@ai-ecoverse/slicc-kernel 1.70.0 → 1.71.1

package/dist/kernel-worker.js

@@ -162,12 +162,12 @@ var IndexedDbMeta = class {
     return [transaction, transaction.objectStore(META_STORE)];
   }
   async get(paths) {
-    const missing3 = paths.filter((path) => !this.cache.has(path));
-    if (missing3.length > 0) {
+    const missing4 = paths.filter((path) => !this.cache.has(path));
+    if (missing4.length > 0) {
       const generation = this.generation;
       const [transaction, store] = this.transaction("readonly");
       const found = /* @__PURE__ */ new Map();
-      for (const path of missing3) {
+      for (const path of missing4) {
         const request2 = store.get(path);
         request2.onsuccess = () => void found.set(path, request2.result ?? null);
       }
@@ -353,6 +353,183 @@ async function chownAs(fs, cred, path, change) {
   });
 }
 
+// src/fs/protect.ts
+var PROTECT_WRITER = "slicc-kernel: protect.writer needs the process tag (#405), which this kernel does not have yet";
+function protectedPrefixes(paths) {
+  return [...new Set(paths.map((p) => normalizePath(p)))];
+}
+function within(path, prefix) {
+  return prefix === "/" || path === prefix || path.startsWith(`${prefix}/`);
+}
+function isProtected(prefixes2, path) {
+  return prefixes2.some((prefix) => within(path, prefix));
+}
+function holdsProtected(prefixes2, path) {
+  return prefixes2.some((prefix) => within(prefix, path));
+}
+var MAX_LINKS = 40;
+function partsOf(path) {
+  return path.split("/").filter((p) => p !== "" && p !== ".");
+}
+function missing(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+async function resolved(fs, path, follow2) {
+  let done4 = [];
+  let todo = partsOf(path);
+  for (let hops = 0; todo.length > 0; ) {
+    const part = todo.shift();
+    if (part === "..") {
+      done4.pop();
+      continue;
+    }
+    if (todo.length === 0 && !follow2) {
+      done4.push(part);
+      break;
+    }
+    const at = `/${[...done4, part].join("/")}`;
+    const st = await fs.lstat(at).catch((err) => {
+      if (missing(err)) return void 0;
+      throw err;
+    });
+    if (!st) {
+      return normalizePath([...done4, part, ...todo].join("/"));
+    }
+    if (!st.isSymbolicLink) {
+      done4.push(part);
+      continue;
+    }
+    if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
+    const link2 = await fs.readlink(at);
+    if (link2.startsWith("/")) done4 = [];
+    todo = [...partsOf(link2), ...todo];
+  }
+  return `/${done4.join("/")}`;
+}
+var ProtectedFs = class {
+  prefixes;
+  constructor(prefixes2) {
+    this.prefixes = prefixes2;
+  }
+  async check(fs, path, follow2, whole = false) {
+    const lexical2 = normalizePath(path);
+    const real = await resolved(fs, lexical2, follow2);
+    for (const p of /* @__PURE__ */ new Set([lexical2, real])) {
+      if (isProtected(this.prefixes, p) || whole && holdsProtected(this.prefixes, p)) {
+        throw fsError("EROFS", path);
+      }
+    }
+  }
+  view(fs) {
+    const check = (path, follow2, whole = false) => this.check(fs, path, follow2, whole);
+    const marked = (path, st) => !st.readonly && isProtected(this.prefixes, normalizePath(path)) ? { ...st, readonly: true } : st;
+    const own = {
+      async writeFile(...args) {
+        await check(args[0], true);
+        return fs.writeFile(...args);
+      },
+      async mkdir(...args) {
+        await check(args[0], false);
+        return fs.mkdir(...args);
+      },
+      async rm(...args) {
+        await check(args[0], false, true);
+        return fs.rm(...args);
+      },
+      async rename(from, to) {
+        await check(from, false, true);
+        await check(to, false, true);
+        return fs.rename(from, to);
+      },
+      async link(from, to, follow2) {
+        await check(from, follow2 === true);
+        await check(to, false);
+        return fs.link(from, to, follow2);
+      },
+      async symlink(...args) {
+        await check(args[1], false);
+        return fs.symlink(...args);
+      },
+      async chmod(path, mode) {
+        await check(path, true);
+        return fs.chmod(path, mode);
+      },
+      async utimes(path, atime, mtime) {
+        await check(path, true);
+        return fs.utimes(path, atime, mtime);
+      },
+      async stat(path) {
+        return marked(path, await fs.stat(path));
+      },
+      async lstat(path) {
+        return marked(path, await fs.lstat(path));
+      },
+      async readdirStat(path) {
+        const dir = normalizePath(path);
+        return (await fs.readdirStat(path)).map(([name2, st]) => [
+          name2,
+          st && marked(`${dir}/${name2}`, st)
+        ]);
+      },
+      ...fs.createExclusive ? {
+        async createExclusive(...args) {
+          await check(args[0], true);
+          return fs.createExclusive?.(...args);
+        }
+      } : {},
+      ...fs.chown ? {
+        async chown(...args) {
+          await check(args[0], args[1].follow !== false);
+          return fs.chown?.(...args);
+        }
+      } : {},
+      ...fs.lutimes ? {
+        async lutimes(path, atime, mtime) {
+          await check(path, false);
+          return fs.lutimes?.(path, atime, mtime);
+        }
+      } : {},
+      ...fs.pwrite ? {
+        async pwrite(...args) {
+          await check(args[0], true);
+          return fs.pwrite?.(...args);
+        }
+      } : {},
+      ...fs.truncate ? {
+        async truncate(path, size) {
+          await check(path, true);
+          return fs.truncate?.(path, size);
+        }
+      } : {},
+      ...fs.exclusive ? {
+        async exclusive(path, run2, follow2) {
+          return fs.exclusive(
+            path,
+            (held) => run2({
+              ...held,
+              writeFile: async (...args) => {
+                await check(args[0], true);
+                return held.writeFile(...args);
+              }
+            }),
+            follow2
+          );
+        }
+      } : {}
+    };
+    const view = {};
+    for (let at = fs; at && at !== Object.prototype; at = Object.getPrototypeOf(at)) {
+      for (const name2 of Object.getOwnPropertyNames(at)) {
+        if (name2 === "constructor" || Object.hasOwn(view, name2)) continue;
+        const value = fs[name2];
+        view[name2] = typeof value === "function" ? value.bind(fs) : value;
+      }
+    }
+    return Object.assign(view, own);
+  }
+};
+
 // src/fs/opfs.ts
 var S_IFDIR = 16384;
 var S_IFREG = 32768;
@@ -360,7 +537,7 @@ var S_IFLNK = 40960;
 var PERM_MASK = 4095;
 var S_ISGID2 = 1024;
 var READ_ATTEMPTS = 3;
-var MAX_LINKS = 40;
+var MAX_LINKS2 = 40;
 var CHECK_MS = 1e3;
 var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
 var ERRNO_BY_DOM_ERROR = {
@@ -397,7 +574,7 @@ function sidecar(meta) {
   });
   return Object.fromEntries(META_OPS.map((op) => [op, guarded2(op)]));
 }
-function missing(err) {
+function missing2(err) {
   const code = err?.code;
   return code === "ENOENT" || code === "ENOTDIR";
 }
@@ -414,7 +591,7 @@ function prefixes(path) {
   const parts2 = split(path);
   return parts2.map((_, i) => `/${parts2.slice(0, i + 1).join("/")}`);
 }
-function within(path, root) {
+function within2(path, root) {
   return path === root || path.startsWith(`${root}/`);
 }
 var LOCKED = /* @__PURE__ */ new Set(["NotReadableError", "NoModificationAllowedError", "InvalidStateError"]);
@@ -553,14 +730,25 @@ var OpfsFs = class {
     const fields = await this.newFields(path, owner, directory);
     if (fields) await this.meta.update(path, (entry) => ({ ...entry, path, ...fields }));
   }
+  guarded = [];
+  protect(prefixes2) {
+    this.guarded = prefixes2;
+  }
+  refuse(path, holding = false) {
+    if (isProtected(this.guarded, path) || holding && holdsProtected(this.guarded, path)) {
+      throw fsError("EROFS", path);
+    }
+  }
   async chown(path, change) {
     if (!this.owners) return;
     if (change.kind === "new") {
       const at = resolvePath((await this.locate(parentOf3(path), true)).path, baseOf(path));
+      this.refuse(at);
       const { uid = 0, gid = 0, mode } = change;
       return this.stampNew(at, { uid, gid, ...mode !== void 0 ? { mode } : {} }, false);
     }
     const found = await this.locate(path, change.follow !== false);
+    this.refuse(found.path);
     const [stored] = found.link ? [found.link] : await this.meta.get([found.path]);
     const current = await this.ownerAt(found.path, stored);
     const next2 = { uid: change.uid ?? current.uid, gid: change.gid ?? current.gid };
@@ -673,11 +861,11 @@ var OpfsFs = class {
   }
   async locate(path, follow2) {
     let current = path;
-    for (let hops = 0; hops <= MAX_LINKS; hops++) {
+    for (let hops = 0; hops <= MAX_LINKS2; hops++) {
       try {
         return { path: current, handle: await this.handle(current) };
       } catch (err) {
-        if (!missing(err)) throw err;
+        if (!missing2(err)) throw err;
         const link2 = await this.linkAlong(current);
         if (!link2) throw err;
         if (link2.path === current && !follow2) return { path: current, link: link2 };
@@ -699,7 +887,7 @@ var OpfsFs = class {
         const st = await this.lstat(at);
         if (!st.isSymbolicLink && !st.isDirectory) throw fsError("ENOTDIR", at);
         if (!st.isSymbolicLink) done4.push(part);
-        else if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
+        else if (++hops > MAX_LINKS2) throw fsError("ELOOP", path);
         else {
           const link2 = await this.readlink(at);
           if (link2.startsWith("/")) done4 = [];
@@ -796,7 +984,7 @@ var OpfsFs = class {
     return this.locate(path, true).then(
       () => true,
       (err) => {
-        if (missing(err)) return false;
+        if (missing2(err)) return false;
         throw err;
       }
     );
@@ -814,8 +1002,10 @@ var OpfsFs = class {
       }
     }
   }
-  async existing(path) {
-    const handle = (await this.locate(path, true)).handle;
+  async existing(path, writing = false) {
+    const found = await this.locate(path, true);
+    if (writing) this.refuse(found.path);
+    const handle = found.handle;
     if (handle.kind === "directory") throw fsError("EISDIR", path);
     return handle;
   }
@@ -840,7 +1030,7 @@ var OpfsFs = class {
     await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
   }
   async truncate(path, size) {
-    const handle = await this.existing(path);
+    const handle = await this.existing(path, true);
     await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
   }
   async writeSession(path, truncate) {
@@ -866,10 +1056,15 @@ var OpfsFs = class {
     return new TextDecoder().decode(await this.readFileBuffer(path));
   }
   async writeTarget(path) {
+    const [target, existed] = await this.locateWrite(path);
+    this.refuse(target);
+    return [target, existed];
+  }
+  async locateWrite(path) {
     try {
       return [(await this.locate(path, true)).path, true];
     } catch (err) {
-      if (!missing(err)) throw err;
+      if (!missing2(err)) throw err;
     }
     const [entry] = await this.meta.get([path]);
     const wanted = entry?.link === void 0 ? path : resolvePath(parentOf3(path), entry.link);
@@ -938,7 +1133,7 @@ var OpfsFs = class {
     try {
       found = await this.locate(path, true);
     } catch (err) {
-      if (!missing(err)) throw err;
+      if (!missing2(err)) throw err;
     }
     if (found) {
       const directory = found.handle?.kind === "directory";
@@ -959,6 +1154,7 @@ var OpfsFs = class {
     }
     const parent = await this.locate(parentOf3(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
+    this.refuse(resolvePath(parent.path, baseOf(path)));
     await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
     const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
     await this.stampNew(made2, owner, true);
@@ -973,6 +1169,7 @@ var OpfsFs = class {
       if (options.force && error.code === "ENOENT") return;
       throw error;
     }
+    this.refuse(found.path, true);
     if (found.handle) {
       const [dir, name2] = await this.parent(found.path);
       try {
@@ -991,19 +1188,28 @@ var OpfsFs = class {
   links() {
     return false;
   }
-  async link(from) {
+  async link(from, to, follow2) {
+    await (follow2 ? this.stat(from) : this.lstat(from));
+    if (!(await this.stat(parentOf3(to))).isDirectory) throw fsError("ENOTDIR", to);
+    if (await this.lstat(to).then(
+      () => true,
+      () => false
+    ))
+      throw fsError("EEXIST", to);
     throw fsError("EPERM", `${from}: this file system has no hard links`);
   }
   async rename(from, to) {
     if (from === to) return;
     const source = await this.locate(from, false);
+    this.refuse(source.path, true);
     this.forget(source.path);
     const parent = await this.locate(parentOf3(to), true);
     const destination = resolvePath(parent.path, baseOf(to));
+    this.refuse(destination, true);
     const sourceStat = await this.describe(source);
-    if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
+    if (sourceStat.isDirectory && within2(destination, source.path)) throw fsError("EINVAL", to);
     const target = await this.locate(destination, false).catch((err) => {
-      if (missing(err)) return null;
+      if (missing2(err)) return null;
       throw err;
     });
     const targetStat = target && await this.describe(target);
@@ -1097,9 +1303,10 @@ var OpfsFs = class {
     const parent = await this.locate(parentOf3(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const at = resolvePath(parent.path, baseOf(path));
+    this.refuse(at);
     if (await this.locate(at, false).then(
       () => true,
-      (err) => !missing(err)
+      (err) => !missing2(err)
     )) {
       throw fsError("EEXIST", path);
     }
@@ -1126,6 +1333,7 @@ var OpfsFs = class {
   }
   async chmod(path, mode) {
     const found = await this.locate(path, true);
+    this.refuse(found.path);
     const ctimeMs = Date.now();
     await this.meta.update(found.path, (entry) => ({
       ...entry,
@@ -1141,6 +1349,7 @@ var OpfsFs = class {
     await this.setTimes(await this.locate(path, false), atime, mtime);
   }
   async setTimes(found, atime, mtime) {
+    this.refuse(found.path);
     const { link: link2 } = found;
     if (link2) {
       const ctimeMs2 = Date.now();
@@ -1345,7 +1554,7 @@ function fresh(bytes, start2 = 0, end = bytes.length) {
 }
 
 // src/fs/walk.ts
-var MAX_LINKS2 = 40;
+var MAX_LINKS3 = 40;
 function parentOf4(path) {
   return path.slice(0, path.lastIndexOf("/")) || "/";
 }
@@ -1374,7 +1583,7 @@ async function realDir(fs, dir, budget = { hops: 0 }) {
       at = next2;
       continue;
     }
-    if (budget.hops >= MAX_LINKS2) throw fsError("ELOOP", dir);
+    if (budget.hops >= MAX_LINKS3) throw fsError("ELOOP", dir);
     budget.hops++;
     queue.unshift(...link2.split("/").filter(Boolean));
     if (link2.startsWith("/")) at = "/";
@@ -1391,7 +1600,7 @@ async function realTarget(fs, path) {
   for (; ; ) {
     const link2 = await linkOf(fs, joinName(dir, name2));
     if (link2 === void 0) break;
-    if (budget.hops >= MAX_LINKS2) throw fsError("ELOOP", path);
+    if (budget.hops >= MAX_LINKS3) throw fsError("ELOOP", path);
     budget.hops++;
     const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
     dir = await realDir(fs, parentOf4(target), budget);
@@ -1404,7 +1613,7 @@ async function realTarget(fs, path) {
 var R_OK = 4;
 var W_OK = 2;
 var X_OK = 1;
-var MAX_LINKS3 = 40;
+var MAX_LINKS4 = 40;
 var S_ISVTX = 512;
 function permOf(st, link2) {
   return {
@@ -1475,7 +1684,7 @@ async function walk(fs, cred, path, follow2) {
     const perm = await perms.at(next2);
     const last = queue.length === 0;
     if (perm?.link !== void 0 && (!last || follow2)) {
-      if (++hops > MAX_LINKS3) return { path: next2, perm: void 0 };
+      if (++hops > MAX_LINKS4) return { path: next2, perm: void 0 };
       queue.unshift(...parts(perm.link));
       if (perm.link.startsWith("/")) at = "/";
       continue;
@@ -3422,7 +3631,7 @@ var UserDb = class {
 };
 
 // src/client/serve-client.ts
-var MAX_LINKS4 = 40;
+var MAX_LINKS5 = 40;
 function act(session, req, signal) {
   if (req.action === "write") session.write(req.bytes);
   else if (req.action === "resize") session.resize(req.cols, req.rows);
@@ -3431,22 +3640,22 @@ function act(session, req, signal) {
 }
 async function realpath(fs, path) {
   let parts2 = fs.resolvePath("/", path).split("/").filter(Boolean);
-  let resolved = "";
+  let resolved2 = "";
   for (let hops = 0; parts2.length > 0; ) {
     const [name2, ...rest2] = parts2;
-    const next2 = `${resolved}/${name2}`;
+    const next2 = `${resolved2}/${name2}`;
     if (!(await fs.lstat(next2)).isSymbolicLink) {
-      resolved = next2;
+      resolved2 = next2;
       parts2 = rest2;
       continue;
     }
-    if (++hops > MAX_LINKS4) throw fsError("ELOOP", path);
+    if (++hops > MAX_LINKS5) throw fsError("ELOOP", path);
     const target = await fs.readlink(next2);
-    const base = target.startsWith("/") ? "/" : resolved || "/";
+    const base = target.startsWith("/") ? "/" : resolved2 || "/";
     parts2 = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest2];
-    resolved = "";
+    resolved2 = "";
   }
-  return resolved || "/";
+  return resolved2 || "/";
 }
 var CLIENT_CHECKS = {
   readFile: (g, at) => readable(g, "read", at(0)),
@@ -3751,7 +3960,7 @@ function serveClient(port, host) {
         if (!FS_METHODS.includes(req.method)) {
           throw new Error(`unknown file system call ${req.method}`);
         }
-        return fsCall(l.fs, req.method, req.args, ownerFor(l, self), guardFor(l, self));
+        return fsCall(l.processFs, req.method, req.args, ownerFor(l, self), guardFor(l, self));
       case "watch":
       case "unwatch":
         return watchOp(l, req, watches, send, guardFor(l, self));
@@ -4970,11 +5179,11 @@ function ipv6(host) {
   const back = halves.length === 2 ? groups(halves[1]) : [];
   if (![...head, ...back].every((g) => /^[0-9A-Fa-f]{1,4}$/.test(g))) return void 0;
   const words2 = [...head, ...back].map((g) => Number.parseInt(g, 16));
-  const missing3 = 8 - words2.length - tail.length;
-  if (halves.length === 2 ? missing3 < 1 : missing3 !== 0) return void 0;
+  const missing4 = 8 - words2.length - tail.length;
+  if (halves.length === 2 ? missing4 < 1 : missing4 !== 0) return void 0;
   const all = [
     ...head.map((g) => Number.parseInt(g, 16)),
-    ...new Array(halves.length === 2 ? missing3 : 0).fill(0),
+    ...new Array(halves.length === 2 ? missing4 : 0).fill(0),
     ...back.map((g) => Number.parseInt(g, 16)),
     ...tail
   ];
@@ -5763,7 +5972,7 @@ function parsePrefix(text) {
   if (length2 < 0 || length2 > max) return void 0;
   return { ...parsed2, length: length2 };
 }
-function within2(prefix, addr) {
+function within3(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
   const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
   return addr.bits >> shift === prefix.bits >> shift;
@@ -5803,9 +6012,9 @@ var Routes = class {
     if (!addr) return "unreachable";
     if (addr.v6 && addr.bits === 1n) return "loopback";
     if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within2(p, addr))) return "reserved";
+    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
     if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within2(p, addr))) return "uplink";
+    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
     return "unreachable";
   }
 };
@@ -6419,8 +6628,8 @@ function binfmtOf(binfmts, path) {
 var S_IFDIR2 = 16384;
 var S_IFREG2 = 32768;
 var COMMAND = /^\/(?:usr\/)?bin\/([^/]+)$/;
-var MAX_LINKS5 = 40;
-function missing2(err) {
+var MAX_LINKS6 = 40;
+function missing3(err) {
   return err?.code === "ENOENT";
 }
 function synthetic(directory, path) {
@@ -6439,7 +6648,7 @@ function synthetic(directory, path) {
 }
 async function followLinks(fs, path) {
   let current = path;
-  for (let hops = 0; hops < MAX_LINKS5; hops++) {
+  for (let hops = 0; hops < MAX_LINKS6; hops++) {
     const st = await fs.lstat(current).catch(() => void 0);
     if (!st?.isSymbolicLink) return current;
     const parent = current.slice(0, current.lastIndexOf("/")) || "/";
@@ -6486,7 +6695,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     try {
       return await real(path);
     } catch (err) {
-      const found = missing2(err) ? await linked(path) : void 0;
+      const found = missing3(err) ? await linked(path) : void 0;
       if (found) return found;
       throw err;
     }
@@ -6498,7 +6707,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       try {
         return await fs.readFileBuffer(path);
       } catch (err) {
-        if (missing2(err) && (await linked(path))?.isFile) return new Uint8Array(0);
+        if (missing3(err) && (await linked(path))?.isFile) return new Uint8Array(0);
         throw err;
       }
     },
@@ -6514,7 +6723,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       const extra = await children2(path);
       if (!extra) return fs.readdir(path);
       const real = await fs.readdir(path).catch((err) => {
-        if (missing2(err)) return [];
+        if (missing3(err)) return [];
         throw err;
       });
       return [.../* @__PURE__ */ new Set([...real, ...extra])].sort();
@@ -6523,7 +6732,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       const extra = await children2(path);
       if (!extra) return fs.readdirStat(path);
       const real = await fs.readdirStat(path).catch((err) => {
-        if (missing2(err)) return [];
+        if (missing3(err)) return [];
         throw err;
       });
       const seen = new Set(real.map(([name2]) => name2));
@@ -6607,7 +6816,7 @@ var UNLINKED_DIR = ".slicc-unlinked";
 function webLocks() {
   return globalThis.navigator?.locks;
 }
-var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var lockName = (instance) => `slicc-unlinked:${instance}`;
 var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
@@ -6707,7 +6916,7 @@ var UnlinkedKeeper = class {
     for (const holder of this.holders) {
       if (holder.owns(target)) continue;
       for (const path of holder.held()) {
-        if (!within3(path, target) || holder.isKept(path)) continue;
+        if (!within4(path, target) || holder.isKept(path)) continue;
         held.set(path, [...held.get(path) ?? [], holder]);
       }
     }
@@ -7261,7 +7470,7 @@ function checkIds(options) {
     if (!ID.test(value) || Number(value) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value}`);
   }
 }
-var MAX_LINKS6 = 40;
+var MAX_LINKS7 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
 var DEFAULT_IO = 8 * 1024 * 1024;
@@ -7271,7 +7480,7 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within5 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -7290,7 +7499,7 @@ var HeldSet = class extends Set {
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within4(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within5(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
@@ -7401,24 +7610,24 @@ var HeldPaths = class extends Map {
     return this.owning === path;
   }
   revoke(prefix) {
-    for (const path of this.keys()) if (within4(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within5(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count] of [...this]) {
-      if (!within4(path, from)) continue;
+      if (!within5(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
     for (const [path, count] of [...this.opens]) {
-      if (!within4(path, from)) continue;
+      if (!within5(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.opens.delete(path);
       this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
     }
     for (const [id2, key] of this.handles) {
-      if (within4(key, from)) this.handles.set(id2, to + key.slice(from.length));
+      if (within5(key, from)) this.handles.set(id2, to + key.slice(from.length));
     }
   }
   isRevoked(path) {
@@ -7525,7 +7734,7 @@ var MountTable = class {
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within4(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within5(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -7668,7 +7877,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within4(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within5(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -7703,10 +7912,10 @@ var MountTable = class {
   }
   forget(mount, path) {
     mount.epoch++;
-    for (const key of [...mount.attrs.keys()]) if (within4(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within5(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
     mount.lists.delete(parentOf7(path));
-    for (const key of [...mount.lists.keys()]) if (within4(key, path)) mount.lists.delete(key);
+    for (const key of [...mount.lists.keys()]) if (within5(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2, settled = false) {
     for (let round = 1; ; round++) {
@@ -7779,7 +7988,7 @@ var MountFs = class {
       throw err;
     }
     if (attr2.kind !== "symlink") return real;
-    if (hops >= MAX_LINKS6) throw errnoError("ELOOP", path);
+    if (hops >= MAX_LINKS7) throw errnoError("ELOOP", path);
     const target = await found.mount.conn.call({ op: "readlink", path: found.rel });
     return this.follow(this.base.resolvePath(parentOf7(real), target), hops + 1, create);
   }
@@ -10813,7 +11022,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within5(path, root) {
+function within6(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -11134,12 +11343,12 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within5(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within6(path, prefix)) return true;
     return false;
   }
   writes(prefix) {
     for (const [path, node] of this.byPath)
-      if (node.writers > 0 && within5(path, prefix)) return true;
+      if (node.writers > 0 && within6(path, prefix)) return true;
     return false;
   }
   closed(node, writable2 = false) {
@@ -11183,11 +11392,11 @@ var VfsNodes = class {
     this.kept.delete(node);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within5(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within6(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within5(held, path)) continue;
+      if (!within6(held, path)) continue;
       await node.serial(async () => {
         await Promise.all([this.keepsOnDisk || node.keep(), node.limit()]);
       });
@@ -11195,14 +11404,14 @@ var VfsNodes = class {
   }
   revoke(prefix) {
     for (const [path, node] of [...this.byPath]) {
-      if (!within5(path, prefix)) continue;
+      if (!within6(path, prefix)) continue;
       node.revoke();
       this.forget(node);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within5(held, path) || this.byPath.get(held) !== node) continue;
+      if (!within6(held, path) || this.byPath.get(held) !== node) continue;
       if (!this.dropName(held, node)) this.orphan(node);
     }
   }
@@ -11210,8 +11419,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of [...this.byPath]) {
-      if (within5(p, from)) moved2.push([p, node]);
-      else if (within5(p, to) && this.byPath.get(p) === node && !this.dropName(p, node)) {
+      if (within6(p, from)) moved2.push([p, node]);
+      else if (within6(p, to) && this.byPath.get(p) === node && !this.dropName(p, node)) {
         this.orphan(node);
       }
     }
@@ -11757,6 +11966,7 @@ var WasmProcess = class {
         this.fds.installAt(fd, await this.procFile(req, path));
         return fd;
       }
+      if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open = { ...req, path };
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner());
@@ -11802,6 +12012,9 @@ var WasmProcess = class {
     };
     return fs.exclusive ? fs.exclusive(first.path, look) : look();
   }
+  writesAt(req) {
+    return (req.flags & WRITE_ACCESS) !== 0 || req.truncate === true || req.create === true || req.exclusive === true;
+  }
   async mayOpen(req) {
     const { guard: guard2 } = this.options;
     const inherited2 = req.orphan || req.contents !== void 0 || req.handle !== void 0;
@@ -12583,6 +12796,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
+    ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
@@ -15309,13 +15523,13 @@ function interpreter(head) {
 function expandDefaults(defaults, env) {
   const out = {};
   for (const [key, value] of Object.entries(defaults ?? {})) {
-    let missing3 = false;
+    let missing4 = false;
     const expanded = value.replace(ENV_REFERENCE, (_, name2) => {
       const set2 = Object.hasOwn(env, name2) ? env[name2] : void 0;
-      if (set2 === void 0) missing3 = true;
+      if (set2 === void 0) missing4 = true;
       return set2 ?? "";
     });
-    if (!missing3) out[key] = expanded;
+    if (!missing4) out[key] = expanded;
   }
   return out;
 }
@@ -15362,6 +15576,8 @@ function concat5(chunks) {
 }
 var Launcher = class {
   fs;
+  processFs;
+  prefixes;
   base;
   createWorker;
   modulesDir;
@@ -15488,6 +15704,10 @@ var Launcher = class {
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
+    if (options.protect?.writer) throw new Error(PROTECT_WRITER);
+    this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
+    this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
+    options.fs.protect?.(this.prefixes);
     this.users = new UserDb(this.fs, this.owners);
     this.sudoer = new Sudo({
       fs: this.fs,
@@ -15838,7 +16058,8 @@ var Launcher = class {
       env: req.env,
       cwd: req.cwd,
       fds: req.fds,
-      fs: this.fs,
+      fs: this.processFs,
+      ...this.prefixes.length > 0 ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
       createWorker: this.createWorker,
       onError: req.report,
       spawner: this.spawner(pid, req.report),
@@ -16123,6 +16344,18 @@ var Launcher = class {
     const keyed = () => this.jobs.fromKeyboard(send);
     this.settling.deliver(sig, pgid, keyed, tty.reading ? void 0 : foreground);
   }
+  async resolvePrefixes() {
+    for (const prefix of [...this.prefixes]) {
+      const real = await this.base.realpath?.(prefix, true).catch(() => void 0);
+      if (real !== void 0 && !this.prefixes.includes(real)) this.prefixes.push(real);
+    }
+  }
+  guardMount(target) {
+    const at = normalizePath(target);
+    if (isProtected(this.prefixes, at) || holdsProtected(this.prefixes, at)) {
+      throw fsError("EROFS", at);
+    }
+  }
   umaskOf(pid) {
     return this.processes.get(pid)?.umask?.() ?? DEFAULT_UMASK;
   }
@@ -16257,6 +16490,7 @@ var Launcher = class {
     };
   }
   async mount(spec) {
+    this.guardMount(spec.target);
     const fsa = spec.type === "fsa" && !spec.source.startsWith("fsa:");
     const entry = await this.mounts.mount(
       fsa ? { ...spec, source: `fsa:${crypto.randomUUID()}` } : spec,
@@ -16275,6 +16509,7 @@ var Launcher = class {
       [`/${UNLINKED_DIR}`, 448]
     ];
     for (const [path, mode] of layout) {
+      if (isProtected(this.prefixes, normalizePath(path))) continue;
       const real = await this.realLayoutPath(path);
       const fresh2 = real !== void 0 && !await this.base.hasOwner?.(real);
       if (fresh2) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
@@ -16337,6 +16572,7 @@ var Launcher = class {
   }
   async processMount(pid, call, signal) {
     const spec = mountCall(call);
+    this.guardMount(spec.target);
     await this.permit({ op: "mount", pid, ...spec, options: { ...spec.options } });
     await this.mountsOwn(
       this.credOf(pid),
@@ -16353,6 +16589,7 @@ var Launcher = class {
   }
   async umountAs(cred, target) {
     const at = normalizePath(target);
+    this.guardMount(at);
     await this.mountsOwn(cred, at, async () => Number(this.mounts.mounted(at)?.options.uid));
     this.umount(at);
   }
@@ -16366,6 +16603,7 @@ var Launcher = class {
   async processUmount(pid, target, flags2) {
     const call = umountCall(target, flags2);
     let mounted;
+    this.guardMount(call.target);
     for (; ; ) {
       mounted = this.mounts.mounted(call.target);
       await this.permit({
@@ -16380,6 +16618,7 @@ var Launcher = class {
     this.umount(call.target, call.detach);
   }
   async prepare() {
+    await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     if (this.owners) await this.base.chmod("/tmp", 1023);
     await this.provisionPnpmHome();
@@ -16436,7 +16675,7 @@ var Launcher = class {
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
-    await this.base.mkdir(cwd, { recursive: true });
+    if (!await this.base.exists(cwd)) await this.processFs.mkdir(cwd, { recursive: true });
     const planned = await this.plan(file, argv, cwd, scope);
     await this.mayExec(credOf(account), { file, cwd, pid: 0 }, planned);
     return { cwd, file, planned };
@@ -16677,6 +16916,7 @@ function hostOptions(req, port, sealed) {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
+    ...req.protect ? { protect: { paths: [...req.protect.paths] } } : {},
     ...req.sealed ? { sealed } : {}
   };
 }