@ai-ecoverse/slicc-kernel 1.69.0 → 1.71.0

package/dist/node.js

@@ -2490,22 +2490,22 @@ function act(session, req, signal) {
 }
 async function realpath(fs, path) {
   let parts2 = fs.resolvePath("/", path).split("/").filter(Boolean);
-  let resolved = "";
+  let resolved2 = "";
   for (let hops = 0; parts2.length > 0; ) {
     const [name2, ...rest2] = parts2;
-    const next2 = `${resolved}/${name2}`;
+    const next2 = `${resolved2}/${name2}`;
     if (!(await fs.lstat(next2)).isSymbolicLink) {
-      resolved = next2;
+      resolved2 = next2;
       parts2 = rest2;
       continue;
     }
     if (++hops > MAX_LINKS3) throw fsError("ELOOP", path);
     const target = await fs.readlink(next2);
-    const base = target.startsWith("/") ? "/" : resolved || "/";
+    const base = target.startsWith("/") ? "/" : resolved2 || "/";
     parts2 = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest2];
-    resolved = "";
+    resolved2 = "";
   }
-  return resolved || "/";
+  return resolved2 || "/";
 }
 var CLIENT_CHECKS = {
   readFile: (g, at) => readable(g, "read", at(0)),
@@ -2810,7 +2810,7 @@ function serveClient(port, host) {
         if (!FS_METHODS.includes(req.method)) {
           throw new Error(`unknown file system call ${req.method}`);
         }
-        return fsCall(l.fs, req.method, req.args, ownerFor(l, self), guardFor(l, self));
+        return fsCall(l.processFs, req.method, req.args, ownerFor(l, self), guardFor(l, self));
       case "watch":
       case "unwatch":
         return watchOp(l, req, watches, send, guardFor(l, self));
@@ -2997,6 +2997,183 @@ var MemoryMeta = class {
   }
 };
 
+// src/fs/protect.ts
+var PROTECT_WRITER = "slicc-kernel: protect.writer needs the process tag (#405), which this kernel does not have yet";
+function protectedPrefixes(paths) {
+  return [...new Set(paths.map((p) => normalizePath(p)))];
+}
+function within(path, prefix) {
+  return prefix === "/" || path === prefix || path.startsWith(`${prefix}/`);
+}
+function isProtected(prefixes2, path) {
+  return prefixes2.some((prefix) => within(path, prefix));
+}
+function holdsProtected(prefixes2, path) {
+  return prefixes2.some((prefix) => within(prefix, path));
+}
+var MAX_LINKS4 = 40;
+function partsOf(path) {
+  return path.split("/").filter((p) => p !== "" && p !== ".");
+}
+function missing(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+async function resolved(fs, path, follow2) {
+  let done4 = [];
+  let todo = partsOf(path);
+  for (let hops = 0; todo.length > 0; ) {
+    const part = todo.shift();
+    if (part === "..") {
+      done4.pop();
+      continue;
+    }
+    if (todo.length === 0 && !follow2) {
+      done4.push(part);
+      break;
+    }
+    const at = `/${[...done4, part].join("/")}`;
+    const st = await fs.lstat(at).catch((err) => {
+      if (missing(err)) return void 0;
+      throw err;
+    });
+    if (!st) {
+      return normalizePath([...done4, part, ...todo].join("/"));
+    }
+    if (!st.isSymbolicLink) {
+      done4.push(part);
+      continue;
+    }
+    if (++hops > MAX_LINKS4) throw fsError("ELOOP", path);
+    const link2 = await fs.readlink(at);
+    if (link2.startsWith("/")) done4 = [];
+    todo = [...partsOf(link2), ...todo];
+  }
+  return `/${done4.join("/")}`;
+}
+var ProtectedFs = class {
+  prefixes;
+  constructor(prefixes2) {
+    this.prefixes = prefixes2;
+  }
+  async check(fs, path, follow2, whole = false) {
+    const lexical2 = normalizePath(path);
+    const real = await resolved(fs, lexical2, follow2);
+    for (const p of /* @__PURE__ */ new Set([lexical2, real])) {
+      if (isProtected(this.prefixes, p) || whole && holdsProtected(this.prefixes, p)) {
+        throw fsError("EROFS", path);
+      }
+    }
+  }
+  view(fs) {
+    const check = (path, follow2, whole = false) => this.check(fs, path, follow2, whole);
+    const marked = (path, st) => !st.readonly && isProtected(this.prefixes, normalizePath(path)) ? { ...st, readonly: true } : st;
+    const own = {
+      async writeFile(...args) {
+        await check(args[0], true);
+        return fs.writeFile(...args);
+      },
+      async mkdir(...args) {
+        await check(args[0], false);
+        return fs.mkdir(...args);
+      },
+      async rm(...args) {
+        await check(args[0], false, true);
+        return fs.rm(...args);
+      },
+      async rename(from, to) {
+        await check(from, false, true);
+        await check(to, false, true);
+        return fs.rename(from, to);
+      },
+      async link(from, to, follow2) {
+        await check(from, follow2 === true);
+        await check(to, false);
+        return fs.link(from, to, follow2);
+      },
+      async symlink(...args) {
+        await check(args[1], false);
+        return fs.symlink(...args);
+      },
+      async chmod(path, mode) {
+        await check(path, true);
+        return fs.chmod(path, mode);
+      },
+      async utimes(path, atime, mtime) {
+        await check(path, true);
+        return fs.utimes(path, atime, mtime);
+      },
+      async stat(path) {
+        return marked(path, await fs.stat(path));
+      },
+      async lstat(path) {
+        return marked(path, await fs.lstat(path));
+      },
+      async readdirStat(path) {
+        const dir = normalizePath(path);
+        return (await fs.readdirStat(path)).map(([name2, st]) => [
+          name2,
+          st && marked(`${dir}/${name2}`, st)
+        ]);
+      },
+      ...fs.createExclusive ? {
+        async createExclusive(...args) {
+          await check(args[0], true);
+          return fs.createExclusive?.(...args);
+        }
+      } : {},
+      ...fs.chown ? {
+        async chown(...args) {
+          await check(args[0], args[1].follow !== false);
+          return fs.chown?.(...args);
+        }
+      } : {},
+      ...fs.lutimes ? {
+        async lutimes(path, atime, mtime) {
+          await check(path, false);
+          return fs.lutimes?.(path, atime, mtime);
+        }
+      } : {},
+      ...fs.pwrite ? {
+        async pwrite(...args) {
+          await check(args[0], true);
+          return fs.pwrite?.(...args);
+        }
+      } : {},
+      ...fs.truncate ? {
+        async truncate(path, size) {
+          await check(path, true);
+          return fs.truncate?.(path, size);
+        }
+      } : {},
+      ...fs.exclusive ? {
+        async exclusive(path, run2, follow2) {
+          return fs.exclusive(
+            path,
+            (held) => run2({
+              ...held,
+              writeFile: async (...args) => {
+                await check(args[0], true);
+                return held.writeFile(...args);
+              }
+            }),
+            follow2
+          );
+        }
+      } : {}
+    };
+    const view = {};
+    for (let at = fs; at && at !== Object.prototype; at = Object.getPrototypeOf(at)) {
+      for (const name2 of Object.getOwnPropertyNames(at)) {
+        if (name2 === "constructor" || Object.hasOwn(view, name2)) continue;
+        const value = fs[name2];
+        view[name2] = typeof value === "function" ? value.bind(fs) : value;
+      }
+    }
+    return Object.assign(view, own);
+  }
+};
+
 // src/fs/opfs.ts
 var S_IFDIR = 16384;
 var S_IFREG = 32768;
@@ -3004,7 +3181,7 @@ var S_IFLNK = 40960;
 var PERM_MASK = 4095;
 var S_ISGID3 = 1024;
 var READ_ATTEMPTS = 3;
-var MAX_LINKS4 = 40;
+var MAX_LINKS5 = 40;
 var CHECK_MS = 1e3;
 var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
 var ERRNO_BY_DOM_ERROR = {
@@ -3041,7 +3218,7 @@ function sidecar(meta) {
   });
   return Object.fromEntries(META_OPS.map((op) => [op, guarded2(op)]));
 }
-function missing(err) {
+function missing2(err) {
   const code = err?.code;
   return code === "ENOENT" || code === "ENOTDIR";
 }
@@ -3058,7 +3235,7 @@ function prefixes(path) {
   const parts2 = split(path);
   return parts2.map((_, i) => `/${parts2.slice(0, i + 1).join("/")}`);
 }
-function within(path, root) {
+function within2(path, root) {
   return path === root || path.startsWith(`${root}/`);
 }
 var LOCKED = /* @__PURE__ */ new Set(["NotReadableError", "NoModificationAllowedError", "InvalidStateError"]);
@@ -3193,14 +3370,25 @@ var OpfsFs = class {
     const fields = await this.newFields(path, owner, directory);
     if (fields) await this.meta.update(path, (entry) => ({ ...entry, path, ...fields }));
   }
+  guarded = [];
+  protect(prefixes2) {
+    this.guarded = prefixes2;
+  }
+  refuse(path, holding = false) {
+    if (isProtected(this.guarded, path) || holding && holdsProtected(this.guarded, path)) {
+      throw fsError("EROFS", path);
+    }
+  }
   async chown(path, change) {
     if (!this.owners) return;
     if (change.kind === "new") {
       const at = resolvePath((await this.locate(parentOf4(path), true)).path, baseOf(path));
+      this.refuse(at);
       const { uid = 0, gid = 0, mode } = change;
       return this.stampNew(at, { uid, gid, ...mode !== void 0 ? { mode } : {} }, false);
     }
     const found = await this.locate(path, change.follow !== false);
+    this.refuse(found.path);
     const [stored] = found.link ? [found.link] : await this.meta.get([found.path]);
     const current = await this.ownerAt(found.path, stored);
     const next2 = { uid: change.uid ?? current.uid, gid: change.gid ?? current.gid };
@@ -3313,11 +3501,11 @@ var OpfsFs = class {
   }
   async locate(path, follow2) {
     let current = path;
-    for (let hops = 0; hops <= MAX_LINKS4; hops++) {
+    for (let hops = 0; hops <= MAX_LINKS5; hops++) {
       try {
         return { path: current, handle: await this.handle(current) };
       } catch (err) {
-        if (!missing(err)) throw err;
+        if (!missing2(err)) throw err;
         const link2 = await this.linkAlong(current);
         if (!link2) throw err;
         if (link2.path === current && !follow2) return { path: current, link: link2 };
@@ -3339,7 +3527,7 @@ var OpfsFs = class {
         const st = await this.lstat(at);
         if (!st.isSymbolicLink && !st.isDirectory) throw fsError("ENOTDIR", at);
         if (!st.isSymbolicLink) done4.push(part);
-        else if (++hops > MAX_LINKS4) throw fsError("ELOOP", path);
+        else if (++hops > MAX_LINKS5) throw fsError("ELOOP", path);
         else {
           const link2 = await this.readlink(at);
           if (link2.startsWith("/")) done4 = [];
@@ -3436,7 +3624,7 @@ var OpfsFs = class {
     return this.locate(path, true).then(
       () => true,
       (err) => {
-        if (missing(err)) return false;
+        if (missing2(err)) return false;
         throw err;
       }
     );
@@ -3454,8 +3642,10 @@ var OpfsFs = class {
       }
     }
   }
-  async existing(path) {
-    const handle = (await this.locate(path, true)).handle;
+  async existing(path, writing = false) {
+    const found = await this.locate(path, true);
+    if (writing) this.refuse(found.path);
+    const handle = found.handle;
     if (handle.kind === "directory") throw fsError("EISDIR", path);
     return handle;
   }
@@ -3480,7 +3670,7 @@ var OpfsFs = class {
     await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
   }
   async truncate(path, size) {
-    const handle = await this.existing(path);
+    const handle = await this.existing(path, true);
     await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
   }
   async writeSession(path, truncate) {
@@ -3506,10 +3696,15 @@ var OpfsFs = class {
     return new TextDecoder().decode(await this.readFileBuffer(path));
   }
   async writeTarget(path) {
+    const [target, existed] = await this.locateWrite(path);
+    this.refuse(target);
+    return [target, existed];
+  }
+  async locateWrite(path) {
     try {
       return [(await this.locate(path, true)).path, true];
     } catch (err) {
-      if (!missing(err)) throw err;
+      if (!missing2(err)) throw err;
     }
     const [entry] = await this.meta.get([path]);
     const wanted = entry?.link === void 0 ? path : resolvePath(parentOf4(path), entry.link);
@@ -3578,7 +3773,7 @@ var OpfsFs = class {
     try {
       found = await this.locate(path, true);
     } catch (err) {
-      if (!missing(err)) throw err;
+      if (!missing2(err)) throw err;
     }
     if (found) {
       const directory = found.handle?.kind === "directory";
@@ -3599,6 +3794,7 @@ var OpfsFs = class {
     }
     const parent = await this.locate(parentOf4(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
+    this.refuse(resolvePath(parent.path, baseOf(path)));
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
     const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
     await this.stampNew(made2, owner, true);
@@ -3613,6 +3809,7 @@ var OpfsFs = class {
       if (options.force && error.code === "ENOENT") return;
       throw error;
     }
+    this.refuse(found.path, true);
     if (found.handle) {
       const [dir, name2] = await this.parent(found.path);
       try {
@@ -3637,13 +3834,15 @@ var OpfsFs = class {
   async rename(from, to) {
     if (from === to) return;
     const source = await this.locate(from, false);
+    this.refuse(source.path, true);
     this.forget(source.path);
     const parent = await this.locate(parentOf4(to), true);
     const destination = resolvePath(parent.path, baseOf(to));
+    this.refuse(destination, true);
     const sourceStat = await this.describe(source);
-    if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
+    if (sourceStat.isDirectory && within2(destination, source.path)) throw fsError("EINVAL", to);
     const target = await this.locate(destination, false).catch((err) => {
-      if (missing(err)) return null;
+      if (missing2(err)) return null;
       throw err;
     });
     const targetStat = target && await this.describe(target);
@@ -3737,9 +3936,10 @@ var OpfsFs = class {
     const parent = await this.locate(parentOf4(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const at = resolvePath(parent.path, baseOf(path));
+    this.refuse(at);
     if (await this.locate(at, false).then(
       () => true,
-      (err) => !missing(err)
+      (err) => !missing2(err)
     )) {
       throw fsError("EEXIST", path);
     }
@@ -3766,6 +3966,7 @@ var OpfsFs = class {
   }
   async chmod(path, mode) {
     const found = await this.locate(path, true);
+    this.refuse(found.path);
     const ctimeMs = Date.now();
     await this.meta.update(found.path, (entry) => ({
       ...entry,
@@ -3781,6 +3982,7 @@ var OpfsFs = class {
     await this.setTimes(await this.locate(path, false), atime, mtime);
   }
   async setTimes(found, atime, mtime) {
+    this.refuse(found.path);
     const { link: link2 } = found;
     if (link2) {
       const ctimeMs2 = Date.now();
@@ -3880,7 +4082,7 @@ function pidOwner(proc) {
 function webLocks() {
   return globalThis.navigator?.locks;
 }
-var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var lockName = (instance) => `slicc-unlinked:${instance}`;
 var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
@@ -3980,7 +4182,7 @@ var UnlinkedKeeper = class {
     for (const holder of this.holders) {
       if (holder.owns(target)) continue;
       for (const path of holder.held()) {
-        if (!within2(path, target) || holder.isKept(path)) continue;
+        if (!within3(path, target) || holder.isKept(path)) continue;
         held.set(path, [...held.get(path) ?? [], holder]);
       }
     }
@@ -5068,8 +5270,8 @@ function binfmtOf(binfmts, path) {
 var S_IFDIR2 = 16384;
 var S_IFREG2 = 32768;
 var COMMAND = /^\/(?:usr\/)?bin\/([^/]+)$/;
-var MAX_LINKS5 = 40;
-function missing2(err) {
+var MAX_LINKS6 = 40;
+function missing3(err) {
   return err?.code === "ENOENT";
 }
 function synthetic(directory, path) {
@@ -5088,7 +5290,7 @@ function synthetic(directory, path) {
 }
 async function followLinks(fs, path) {
   let current = path;
-  for (let hops = 0; hops < MAX_LINKS5; hops++) {
+  for (let hops = 0; hops < MAX_LINKS6; hops++) {
     const st = await fs.lstat(current).catch(() => void 0);
     if (!st?.isSymbolicLink) return current;
     const parent = current.slice(0, current.lastIndexOf("/")) || "/";
@@ -5135,7 +5337,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     try {
       return await real(path);
     } catch (err) {
-      const found = missing2(err) ? await linked(path) : void 0;
+      const found = missing3(err) ? await linked(path) : void 0;
       if (found) return found;
       throw err;
     }
@@ -5147,7 +5349,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       try {
         return await fs.readFileBuffer(path);
       } catch (err) {
-        if (missing2(err) && (await linked(path))?.isFile) return new Uint8Array(0);
+        if (missing3(err) && (await linked(path))?.isFile) return new Uint8Array(0);
         throw err;
       }
     },
@@ -5163,7 +5365,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       const extra = await children2(path);
       if (!extra) return fs.readdir(path);
       const real = await fs.readdir(path).catch((err) => {
-        if (missing2(err)) return [];
+        if (missing3(err)) return [];
         throw err;
       });
       return [.../* @__PURE__ */ new Set([...real, ...extra])].sort();
@@ -5172,7 +5374,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       const extra = await children2(path);
       if (!extra) return fs.readdirStat(path);
       const real = await fs.readdirStat(path).catch((err) => {
-        if (missing2(err)) return [];
+        if (missing3(err)) return [];
         throw err;
       });
       const seen = new Set(real.map(([name2]) => name2));
@@ -5387,6 +5589,18 @@ function capturing(chunks2, max = Number.POSITIVE_INFINITY, overflow) {
     size += bytes.length;
   };
 }
+function captureFile(onData, control) {
+  if (!control) return sinkFile(onData);
+  control.opened = true;
+  return new OpenFile({
+    write: async (bytes) => {
+      if (control.shut) throw new KernelError("EPIPE");
+      onData(bytes.slice());
+      return bytes.length;
+    },
+    close: () => control.ended()
+  });
+}
 function concat2(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let offset = 0;
@@ -5421,7 +5635,12 @@ var ChildTable = class {
     const fds = new FdTable();
     const captured = /* @__PURE__ */ new Map();
     try {
-      for (const [n, slot2] of stdio.entries()) fds.installAt(n, this.openSlot(slot2, n, captured));
+      for (const [n, slot2] of stdio.entries()) {
+        fds.installAt(
+          n,
+          "sameAs" in slot2 ? fds.get(slot2.sameAs).retain() : this.openSlot(slot2, n, captured)
+        );
+      }
       for (const slot2 of inherit2) {
         if (slot2.fd <= 2) continue;
         if ("device" in slot2) {
@@ -5478,7 +5697,7 @@ var ChildTable = class {
     if ("capture" in slot2) {
       const chunks2 = [];
       captured.set(n, chunks2);
-      return sinkFile(capturing(chunks2, slot2.max, slot2.overflow));
+      return captureFile(capturing(chunks2, slot2.max, slot2.overflow), slot2.control);
     }
     return deviceFile("null");
   }
@@ -5671,7 +5890,7 @@ function checkIds(options) {
     if (!ID.test(value) || Number(value) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value}`);
   }
 }
-var MAX_LINKS6 = 40;
+var MAX_LINKS7 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
 var DEFAULT_IO = 8 * 1024 * 1024;
@@ -5681,7 +5900,7 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -5700,7 +5919,7 @@ var HeldSet = class extends Set {
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within3(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within4(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
@@ -5811,24 +6030,24 @@ var HeldPaths = class extends Map {
     return this.owning === path;
   }
   revoke(prefix) {
-    for (const path of this.keys()) if (within3(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within4(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count] of [...this]) {
-      if (!within3(path, from)) continue;
+      if (!within4(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
     for (const [path, count] of [...this.opens]) {
-      if (!within3(path, from)) continue;
+      if (!within4(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.opens.delete(path);
       this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
     }
     for (const [id2, key] of this.handles) {
-      if (within3(key, from)) this.handles.set(id2, to + key.slice(from.length));
+      if (within4(key, from)) this.handles.set(id2, to + key.slice(from.length));
     }
   }
   isRevoked(path) {
@@ -5935,7 +6154,7 @@ var MountTable = class {
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within3(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within4(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -6078,7 +6297,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within3(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within4(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -6113,10 +6332,10 @@ var MountTable = class {
   }
   forget(mount, path) {
     mount.epoch++;
-    for (const key of [...mount.attrs.keys()]) if (within3(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within4(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
     mount.lists.delete(parentOf7(path));
-    for (const key of [...mount.lists.keys()]) if (within3(key, path)) mount.lists.delete(key);
+    for (const key of [...mount.lists.keys()]) if (within4(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2, settled = false) {
     for (let round = 1; ; round++) {
@@ -6189,7 +6408,7 @@ var MountFs = class {
       throw err;
     }
     if (attr2.kind !== "symlink") return real;
-    if (hops >= MAX_LINKS6) throw errnoError("ELOOP", path);
+    if (hops >= MAX_LINKS7) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
     return this.follow(this.base.resolvePath(parentOf7(real), target), hops + 1, create);
   }
@@ -8834,11 +9053,11 @@ function ipv6(host) {
   const back = halves.length === 2 ? groups(halves[1]) : [];
   if (![...head, ...back].every((g) => /^[0-9A-Fa-f]{1,4}$/.test(g))) return void 0;
   const words2 = [...head, ...back].map((g) => Number.parseInt(g, 16));
-  const missing3 = 8 - words2.length - tail.length;
-  if (halves.length === 2 ? missing3 < 1 : missing3 !== 0) return void 0;
+  const missing4 = 8 - words2.length - tail.length;
+  if (halves.length === 2 ? missing4 < 1 : missing4 !== 0) return void 0;
   const all = [
     ...head.map((g) => Number.parseInt(g, 16)),
-    ...new Array(halves.length === 2 ? missing3 : 0).fill(0),
+    ...new Array(halves.length === 2 ? missing4 : 0).fill(0),
     ...back.map((g) => Number.parseInt(g, 16)),
     ...tail
   ];
@@ -9682,7 +9901,7 @@ function parsePrefix(text) {
   if (length2 < 0 || length2 > max) return void 0;
   return { ...parsed2, length: length2 };
 }
-function within4(prefix, addr) {
+function within5(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
   const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
   return addr.bits >> shift === prefix.bits >> shift;
@@ -9722,9 +9941,9 @@ var Routes = class {
     if (!addr) return "unreachable";
     if (addr.v6 && addr.bits === 1n) return "loopback";
     if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within4(p, addr))) return "reserved";
+    if (RESERVED.some((p) => within5(p, addr))) return "reserved";
     if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within4(p, addr))) return "uplink";
+    if (this.exit || this.table.some((p) => within5(p, addr))) return "uplink";
     return "unreachable";
   }
 };
@@ -10333,9 +10552,11 @@ function capLimit(maxBuffer) {
   return Math.min(asked, RUN_CAPTURE_CAP);
 }
 function slot(how, n, extra) {
+  if (how === "stdout") return { sameAs: 1 };
+  if (typeof how === "number") return { fd: how };
   if (how === "inherit") return { fd: n };
   if (how === "ignore") return { none: true };
-  return extra;
+  return extra();
 }
 function frame2(outcome, out, err) {
   const head = new TextEncoder().encode(JSON.stringify(outcome));
@@ -10365,12 +10586,20 @@ async function runChild(req, deps) {
     if (failure !== void 0) return;
     failure = code;
     if (pid !== 0) kill();
+    decided.resolve();
+  };
+  const controls = [];
+  const capture = () => {
+    const { promise, resolve } = Promise.withResolvers();
+    const control = { shut: false, ended: resolve, eof: promise };
+    controls.push(control);
+    return { capture: true, max, overflow: () => stop("ENOBUFS"), control };
   };
-  const capture = () => ({ capture: true, max, overflow: () => stop("ENOBUFS") });
+  const decided = Promise.withResolvers();
   const stdio = [
-    slot(req.stdin, 0, { input: req.input ?? new Uint8Array(0) }),
-    slot(req.stdout, 1, capture()),
-    slot(req.stderr, 2, capture())
+    slot(req.stdin, 0, () => ({ input: req.input ?? new Uint8Array(0) })),
+    slot(req.stdout, 1, capture),
+    slot(req.stderr, 2, capture)
   ];
   try {
     pid = await deps.children.spawn(
@@ -10387,8 +10616,11 @@ async function runChild(req, deps) {
   let status;
   try {
     status = await reaped(deps, pid);
+    const open = controls.filter((c) => c.opened);
+    await Promise.race([Promise.all(open.map((c) => c.eof)), decided.promise]);
   } finally {
     clearTimeout(timer);
+    for (const control of controls) control.shut = true;
   }
   const out = deps.children.captured(pid, 1);
   const err = deps.children.captured(pid, 2);
@@ -10558,7 +10790,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within5(path, root) {
+function within6(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -10879,12 +11111,12 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within5(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within6(path, prefix)) return true;
     return false;
   }
   writes(prefix) {
     for (const [path, node] of this.byPath)
-      if (node.writers > 0 && within5(path, prefix)) return true;
+      if (node.writers > 0 && within6(path, prefix)) return true;
     return false;
   }
   closed(node, writable2 = false) {
@@ -10928,11 +11160,11 @@ var VfsNodes = class {
     this.kept.delete(node);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within5(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within6(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within5(held, path)) continue;
+      if (!within6(held, path)) continue;
       await node.serial(async () => {
         await Promise.all([this.keepsOnDisk || node.keep(), node.limit()]);
       });
@@ -10940,14 +11172,14 @@ var VfsNodes = class {
   }
   revoke(prefix) {
     for (const [path, node] of [...this.byPath]) {
-      if (!within5(path, prefix)) continue;
+      if (!within6(path, prefix)) continue;
       node.revoke();
       this.forget(node);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within5(held, path) || this.byPath.get(held) !== node) continue;
+      if (!within6(held, path) || this.byPath.get(held) !== node) continue;
       if (!this.dropName(held, node)) this.orphan(node);
     }
   }
@@ -10955,8 +11187,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of [...this.byPath]) {
-      if (within5(p, from)) moved2.push([p, node]);
-      else if (within5(p, to) && this.byPath.get(p) === node && !this.dropName(p, node)) {
+      if (within6(p, from)) moved2.push([p, node]);
+      else if (within6(p, to) && this.byPath.get(p) === node && !this.dropName(p, node)) {
         this.orphan(node);
       }
     }
@@ -11502,6 +11734,7 @@ var WasmProcess = class {
         this.fds.installAt(fd, await this.procFile(req, path));
         return fd;
       }
+      if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open = { ...req, path };
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner());
@@ -11547,6 +11780,9 @@ var WasmProcess = class {
     };
     return fs.exclusive ? fs.exclusive(first.path, look) : look();
   }
+  writesAt(req) {
+    return (req.flags & WRITE_ACCESS) !== 0 || req.truncate === true || req.create === true || req.exclusive === true;
+  }
   async mayOpen(req) {
     const { guard: guard2 } = this.options;
     const inherited2 = req.orphan || req.contents !== void 0 || req.handle !== void 0;
@@ -12328,6 +12564,7 @@ function processOptions(opts, header4, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
+    ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
@@ -15157,13 +15394,13 @@ function interpreter(head) {
 function expandDefaults(defaults, env) {
   const out = {};
   for (const [key, value] of Object.entries(defaults ?? {})) {
-    let missing3 = false;
+    let missing4 = false;
     const expanded = value.replace(ENV_REFERENCE, (_, name2) => {
       const set2 = Object.hasOwn(env, name2) ? env[name2] : void 0;
-      if (set2 === void 0) missing3 = true;
+      if (set2 === void 0) missing4 = true;
       return set2 ?? "";
     });
-    if (!missing3) out[key] = expanded;
+    if (!missing4) out[key] = expanded;
   }
   return out;
 }
@@ -15210,6 +15447,8 @@ function concat5(chunks2) {
 }
 var Launcher = class {
   fs;
+  processFs;
+  prefixes;
   base;
   createWorker;
   modulesDir;
@@ -15336,6 +15575,10 @@ var Launcher = class {
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
+    if (options.protect?.writer) throw new Error(PROTECT_WRITER);
+    this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
+    this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
+    options.fs.protect?.(this.prefixes);
     this.users = new UserDb(this.fs, this.owners);
     this.sudoer = new Sudo({
       fs: this.fs,
@@ -15686,7 +15929,8 @@ var Launcher = class {
       env: req.env,
       cwd: req.cwd,
       fds: req.fds,
-      fs: this.fs,
+      fs: this.processFs,
+      ...this.prefixes.length > 0 ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
       createWorker: this.createWorker,
       onError: req.report,
       spawner: this.spawner(pid, req.report),
@@ -15971,6 +16215,18 @@ var Launcher = class {
     const keyed = () => this.jobs.fromKeyboard(send);
     this.settling.deliver(sig, pgid, keyed, tty.reading ? void 0 : foreground);
   }
+  async resolvePrefixes() {
+    for (const prefix of [...this.prefixes]) {
+      const real = await this.base.realpath?.(prefix, true).catch(() => void 0);
+      if (real !== void 0 && !this.prefixes.includes(real)) this.prefixes.push(real);
+    }
+  }
+  guardMount(target) {
+    const at = normalizePath(target);
+    if (isProtected(this.prefixes, at) || holdsProtected(this.prefixes, at)) {
+      throw fsError("EROFS", at);
+    }
+  }
   umaskOf(pid) {
     return this.processes.get(pid)?.umask?.() ?? DEFAULT_UMASK;
   }
@@ -16105,6 +16361,7 @@ var Launcher = class {
     };
   }
   async mount(spec) {
+    this.guardMount(spec.target);
     const fsa = spec.type === "fsa" && !spec.source.startsWith("fsa:");
     const entry = await this.mounts.mount(
       fsa ? { ...spec, source: `fsa:${crypto.randomUUID()}` } : spec,
@@ -16123,6 +16380,7 @@ var Launcher = class {
       [`/${UNLINKED_DIR}`, 448]
     ];
     for (const [path, mode] of layout) {
+      if (isProtected(this.prefixes, normalizePath(path))) continue;
       const real = await this.realLayoutPath(path);
       const fresh2 = real !== void 0 && !await this.base.hasOwner?.(real);
       if (fresh2) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
@@ -16185,6 +16443,7 @@ var Launcher = class {
   }
   async processMount(pid, call, signal) {
     const spec = mountCall(call);
+    this.guardMount(spec.target);
     await this.permit({ op: "mount", pid, ...spec, options: { ...spec.options } });
     await this.mountsOwn(
       this.credOf(pid),
@@ -16201,6 +16460,7 @@ var Launcher = class {
   }
   async umountAs(cred, target) {
     const at = normalizePath(target);
+    this.guardMount(at);
     await this.mountsOwn(cred, at, async () => Number(this.mounts.mounted(at)?.options.uid));
     this.umount(at);
   }
@@ -16214,6 +16474,7 @@ var Launcher = class {
   async processUmount(pid, target, flags2) {
     const call = umountCall(target, flags2);
     let mounted;
+    this.guardMount(call.target);
     for (; ; ) {
       mounted = this.mounts.mounted(call.target);
       await this.permit({
@@ -16228,6 +16489,7 @@ var Launcher = class {
     this.umount(call.target, call.detach);
   }
   async prepare() {
+    await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     if (this.owners) await this.base.chmod("/tmp", 1023);
     await this.provisionPnpmHome();
@@ -16284,7 +16546,7 @@ var Launcher = class {
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
-    await this.base.mkdir(cwd, { recursive: true });
+    if (!await this.base.exists(cwd)) await this.processFs.mkdir(cwd, { recursive: true });
     const planned = await this.plan(file, argv, cwd, scope);
     await this.mayExec(credOf(account), { file, cwd, pid: 0 }, planned);
     return { cwd, file, planned };
@@ -17524,6 +17786,7 @@ async function createNodeKernel(options = {}) {
     ...options.hostname !== void 0 ? { hostname: options.hostname } : {},
     ...options.users !== void 0 ? { users: options.users } : {},
     ...options.onDenial ? { onDenial: options.onDenial } : {},
+    ...options.protect ? { protect: options.protect } : {},
     ...options.sealed ? { sealed: options.sealed } : {},
     ...options.approve ? { approve: options.approve } : {}
   });