@ai-ecoverse/slicc-kernel 1.64.1 → 1.65.0

package/dist/process-worker.js

@@ -13,6 +13,94 @@ var __export = (target, all) => {
     __defProp(target, name2, { get: all[name2], enumerable: true });
 };
 
+// src/process/js/lockdown.ts
+function chain(target) {
+  const out = [];
+  for (let at = target; at && at !== Object.prototype; ) {
+    out.push(at);
+    at = Object.getPrototypeOf(at);
+  }
+  return out;
+}
+function hide(target, names) {
+  for (const name2 of names) {
+    const holders = chain(target);
+    for (const holder of holders) {
+      if (Object.getOwnPropertyDescriptor(holder, name2)?.configurable) {
+        Reflect.deleteProperty(holder, name2);
+      }
+    }
+    const kept = holders.slice(1).some((holder) => Object.hasOwn(holder, name2));
+    const defined = Reflect.defineProperty(target, name2, {
+      value: void 0,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+    if (kept || !defined && Reflect.get(target, name2) !== void 0) {
+      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
+    }
+  }
+}
+function vacate(target, names) {
+  for (const name2 of names) {
+    for (let at = target; at && at !== Object.prototype; ) {
+      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
+      at = Object.getPrototypeOf(at);
+    }
+    Reflect.defineProperty(target, name2, {
+      value: void 0,
+      writable: true,
+      enumerable: false,
+      configurable: true
+    });
+    if (Reflect.get(target, name2) !== void 0) {
+      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
+    }
+  }
+}
+function lockdown(scope2 = globalThis) {
+  hide(scope2, BLOCKED_GLOBALS);
+  vacate(scope2, OPEN_SLOTS);
+  const navigator = scope2.navigator;
+  if (navigator && typeof navigator === "object") hide(navigator, BLOCKED_NAVIGATOR);
+}
+var BLOCKED_GLOBALS, BLOCKED_NAVIGATOR, OPEN_SLOTS;
+var init_lockdown = __esm({
+  "src/process/js/lockdown.ts"() {
+    "use strict";
+    BLOCKED_GLOBALS = [
+      "XMLHttpRequest",
+      "WebSocketStream",
+      "WebTransport",
+      "EventSource",
+      "importScripts",
+      "indexedDB",
+      "caches",
+      "cookieStore",
+      "Worker",
+      "SharedWorker",
+      "BroadcastChannel",
+      "postMessage",
+      "close",
+      "webkitRequestFileSystem",
+      "webkitRequestFileSystemSync",
+      "webkitResolveLocalFileSystemURL",
+      "webkitResolveLocalFileSystemSyncURL"
+    ];
+    BLOCKED_NAVIGATOR = [
+      "storage",
+      "storageBuckets",
+      "locks",
+      "serviceWorker",
+      "usb",
+      "hid",
+      "serial"
+    ];
+    OPEN_SLOTS = ["fetch", "WebSocket"];
+  }
+});
+
 // src/kernel/protocol.ts
 var WASM_PROCESS_INIT, WASM_PROCESS_EXIT, WASM_PROCESS_ERROR, WASM_THREAD_SPAWN, WASM_THREAD_INIT, WASM_THREAD_EXIT, WASM_MAX_THREADS, WASM_DEFAULT_THREADS;
 var init_protocol = __esm({
@@ -573,16 +661,16 @@ var init_wasi_errno = __esm({
 });
 
 // src/realm/sync-fs-wire.ts
-function parseSyncFsUsage(json) {
-  const u = json;
+function parseSyncFsUsage(json2) {
+  const u = json2;
   if (!u || typeof u.quota !== "number" || typeof u.usage !== "number") return null;
   return { quota: u.quota, usage: u.usage };
 }
 function syncError(code2, label) {
   return Object.assign(new Error(`${code2}: ${label}`), { code: code2 });
 }
-function parseSyncFsStat(json) {
-  const s = json;
+function parseSyncFsStat(json2) {
+  const s = json2;
   if (!s || typeof s.isFile !== "boolean" || typeof s.isDirectory !== "boolean" || typeof s.size !== "number") {
     return null;
   }
@@ -1698,7 +1786,7 @@ function createSyncFsSabBridge(transport, opts = {}) {
     if (r.ok && r.kind === "bytes") return r.bytes;
     throw errnoError("EIO", path);
   }
-  function json(req, path) {
+  function json2(req, path) {
     const r = run(req, path);
     if (r.ok && r.kind === "json") return r.json;
     throw errnoError("EIO", path);
@@ -1726,31 +1814,31 @@ function createSyncFsSabBridge(transport, opts = {}) {
   return {
     ...io({}),
     pinned: (handle) => io({ handle }),
-    kept: (handle) => json({ op: "kept", path: "/", handle }, "/") === true,
+    kept: (handle) => json2({ op: "kept", path: "/", handle }, "/") === true,
     keptStat: (handle) => {
-      const s = parseSyncFsStat(json({ op: "stat", path: "/", handle }, "/"));
+      const s = parseSyncFsStat(json2({ op: "stat", path: "/", handle }, "/"));
       if (!s) throw errnoError("EIO", "/");
       return s;
     },
     stat: (path) => {
-      const s = parseSyncFsStat(json({ op: "stat", path }, path));
+      const s = parseSyncFsStat(json2({ op: "stat", path }, path));
       if (!s) throw errnoError("EIO", path);
       return s;
     },
     lstat: (path) => {
-      const s = parseSyncFsStat(json({ op: "lstat", path }, path));
+      const s = parseSyncFsStat(json2({ op: "lstat", path }, path));
       if (!s) throw errnoError("EIO", path);
       return s;
     },
     readdir: (path) => {
-      const list = json({ op: "readdir", path }, path);
+      const list = json2({ op: "readdir", path }, path);
       if (!Array.isArray(list) || !list.every((s) => typeof s === "string")) {
         throw errnoError("EIO", path);
       }
       return list;
     },
     readdirStat: (path) => {
-      const list = json({ op: "readdir-stat", path }, path);
+      const list = json2({ op: "readdir-stat", path }, path);
       if (!Array.isArray(list)) throw errnoError("EIO", path);
       return list.map((entry) => {
         if (!Array.isArray(entry) || typeof entry[0] !== "string") throw errnoError("EIO", path);
@@ -1761,7 +1849,7 @@ function createSyncFsSabBridge(transport, opts = {}) {
       });
     },
     exists: (path) => {
-      const v = json({ op: "exists", path }, path);
+      const v = json2({ op: "exists", path }, path);
       if (typeof v !== "boolean") throw errnoError("EIO", path);
       return v;
     },
@@ -1787,7 +1875,7 @@ function createSyncFsSabBridge(transport, opts = {}) {
       run({ op: "symlink", path: linkPath, arg2: target }, linkPath);
     },
     readlink: (path) => {
-      const target = json({ op: "readlink", path }, path);
+      const target = json2({ op: "readlink", path }, path);
       if (typeof target !== "string") throw errnoError("EIO", path);
       return target;
     },
@@ -1817,11 +1905,11 @@ function createSyncFsSabBridge(transport, opts = {}) {
     },
     hold: (path, held, open, handle, want = 0) => {
       const mode = (held ? 1 : 0) | (open ? 2 : 0);
-      if (mode === 3) return json({ op: "hold", path, mode: mode | want }, path);
+      if (mode === 3) return json2({ op: "hold", path, mode: mode | want }, path);
       run({ op: "hold", path, mode, ...handle !== void 0 ? { handle } : {} }, path);
       return void 0;
     },
-    statfs: (path = "/") => parseSyncFsUsage(json({ op: "statfs", path }, path))
+    statfs: (path = "/") => parseSyncFsUsage(json2({ op: "statfs", path }, path))
   };
 }
 var init_sync_sab_bridge = __esm({
@@ -2827,8 +2915,11 @@ function useDevFd(Fs) {
     return fstat.call(Fs, fd);
   };
 }
+function pinRootKind() {
+  pinnedRoot = rootKind();
+}
 function mountTable(mounts = []) {
-  const root = globalThis.navigator?.storage ? "opfs" : "memory";
+  const root = pinnedRoot ?? rootKind();
   const lines = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
   for (const m of mounts) {
     const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
@@ -2934,7 +3025,7 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, NAME, AT_FDCWD, AT_EACCESS, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
@@ -2976,6 +3067,7 @@ var init_process_fds = __esm({
     O_ACCMODE2 = 3;
     O_CREAT2 = 64;
     field = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
+    rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
     NAME = /^[a-z_][a-z0-9_-]*$/i;
     AT_FDCWD = -100;
     AT_EACCESS = 512;
@@ -3629,7 +3721,7 @@ function createSocketKernel(deps) {
     if (!r.ok) throw new SyscallError(r.errno);
     return r;
   };
-  const json = (req) => {
+  const json2 = (req) => {
     const r = call2(req);
     return r.ok && r.kind === "json" ? r.json : void 0;
   };
@@ -3669,9 +3761,9 @@ function createSocketKernel(deps) {
     return stream.fd;
   };
   return {
-    socket: (domain, nonblock, cloexec) => guard(() => install(json({ op: "sock-open", domain }), nonblock, cloexec)),
+    socket: (domain, nonblock, cloexec) => guard(() => install(json2({ op: "sock-open", domain }), nonblock, cloexec)),
     socketpair: (domain, nonblock, cloexec) => guard(() => {
-      const [a, b] = json({ op: "sock-pair", domain });
+      const [a, b] = json2({ op: "sock-pair", domain });
       let first;
       try {
         first = install(a, nonblock, cloexec);
@@ -3706,7 +3798,7 @@ function createSocketKernel(deps) {
         fd: listener.sliccKernelFd,
         nonblock: (listener.flags & O_NONBLOCK) !== 0
       };
-      const got = json(req);
+      const got = json2(req);
       return { fd: install(got.fd, nonblock, cloexec), peer: got.peer };
     }),
     connect: (fd, addr) => guard(() => {
@@ -3720,10 +3812,10 @@ function createSocketKernel(deps) {
       });
     }),
     shutdown: (fd, how) => guard(() => done({ op: "sock-shutdown", fd: kfd(fd), how })),
-    name: (fd, peer) => guard(() => json({ op: "sock-name", fd: kfd(fd), peer })),
-    getopt: (fd, level, name2) => guard(() => ({ value: json({ op: "sock-getopt", fd: kfd(fd), level, name: name2 }) })),
+    name: (fd, peer) => guard(() => json2({ op: "sock-name", fd: kfd(fd), peer })),
+    getopt: (fd, level, name2) => guard(() => ({ value: json2({ op: "sock-getopt", fd: kfd(fd), level, name: name2 }) })),
     setopt: (fd, level, name2, value2) => guard(() => done({ op: "sock-setopt", fd: kfd(fd), level, name: name2, value: value2 })),
-    resolve: (name2, family = 4) => guard(() => json({ op: "sock-resolve", name: name2, family })),
+    resolve: (name2, family = 4) => guard(() => json2({ op: "sock-resolve", name: name2, family })),
     send: (fd, bytes, flags) => guard(() => {
       const stream = socketAt(fd);
       const nonblock = flags.dontwait === true || (stream.flags & O_NONBLOCK) !== 0;
@@ -4160,7 +4252,7 @@ function kernelSys(transport) {
     if (!r.ok) throw new SyscallError(r.errno);
     return r;
   };
-  const json = (r) => r.ok && r.kind === "json" ? r.json : void 0;
+  const json2 = (r) => r.ok && r.kind === "json" ? r.json : void 0;
   return {
     read(fd, max, opts) {
       const flags = {
@@ -4177,20 +4269,20 @@ function kernelSys(transport) {
         body: bytes,
         ...opts?.nonblock ? { nonblock: true } : {}
       };
-      const n = json(call2(req, `fd-write ${fd}`));
+      const n = json2(call2(req, `fd-write ${fd}`));
       return typeof n === "number" ? n : bytes.length;
     },
     close(fd) {
       call2({ op: "fd-close", fd }, `fd-close ${fd}`);
     },
     pipe() {
-      return json(call2({ op: "fd-pipe" }, "fd-pipe"));
+      return json2(call2({ op: "fd-pipe" }, "fd-pipe"));
     },
     poll(fd) {
-      return json(call2({ op: "fd-poll", fd }, `fd-poll ${fd}`));
+      return json2(call2({ op: "fd-poll", fd }, `fd-poll ${fd}`));
     },
     openVfs(path, flags, position, opts) {
-      return json(
+      return json2(
         call2(
           {
             op: "fd-open-vfs",
@@ -4210,7 +4302,7 @@ function kernelSys(transport) {
       );
     },
     seek(fd, offset, whence) {
-      return json(call2({ op: "fd-seek", fd, offset, whence }, `fd-seek ${fd}`));
+      return json2(call2({ op: "fd-seek", fd, offset, whence }, `fd-seek ${fd}`));
     },
     flush(fd) {
       call2({ op: "fd-flush", fd }, `fd-flush ${fd}`);
@@ -4220,64 +4312,64 @@ function kernelSys(transport) {
       return r.ok && r.kind === "bytes" ? r.bytes : new Uint8Array(0);
     },
     pwrite(fd, bytes, at) {
-      return json(
+      return json2(
         call2({ op: "fd-pwrite", fd, offset: at, body: bytes }, `fd-pwrite ${fd}`)
       );
     },
     isatty(fd) {
-      return json(call2({ op: "fd-info", fd }, `fd-info ${fd}`))?.tty === true;
+      return json2(call2({ op: "fd-info", fd }, `fd-info ${fd}`))?.tty === true;
     },
     ttyName(fd) {
-      return json(call2({ op: "fd-info", fd }, `fd-info ${fd}`))?.name;
+      return json2(call2({ op: "fd-info", fd }, `fd-info ${fd}`))?.name;
     },
     kind(fd) {
-      return json(call2({ op: "fd-info", fd }, `fd-info ${fd}`))?.kind;
+      return json2(call2({ op: "fd-info", fd }, `fd-info ${fd}`))?.kind;
     },
     heldMeta(fd) {
-      return json(call2({ op: "fd-info", fd }, `fd-info ${fd}`)).meta;
+      return json2(call2({ op: "fd-info", fd }, `fd-info ${fd}`)).meta;
     },
     access(fd) {
-      return json(call2({ op: "fd-info", fd }, `fd-info ${fd}`)).access;
+      return json2(call2({ op: "fd-info", fd }, `fd-info ${fd}`)).access;
     },
     size(fd) {
-      return json(call2({ op: "fd-vfs-stat", fd }, `fd-vfs-stat ${fd}`)).size;
+      return json2(call2({ op: "fd-vfs-stat", fd }, `fd-vfs-stat ${fd}`)).size;
     },
     ttyNames() {
-      return json(call2({ op: "fd-tty-names" }, "fd-tty-names"));
+      return json2(call2({ op: "fd-tty-names" }, "fd-tty-names"));
     },
     ttyOwner(name2) {
-      return json(call2({ op: "fd-tty-owner", name: name2 }, `fd-tty-owner ${name2}`));
+      return json2(call2({ op: "fd-tty-owner", name: name2 }, `fd-tty-owner ${name2}`));
     },
     openTty(name2) {
       const req = name2 === void 0 ? { op: "fd-open-tty" } : { op: "fd-open-tty", name: name2 };
-      return json(call2(req, `fd-open-tty ${name2 ?? ""}`));
+      return json2(call2(req, `fd-open-tty ${name2 ?? ""}`));
     },
     tcgets(fd) {
-      return json(call2({ op: "tty-get", fd }, `tty-get ${fd}`));
+      return json2(call2({ op: "tty-get", fd }, `tty-get ${fd}`));
     },
     tcsets(fd, termios, flush) {
       call2({ op: "tty-set", fd, termios, ...flush ? { flush } : {} }, `tty-set ${fd}`);
     },
     winsize(fd) {
-      return json(call2({ op: "tty-winsz", fd }, `tty-winsz ${fd}`));
+      return json2(call2({ op: "tty-winsz", fd }, `tty-winsz ${fd}`));
     },
     openPty() {
-      return json(call2({ op: "pty-open" }, "pty-open"));
+      return json2(call2({ op: "pty-open" }, "pty-open"));
     },
     openPts(n, noctty) {
-      return json(call2({ op: "pty-slave-open", n, noctty }, `pty-slave-open ${n}`));
+      return json2(call2({ op: "pty-slave-open", n, noctty }, `pty-slave-open ${n}`));
     },
     ptyNumbers() {
-      return json(call2({ op: "pty-list" }, "pty-list"));
+      return json2(call2({ op: "pty-list" }, "pty-list"));
     },
     procList() {
-      return json(call2({ op: "proc-list" }, "proc-list"));
+      return json2(call2({ op: "proc-list" }, "proc-list"));
     },
     mountList() {
-      return json(call2({ op: "mount-list" }, "mount-list"));
+      return json2(call2({ op: "mount-list" }, "mount-list"));
     },
     ptyNumber(fd) {
-      return json(call2({ op: "pty-number", fd }, `pty-number ${fd}`));
+      return json2(call2({ op: "pty-number", fd }, `pty-number ${fd}`));
     },
     ptyLock(fd, lock) {
       call2({ op: "pty-lock", fd, lock }, `pty-lock ${fd}`);
@@ -4401,8 +4493,8 @@ async function runWasmProcess(init, port2, deps = {}) {
     }
   };
   const sys = kernelSys(transport);
-  const encoder4 = new TextEncoder();
-  const say = (fd) => (text) => sys.write(fd, encoder4.encode(`${text}
+  const encoder5 = new TextEncoder();
+  const say = (fd) => (text) => sys.write(fd, encoder5.encode(`${text}
 `));
   let ready;
   let failed5;
@@ -6042,11 +6134,11 @@ var init_wasi_memory = __esm({
         return at;
       }
       putStrings(list, ptrs, buf) {
-        const encoder4 = new TextEncoder();
+        const encoder5 = new TextEncoder();
         const v = this.view();
         let at = buf;
         list.forEach((s, i) => {
-          const b = encoder4.encode(s);
+          const b = encoder5.encode(s);
           v.setUint32(ptrs + i * 4, at, true);
           this.bytes(at, b.length).set(b);
           v.setUint8(at + b.length, 0);
@@ -6054,12 +6146,12 @@ var init_wasi_memory = __esm({
         });
       }
       putSizes(list, countPtr, sizePtr) {
-        const encoder4 = new TextEncoder();
+        const encoder5 = new TextEncoder();
         const v = this.view();
         v.setUint32(countPtr, list.length, true);
         v.setUint32(
           sizePtr,
-          list.reduce((n, s) => n + encoder4.encode(s).length + 1, 0),
+          list.reduce((n, s) => n + encoder5.encode(s).length + 1, 0),
           true
         );
       }
@@ -10646,14 +10738,32 @@ var init_js_kernel = __esm({
         const result = await this.call(req);
         return result.ok && result.kind === "bytes" ? result.bytes : new Uint8Array(0);
       }
-      async blocking(req, signal) {
+      async blocking(req, signal, track) {
         for (; ; ) {
-          const id = await this.json({ op: "async-submit", req });
+          const id = await this.submit(req, track);
           const result = await this.settled(id, signal);
           if (result.ok) return result;
           if (result.errno !== "EINTR") throw new JsCallError(result.errno, req.op);
         }
       }
+      acks = [];
+      ack(id) {
+        this.acks.push(id);
+      }
+      async submit(req, track) {
+        const ack = this.acks;
+        this.acks = [];
+        const r = await this.transport.call({
+          op: "async-submit",
+          req,
+          ...ack.length > 0 ? { ack } : {}
+        });
+        const id = r.ok && r.kind === "json" ? r.json : void 0;
+        if (id !== void 0) track?.(id);
+        this.deliver();
+        if (id === void 0) throw new JsCallError(r.ok ? "EIO" : r.errno, "async-submit");
+        return id;
+      }
       async settled(id, signal) {
         for (; ; ) {
           const seen = Atomics.load(this.header, SAB_I_ASYNC);
@@ -10855,6 +10965,165 @@ var init_js_children = __esm({
   }
 });
 
+// src/process/js/js-io.ts
+function typeOf(info) {
+  if (info.meta && "dir" in info.meta) return "directory";
+  if (info.meta && "device" in info.meta) return "device";
+  if (info.tty || info.kind === "tty") return "tty";
+  if (info.kind === "socket") return "socket";
+  return info.kind === "file" ? "file" : "pipe";
+}
+function device(info) {
+  return info.meta && "device" in info.meta ? info.meta : void 0;
+}
+function readDevice(info, max, random) {
+  if (typeOf(info) === "directory") throw new JsCallError("EISDIR", "read");
+  const dev = device(info);
+  if (!dev) return void 0;
+  if (dev.access === "write") throw new JsCallError("EBADF", "read");
+  if (dev.device === "null") return new Uint8Array(0);
+  const out = new Uint8Array(Math.min(max, CHUNK));
+  if (dev.device === "urandom") random(out);
+  return out;
+}
+function writeDevice(info) {
+  if (typeOf(info) === "directory") throw new JsCallError("EISDIR", "write");
+  const dev = device(info);
+  if (!dev) return false;
+  if (dev.access === "read") throw new JsCallError("EBADF", "write");
+  if (dev.device === "full") throw new JsCallError("ENOSPC", "write");
+  return true;
+}
+function brokenPipe(err, info) {
+  return err instanceof JsCallError && err.code === "EPIPE" && typeOf(info) !== "socket";
+}
+function written(r, fallback) {
+  return r.ok && r.kind === "json" && typeof r.json === "number" ? r.json : fallback;
+}
+function joined(parts, length) {
+  if (parts.length === 1) return parts[0];
+  const out = new Uint8Array(length);
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+function fileWrite(fd, append, offset, body) {
+  return append ? { op: "fd-write", fd, body } : { op: "fd-pwrite", fd, offset, body };
+}
+function isExclusive(o) {
+  return o.create === true && o.exclusive === true;
+}
+function absent(err) {
+  if (err instanceof JsCallError && err.code === "ENOENT") return void 0;
+  throw err;
+}
+function checkOpen(abs, o, existing) {
+  if (existing && isExclusive(o)) throw new JsCallError("EEXIST", abs);
+  if (!existing && !o.create) throw new JsCallError("ENOENT", abs);
+  if (existing?.isDirectory) throw new JsCallError("EISDIR", abs);
+}
+function flagsOf(o) {
+  const write2 = o.write || o.append || o.truncate;
+  const access = write2 ? o.read ? O_RDWR6 : O_WRONLY6 : 0;
+  return access | (o.append ? O_APPEND3 : 0);
+}
+function openRequest(abs, o) {
+  return {
+    op: "fd-open-vfs",
+    path: abs,
+    flags: flagsOf(o),
+    position: 0,
+    ...isExclusive(o) ? { exclusive: true } : o.create ? { create: true } : { existing: true },
+    ...o.truncate ? { truncate: true } : {}
+  };
+}
+function index2(n, what) {
+  if (!Number.isSafeInteger(n) || n < 0) throw new JsCallError("EINVAL", what);
+}
+var CHUNK, MAX_IO, O_WRONLY6, O_RDWR6, O_APPEND3;
+var init_js_io = __esm({
+  "src/process/js/js-io.ts"() {
+    "use strict";
+    init_js_kernel();
+    CHUNK = 64 * 1024;
+    MAX_IO = 1024 * 1024;
+    O_WRONLY6 = 1;
+    O_RDWR6 = 2;
+    O_APPEND3 = 1024;
+  }
+});
+
+// src/process/js/js-exit.ts
+function json(r) {
+  return r.ok && r.kind === "json" ? r.json : void 0;
+}
+function restoreMode(lane, { terminal, fd, termios }) {
+  const open = json(lane({ op: "fd-list" })) ?? [];
+  const on = open.filter((entry) => entry.terminal === terminal);
+  const at = (on.find((entry) => entry.fd === fd) ?? on[0])?.fd;
+  if (at !== void 0) {
+    lane({ op: "tty-set", fd: at, termios });
+    return;
+  }
+  const opened = json(lane({ op: "fd-open-tty", name: terminal }));
+  if (typeof opened !== "number") return;
+  lane({ op: "tty-set", fd: opened, termios });
+  lane({ op: "fd-close", fd: opened });
+}
+function writeOut(lane, fd, data) {
+  let at = 0;
+  while (at < data.length) {
+    const body = data.subarray(at, at + MAX_IO);
+    const r = lane({ op: "fd-write", fd, body });
+    if (!r.ok && r.errno === "EINTR") continue;
+    if (!r.ok) return false;
+    const n = written(r, body.length);
+    if (n <= 0) return false;
+    at += n;
+  }
+  return true;
+}
+function progress(result, len) {
+  if (!result) return len;
+  if (result.ok) return written(result, len);
+  return result.errno === "EINTR" ? 0 : -1;
+}
+function settled(lane, writes) {
+  const inFlight = writes.filter((w) => w.op !== void 0);
+  const out = /* @__PURE__ */ new Map();
+  if (inFlight.length === 0) return out;
+  const r = lane({ op: "async-settle", ids: inFlight.map((w) => w.op) });
+  const results = r.ok && r.kind === "json" ? r.json : [];
+  inFlight.forEach((w, i) => {
+    const result = results[i];
+    out.set(w, progress(result, w.len));
+  });
+  return out;
+}
+function exitAtOnce(lane, writes, modes, status2) {
+  const done = settled(lane, writes);
+  const broken = /* @__PURE__ */ new Set();
+  for (const w of writes) {
+    const sent = done.get(w);
+    if (sent === -1) broken.add(w.fd);
+    if (broken.has(w.fd)) continue;
+    if (!writeOut(lane, w.fd, w.data.subarray(w.at + (sent ?? 0)))) broken.add(w.fd);
+  }
+  for (const mode of modes) restoreMode(lane, mode);
+  lane({ op: "proc-exit", status: status2 & 255 });
+  const parked = new Int32Array(new SharedArrayBuffer(4));
+  for (; ; ) Atomics.wait(parked, 0, 0);
+}
+var init_js_exit = __esm({
+  "src/process/js/js-exit.ts"() {
+    "use strict";
+    init_js_io();
+  }
+});
+
 // src/process/js/js-fetch.ts
 function withoutFragment(url) {
   url.hash = "";
@@ -11087,7 +11356,7 @@ function fetchOp(kernel) {
           let r;
           try {
             signal.throwIfAborted();
-            r = await kernel.blocking({ op: "net-read", handle, max: CHUNK }, signal);
+            r = await kernel.blocking({ op: "net-read", handle, max: CHUNK2 }, signal);
           } catch (err) {
             settle();
             await close(handle);
@@ -11176,12 +11445,12 @@ function fetchOp(kernel) {
     }
   };
 }
-var CHUNK, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTIALS, OVER, TOKEN, QUOTABLE, SPACE, BASE64, SLICE;
+var CHUNK2, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTIALS, OVER, TOKEN, QUOTABLE, SPACE, BASE64, SLICE;
 var init_js_fetch = __esm({
   "src/process/js/js-fetch.ts"() {
     "use strict";
     init_js_kernel();
-    CHUNK = 64 * 1024;
+    CHUNK2 = 64 * 1024;
     MAX_REDIRECTS = 20;
     NULL_BODY = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
     REDIRECTS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
@@ -11203,97 +11472,6 @@ var init_js_fetch = __esm({
   }
 });
 
-// src/process/js/js-io.ts
-function typeOf(info) {
-  if (info.meta && "dir" in info.meta) return "directory";
-  if (info.meta && "device" in info.meta) return "device";
-  if (info.tty || info.kind === "tty") return "tty";
-  if (info.kind === "socket") return "socket";
-  return info.kind === "file" ? "file" : "pipe";
-}
-function device(info) {
-  return info.meta && "device" in info.meta ? info.meta : void 0;
-}
-function readDevice(info, max, random) {
-  if (typeOf(info) === "directory") throw new JsCallError("EISDIR", "read");
-  const dev = device(info);
-  if (!dev) return void 0;
-  if (dev.access === "write") throw new JsCallError("EBADF", "read");
-  if (dev.device === "null") return new Uint8Array(0);
-  const out = new Uint8Array(Math.min(max, CHUNK2));
-  if (dev.device === "urandom") random(out);
-  return out;
-}
-function writeDevice(info) {
-  if (typeOf(info) === "directory") throw new JsCallError("EISDIR", "write");
-  const dev = device(info);
-  if (!dev) return false;
-  if (dev.access === "read") throw new JsCallError("EBADF", "write");
-  if (dev.device === "full") throw new JsCallError("ENOSPC", "write");
-  return true;
-}
-function brokenPipe(err, info) {
-  return err instanceof JsCallError && err.code === "EPIPE" && typeOf(info) !== "socket";
-}
-function written(r, fallback) {
-  return r.ok && r.kind === "json" && typeof r.json === "number" ? r.json : fallback;
-}
-function joined(parts, length) {
-  if (parts.length === 1) return parts[0];
-  const out = new Uint8Array(length);
-  let at = 0;
-  for (const part of parts) {
-    out.set(part, at);
-    at += part.length;
-  }
-  return out;
-}
-function fileWrite(fd, append, offset, body) {
-  return append ? { op: "fd-write", fd, body } : { op: "fd-pwrite", fd, offset, body };
-}
-function isExclusive(o) {
-  return o.create === true && o.exclusive === true;
-}
-function absent(err) {
-  if (err instanceof JsCallError && err.code === "ENOENT") return void 0;
-  throw err;
-}
-function checkOpen(abs, o, existing) {
-  if (existing && isExclusive(o)) throw new JsCallError("EEXIST", abs);
-  if (!existing && !o.create) throw new JsCallError("ENOENT", abs);
-  if (existing?.isDirectory) throw new JsCallError("EISDIR", abs);
-}
-function flagsOf(o) {
-  const write2 = o.write || o.append || o.truncate;
-  const access = write2 ? o.read ? O_RDWR6 : O_WRONLY6 : 0;
-  return access | (o.append ? O_APPEND3 : 0);
-}
-function openRequest(abs, o) {
-  return {
-    op: "fd-open-vfs",
-    path: abs,
-    flags: flagsOf(o),
-    position: 0,
-    ...isExclusive(o) ? { exclusive: true } : o.create ? { create: true } : { existing: true },
-    ...o.truncate ? { truncate: true } : {}
-  };
-}
-function index2(n, what) {
-  if (!Number.isSafeInteger(n) || n < 0) throw new JsCallError("EINVAL", what);
-}
-var CHUNK2, MAX_IO, O_WRONLY6, O_RDWR6, O_APPEND3;
-var init_js_io = __esm({
-  "src/process/js/js-io.ts"() {
-    "use strict";
-    init_js_kernel();
-    CHUNK2 = 64 * 1024;
-    MAX_IO = 1024 * 1024;
-    O_WRONLY6 = 1;
-    O_RDWR6 = 2;
-    O_APPEND3 = 1024;
-  }
-});
-
 // src/process/js/js-net.ts
 function errnoName(errno2) {
   const found = Object.entries(E).find(([, n]) => n === errno2);
@@ -11435,6 +11613,67 @@ var init_js_net = __esm({
   }
 });
 
+// src/process/js/js-run.ts
+function stdioOf(how) {
+  if (how === void 0) return "pipe";
+  if (!STDIO3.has(how)) throw new JsCallError("EINVAL", "run");
+  return how;
+}
+function limit(value2) {
+  if (value2 === void 0 || value2 === Number.POSITIVE_INFINITY) return value2;
+  if (!(value2 >= 0)) throw new JsCallError("EINVAL", "run");
+  return value2;
+}
+function decodeRun(bytes, stdout, stderr) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const size = view.getUint32(0, true);
+  const outcome = JSON.parse(new TextDecoder().decode(bytes.subarray(4, 4 + size)));
+  const out = bytes.slice(4 + size, 4 + size + outcome.out);
+  const err = bytes.slice(4 + size + outcome.out, 4 + size + outcome.out + outcome.err);
+  return {
+    pid: outcome.pid,
+    status: outcome.status,
+    ...outcome.signal !== void 0 ? { signal: outcome.signal } : {},
+    ...stdout === "pipe" ? { stdout: out } : {},
+    ...stderr === "pipe" ? { stderr: err } : {},
+    ...outcome.error ? { error: outcome.error } : {}
+  };
+}
+function runSync(kernel, d, o) {
+  const [file] = o.argv;
+  if (file === void 0) throw new JsCallError("EINVAL", "run");
+  const stdout = stdioOf(o.stdout);
+  const stderr = stdioOf(o.stderr);
+  const input = typeof o.input === "string" ? encoder2.encode(o.input) : o.input;
+  const maxBuffer = limit(o.maxBuffer);
+  const timeout = limit(o.timeout);
+  const bytes = kernel.bytes({
+    op: "proc-run",
+    file,
+    argv: [...o.argv],
+    env: { ...o.env ?? d.env },
+    cwd: o.cwd === void 0 ? d.cwd : d.resolve(o.cwd),
+    stdin: stdioOf(o.stdin),
+    ...input ? { input } : {},
+    stdout,
+    stderr,
+    ...maxBuffer !== void 0 && maxBuffer !== Number.POSITIVE_INFINITY ? { maxBuffer } : {},
+    ...maxBuffer === Number.POSITIVE_INFINITY ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {},
+    ...timeout !== void 0 && timeout !== Number.POSITIVE_INFINITY ? { timeoutMs: timeout } : {},
+    killSignal: d.signal(o.killSignal ?? "SIGTERM")
+  });
+  return decodeRun(bytes, stdout, stderr);
+}
+var encoder2, STDIO3;
+var init_js_run = __esm({
+  "src/process/js/js-run.ts"() {
+    "use strict";
+    init_js_kernel();
+    encoder2 = new TextEncoder();
+    STDIO3 = /* @__PURE__ */ new Set(["pipe", "ignore", "inherit"]);
+  }
+});
+
 // src/process/js/js-sync.ts
 function laneOf(lane) {
   if (!lane) return () => ({ ok: false, errno: "ENOSYS", message: "no sync lane" });
@@ -11450,7 +11689,7 @@ function syncOps(kernel, shared) {
     infos.set(fd, got);
     return got;
   };
-  const read2 = (fd, max = CHUNK2) => {
+  const read2 = (fd, max = CHUNK) => {
     index2(max, "read");
     const emulated = readDevice(info(fd), max, shared.random);
     if (emulated) return emulated;
@@ -11458,7 +11697,7 @@ function syncOps(kernel, shared) {
     return r.ok && r.kind === "bytes" ? r.bytes : new Uint8Array(0);
   };
   const write2 = (fd, data) => {
-    const bytes = typeof data === "string" ? encoder2.encode(data) : data;
+    const bytes = typeof data === "string" ? encoder3.encode(data) : data;
     const i = info(fd);
     if (writeDevice(i)) return;
     let at = 0;
@@ -11601,14 +11840,14 @@ function syncPathOps(kernel, resolve, statOf, open) {
     writeFile(path, data) {
       const file = open(path, { write: true, create: true, truncate: true });
       try {
-        file.write(0, typeof data === "string" ? encoder2.encode(data) : data);
+        file.write(0, typeof data === "string" ? encoder3.encode(data) : data);
       } finally {
         file.close();
       }
     }
   };
 }
-var encoder2, JsSyncKernel;
+var encoder3, JsSyncKernel;
 var init_js_sync = __esm({
   "src/process/js/js-sync.ts"() {
     "use strict";
@@ -11617,7 +11856,7 @@ var init_js_sync = __esm({
     init_sync_sab_bridge();
     init_js_io();
     init_js_kernel();
-    encoder2 = new TextEncoder();
+    encoder3 = new TextEncoder();
     JsSyncKernel = class {
       lane;
       kernel;
@@ -11725,7 +11964,8 @@ function ttyOps(kernel) {
       await back.catch(() => void 0);
     }
   };
-  return { tty, restore };
+  const modes = () => [...saved].reverse().map(([terminal, { fd, termios }]) => ({ terminal, fd, termios }));
+  return { tty, restore, modes };
 }
 var BRKINT, INPCK, ISTRIP, ICRNL, IXON, ONLCR, CS8, ISIG, ICANON2, ECHO2, IEXTEN, VTIME, VMIN;
 var init_js_tty = __esm({
@@ -11816,14 +12056,14 @@ function websocketOp(kernel) {
       finish();
     };
     signal.addEventListener("abort", onAbort, { once: true });
-    let settled = false;
+    let settled2 = false;
     let readDone = false;
     const release = () => {
-      if (!settled || !readDone || freed) return;
+      if (!settled2 || !readDone || freed) return;
       finish();
     };
     kernel.blocking({ op: "net-ws-wait", handle }, stop.signal).then((r) => {
-      settled = true;
+      settled2 = true;
       settle(r.json);
       release();
     }).catch(lose);
@@ -11871,7 +12111,7 @@ function websocketOp(kernel) {
       async write(chunk, controller) {
         stop.signal.throwIfAborted();
         const send = async (body) => {
-          if (settled) throw new JsCallError("EPIPE", "the websocket is closed");
+          if (settled2) throw new JsCallError("EPIPE", "the websocket is closed");
           return await kernel.json({ op: "net-ws-send", handle, ...body });
         };
         let buffered = await send(typeof chunk === "string" ? { text: chunk } : { body: chunk });
@@ -11931,6 +12171,41 @@ function resolvePath(cwd, path) {
   }
   return `/${parts.join("/")}`;
 }
+function writer(kernel, info, pid) {
+  const writes = /* @__PURE__ */ new Set();
+  const sendAll = async (fd, data, i, w, signal) => {
+    while (w.at < data.length) {
+      const body = data.subarray(w.at, w.at + MAX_IO);
+      w.len = body.length;
+      try {
+        w.at += signal ? await sendSome(kernel, fd, body, signal) : written(
+          await kernel.blocking({ op: "fd-write", fd, body }, void 0, (id) => {
+            if (w.op !== void 0) kernel.ack(w.op);
+            w.op = id;
+          }),
+          body.length
+        );
+        if (w.op !== void 0) kernel.ack(w.op);
+        w.op = void 0;
+      } catch (err) {
+        if (brokenPipe(err, i)) await kernel.call({ op: "proc-kill", pid, sig: SIG.PIPE });
+        throw err;
+      }
+    }
+  };
+  const writeAll = async (fd, data, signal) => {
+    const w = { fd, data, at: 0, len: 0 };
+    if (!signal) writes.add(w);
+    try {
+      const i = await info(fd);
+      if (writeDevice(i)) return;
+      await sendAll(fd, data, i, w, signal);
+    } finally {
+      writes.delete(w);
+    }
+  };
+  return { writes, writeAll };
+}
 function createContext(o) {
   const { kernel } = o;
   const infos = /* @__PURE__ */ new Map();
@@ -11955,36 +12230,23 @@ function createContext(o) {
     infos.set(fd, got);
     return got;
   };
-  const read2 = async (fd, max = CHUNK2, signal) => {
+  const read2 = async (fd, max = CHUNK, signal) => {
     index2(max, "read");
     const emulated = readDevice(await info(fd), max, random);
     if (emulated) return emulated;
     return readPipe(kernel, fd, Math.min(max, MAX_IO), signal);
   };
-  const writeAll = async (fd, data, signal) => {
-    const i = await info(fd);
-    if (writeDevice(i)) return;
-    let at = 0;
-    while (at < data.length) {
-      const body = data.subarray(at, at + MAX_IO);
-      try {
-        at += signal ? await sendSome(kernel, fd, body, signal) : written(await kernel.blocking({ op: "fd-write", fd, body }), body.length);
-      } catch (err) {
-        if (brokenPipe(err, i)) await kernel.call({ op: "proc-kill", pid: o.pid, sig: SIG.PIPE });
-        throw err;
-      }
-    }
-  };
+  const { writes, writeAll } = writer(kernel, info, o.pid);
   const write2 = (fd, data) => {
-    const bytes = typeof data === "string" ? encoder3.encode(data) : data;
+    const bytes = typeof data === "string" ? encoder4.encode(data) : data;
     let settle;
-    const settled = new Promise((resolve2) => settle = resolve2);
-    pending.add(settled);
+    const settled2 = new Promise((resolve2) => settle = resolve2);
+    pending.add(settled2);
     return (async () => {
       try {
         await writeAll(fd, bytes);
       } finally {
-        pending.delete(settled);
+        pending.delete(settled2);
         settle();
       }
     })();
@@ -12017,14 +12279,17 @@ function createContext(o) {
     return handle.file;
   };
   const fs = pathOps(kernel, resolve, statOf, open);
-  const sync = syncOps(new JsSyncKernel(o.lane ?? laneOf(void 0), kernel, unwind), {
-    pid: o.pid,
-    resolve,
-    random,
-    infos,
-    handles
-  });
+  const lane = o.lane ?? laneOf(void 0);
+  const syncKernel = new JsSyncKernel(lane, kernel, unwind);
   const terminal = ttyOps(kernel);
+  const sync = {
+    ...syncOps(syncKernel, { pid: o.pid, resolve, random, infos, handles }),
+    run: (options) => runSync(syncKernel, { env: o.env, cwd: o.cwd, resolve, signal: signalNumber }, options),
+    exit: (status2 = 0) => {
+      exiting ??= status2 & 255;
+      return exitAtOnce(lane, [...writes], terminal.modes(), exiting);
+    }
+  };
   const io = { read: read2, send: writeAll, close: (fd) => ctx.close(fd) };
   const children = childOps(kernel, io, { env: o.env, cwd: o.cwd, signal: signalNumber });
   const strays = o.strays ?? { exception: /* @__PURE__ */ new Set(), rejection: /* @__PURE__ */ new Set() };
@@ -12198,24 +12463,26 @@ function pathOps(kernel, resolve, statOf, open) {
     async writeFile(path, data) {
       const file = await open(path, { write: true, create: true, truncate: true });
       try {
-        await file.write(0, typeof data === "string" ? encoder3.encode(data) : data);
+        await file.write(0, typeof data === "string" ? encoder4.encode(data) : data);
       } finally {
         await file.close();
       }
     }
   };
 }
-var JsExit, encoder3;
+var JsExit, encoder4;
 var init_js_context = __esm({
   "src/process/js/js-context.ts"() {
     "use strict";
     init_signals();
     init_sync_fs_wire();
     init_js_children();
+    init_js_exit();
     init_js_fetch();
     init_js_io();
     init_js_kernel();
     init_js_net();
+    init_js_run();
     init_js_sync();
     init_js_tty();
     init_js_websocket();
@@ -12227,83 +12494,7 @@ var init_js_context = __esm({
         this.status = status2;
       }
     };
-    encoder3 = new TextEncoder();
-  }
-});
-
-// src/process/js/lockdown.ts
-function chain(target) {
-  const out = [];
-  for (let at = target; at && at !== Object.prototype; ) {
-    out.push(at);
-    at = Object.getPrototypeOf(at);
-  }
-  return out;
-}
-function hide(target, names) {
-  for (const name2 of names) {
-    const holders = chain(target);
-    for (const holder of holders) {
-      if (Object.getOwnPropertyDescriptor(holder, name2)?.configurable) {
-        Reflect.deleteProperty(holder, name2);
-      }
-    }
-    const kept = holders.slice(1).some((holder) => Object.hasOwn(holder, name2));
-    const defined = Reflect.defineProperty(target, name2, {
-      value: void 0,
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-    if (kept || !defined && Reflect.get(target, name2) !== void 0) {
-      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
-    }
-  }
-}
-function vacate(target, names) {
-  for (const name2 of names) {
-    for (let at = target; at && at !== Object.prototype; ) {
-      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
-      at = Object.getPrototypeOf(at);
-    }
-    Reflect.defineProperty(target, name2, {
-      value: void 0,
-      writable: true,
-      enumerable: false,
-      configurable: true
-    });
-    if (Reflect.get(target, name2) !== void 0) {
-      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
-    }
-  }
-}
-function lockdown(scope2 = globalThis) {
-  hide(scope2, BLOCKED_GLOBALS);
-  vacate(scope2, OPEN_SLOTS);
-  const navigator = scope2.navigator;
-  if (navigator && typeof navigator === "object") hide(navigator, BLOCKED_NAVIGATOR);
-}
-var BLOCKED_GLOBALS, BLOCKED_NAVIGATOR, OPEN_SLOTS;
-var init_lockdown = __esm({
-  "src/process/js/lockdown.ts"() {
-    "use strict";
-    BLOCKED_GLOBALS = [
-      "XMLHttpRequest",
-      "WebSocketStream",
-      "WebTransport",
-      "EventSource",
-      "importScripts",
-      "indexedDB",
-      "caches",
-      "cookieStore",
-      "Worker",
-      "SharedWorker",
-      "BroadcastChannel",
-      "postMessage",
-      "close"
-    ];
-    BLOCKED_NAVIGATOR = ["storage", "locks", "serviceWorker"];
-    OPEN_SLOTS = ["fetch", "WebSocket"];
+    encoder4 = new TextEncoder();
   }
 });
 
@@ -12429,11 +12620,15 @@ var init_js_runtime = __esm({
   }
 });
 
+// src/process-worker.ts
+init_lockdown();
+
 // src/process/process-entry.ts
 init_protocol();
 init_process_runtime();
 var loadWasi = () => Promise.resolve().then(() => (init_wasi_runtime(), wasi_runtime_exports));
 var loadJs = () => Promise.resolve().then(() => (init_js_runtime(), js_runtime_exports));
+var NOT_RUNNABLE2 = 126;
 function started(init, port2, run, wasi, js) {
   if (init.program?.abi === "js") {
     const jsInit = init;
@@ -12443,18 +12638,35 @@ function started(init, port2, run, wasi, js) {
   if (wasmInit.program?.abi === "wasi") return wasi().then((m) => m.runWasiProcess(wasmInit, port2));
   return run(wasmInit, port2);
 }
-function processEntry(port2, run = runWasmProcess, wasi = loadWasi, js = loadJs) {
-  const failed5 = (err) => port2.postMessage({
+function processEntry(port2, run = runWasmProcess, wasi = loadWasi, js = loadJs, seal = () => {
+}) {
+  const failed5 = (err, code2) => port2.postMessage({
     type: WASM_PROCESS_ERROR,
-    message: err instanceof Error ? err.stack ?? err.message : String(err)
+    message: err instanceof Error ? err.stack ?? err.message : String(err),
+    ...code2 === void 0 ? {} : { code: code2 }
   });
+  let refused;
+  const sealOnce = () => {
+    if (refused === void 0) {
+      try {
+        seal();
+        refused = null;
+      } catch (error) {
+        refused = { error };
+      }
+    }
+    return refused;
+  };
   return (data) => {
     const type = data?.type;
+    if (type !== WASM_THREAD_INIT && type !== WASM_PROCESS_INIT) return;
+    const refusal2 = sealOnce();
     if (type === WASM_THREAD_INIT) {
+      if (refusal2) return failed5(refusal2.error);
       wasi().then((m) => m.runWasiThread(data, port2)).catch(failed5);
       return;
     }
-    if (type !== WASM_PROCESS_INIT) return;
+    if (refusal2) return failed5(refusal2.error, NOT_RUNNABLE2);
     started(data, port2, run, wasi, js).then(
       (code2) => port2.postMessage({ type: WASM_PROCESS_EXIT, code: code2 }),
       failed5
@@ -12463,8 +12675,18 @@ function processEntry(port2, run = runWasmProcess, wasi = loadWasi, js = loadJs)
 }
 
 // src/process-worker.ts
+init_process_fds();
 var scope = globalThis;
 var post = scope.postMessage.bind(scope);
-var onMessage = processEntry({ postMessage: (message2) => post(message2) });
+var onMessage = processEntry(
+  { postMessage: (message2) => post(message2) },
+  void 0,
+  void 0,
+  void 0,
+  () => {
+    pinRootKind();
+    lockdown();
+  }
+);
 scope.addEventListener("message", (event) => onMessage(event.data));
 //# sourceMappingURL=process-worker.js.map