@ai-ecoverse/slicc-kernel 1.67.1 → 1.69.0

package/dist/node-process-worker.js

@@ -1164,6 +1164,34 @@ var init_cred = __esm({
   }
 });
 
+// src/kernel/pipe.ts
+var PIPE_CAPACITY;
+var init_pipe = __esm({
+  "src/kernel/pipe.ts"() {
+    "use strict";
+    PIPE_CAPACITY = 64 * 1024;
+  }
+});
+
+// src/kernel/fd-table.ts
+function deviceAt(path) {
+  return DEVICE_PATHS.get(path);
+}
+var DEVICE_PATHS;
+var init_fd_table = __esm({
+  "src/kernel/fd-table.ts"() {
+    "use strict";
+    init_pipe();
+    DEVICE_PATHS = /* @__PURE__ */ new Map([
+      ["/dev/null", "null"],
+      ["/dev/zero", "zero"],
+      ["/dev/full", "full"],
+      ["/dev/urandom", "urandom"],
+      ["/dev/random", "urandom"]
+    ]);
+  }
+});
+
 // src/realm/sync-fs-wire.ts
 function parseSyncFsUsage(json2) {
   const u = json2;
@@ -1247,7 +1275,7 @@ function stdioAlias(path) {
   return m[1] ? 0 : m[2] ? 1 : m[3] ? 2 : Number(m[4]);
 }
 function deviceOf(path) {
-  return DEVICES[path];
+  return deviceAt(path);
 }
 function within(path, root) {
   return path === root || path.startsWith(root === "/" ? "/" : `${root}/`);
@@ -1315,10 +1343,11 @@ function promoteRequest(fd, f, handed) {
     ...f.buffer.handle !== void 0 ? { handle: f.buffer.handle } : {}
   };
 }
-var SYNTHETIC_DIRS, O_NONBLOCK, O_WRONLY, O_RDWR, O_APPEND, DEVICES, WasiFds, GEN;
+var SYNTHETIC_DIRS, O_NONBLOCK, O_WRONLY, O_RDWR, O_APPEND, SEALED_PATH, WasiFds, GEN;
 var init_wasi_fds = __esm({
   "src/process/wasi/wasi-fds.ts"() {
     "use strict";
+    init_fd_table();
     init_sync_fs_wire();
     init_wasi_abi();
     init_wasi_files();
@@ -1327,13 +1356,7 @@ var init_wasi_fds = __esm({
     O_WRONLY = 1;
     O_RDWR = 2;
     O_APPEND = 1024;
-    DEVICES = {
-      "/dev/null": "null",
-      "/dev/zero": "zero",
-      "/dev/full": "full",
-      "/dev/urandom": "urandom",
-      "/dev/random": "urandom"
-    };
+    SEALED_PATH = "/dev/sealed";
     WasiFds = class {
       table = /* @__PURE__ */ new Map();
       buffers = /* @__PURE__ */ new Map();
@@ -1798,16 +1821,30 @@ var init_wasi_fds = __esm({
         const joined2 = path.startsWith("/") ? path : `${this.dir(dirfd).path}/${path}`;
         return joined2.split("/").includes("..") ? physical(this.fs, joined2) : normalize(joined2);
       }
+      openKernelDevice(path, oflags, fdflags) {
+        const { openSealed, openTty } = this.kernel.sys;
+        const nonblock = (fdflags & FDFLAGS.NONBLOCK) !== 0;
+        let fd;
+        let kind;
+        if (path === SEALED_PATH && openSealed) {
+          if (oflags & OFLAGS.DIRECTORY) throw new WasiError("ENOTDIR");
+          if (oflags & OFLAGS.CREAT && oflags & OFLAGS.EXCL) throw new WasiError("EEXIST");
+          fd = openSealed.call(this.kernel.sys);
+          kind = "sealed";
+        } else if (path === "/dev/tty" || /^\/dev\/tty\d+$/.test(path)) {
+          fd = openTty?.call(this.kernel.sys, path === "/dev/tty" ? void 0 : path);
+          if (fd === void 0) throw new WasiError("ENXIO");
+          kind = "tty";
+        } else return void 0;
+        this.adopt(fd, kind, nonblock);
+        this.bump();
+        return fd;
+      }
       open(path, oflags, rights, fdflags) {
         const device2 = deviceOf(path);
         if (device2) return this.install({ type: "device", device: device2 });
-        if (path === "/dev/tty" || /^\/dev\/tty\d+$/.test(path)) {
-          const fd = this.kernel.sys.openTty?.(path === "/dev/tty" ? void 0 : path);
-          if (fd === void 0) throw new WasiError("ENXIO");
-          this.table.set(fd, { ...kernelEntry(), kind: "tty" });
-          this.bump();
-          return fd;
-        }
+        const kernelDevice = this.openKernelDevice(path, oflags, fdflags);
+        if (kernelDevice !== void 0) return kernelDevice;
         const alias = stdioAlias(path);
         if (alias !== void 0) return this.reopen(alias);
         const exclusive = (oflags & OFLAGS.CREAT) !== 0 && (oflags & OFLAGS.EXCL) !== 0;
@@ -2248,6 +2285,7 @@ function filestatOf(path, s) {
 function kernelFiletype(kind) {
   switch (kind) {
     case "tty":
+    case "sealed":
       return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: false };
     case "device":
       return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: true };
@@ -2288,7 +2326,7 @@ function wrap(table) {
   }
   return out;
 }
-var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW, AT_EACCESS, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, WasiHost;
+var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW, AT_EACCESS, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, SEALED_MODE, WasiHost;
 var init_wasi_host = __esm({
   "src/process/wasi/wasi-host.ts"() {
     "use strict";
@@ -2318,6 +2356,7 @@ var init_wasi_host = __esm({
     MONOTONIC_BASE = BigInt(Math.round(performance.timeOrigin)) * NS_PER_MS;
     MAX_READ = 1024 * 1024;
     SIGPIPE_EXIT = 141;
+    SEALED_MODE = 8630;
     WasiHost = class {
       mem = new WasiMemory();
       fds;
@@ -2403,7 +2442,9 @@ var init_wasi_host = __esm({
         const fdOwned = (fd) => {
           const e = fds.get(fd);
           if (e.type === "device") return ROOT_IDS;
-          if (e.type === "kernel" && fds.kind(fd, e) !== "file") return void 0;
+          const kind = e.type === "kernel" ? fds.kind(fd, e) : "file";
+          if (kind === "sealed") return ROOT_IDS;
+          if (kind !== "file") return void 0;
           try {
             return this.o.fs.stat(pathOf(fd));
           } catch (err) {
@@ -2412,7 +2453,7 @@ var init_wasi_host = __esm({
           }
         };
         const pathOwned = (path, follow2) => {
-          if (deviceOf(path)) return ROOT_IDS;
+          if (this.synthetic(path)) return ROOT_IDS;
           return follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path);
         };
         return wrap({
@@ -2427,11 +2468,11 @@ var init_wasi_host = __esm({
             this.writeFilestat(statOut, this.fdFilestat(fd));
             owner(fdOwned(fd), out);
           },
-          path_filestat_owner: (dirfd, lookup, p, l, statOut, out) => {
+          path_filestat_owner: (dirfd, lookup2, p, l, statOut, out) => {
             if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             const path = at(dirfd, p, l);
-            this.writeFilestat(statOut, this.pathFilestat(path, lookup));
-            owner(pathOwned(path, (lookup & LOOKUP_SYMLINK_FOLLOW) !== 0), out);
+            this.writeFilestat(statOut, this.pathFilestat(path, lookup2));
+            owner(pathOwned(path, (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0), out);
           },
           path_owner: (dirfd, p, l, flags, out) => {
             if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
@@ -2441,7 +2482,7 @@ var init_wasi_host = __esm({
           path_access: (dirfd, p, l, amode, flags) => {
             const path = at(dirfd, p, l);
             const nofollow = (flags & AT_SYMLINK_NOFOLLOW) !== 0;
-            if (deviceOf(path)) {
+            if (this.synthetic(path)) {
               if (this.o.fs.owners && amode & 1) throw new WasiError("EACCES");
               return;
             }
@@ -2458,12 +2499,14 @@ var init_wasi_host = __esm({
           },
           fd_mode: (fd, out) => {
             const e = fds.get(fd);
-            const pipe = e.type === "kernel" && fds.kind(fd, e) === "stream";
-            const mode = pipe ? S_IFIFO | 384 : modeOf(this.o.fs.stat(pathOf(fd)));
+            const kind = e.type === "kernel" ? fds.kind(fd, e) : void 0;
+            const mode = kind === "stream" ? S_IFIFO | 384 : kind === "sealed" ? SEALED_MODE : modeOf(this.o.fs.stat(pathOf(fd)));
             mem.view().setUint32(out, mode, true);
           },
           path_mode: (dirfd, p, l, flags, out) => {
             const path = at(dirfd, p, l);
+            if (path === SEALED_PATH && this.o.kernel.sys.openSealed)
+              return void mem.view().setUint32(out, SEALED_MODE, true);
             const st = flags & AT_SYMLINK_NOFOLLOW ? this.o.fs.lstat(path) : this.o.fs.stat(path);
             mem.view().setUint32(out, modeOf(st), true);
           }
@@ -2651,15 +2694,15 @@ var init_wasi_host = __esm({
           path_open: (dirfd, _lookup, p, l, oflags, rights, _inheriting, fdflags, out) => {
             const path = at(dirfd, p, l);
             if (deviceOf(path)) this.interrupted?.();
-            const fresh = (oflags & OFLAGS.CREAT) !== 0 && !o.fs.exists(path);
+            const fresh = (oflags & OFLAGS.CREAT) !== 0 && !this.synthetic(path) && !o.fs.exists(path);
             mem.view().setUint32(out, fds.open(path, oflags, rights, fdflags), true);
             if (fresh) this.created(path, 438);
           },
-          path_filestat_get: (dirfd, lookup, p, l, out) => void this.writeFilestat(out, this.pathFilestat(at(dirfd, p, l), lookup)),
-          path_filestat_set_times: (dirfd, lookup, p, l, atim, mtim, flags) => {
+          path_filestat_get: (dirfd, lookup2, p, l, out) => void this.writeFilestat(out, this.pathFilestat(at(dirfd, p, l), lookup2)),
+          path_filestat_set_times: (dirfd, lookup2, p, l, atim, mtim, flags) => {
             const path = at(dirfd, p, l);
             fds.flushPath(path);
-            this.setTimes(path, atim, mtim, flags, (lookup & LOOKUP_SYMLINK_FOLLOW) !== 0);
+            this.setTimes(path, atim, mtim, flags, (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0);
           },
           path_create_directory: (dirfd, p, l) => {
             const path = at(dirfd, p, l);
@@ -2692,10 +2735,10 @@ var init_wasi_host = __esm({
             mem.bytes(buf, n).set(target.subarray(0, n));
             mem.view().setUint32(used, n, true);
           },
-          path_link: (fd, lookup, p, l, fd2, p2, l2) => {
+          path_link: (fd, lookup2, p, l, fd2, p2, l2) => {
             const from = at(fd, p, l);
             const to = at(fd2, p2, l2);
-            const follow2 = (lookup & LOOKUP_SYMLINK_FOLLOW) !== 0;
+            const follow2 = (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0;
             const source = follow2 ? physicalPath(o.fs, from) : from;
             fds.flushPath(from);
             if (source !== from) fds.flushPath(source);
@@ -2960,8 +3003,11 @@ var init_wasi_host = __esm({
         const out = this.sized(path, s, size);
         return gone ? { ...out, nlink: 0n } : out;
       }
-      pathFilestat(path, lookup) {
-        if (deviceOf(path)) {
+      synthetic(path) {
+        return deviceOf(path) !== void 0 || path === SEALED_PATH && !!this.o.kernel.sys.openSealed;
+      }
+      pathFilestat(path, lookup2) {
+        if (this.synthetic(path)) {
           return this.local({
             filetype: FILETYPE.CHARACTER_DEVICE,
             size: 0n,
@@ -2970,7 +3016,7 @@ var init_wasi_host = __esm({
           });
         }
         this.fds.flushPath(path);
-        const follow2 = (lookup & LOOKUP_SYMLINK_FOLLOW) !== 0;
+        const follow2 = (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0;
         return filestatOf(path, follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path));
       }
       setTimes(path, atim, mtim, flags, follow2 = true) {
@@ -3097,12 +3143,12 @@ var init_wasix_process = __esm({
         fds.promoteFiles();
         const map = fds.inheritable();
         const nulls = /* @__PURE__ */ new Set();
-        const opened = [];
+        const opened2 = [];
         let cwd = this.host.cwd;
         try {
-          for (const op of ops) cwd = this.applyFdOp(op, { map, nulls, opened }, cwd);
+          for (const op of ops) cwd = this.applyFdOp(op, { map, nulls, opened: opened2 }, cwd);
         } catch (e) {
-          for (const kfd of opened) this.host.o.kernel.sys.close(kfd);
+          for (const kfd of opened2) this.host.o.kernel.sys.close(kfd);
           throw e;
         }
         const stdio = [0, 1, 2].map((fd) => {
@@ -3113,10 +3159,10 @@ var init_wasix_process = __esm({
           ...[...map].filter(([fd]) => fd > 2).map(([fd, kernel]) => ({ fd, kernel })),
           ...[...nulls].filter((fd) => fd > 2).map((fd) => ({ fd, device: "null" }))
         ];
-        return { stdio, inherit, cwd, opened };
+        return { stdio, inherit, cwd, opened: opened2 };
       }
       applyFdOp(op, slots3, cwd) {
-        const { map, nulls, opened } = slots3;
+        const { map, nulls, opened: opened2 } = slots3;
         const { fds } = this.host;
         const point = (fd, kfd) => {
           if (kfd === void 0) {
@@ -3139,7 +3185,7 @@ var init_wasix_process = __esm({
           point(op.fd, void 0);
         } else if (op.cmd === "open") {
           const kfd = this.openFor(op, cwd);
-          opened.push(kfd);
+          opened2.push(kfd);
           point(op.fd, kfd);
         } else if (op.cmd === "chdir") return this.physicalFrom(cwd, op.path);
         else return physicalPath(this.host.o.fs, fds.dir(op.fd).path);
@@ -3161,7 +3207,7 @@ var init_wasix_process = __esm({
         });
       }
       spawn(req, exec = false) {
-        const { stdio, inherit, cwd, opened } = this.childFds(req.ops ?? []);
+        const { stdio, inherit, cwd, opened: opened2 } = this.childFds(req.ops ?? []);
         try {
           const spawn = {
             op: "proc-spawn",
@@ -3176,7 +3222,7 @@ var init_wasix_process = __esm({
           };
           return restarted(() => this.call(spawn));
         } finally {
-          for (const kfd of opened) this.host.o.kernel.sys.close(kfd);
+          for (const kfd of opened2) this.host.o.kernel.sys.close(kfd);
           this.host.o.fs.invalidate?.();
         }
       }
@@ -3697,6 +3743,11 @@ function untilAborted(work, signal) {
     work.then(done, done);
   });
 }
+function caughtOf(handlers) {
+  let caught = 0;
+  for (const sig of handlers.keys()) caught |= sigbit(sig);
+  return caught;
+}
 var JsCallError, JsKernel;
 var init_js_kernel = __esm({
   "src/process/js/js-kernel.ts"() {
@@ -3724,6 +3775,7 @@ var init_js_kernel = __esm({
       reported = { caught: 0, ignored: 0 };
       watching = false;
       faulted = false;
+      syncLane;
       constructor(o) {
         this.header = new Int32Array(o.sab, 0, SAB_HEADER_I32);
         this.transport = o.transport;
@@ -3826,16 +3878,41 @@ var init_js_kernel = __esm({
         if (sig === SIG.KILL || sig === SIG.STOP) {
           return Promise.reject(new JsCallError("EINVAL", "signal"));
         }
+        if (this.syncLane) {
+          try {
+            this.changeNow(this.syncLane, sig, handler);
+            return Promise.resolve();
+          } catch (err) {
+            return Promise.reject(err);
+          }
+        }
         const run = this.changing.then(() => this.change(sig, handler));
         this.changing = run.catch(() => void 0);
         return run;
       }
-      async change(sig, handler) {
+      changeNow(lane, sig, handler) {
+        const { handlers, ignored } = this.disposed(sig, handler);
+        const defaults = handler === "default" ? sigbit(sig) : 0;
+        const caught = caughtOf(handlers);
+        if (caught !== this.reported.caught || ignored !== this.reported.ignored || defaults !== 0) {
+          const r = lane({ op: "sig-mask", caught, ignored, ...defaults ? { defaults } : {} });
+          if (!r.ok) throw new JsCallError(r.errno, "sig-mask");
+          this.reported = { caught, ignored };
+        }
+        this.handlers = handlers;
+        this.ignored = ignored;
+        if (handlers.size > 0) void this.watch();
+      }
+      disposed(sig, handler) {
         const handlers = new Map(this.handlers);
         handlers.delete(sig);
         let ignored = this.ignored & ~sigbit(sig);
         if (handler === "ignore") ignored |= sigbit(sig);
         else if (handler !== "default") handlers.set(sig, handler);
+        return { handlers, ignored };
+      }
+      async change(sig, handler) {
+        const { handlers, ignored } = this.disposed(sig, handler);
         await this.report(handlers, ignored, handler === "default" ? sigbit(sig) : 0);
         this.handlers = handlers;
         this.ignored = ignored;
@@ -3845,8 +3922,7 @@ var init_js_kernel = __esm({
         this.call({ op: "proc-kill", pid: this.pid, sig }).catch(this.onError);
       }
       async report(handlers, ignored, defaults) {
-        let caught = 0;
-        for (const sig of handlers.keys()) caught |= sigbit(sig);
+        const caught = caughtOf(handlers);
         const same = caught === this.reported.caught && ignored === this.reported.ignored;
         if (same && defaults === 0) return;
         this.reported = { caught, ignored };
@@ -4066,6 +4142,344 @@ var init_js_io = __esm({
   }
 });
 
+// src/process/js/js-dev.ts
+function inDev(abs) {
+  return abs.startsWith("/dev") && (abs.length === 4 || abs[4] === "/");
+}
+function missing(path) {
+  throw new JsCallError("ENOENT", path);
+}
+function nodeStat(mode, size = 0, owner) {
+  return {
+    isFile: false,
+    isDirectory: (mode & S_IFMT) === DIR,
+    isSymbolicLink: (mode & S_IFMT) === LINK,
+    size,
+    mode,
+    mtimeMs: BORN,
+    atimeMs: BORN,
+    ctimeMs: BORN,
+    nlink: 1,
+    uid: owner?.uid ?? 0,
+    gid: owner?.gid ?? 0
+  };
+}
+function* lookup(abs) {
+  if (abs === "/dev") return { kind: "dir", mode: DIR | 493 };
+  const name2 = abs.slice("/dev/".length);
+  if (DEVICES.includes(name2)) return { kind: "device" };
+  if (name2 === "tty") return { kind: "tty" };
+  const std = STDIO3.indexOf(name2);
+  if (std >= 0) return { kind: "link", target: `${SELF_FD}/${std}`, fd: std };
+  if (name2 === "fd") return { kind: "link", target: SELF_FD };
+  const fd = /^fd\/(\d+)$/.exec(name2)?.[1];
+  if (fd !== void 0) return { kind: "fd", fd: Number(fd) };
+  if (/^tty\d+$/.test(name2)) {
+    const names = yield { op: "fd-tty-names" };
+    if (names.includes(abs)) return { kind: "terminal", name: abs };
+  }
+  const pts = /^pts\/(\d+)$/.exec(name2)?.[1];
+  if (pts !== void 0) {
+    const open = yield { op: "pty-list" };
+    if (open.includes(Number(pts))) return { kind: "terminal", name: abs, pts: Number(pts) };
+  }
+  return missing(abs);
+}
+function* fdInfo(fd, path) {
+  try {
+    return yield { op: "fd-info", fd };
+  } catch (err) {
+    if (err instanceof JsCallError && err.code === "EBADF") return missing(path);
+    throw err;
+  }
+}
+function* pathStat(path) {
+  const s = parseSyncFsStat(yield { op: "stat", path });
+  if (!s) throw new JsCallError("EIO", "stat");
+  return s;
+}
+function* terminalStat(name2) {
+  const owner = yield { op: "fd-tty-owner", name: name2 };
+  if (owner) return nodeStat(CHAR | (owner.mode ?? 400), 0, owner);
+  return nodeStat(CHAR | (name2.startsWith("/dev/pts/") ? 400 : 438));
+}
+function* fdStat(fd, path) {
+  const info = yield* fdInfo(fd, path);
+  if (info.meta && "dir" in info.meta) return yield* pathStat(info.meta.dir);
+  if (info.kind === "file") {
+    const file = yield { op: "fd-vfs-stat", fd };
+    if (file.orphan) return { ...nodeStat(33152, file.size), isFile: true };
+    return yield* pathStat(file.path);
+  }
+  if (info.terminal) return yield* terminalStat(info.terminal);
+  if (info.kind === "device" || info.kind === "tty") return nodeStat(CHAR | 438);
+  if (info.kind === "socket") return nodeStat(49663);
+  return nodeStat(4480);
+}
+function* fdTarget(fd, path) {
+  const info = yield* fdInfo(fd, path);
+  if (info.meta && "dir" in info.meta) return info.meta.dir;
+  if (info.kind === "file") return (yield { op: "fd-vfs-stat", fd }).path;
+  if (info.terminal) return info.terminal;
+  if (info.meta && "device" in info.meta) return `/dev/${info.meta.device}`;
+  return `${info.kind === "socket" ? "socket" : "pipe"}:[${fd}]`;
+}
+function linkStat(target) {
+  return nodeStat(LINK | 511, target.length);
+}
+function* devStat(abs, follow2) {
+  const node = yield* lookup(abs);
+  switch (node.kind) {
+    case "dir":
+      return nodeStat(node.mode);
+    case "device":
+    case "tty":
+      return nodeStat(CHAR | 438);
+    case "terminal":
+      return yield* terminalStat(node.name);
+    case "link":
+      if (!follow2) return linkStat(node.target);
+      return node.fd === void 0 ? nodeStat(DIR | 365) : yield* fdStat(node.fd, abs);
+    case "fd":
+      return follow2 ? yield* fdStat(node.fd, abs) : linkStat(yield* fdTarget(node.fd, abs));
+  }
+}
+function* devExists(abs) {
+  try {
+    yield* devStat(abs, true);
+    return true;
+  } catch (err) {
+    if (err instanceof JsCallError) return false;
+    throw err;
+  }
+}
+function* devReadlink(abs) {
+  const node = yield* lookup(abs);
+  if (node.kind === "link") return node.target;
+  if (node.kind === "fd") return yield* fdTarget(node.fd, abs);
+  throw new JsCallError("EINVAL", abs);
+}
+function* devReaddir(abs) {
+  if (abs === "/dev/fd") {
+    const fds = yield { op: "fd-list" };
+    return fds.map(({ fd }) => String(fd));
+  }
+  const node = yield* lookup(abs);
+  if (node.kind !== "dir") throw new JsCallError("ENOTDIR", abs);
+  const names = yield { op: "fd-tty-names" };
+  const ttys = names.filter((n) => /^\/dev\/tty\d+$/.test(n)).map((n) => n.slice(5));
+  return [...DEVICES, "tty", "fd", ...STDIO3, ...ttys].sort();
+}
+function* aliasOf(fd, abs, o) {
+  const info = yield* fdInfo(fd, abs);
+  const file = info.kind === "file";
+  if (file) {
+    const at = yield { op: "fd-vfs-stat", fd };
+    if (!at.orphan)
+      return { fd: yield openRequest(at.path, { ...o, create: false }), file };
+  }
+  const copy2 = yield { op: "fd-dup", fd, min: 3 };
+  if (file && o.truncate) {
+    try {
+      yield { op: "fd-resize", fd: copy2, size: 0 };
+    } catch (err) {
+      yield { op: "fd-close", fd: copy2 };
+      throw err;
+    }
+  }
+  return { fd: copy2, file };
+}
+function* opened(abs, o) {
+  const node = yield* lookup(abs);
+  if (isExclusive(o)) throw new JsCallError("EEXIST", abs);
+  switch (node.kind) {
+    case "device":
+      return { fd: yield openRequest(abs, { ...o, create: false }), file: false };
+    case "tty":
+      return { fd: yield { op: "fd-open-tty" }, file: false };
+    case "terminal": {
+      const req = node.pts === void 0 ? { op: "fd-open-tty", name: node.name } : { op: "pty-slave-open", n: node.pts, noctty: true };
+      return { fd: yield req, file: false };
+    }
+    case "fd":
+      return yield* aliasOf(node.fd, abs, o);
+    case "link":
+      if (node.fd !== void 0) return yield* aliasOf(node.fd, abs, o);
+      throw new JsCallError("EISDIR", abs);
+    case "dir":
+      throw new JsCallError("EISDIR", abs);
+  }
+}
+function* devOpen(abs, o) {
+  const write2 = o.write === true || o.append === true || o.truncate === true;
+  return { ...yield* opened(abs, o), read: o.read === true || !write2, write: write2 };
+}
+async function devAsync(kernel, step) {
+  let next2 = step.next();
+  while (!next2.done) {
+    let answer2;
+    try {
+      answer2 = { value: await kernel.json(next2.value) };
+    } catch (error) {
+      answer2 = { error };
+    }
+    next2 = "value" in answer2 ? step.next(answer2.value) : step.throw(answer2.error);
+  }
+  return next2.value;
+}
+function devSync(kernel, step) {
+  let next2 = step.next();
+  while (!next2.done) {
+    let answer2;
+    try {
+      answer2 = { value: kernel.json(next2.value) };
+    } catch (error) {
+      answer2 = { error };
+    }
+    next2 = "value" in answer2 ? step.next(answer2.value) : step.throw(answer2.error);
+  }
+  return next2.value;
+}
+function tooLarge(got) {
+  if (got > DEV_READ_MAX) throw new JsCallError("EFBIG", "readFile");
+}
+function liveness(path) {
+  let open = true;
+  return {
+    live: () => {
+      if (!open) throw new JsCallError("EBADF", path);
+    },
+    end: () => {
+      open = false;
+    }
+  };
+}
+function allowed(may, what) {
+  if (!may) throw new JsCallError("EBADF", what);
+}
+function streamFile(fd, path, io, access) {
+  const { live, end } = liveness(path);
+  const file = {
+    fd,
+    path,
+    async size() {
+      live();
+      return 0;
+    },
+    async read(position, length) {
+      index2(position, "read");
+      index2(length, "read");
+      live();
+      allowed(access.read, "read");
+      return length === 0 ? new Uint8Array(0) : io.read(fd, Math.min(length, MAX_IO));
+    },
+    async write(position, data) {
+      index2(position, "write");
+      live();
+      allowed(access.write, "write");
+      await io.write(fd, data);
+      return data.length;
+    },
+    async truncate(size) {
+      live();
+      index2(size, "truncate");
+      throw new JsCallError("EINVAL", "truncate");
+    },
+    sync: async () => live(),
+    async close() {
+      live();
+      end();
+      await io.close(fd);
+    }
+  };
+  return { file, invalidate: end };
+}
+function streamSyncFile(fd, path, io, access) {
+  const { live, end } = liveness(path);
+  const file = {
+    fd,
+    path,
+    size() {
+      live();
+      return 0;
+    },
+    read(position, length) {
+      index2(position, "read");
+      index2(length, "read");
+      live();
+      allowed(access.read, "read");
+      return length === 0 ? new Uint8Array(0) : io.read(fd, Math.min(length, MAX_IO));
+    },
+    write(position, data) {
+      index2(position, "write");
+      live();
+      allowed(access.write, "write");
+      io.write(fd, data);
+      return data.length;
+    },
+    truncate(size) {
+      live();
+      index2(size, "truncate");
+      throw new JsCallError("EINVAL", "truncate");
+    },
+    sync: () => live(),
+    close() {
+      live();
+      end();
+      io.close(fd);
+    }
+  };
+  return { file, invalidate: end };
+}
+async function readWhole(file) {
+  try {
+    const parts = [];
+    let got = 0;
+    for (; ; ) {
+      const chunk = await file.read(got, MAX_IO);
+      if (chunk.length === 0) return joined(parts, got);
+      got += chunk.length;
+      tooLarge(got);
+      parts.push(chunk);
+    }
+  } finally {
+    await file.close();
+  }
+}
+function readWholeSync(file) {
+  try {
+    const parts = [];
+    let got = 0;
+    for (; ; ) {
+      const chunk = file.read(got, MAX_IO);
+      if (chunk.length === 0) return joined(parts, got);
+      got += chunk.length;
+      tooLarge(got);
+      parts.push(chunk);
+    }
+  } finally {
+    file.close();
+  }
+}
+var DEV_READ_MAX, DEVICES, STDIO3, SELF_FD, S_IFMT, DIR, LINK, CHAR, BORN;
+var init_js_dev = __esm({
+  "src/process/js/js-dev.ts"() {
+    "use strict";
+    init_sync_fs_wire();
+    init_js_io();
+    init_js_kernel();
+    DEV_READ_MAX = 64 * 1024 * 1024;
+    DEVICES = ["null", "zero", "full", "random", "urandom"];
+    STDIO3 = ["stdin", "stdout", "stderr"];
+    SELF_FD = "/proc/self/fd";
+    S_IFMT = 61440;
+    DIR = 16384;
+    LINK = 40960;
+    CHAR = 8192;
+    BORN = Date.now();
+  }
+});
+
 // src/process/js/js-exit.ts
 function json(r) {
   return r.ok && r.kind === "json" ? r.json : void 0;
@@ -4078,10 +4492,10 @@ function restoreMode(lane, { terminal, fd, termios }) {
     lane({ op: "tty-set", fd: at, termios });
     return;
   }
-  const opened = json(lane({ op: "fd-open-tty", name: terminal }));
-  if (typeof opened !== "number") return;
-  lane({ op: "tty-set", fd: opened, termios });
-  lane({ op: "fd-close", fd: opened });
+  const opened2 = json(lane({ op: "fd-open-tty", name: terminal }));
+  if (typeof opened2 !== "number") return;
+  lane({ op: "tty-set", fd: opened2, termios });
+  lane({ op: "fd-close", fd: opened2 });
 }
 function writeOut(lane, fd, data) {
   let at = 0;
@@ -4530,7 +4944,7 @@ function netOps(kernel, io) {
     const r = await kernel.blocking({ op: "sock-resolve", name: host, family: 4 }, signal);
     return (r.ok && r.kind === "json" ? r.json : [])[0];
   };
-  const opened = async (use) => {
+  const opened2 = async (use) => {
     const fd = await kernel.json({ op: "sock-open", domain: "inet" });
     try {
       return await use(fd);
@@ -4572,7 +4986,7 @@ function netOps(kernel, io) {
     };
   };
   return {
-    listen: (options = {}) => opened(async (fd) => {
+    listen: (options = {}) => opened2(async (fd) => {
       const addr = {
         family: "inet",
         host: options.host ?? "127.0.0.1",
@@ -4592,7 +5006,7 @@ function netOps(kernel, io) {
         host: await resolve(host, signal),
         port: port(options.port)
       };
-      return opened(async (fd) => {
+      return opened2(async (fd) => {
         const r = await kernel.raw({ op: "sock-connect", fd, addr, nonblock: true });
         if (!r.ok && r.errno !== "EINPROGRESS") throw new JsCallError(r.errno, "connect");
         await kernel.blocking({ op: "fd-select", read: [], write: [fd], timeoutMs: -1 }, signal);
@@ -4626,7 +5040,7 @@ var init_js_net = __esm({
 // src/process/js/js-run.ts
 function stdioOf(how) {
   if (how === void 0) return "pipe";
-  if (!STDIO3.has(how)) throw new JsCallError("EINVAL", "run");
+  if (!STDIO4.has(how)) throw new JsCallError("EINVAL", "run");
   return how;
 }
 function limit(value2) {
@@ -4674,13 +5088,13 @@ function runSync(kernel, d, o) {
   });
   return decodeRun(bytes, stdout, stderr);
 }
-var encoder2, STDIO3;
+var encoder2, STDIO4;
 var init_js_run = __esm({
   "src/process/js/js-run.ts"() {
     "use strict";
     init_js_kernel();
     encoder2 = new TextEncoder();
-    STDIO3 = /* @__PURE__ */ new Set(["pipe", "ignore", "inherit"]);
+    STDIO4 = /* @__PURE__ */ new Set(["pipe", "ignore", "inherit"]);
   }
 });
 
@@ -4974,13 +5388,30 @@ function syncOps(kernel, shared) {
   };
   const statOf = (op, path) => {
     const abs = resolve(path);
+    if (inDev(abs)) return devSync(kernel, devStat(abs, op === "stat"));
     kernel.call({ op: "fd-path-flush", path: abs });
     const s = parseSyncFsStat(kernel.json({ op, path: abs }));
     if (!s) throw new JsCallError("EIO", op);
     return s;
   };
+  const openDev2 = (abs, options) => {
+    const { fd, file, ...access } = devSync(kernel, devOpen(abs, options));
+    const forget = () => {
+      infos.delete(fd);
+      handles.delete(fd);
+    };
+    if (file) infos.set(fd, { kind: "file" });
+    const close = (n) => {
+      forget();
+      kernel.call({ op: "fd-close", fd: n });
+    };
+    const handle = file ? syncFile(kernel, fd, abs, options.append === true, forget) : streamSyncFile(fd, abs, { read: (n, max) => read2(n, max), write: write2, close }, access);
+    handles.set(fd, handle.invalidate);
+    return handle.file;
+  };
   const open = (path, options = {}) => {
     const abs = resolve(path);
+    if (inDev(abs)) return openDev2(abs, options);
     let existing;
     try {
       existing = statOf(isExclusive(options) ? "lstat" : "stat", abs);
@@ -5084,17 +5515,30 @@ function syncPathOps(kernel, resolve, statOf, open) {
   return {
     stat: (path) => statOf("stat", path),
     lstat: (path) => statOf("lstat", path),
-    exists: (path) => kernel.json({ op: "exists", path: resolve(path) }) === true,
-    readdir: (path) => kernel.json({ op: "readdir", path: resolve(path) }),
+    exists(path) {
+      const abs = resolve(path);
+      if (inDev(abs)) return devSync(kernel, devExists(abs));
+      return kernel.json({ op: "exists", path: abs }) === true;
+    },
+    readdir(path) {
+      const abs = resolve(path);
+      if (inDev(abs)) return devSync(kernel, devReaddir(abs));
+      return kernel.json({ op: "readdir", path: abs });
+    },
     mkdir: (path) => void kernel.call({ op: "mkdir", path: resolve(path) }),
     rm: (path) => void kernel.call({ op: "rm", path: resolve(path) }),
     unlink: (path) => void kernel.call({ op: "unlink", path: resolve(path) }),
     rename: (from, to) => void kernel.call({ op: "rename", path: resolve(from), arg2: resolve(to) }),
     link: (from, to) => void kernel.call({ op: "link", path: resolve(from), arg2: resolve(to) }),
     symlink: (target, path) => void kernel.call({ op: "symlink", path: resolve(path), arg2: target }),
-    readlink: (path) => String(kernel.json({ op: "readlink", path: resolve(path) })),
+    readlink(path) {
+      const abs = resolve(path);
+      if (inDev(abs)) return devSync(kernel, devReadlink(abs));
+      return String(kernel.json({ op: "readlink", path: abs }));
+    },
     readFile(path) {
       const abs = resolve(path);
+      if (inDev(abs)) return readWholeSync(open(abs));
       kernel.call({ op: "fd-path-flush", path: abs });
       return kernel.bytes({ op: "read", path: abs });
     },
@@ -5115,6 +5559,7 @@ var init_js_sync = __esm({
     init_signals();
     init_sync_fs_wire();
     init_sync_sab_bridge();
+    init_js_dev();
     init_js_io();
     init_js_kernel();
     encoder3 = new TextEncoder();
@@ -5515,6 +5960,7 @@ function createContext(o) {
   const writable2 = (fd) => new WritableStream({ write: (chunk) => write2(fd, chunk) });
   const statOf = async (op, path) => {
     const abs = resolve(path);
+    if (inDev(abs)) return devAsync(kernel, devStat(abs, op === "stat"));
     await kernel.call({ op: "fd-path-flush", path: abs });
     const s = parseSyncFsStat(await kernel.json({ op, path: abs }));
     if (!s) throw new JsCallError("EIO", op);
@@ -5522,6 +5968,7 @@ function createContext(o) {
   };
   const open = async (path, options = {}) => {
     const abs = resolve(path);
+    if (inDev(abs)) return openDev(kernel, abs, options, { infos, handles, read: read2, write: writeAll });
     const existing = await statOf(isExclusive(options) ? "lstat" : "stat", abs).catch(absent);
     checkOpen(abs, options, existing);
     const fd = await kernel.json(openRequest(abs, options));
@@ -5541,6 +5988,7 @@ function createContext(o) {
   };
   const fs = pathOps(kernel, resolve, statOf, open);
   const lane = o.lane ?? laneOf(void 0);
+  if (o.lane) kernel.syncLane = o.lane;
   const syncKernel = new JsSyncKernel(lane, kernel, unwind);
   const terminal = ttyOps(kernel);
   const sync = {
@@ -5621,6 +6069,26 @@ function createContext(o) {
   };
   return { ctx, drain: drain2 };
 }
+async function openDev(kernel, abs, options, state) {
+  const { fd, file, ...access } = await devAsync(kernel, devOpen(abs, options));
+  const forget = () => {
+    state.infos.delete(fd);
+    state.handles.delete(fd);
+  };
+  if (file) state.infos.set(fd, { kind: "file" });
+  const close = async (n) => {
+    forget();
+    await kernel.call({ op: "fd-close", fd: n });
+  };
+  const handle = file ? fileHandle(kernel, fd, abs, options.append === true, forget) : streamFile(
+    fd,
+    abs,
+    { read: (n, max) => state.read(n, max), write: state.write, close },
+    access
+  );
+  state.handles.set(fd, handle.invalidate);
+  return handle.file;
+}
 function fileHandle(kernel, fd, path, append, forget) {
   let open = true;
   const live = () => {
@@ -5713,17 +6181,30 @@ function pathOps(kernel, resolve, statOf, open) {
   return {
     stat: (path) => statOf("stat", path),
     lstat: (path) => statOf("lstat", path),
-    exists: async (path) => await kernel.json({ op: "exists", path: resolve(path) }) === true,
-    readdir: async (path) => await kernel.json({ op: "readdir", path: resolve(path) }),
+    async exists(path) {
+      const abs = resolve(path);
+      if (inDev(abs)) return devAsync(kernel, devExists(abs));
+      return await kernel.json({ op: "exists", path: abs }) === true;
+    },
+    async readdir(path) {
+      const abs = resolve(path);
+      if (inDev(abs)) return devAsync(kernel, devReaddir(abs));
+      return await kernel.json({ op: "readdir", path: abs });
+    },
     mkdir: async (path) => void await kernel.call({ op: "mkdir", path: resolve(path) }),
     rm: async (path) => void await kernel.call({ op: "rm", path: resolve(path) }),
     unlink: async (path) => void await kernel.call({ op: "unlink", path: resolve(path) }),
     rename: async (from, to) => void await kernel.call({ op: "rename", path: resolve(from), arg2: resolve(to) }),
     link: async (from, to) => void await kernel.call({ op: "link", path: resolve(from), arg2: resolve(to) }),
     symlink: async (target, path) => void await kernel.call({ op: "symlink", path: resolve(path), arg2: target }),
-    readlink: async (path) => String(await kernel.json({ op: "readlink", path: resolve(path) })),
+    async readlink(path) {
+      const abs = resolve(path);
+      if (inDev(abs)) return devAsync(kernel, devReadlink(abs));
+      return String(await kernel.json({ op: "readlink", path: abs }));
+    },
     async readFile(path) {
       const abs = resolve(path);
+      if (inDev(abs)) return readWhole(await open(abs));
       await kernel.call({ op: "fd-path-flush", path: abs });
       return kernel.bytes({ op: "read", path: abs });
     },
@@ -5744,6 +6225,7 @@ var init_js_context = __esm({
     init_signals();
     init_sync_fs_wire();
     init_js_children();
+    init_js_dev();
     init_js_exit();
     init_js_fetch();
     init_js_io();
@@ -6398,7 +6880,7 @@ function createStreamOps(h) {
       }
     }
   };
-  const opened = (node, on, want = 0) => {
+  const opened2 = (node, on, want = 0) => {
     const s = node.live;
     try {
       const handle = bridgeOf(node).hold?.(liveNodePath(node), on, true, s.handle, want);
@@ -6449,7 +6931,7 @@ function createStreamOps(h) {
         const want = permitted(stream, created);
         live.openCount++;
         counted = true;
-        if (live.openCount === 1) opened(stream.node, true, want);
+        if (live.openCount === 1) opened2(stream.node, true, want);
       } catch (err) {
         if (counted) live.openCount--;
         if (stream.fd !== void 0) Fs.closeStream?.(stream.fd);
@@ -6480,7 +6962,7 @@ function createStreamOps(h) {
         s.len = 0;
         s.loaded = false;
         held(stream, -1);
-        opened(node, false);
+        opened2(node, false);
       }
     },
     read(stream, buffer, offset, length, position) {
@@ -6857,10 +7339,28 @@ function ptyStat(path) {
     ctime: now
   };
 }
+function sealedStat() {
+  const now = /* @__PURE__ */ new Date();
+  return {
+    dev: 22,
+    ino: 1,
+    mode: 8630,
+    nlink: 1,
+    uid: 0,
+    gid: 0,
+    rdev: 10 << 8 | 250,
+    size: 0,
+    blksize: 4096,
+    blocks: 0,
+    atime: now,
+    mtime: now,
+    ctime: now
+  };
+}
 function nonblocking(stream) {
   return (stream.flags & O_NONBLOCK2) !== 0 ? { nonblock: true } : void 0;
 }
-var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK2, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
+var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK2, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, SEALED_PATH2, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
 var init_kernel_streams = __esm({
   "src/process/kernel-streams.ts"() {
     "use strict";
@@ -6877,6 +7377,7 @@ var init_kernel_streams = __esm({
     PTY_PATH = /^\/dev\/(?:ptmx|pts\/(\d+))$/;
     TTY_PATH = /^\/dev\/tty\d+$/;
     TTY_NAME = /^tty\d+$/;
+    SEALED_PATH2 = "/dev/sealed";
     O_CREAT = 64;
     O_EXCL = 128;
     O_NOCTTY = 256;
@@ -6950,6 +7451,15 @@ var init_kernel_streams = __esm({
         if (typeof this.Fs.stat !== "function") return;
         stream.stream_ops = { ...stream.stream_ops, getattr: () => this.Fs.stat?.(name2) ?? {} };
       }
+      listSealed() {
+        const { analyzePath, mkdev, makedev } = this.Fs;
+        if (!this.sys.openSealed || !analyzePath || !mkdev || !makedev) return;
+        if (analyzePath.call(this.Fs, SEALED_PATH2).exists) return;
+        try {
+          mkdev.call(this.Fs, SEALED_PATH2, makedev.call(this.Fs, 10, 250));
+        } catch {
+        }
+      }
       creatingTerminal = false;
       useTerminalNodes() {
         const fs = this.Fs;
@@ -6976,8 +7486,8 @@ var init_kernel_streams = __esm({
         fs.readdir = (path) => {
           const names = readdir.call(fs, path);
           if (path.replace(/\/+$/, "") !== "/dev") return names;
-          const missing = ttyNames().map((tty) => tty.slice("/dev/".length)).filter((name2) => TTY_NAME.test(name2) && !names.includes(name2));
-          return [...names, ...missing];
+          const missing2 = ttyNames().map((tty) => tty.slice("/dev/".length)).filter((name2) => TTY_NAME.test(name2) && !names.includes(name2));
+          return [...names, ...missing2];
         };
       }
       ttyNode(name2) {
@@ -7042,13 +7552,14 @@ var init_kernel_streams = __esm({
         if (typeof this.Fs.open !== "function") return;
         this.usePtyPaths();
         this.useTerminalNodes();
+        this.listSealed();
         const open = this.Fs.open.bind(this.Fs);
         this.Fs.open = (path, flags, mode) => {
           const device2 = typeof path === "string" ? this.devicePath(path) : void 0;
           if (device2 !== void 0 && TTY_PATH.test(device2) && !this.terminalExists(device2)) {
             throw new this.Fs.ErrnoError(wasiErrno("ENOENT"));
           }
-          const pty = this.openPty(open, path, flags, mode);
+          const pty = this.openPty(open, path, flags, mode) ?? this.openSealed(open, path, flags, mode);
           if (pty) return pty;
           this.refuseExclusiveLink(path, flags);
           const stream = this.openRacing(open, path, flags, mode);
@@ -7106,15 +7617,24 @@ var init_kernel_streams = __esm({
         const kfd = this.call(
           () => pts ? openPts(Number(pts[1]), (flags & O_NOCTTY) !== 0) : openPty()
         );
+        return this.vessel(open, kfd, { path, flags, mode }, true);
+      }
+      openSealed(open, path, flags, mode) {
+        const { openSealed } = this.sys;
+        if (path !== SEALED_PATH2 || !openSealed) return void 0;
+        const kfd = this.call(() => openSealed.call(this.sys));
+        return this.vessel(open, kfd, { path, flags, mode }, false);
+      }
+      vessel(open, kfd, at, terminal) {
         let stream;
         try {
-          stream = open("/dev/null", flags & ~(O_CREAT | O_EXCL | O_TRUNC2), mode);
+          stream = open("/dev/null", at.flags & ~(O_CREAT | O_EXCL | O_TRUNC2), at.mode);
         } catch (e) {
           this.sys.close(kfd);
           throw e;
         }
-        this.attach(stream, kfd, true);
-        this.nameStream(stream, path);
+        this.attach(stream, kfd, terminal);
+        this.nameStream(stream, at.path);
         return stream;
       }
       usePtyPaths() {
@@ -7128,6 +7648,7 @@ var init_kernel_streams = __esm({
           const original = fs[name2];
           if (typeof original !== "function") continue;
           fs[name2] = (path, ...rest2) => {
+            if (path === SEALED_PATH2 && this.sys.openSealed) return sealedStat();
             const owned = this.ownedTty(path);
             if (owned && isPtyPath(path)) return this.owned(path, ptyStat(path));
             if (!isPtyPath(path)) {
@@ -7744,13 +8265,13 @@ function describeFdDir(Fs) {
     return;
   }
   const ops = dir?.node_ops;
-  const lookup = ops?.lookup;
-  if (!dir || !lookup || ops.getattr) return;
+  const lookup2 = ops?.lookup;
+  if (!dir || !lookup2 || ops.getattr) return;
   dir.node_ops = {
     ...ops,
     getattr: () => syntheticAttr(DIR_MODE, 1),
     lookup: (parent, name2) => {
-      const entry = lookup(parent, name2);
+      const entry = lookup2(parent, name2);
       entry.node_ops = {
         ...entry.node_ops,
         getattr: () => syntheticAttr(LINK_MODE, entry.id ?? 0)
@@ -8290,7 +8811,7 @@ function createProcessKernel(deps) {
     if (!stream) return { none: true };
     promote?.(stream);
     if (stream.sliccKernelFd !== void 0) return { fd: stream.sliccKernelFd };
-    if (((stream.node?.mode ?? 0) & S_IFMT) === S_IFDIR2 && stream.path) return { dir: stream.path };
+    if (((stream.node?.mode ?? 0) & S_IFMT2) === S_IFDIR2 && stream.path) return { dir: stream.path };
     const device2 = deviceOfStream(stream);
     if (device2) return device2;
     return n === 0 ? { input: drain(Fs, stream) } : { capture: true };
@@ -8437,13 +8958,13 @@ function createProcessKernel(deps) {
     }
   };
 }
-var S_IFMT, S_IFDIR2, POLLIN2, POLLOUT2, POLLERR2, POLLHUP2, POLLNVAL, SELECT_SLICE_MS, WUNTRACED, WCONTINUED;
+var S_IFMT2, S_IFDIR2, POLLIN2, POLLOUT2, POLLERR2, POLLHUP2, POLLNVAL, SELECT_SLICE_MS, WUNTRACED, WCONTINUED;
 var init_process_children = __esm({
   "src/process/process-children.ts"() {
     "use strict";
     init_process_fork();
     init_wasi_errno();
-    S_IFMT = 61440;
+    S_IFMT2 = 61440;
     S_IFDIR2 = 16384;
     POLLIN2 = 1;
     POLLOUT2 = 4;
@@ -9018,7 +9539,7 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
     return found;
   };
   const procOps = proc.node_ops;
-  const lookup = procOps.lookup?.bind(procOps);
+  const lookup2 = procOps.lookup?.bind(procOps);
   const readdir = procOps.readdir?.bind(procOps);
   const listAll = (node) => {
     const names = new Set(readdir ? readdir(node) : [".", ".."]);
@@ -9041,8 +9562,8 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
           () => systemFile(name2, procList(), Date.now(), memory)
         );
       }
-      if (!lookup) throw error();
-      return lookup(parent, name2);
+      if (!lookup2) throw error();
+      return lookup2(parent, name2);
     },
     readdir: (node) => listAll(node)
   };
@@ -9255,6 +9776,9 @@ function kernelSys(transport) {
     openPts(n, noctty) {
       return json2(call2({ op: "pty-slave-open", n, noctty }, `pty-slave-open ${n}`));
     },
+    openSealed() {
+      return json2(call2({ op: "fd-open-sealed" }, "fd-open-sealed"));
+    },
     ptyNumbers() {
       return json2(call2({ op: "pty-list" }, "pty-list"));
     },
@@ -11774,8 +12298,8 @@ var init_wasix_host = __esm({
             mem.view().setUint16(out, host.fds.cloexec.has(fd) ? FDFLAGSEXT_CLOEXEC : 0, true);
           },
           fd_fdflags_set: (fd, flags) => void host.fds.setCloexec(fd, (flags & FDFLAGSEXT_CLOEXEC) !== 0),
-          path_open2: (dirfd, lookup, p, l, oflags, rights, inheriting, fdflags, fdflagsext, out) => {
-            const r = preview1.path_open(dirfd, lookup, p, l, oflags, rights, inheriting, fdflags, out);
+          path_open2: (dirfd, lookup2, p, l, oflags, rights, inheriting, fdflags, fdflagsext, out) => {
+            const r = preview1.path_open(dirfd, lookup2, p, l, oflags, rights, inheriting, fdflags, out);
             if (r === E.SUCCESS && fdflagsext & FDFLAGSEXT_CLOEXEC)
               host.fds.setCloexec(mem.view().getUint32(out, true), true);
             return r;