, path) {
+  return joinName(dir.path, path.slice(path.lastIndexOf("/") + 1));
+}
 async function stickyEntry(g, op, path, dir) {
   const perm = dir.perm;
   if (!perm || sticky(g.cred, perm, perm)) return;
-  const entry = joinName(dir.path, path.slice(path.lastIndexOf("/") + 1));
+  const entry = entryIn(dir, path);
   if (sticky(g.cred, perm, (await ancestryOf(g.fs, entry)).at(-1))) return;
   if (await present(g.fs, entry, false)) deny(g, op, path, "EPERM");
 }
 async function inParent(g, op, path, old = false) {
-  const dir = await need(g, op, parentOf3(path), W_OK | X_OK, {}, path);
-  if (old && dir.denied === void 0) await stickyEntry(g, op, path, dir);
+  if (old === "replaced") {
+    const dir2 = await need(g, op, parentOf3(path), W_OK | X_OK, DIR, path);
+    return dir2.denied === void 0 ? stickyEntry(g, op, path, dir2) : void 0;
+  }
+  if (!old) return void await need(g, op, parentOf3(path), W_OK | X_OK, DIR, path);
+  const dir = await access(g.fs, g.cred, parentOf3(path), W_OK | X_OK, DIR);
+  if (dir.denied === void 0) return stickyEntry(g, op, path, dir);
+  const lookup = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
+  if (!lookup || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
 }
 async function makeIn(g, op, path) {
   for (let dir = parentOf3(path); ; dir = parentOf3(dir)) {
-    const walked = await access(g.fs, g.cred, dir, W_OK | X_OK);
+    const walked = await access(g.fs, g.cred, dir, W_OK | X_OK, DIR);
     if (walked.denied !== void 0) {
       if (!await present(g.fs, path, true)) deny(g, op, path);
       return;
@@ -1499,7 +1538,7 @@ async function removable(g, op, path) {
 async function renamable(g, from, to) {
   if (from === to) return void await need(g, "rename", from, 0, { follow: false });
   await inParent(g, "rename", from, true);
-  await inParent(g, "rename", to, true);
+  await inParent(g, "rename", to, "replaced");
   if (g.cred.euid === 0 || parentOf3(from) === parentOf3(to)) return;
   const st = await g.fs.lstat(from).catch(() => void 0);
   if (st?.isDirectory && !permits(g.cred, permOf(st), W_OK)) deny(g, "rename", from);
@@ -1525,8 +1564,20 @@ async function chmodMode(g, path, mode) {
   if (!g.dac.enforcing || !perm || g.cred.euid === 0 || inGroup(g.cred, perm.gid)) return mode;
   return mode & ~S_ISGID3;
 }
-async function retimable(g, op, path) {
-  await ownerOnly(g, op, path, op !== "lutimes");
+async function retimable(g, op, path, now = false) {
+  const follow2 = op !== "lutimes";
+  if (!now) return void await ownerOnly(g, op, path, follow2);
+  const walked = await need(g, op, path, 0, { follow: follow2 });
+  const perm = walked.perm;
+  if (!perm || g.cred.euid === 0 || perm.uid === g.cred.euid) return;
+  if (permits(g.cred, perm, W_OK, false)) return;
+  if (await present(g.fs, walked.path, false)) deny(g, op, path);
+}
+async function fileWritable(g, op, path) {
+  await need(g, op, path, W_OK, { directory: false });
+}
+function realIds(cred) {
+  return { ...cred, groups: [...cred.groups], euid: cred.ruid, egid: cred.rgid };
 }
 async function listable(g, op, path) {
   await need(g, op, path, R_OK | X_OK, { directory: true });
@@ -1538,10 +1589,16 @@ async function readable(g, op, path) {
   await need(g, op, path, R_OK, { directory: false });
 }
 async function writable(g, op, path) {
-  const st = await g.fs.stat(path).catch(() => void 0);
-  if (st) return void await need(g, op, path, W_OK, { directory: st.isDirectory });
+  await openable(g, op, path, W_OK, true);
+}
+async function creatable(g, op, path) {
   const target = await need(g, op, path, 0);
-  if (target.denied === void 0) await need(g, op, parentOf3(target.path), W_OK | X_OK, {}, path);
+  if (target.denied === void 0) await need(g, op, parentOf3(target.path), W_OK | X_OK, DIR, path);
+}
+async function openable(g, op, path, want, create) {
+  const st = create ? await g.fs.stat(path).catch(() => void 0) : void 0;
+  if (create && !st) return creatable(g, op, path);
+  await need(g, op, path, want, { directory: st?.isDirectory ?? false });
 }
 
 // src/kernel/pipe.ts
@@ -4980,11 +5037,11 @@ function realmCa(owner, store) {
   opened.set(store, cas);
   let ca = cas.get(owner);
   if (!ca) {
-    const opening = RealmCa.open(owner, store);
-    ca = opening;
-    cas.set(owner, opening);
-    opening.catch(() => {
-      if (cas.get(owner) === opening) cas.delete(owner);
+    const opening2 = RealmCa.open(owner, store);
+    ca = opening2;
+    cas.set(owner, opening2);
+    opening2.catch(() => {
+      if (cas.get(owner) === opening2) cas.delete(owner);
     });
   }
   return ca;
@@ -6373,6 +6430,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     ...fs.realpath ? { realpath: fs.realpath.bind(fs) } : {},
     ...fs.chown ? { chown: fs.chown.bind(fs) } : {},
     ...fs.ancestry ? { ancestry: fs.ancestry.bind(fs) } : {},
+    ...fs.hasOwner ? { hasOwner: fs.hasOwner.bind(fs) } : {},
     chmod: (path, mode) => fs.chmod(path, mode),
     utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime),
     lutimes: (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
@@ -6472,8 +6530,10 @@ var UnlinkedKeeper = class {
   count = 0;
   links = /* @__PURE__ */ new Map();
   linked = /* @__PURE__ */ new Map();
+  dirOwner;
   constructor(fs, holders, rootOf, options = {}) {
     const { locks, owner } = options;
+    this.dirOwner = options.dirOwner;
     this.fs = fs;
     this.holders = holders;
     this.rootOf = rootOf;
@@ -6584,7 +6644,8 @@ var UnlinkedKeeper = class {
       const dir = dirOf(this.rootOf(path));
       const hidden = `${dir}/${this.instance}.${++this.count}`;
       try {
-        await this.fs.mkdir(dir, { recursive: true });
+        const owner = this.dirOwner;
+        await this.fs.mkdir(dir, { recursive: true, ...owner ? { owner } : {} });
         await this.fs.rename(path, hidden);
         await this.linkedName(hidden);
         return hidden;
@@ -7963,6 +8024,10 @@ var MountFs = class {
     if (this.at(real)) throw errnoError("ENOSYS", path);
     return real;
   }
+  async hasOwner(path) {
+    if (this.at(path)) return true;
+    return await this.base.hasOwner?.(path) ?? true;
+  }
   async ancestry(path) {
     const names = chain(normalizePath(path));
     const first = names.findIndex((name2) => this.at(name2));
@@ -8052,6 +8117,9 @@ function revokeSyncFsToken(token) {
 }
 
 // src/realm/sync-fs-wire.ts
+var HOLD_READ = 4;
+var HOLD_WRITE = 8;
+var HOLD_CREATED = 16;
 var SYNC_FS_REQUEST_TIMEOUT_MS = 25e3;
 function syncError(code, label) {
   return Object.assign(new Error(`${code}: ${label}`), { code });
@@ -8175,6 +8243,7 @@ async function run(entry, path, req) {
       return done;
     case "create":
       await createExclusive(fs, path, ownerFor2(entry, req.mode ?? 438));
+      entry.created?.add(path);
       return done;
     case "readlink":
       return json2(await fs.readlink(path));
@@ -8231,11 +8300,47 @@ async function guard(g, path, req, cwd) {
       return linkable(g, path, other(), req.mode === 1);
     case "utimes":
     case "lutimes":
-      return retimable(g, op, path);
+      return retimable(g, op, path, req.now === true);
+    case "read":
+    case "pread":
+      return req.handle === void 0 ? readable(g, op, path) : void 0;
+    case "pwrite":
+    case "truncate":
+      return req.handle === void 0 ? fileWritable(g, op, path) : void 0;
+    case "write":
+      return req.handle === void 0 && req.mode !== 1 ? writable(g, op, path) : void 0;
     default:
       return void 0;
   }
 }
+async function opening(entry, path, mode) {
+  const g = guardOf(entry);
+  const want = (mode & HOLD_READ ? R_OK : 0) | (mode & HOLD_WRITE ? W_OK : 0);
+  const created3 = (mode & HOLD_CREATED) !== 0 && entry.created?.take(path) === true;
+  if (g && want !== 0 && !created3) {
+    await need(g, "open", path, want, { directory: false });
+  }
+}
+async function holdOp(entry, path, req) {
+  const mode = req.mode ?? 0;
+  const [on, open] = [(mode & 1) === 1, (mode & 2) === 2];
+  if (on && open) {
+    await opening(entry, path, mode);
+    const real = await entry.fs.realpath?.(path, true).catch(() => path);
+    return json2(entry.hold?.(path, on, open, real) ?? null);
+  }
+  entry.hold?.(path, on, open, void 0, req.handle);
+  return done;
+}
+async function accessOp(entry, path, req) {
+  const g = guardOf(entry);
+  if (!g) return done;
+  const open = req.arg2 === "open";
+  const cred = open || req.arg2 === "eaccess" ? g.cred : realIds(g.cred);
+  const options = { follow: req.nofollow !== true, ...open ? { directory: false } : {} };
+  await need({ ...g, cred }, open ? "open" : "access", path, req.mode ?? 0, options);
+  return done;
+}
 async function guarded(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return void 0;
@@ -8299,16 +8404,6 @@ async function owned(entry, own, req, path, target) {
   }
   return own(target, () => run(entry, path, req));
 }
-async function holdOp(entry, path, req) {
-  const mode = req.mode ?? 0;
-  const [on, open] = [(mode & 1) === 1, (mode & 2) === 2];
-  if (on && open) {
-    const real = await entry.fs.realpath?.(path, true).catch(() => path);
-    return json2(entry.hold?.(path, on, open, real) ?? null);
-  }
-  entry.hold?.(path, on, open, void 0, req.handle);
-  return done;
-}
 var IDENTITY_OPS = /* @__PURE__ */ new Set([
   "write",
   "pwrite",
@@ -8345,7 +8440,8 @@ async function dispatchOne(entry, req) {
     const path = fs.resolvePath(cwd, req.path);
     if (req.op === "kept") return json2(entry.keptFor?.(req.handle ?? -1) !== void 0);
     if (req.op === "stat" && req.handle !== void 0) return await keptStat(entry, req);
-    if (req.op === "hold") return holdOp(entry, path, req);
+    if (req.op === "access") return await accessOp(entry, path, req);
+    if (req.op === "hold") return await holdOp(entry, path, req);
     const refused2 = await guarded(entry, path, req);
     if (refused2) return refused2;
     if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
@@ -8514,188 +8610,6 @@ function attachSyncSabResponder(port, sab, token, opts) {
   };
 }
 
-// src/process/process-fds.ts
-var field2 = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
-function mountTable(mounts = []) {
-  const root = globalThis.navigator?.storage ? "opfs" : "memory";
-  const lines2 = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
-  for (const m of mounts) {
-    const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
-    if (m.state !== "ok") options.push(m.state);
-    const access2 = options.includes("ro") ? [] : ["rw"];
-    lines2.push(
-      `${field2(m.source)} ${field2(m.target)} ${m.type} ${[...access2, ...options].join(",")} 0 0`
-    );
-  }
-  return `${lines2.join("\n")}
-`;
-}
-
-// src/process/procfs.ts
-var HZ = 100;
-var KIB = 1024;
-var FALLBACK_MEMORY = 4 * KIB * KIB * KIB;
-var PID_FILES = ["cmdline", "comm", "stat", "statm", "status"];
-var SYSTEM_FILES = ["loadavg", "meminfo", "stat", "uptime"];
-function commOf(info) {
-  const name2 = info.argv[0] ?? "";
-  return name2.slice(name2.lastIndexOf("/") + 1).slice(0, 15);
-}
-function ttyNumber(tty) {
-  const pts = tty && /^\/dev\/pts\/(\d+)$/.exec(tty);
-  if (pts) return 136 << 8 | Number(pts[1]);
-  const vt = tty && /^\/dev\/tty(\d+)$/.exec(tty);
-  return vt ? 4 << 8 | Number(vt[1]) : 0;
-}
-function pages(bytes) {
-  return Math.ceil(bytes / 4096);
-}
-function ticks(ms) {
-  return Math.max(0, Math.floor(ms * HZ / 1e3));
-}
-function pidStat(info, boot) {
-  const fields = [
-    info.pid,
-    `(${commOf(info)})`,
-    info.state,
-    info.ppid,
-    info.pgid,
-    info.sid,
-    ttyNumber(info.tty),
-    info.tty ? info.pgid : -1,
-    4194304,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    20,
-    0,
-    1,
-    0,
-    ticks(info.started - boot),
-    info.memory,
-    pages(info.memory),
-    "18446744073709551615",
-    ...Array(12).fill(0),
-    17,
-    0,
-    0,
-    0,
-    0,
-    0,
-    0,
-    ...Array(7).fill(0),
-    0
-  ];
-  return `${fields.join(" ")}
-`;
-}
-var sigMask = (mask = 0) => (mask >>> 1).toString(16).padStart(16, "0");
-function pidStatus(info) {
-  const state = info.state === "Z" ? "Z (zombie)" : "S (sleeping)";
-  const c = info.cred ?? ROOT;
-  const ids = (r, e, s) => `${r}	${e}	${s}	${e}`;
-  return [
-    `Name:	${commOf(info)}`,
-    `Umask:	${(info.umask ?? 18).toString(8).padStart(4, "0")}`,
-    `State:	${state}`,
-    `Tgid:	${info.pid}`,
-    "Ngid:	0",
-    `Pid:	${info.pid}`,
-    `PPid:	${info.ppid}`,
-    "TracerPid:	0",
-    `Uid:	${ids(c.ruid, c.euid, c.suid)}`,
-    `Gid:	${ids(c.rgid, c.egid, c.sgid)}`,
-    "FDSize:	64",
-    `VmSize:	${Math.ceil(info.memory / KIB)} kB`,
-    `VmRSS:	${Math.ceil(info.memory / KIB)} kB`,
-    `Groups:	${c.groups.join(" ")}`,
-    `NSpid:	${info.pid}`,
-    `NSpgid:	${info.pgid}`,
-    `NSsid:	${info.sid}`,
-    "Threads:	1",
-    "SigQ:	0/0",
-    "SigPnd:	0000000000000000",
-    "ShdPnd:	0000000000000000",
-    "SigBlk:	0000000000000000",
-    `SigIgn:	${sigMask(info.sigIgn)}`,
-    `SigCgt:	${sigMask(info.sigCgt)}`,
-    ""
-  ].join("\n");
-}
-function pidFile(name2, info, boot) {
-  if (name2 === "cmdline") return info.state === "Z" ? "" : `${info.argv.join("\0")}\0`;
-  if (name2 === "comm") return `${commOf(info)}
-`;
-  if (name2 === "stat") return pidStat(info, boot);
-  if (name2 === "statm") {
-    const p = pages(info.memory);
-    return `${p} ${p} 0 0 0 ${p} 0
-`;
-  }
-  return pidStatus(info);
-}
-function memoryInfo(source, used = 0) {
-  const total = source.deviceMemory ? source.deviceMemory * KIB * KIB * KIB : FALLBACK_MEMORY;
-  const free = Math.max(0, total - used - (source.usedHeap ?? 0));
-  const kb = (bytes) => `${Math.floor(bytes / KIB)} kB`;
-  return [
-    ["MemTotal", kb(total)],
-    ["MemFree", kb(free)],
-    ["MemAvailable", kb(free)],
-    ["Buffers", kb(0)],
-    ["Cached", kb(0)],
-    ["SwapCached", kb(0)],
-    ["Shmem", kb(0)],
-    ["SReclaimable", kb(0)],
-    ["SwapTotal", kb(0)],
-    ["SwapFree", kb(0)]
-  ].map(([key, value]) => `${`${key}:`.padEnd(16)}${value.padStart(12)}`).concat("").join("\n");
-}
-function systemFile(name2, listing, now, memory) {
-  const up = Math.max(0, now - listing.boot) / 1e3;
-  if (name2 === "uptime") return `${up.toFixed(2)} ${up.toFixed(2)}
-`;
-  if (name2 === "meminfo") {
-    return memoryInfo(
-      memory,
-      listing.processes.reduce((sum, p) => sum + p.memory, 0)
-    );
-  }
-  const live = listing.processes.filter((p) => p.state !== "Z");
-  if (name2 === "loadavg") {
-    const last = Math.max(0, ...listing.processes.map((p) => p.pid));
-    return `0.00 0.00 0.00 1/${live.length} ${last}
-`;
-  }
-  const idle = ticks(now - listing.boot);
-  return [
-    `cpu  0 0 0 ${idle} 0 0 0 0 0 0`,
-    `cpu0 0 0 0 ${idle} 0 0 0 0 0 0`,
-    "intr 0",
-    "ctxt 0",
-    `btime ${Math.floor(listing.boot / 1e3)}`,
-    `processes ${listing.processes.length}`,
-    "procs_running 1",
-    "procs_blocked 0",
-    ""
-  ].join("\n");
-}
-function memorySource(scope = globalThis) {
-  const nav = scope.navigator;
-  const perf = scope.performance;
-  const deviceMemory = nav?.deviceMemory;
-  const used = perf?.memory?.usedJSHeapSize;
-  return {
-    ...typeof deviceMemory === "number" && deviceMemory > 0 ? { deviceMemory } : {},
-    ...typeof used === "number" ? { usedHeap: used } : {}
-  };
-}
-
 // src/fs/pages.ts
 var PAGE = 64 * 1024;
 var READAHEAD = 1024 * 1024;
@@ -8921,6 +8835,191 @@ var AsyncRangedFile = class {
   }
 };
 
+// src/realm/live-vfs-fs.ts
+var EARLY_WHOLE_FILE = 64 * 1024;
+
+// src/process/process-fds.ts
+var field2 = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
+function mountTable(mounts = []) {
+  const root = globalThis.navigator?.storage ? "opfs" : "memory";
+  const lines2 = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
+  for (const m of mounts) {
+    const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
+    if (m.state !== "ok") options.push(m.state);
+    const access2 = options.includes("ro") ? [] : ["rw"];
+    lines2.push(
+      `${field2(m.source)} ${field2(m.target)} ${m.type} ${[...access2, ...options].join(",")} 0 0`
+    );
+  }
+  return `${lines2.join("\n")}
+`;
+}
+
+// src/process/procfs.ts
+var HZ = 100;
+var KIB = 1024;
+var FALLBACK_MEMORY = 4 * KIB * KIB * KIB;
+var PID_FILES = ["cmdline", "comm", "stat", "statm", "status"];
+var SYSTEM_FILES = ["loadavg", "meminfo", "stat", "uptime"];
+function commOf(info) {
+  const name2 = info.argv[0] ?? "";
+  return name2.slice(name2.lastIndexOf("/") + 1).slice(0, 15);
+}
+function ttyNumber(tty) {
+  const pts = tty && /^\/dev\/pts\/(\d+)$/.exec(tty);
+  if (pts) return 136 << 8 | Number(pts[1]);
+  const vt = tty && /^\/dev\/tty(\d+)$/.exec(tty);
+  return vt ? 4 << 8 | Number(vt[1]) : 0;
+}
+function pages(bytes) {
+  return Math.ceil(bytes / 4096);
+}
+function ticks(ms) {
+  return Math.max(0, Math.floor(ms * HZ / 1e3));
+}
+function pidStat(info, boot) {
+  const fields = [
+    info.pid,
+    `(${commOf(info)})`,
+    info.state,
+    info.ppid,
+    info.pgid,
+    info.sid,
+    ttyNumber(info.tty),
+    info.tty ? info.pgid : -1,
+    4194304,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+    20,
+    0,
+    1,
+    0,
+    ticks(info.started - boot),
+    info.memory,
+    pages(info.memory),
+    "18446744073709551615",
+    ...Array(12).fill(0),
+    17,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+    ...Array(7).fill(0),
+    0
+  ];
+  return `${fields.join(" ")}
+`;
+}
+var sigMask = (mask = 0) => (mask >>> 1).toString(16).padStart(16, "0");
+function pidStatus(info) {
+  const state = info.state === "Z" ? "Z (zombie)" : "S (sleeping)";
+  const c = info.cred ?? ROOT;
+  const ids = (r, e, s) => `${r}	${e}	${s}	${e}`;
+  return [
+    `Name:	${commOf(info)}`,
+    `Umask:	${(info.umask ?? 18).toString(8).padStart(4, "0")}`,
+    `State:	${state}`,
+    `Tgid:	${info.pid}`,
+    "Ngid:	0",
+    `Pid:	${info.pid}`,
+    `PPid:	${info.ppid}`,
+    "TracerPid:	0",
+    `Uid:	${ids(c.ruid, c.euid, c.suid)}`,
+    `Gid:	${ids(c.rgid, c.egid, c.sgid)}`,
+    "FDSize:	64",
+    `VmSize:	${Math.ceil(info.memory / KIB)} kB`,
+    `VmRSS:	${Math.ceil(info.memory / KIB)} kB`,
+    `Groups:	${c.groups.join(" ")}`,
+    `NSpid:	${info.pid}`,
+    `NSpgid:	${info.pgid}`,
+    `NSsid:	${info.sid}`,
+    "Threads:	1",
+    "SigQ:	0/0",
+    "SigPnd:	0000000000000000",
+    "ShdPnd:	0000000000000000",
+    "SigBlk:	0000000000000000",
+    `SigIgn:	${sigMask(info.sigIgn)}`,
+    `SigCgt:	${sigMask(info.sigCgt)}`,
+    ""
+  ].join("\n");
+}
+function pidFile(name2, info, boot) {
+  if (name2 === "cmdline") return info.state === "Z" ? "" : `${info.argv.join("\0")}\0`;
+  if (name2 === "comm") return `${commOf(info)}
+`;
+  if (name2 === "stat") return pidStat(info, boot);
+  if (name2 === "statm") {
+    const p = pages(info.memory);
+    return `${p} ${p} 0 0 0 ${p} 0
+`;
+  }
+  return pidStatus(info);
+}
+function memoryInfo(source, used = 0) {
+  const total = source.deviceMemory ? source.deviceMemory * KIB * KIB * KIB : FALLBACK_MEMORY;
+  const free = Math.max(0, total - used - (source.usedHeap ?? 0));
+  const kb = (bytes) => `${Math.floor(bytes / KIB)} kB`;
+  return [
+    ["MemTotal", kb(total)],
+    ["MemFree", kb(free)],
+    ["MemAvailable", kb(free)],
+    ["Buffers", kb(0)],
+    ["Cached", kb(0)],
+    ["SwapCached", kb(0)],
+    ["Shmem", kb(0)],
+    ["SReclaimable", kb(0)],
+    ["SwapTotal", kb(0)],
+    ["SwapFree", kb(0)]
+  ].map(([key, value]) => `${`${key}:`.padEnd(16)}${value.padStart(12)}`).concat("").join("\n");
+}
+function systemFile(name2, listing, now, memory) {
+  const up = Math.max(0, now - listing.boot) / 1e3;
+  if (name2 === "uptime") return `${up.toFixed(2)} ${up.toFixed(2)}
+`;
+  if (name2 === "meminfo") {
+    return memoryInfo(
+      memory,
+      listing.processes.reduce((sum, p) => sum + p.memory, 0)
+    );
+  }
+  const live = listing.processes.filter((p) => p.state !== "Z");
+  if (name2 === "loadavg") {
+    const last = Math.max(0, ...listing.processes.map((p) => p.pid));
+    return `0.00 0.00 0.00 1/${live.length} ${last}
+`;
+  }
+  const idle = ticks(now - listing.boot);
+  return [
+    `cpu  0 0 0 ${idle} 0 0 0 0 0 0`,
+    `cpu0 0 0 0 ${idle} 0 0 0 0 0 0`,
+    "intr 0",
+    "ctxt 0",
+    `btime ${Math.floor(listing.boot / 1e3)}`,
+    `processes ${listing.processes.length}`,
+    "procs_running 1",
+    "procs_blocked 0",
+    ""
+  ].join("\n");
+}
+function memorySource(scope = globalThis) {
+  const nav = scope.navigator;
+  const perf = scope.performance;
+  const deviceMemory = nav?.deviceMemory;
+  const used = perf?.memory?.usedJSHeapSize;
+  return {
+    ...typeof deviceMemory === "number" && deviceMemory > 0 ? { deviceMemory } : {},
+    ...typeof used === "number" ? { usedHeap: used } : {}
+  };
+}
+
 // src/process/wasi/wasi-files.ts
 function normalize(path) {
   const out = [];
@@ -11199,6 +11298,7 @@ var WasmProcess = class {
       throw Object.assign(new Error(alias.refused), { code: alias.refused });
     if (alias !== void 0) return this.openProc(req, alias);
     await refuseReadonly(this.options.fs, req.path, req.flags, req);
+    await this.mayOpen(req);
     const fd = this.fds.install(heldFile(), 3);
     try {
       const nodes = this.nodes;
@@ -11244,6 +11344,17 @@ var WasmProcess = class {
     };
     return fs.exclusive ? fs.exclusive(first.path, look) : look();
   }
+  async mayOpen(req) {
+    const { guard: guard2 } = this.options;
+    const inherited2 = req.orphan || req.contents !== void 0 || req.handle !== void 0;
+    if (!guard2 || inherited2 || req.pin !== void 0) return;
+    const g = { fs: guard2.fs, dac: guard2.dac, cred: this.cred, pid: this.pid };
+    if (req.exclusive) return inParent(g, "open", req.path);
+    if (req.created && guard2.created?.take(req.path)) return;
+    const access2 = req.flags & WRITE_ACCESS;
+    const want = (access2 === 1 ? 0 : R_OK) | (access2 !== 0 || req.truncate ? W_OK : 0);
+    await openable(g, "open", req.path, want, req.create === true);
+  }
   newOwner() {
     if (!this.options.owners) return void 0;
     return { uid: this.cred.euid, gid: this.cred.egid, mode: 438 & ~this.umask };
@@ -11928,7 +12039,7 @@ function inherited(opts) {
 function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
     ...opts.owners ? caller : {},
-    ...opts.dac ? { dac: opts.dac, pid: opts.pid } : {},
+    ...opts.dac ? { dac: opts.dac, pid: opts.pid, created: caller.created } : {},
     fs: opts.fs,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
@@ -11941,10 +12052,11 @@ function holdingToken(opts, holds, caller) {
     renamed: (from, to) => holds.renamed(from, to)
   });
 }
-function processOptions(opts, header3, hooks) {
+function processOptions(opts, header3, hooks, created3) {
   return {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
+    ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
     ...opts.settling ? { settling: opts.settling } : {},
@@ -11978,20 +12090,27 @@ function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const threadSignals = /* @__PURE__ */ new Map();
+  const created3 = new Created();
   const process = new WasmProcess(
     opts.pid,
     opts.fds,
-    processOptions(opts, header3, {
-      raise: (sig) => signal(sig),
-      threadKill: (tid, sig) => killThread(threadSignals.get(tid), process.signalMasks().caught, sig)
-    })
+    processOptions(
+      opts,
+      header3,
+      {
+        raise: (sig) => signal(sig),
+        threadKill: (tid, sig) => killThread(threadSignals.get(tid), process.signalMasks().caught, sig)
+      },
+      created3
+    )
   );
   publishStops(process, header3);
   const holds = new HeldPaths();
   opts.held?.add(holds);
   const token = holdingToken(opts, holds, {
     cred: () => process.cred,
-    umask: () => process.umask
+    umask: () => process.umask,
+    created: created3
   });
   process.keptPath = (path) => holds.keptAt(path)?.hidden;
   process.keptHandle = (handle2) => holds.keptFor(handle2)?.hidden;
@@ -13104,16 +13223,16 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
   });
   async function writable2(client, path, flags) {
     const { ifMatch: _, ...asked } = flags;
-    const opening = () => client.call("open", { path: rel(path), ...asked });
+    const opening2 = () => client.call("open", { path: rel(path), ...asked });
     try {
-      return { opened: await opening(), restore: void 0 };
+      return { opened: await opening2(), restore: void 0 };
     } catch (err) {
       if (!flags.write || codeOf4(err) !== "EACCES") throw err;
       const was = await client.call("stat", { path: rel(path) });
       const mode = was.mode ?? 0;
       if (mode & 128) throw err;
       const restore = { path: rel(path), mode, was };
-      const opened2 = await client.call("setattr", { path: rel(path), mode: mode | 128 }).then(opening).catch(async (again) => {
+      const opened2 = await client.call("setattr", { path: rel(path), mode: mode | 128 }).then(opening2).catch(async (again) => {
         await settle3(client, restore).catch(() => {
         });
         throw again;
@@ -14018,6 +14137,16 @@ var NOT_FOUND = 127;
 var DECIDE_MS = 100;
 var INIT_PID = 1;
 var SHARED_DIRS = ["/tmp", "/home"];
+var LAYOUT = [
+  ["/", 493],
+  ["/root", 448],
+  ["/home", 493],
+  ["/etc", 493],
+  [PASSWD, 420],
+  [GROUP, 420],
+  ["/usr", 493],
+  ["/usr/local", 493]
+];
 var encoder3 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
@@ -14211,7 +14340,8 @@ var Launcher = class {
       {
         locks: webLocks(),
         busy: (path) => [...this.openFiles].some((nodes) => nodes.holds(path)),
-        owner: options.unlinkOwner
+        owner: options.unlinkOwner,
+        ...this.owners ? { dirOwner: { uid: 0, gid: 0, mode: 448 } } : {}
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
@@ -14371,15 +14501,33 @@ var Launcher = class {
         return void 0;
       }
       const inner = await this.interpreted(interp, [interp, ...passed], cwd, scope, depth + 1);
-      return inner && { ...inner, target: withScriptEnv(inner.target, command) };
+      const via = [interp, ...inner?.via ?? []];
+      return inner && { ...inner, target: withScriptEnv(inner.target, command), via };
     }
     const target = withScriptEnv(found, command);
-    return { target, args: [...target.prefix ?? [], ...passed] };
+    return { target, args: [...target.prefix ?? [], ...passed], via: [interp] };
   }
   async plan(file, argv, cwd, scope) {
     const direct = await this.resolve(file, argv[0] ?? file, cwd, scope);
     if (direct) return { target: direct, args: [...direct.prefix ?? [], ...argv.slice(1)] };
-    return this.interpreted(file, argv, cwd, scope);
+    const script = await this.interpreted(file, argv, cwd, scope);
+    return script && { ...script, script: true };
+  }
+  async mayExec(cred, req, planned) {
+    const { dac } = this;
+    if (!dac) return;
+    const g = { fs: this.fs, cred, pid: req.pid, dac };
+    const byPath = (file) => file.includes("/") && !COMMAND2.test(file);
+    if (byPath(req.file)) {
+      const path = this.fs.resolvePath(req.cwd, req.file);
+      await need(g, "exec", path, planned?.script ? R_OK | X_OK : X_OK);
+    }
+    const via = planned?.via ?? [];
+    for (const [i, file] of via.entries()) {
+      if (!byPath(file)) continue;
+      const want = i < via.length - 1 ? R_OK | X_OK : X_OK;
+      await need(g, "exec", this.fs.resolvePath(req.cwd, file), want);
+    }
   }
   async unrunnable(file, cwd, scope) {
     const path = this.fs.resolvePath(cwd, file);
@@ -14599,6 +14747,12 @@ var Launcher = class {
     return async (req, fds) => {
       const scope = await this.scopeOf(this.credOf(ppid).euid);
       const planned = await this.plan(req.file, req.argv, req.cwd, scope);
+      try {
+        await this.mayExec(this.credOf(ppid), { ...req, pid: ppid }, planned);
+      } catch (err) {
+        await fds.closeAll();
+        throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+      }
       if (!planned) {
         await fds.closeAll();
         throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
@@ -14812,6 +14966,24 @@ var Launcher = class {
       await this.provisionPnpmHome();
     return entry;
   }
+  async stampLayout() {
+    const layout = [
+      ...LAYOUT,
+      [this.modulesDir, 493],
+      [this.pnpmHome, 493],
+      [`/${UNLINKED_DIR}`, 448]
+    ];
+    for (const [path, mode] of layout) {
+      const real = await this.realLayoutPath(path);
+      const fresh = real !== void 0 && !await this.base.hasOwner?.(real);
+      if (fresh) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
+    }
+  }
+  async realLayoutPath(path) {
+    if (!await this.base.exists(path)) return void 0;
+    if (path === "/") return path;
+    return joinName(await realDir(this.base, parentOf3(path)), baseName(path));
+  }
   async provisionPnpmHome() {
     await this.base.mkdir(this.pnpmHome, { recursive: true }).catch(() => void 0);
   }
@@ -14882,8 +15054,10 @@ var Launcher = class {
   }
   async prepare() {
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
+    if (this.owners) await this.base.chmod("/tmp", 1023);
     await this.provisionPnpmHome();
     await this.users.ensure();
+    if (this.owners) await this.stampLayout();
     await writeCaFile(this.base, this.ca).catch(() => void 0);
     this.fstab = this.mountFstab();
   }
@@ -14929,7 +15103,9 @@ var Launcher = class {
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
     await this.base.mkdir(cwd, { recursive: true });
-    return { cwd, file, planned: await this.plan(file, argv, cwd, scope) };
+    const planned = await this.plan(file, argv, cwd, scope);
+    await this.mayExec(credOf(account), { file, cwd, pid: 0 }, planned);
+    return { cwd, file, planned };
   }
   async openTerminal(argv, options) {
     const account = await this.account(options.user);