@ai-ecoverse/slicc-kernel 1.73.3 → 1.75.0

package/dist/kernel-worker.js

@@ -2255,9 +2255,11 @@ var KernelPipe = class {
 // src/kernel/fd-table.ts
 var KernelError = class extends Error {
   code;
-  constructor(code) {
+  detail;
+  constructor(code, detail) {
     super(code);
     this.code = code;
+    if (detail !== void 0) this.detail = detail;
   }
 };
 function pollFile(file) {
@@ -2400,6 +2402,7 @@ function kernelFdKind(file) {
   if (file.heldMeta && "device" in file.heldMeta) return "device";
   if (file.tty) return "tty";
   if (file.sealed) return "sealed";
+  if (file.clipboard) return "clipboard";
   return file.seek ? "file" : "stream";
 }
 var FdTable = class _FdTable {
@@ -4190,6 +4193,203 @@ function serveClient(port, host) {
   return { detach, closed: ended.promise };
 }
 
+// src/kernel/clipboard.ts
+var CLIPBOARD_MAX_BYTES = 1024 * 1024;
+var CLIPBOARD_TIMEOUT_MS = 1e4;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var READY = { readable: true, writable: true, hangup: false };
+function lineOf(err) {
+  const text = err instanceof Error ? err.message : String(err);
+  return (text.split("\n")[0] ?? "").slice(0, 200);
+}
+function clipboardFailure(err) {
+  if (err instanceof KernelError) return err;
+  const name2 = err?.name;
+  return new KernelError(name2 === "NotAllowedError" ? "EACCES" : "EIO", lineOf(err));
+}
+function joined2(chunks, size) {
+  if (chunks.length === 1) return chunks[0];
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const chunk2 of chunks) {
+    out.set(chunk2, at);
+    at += chunk2.length;
+  }
+  return out;
+}
+async function interruptible(work, signal) {
+  if (!signal) return work;
+  if (signal.aborted) throw new KernelError("EINTR");
+  let stop = () => {
+  };
+  const interrupted2 = new Promise((_, reject) => {
+    stop = () => reject(new KernelError("EINTR"));
+    signal.addEventListener("abort", stop, { once: true });
+  });
+  try {
+    return await Promise.race([work, interrupted2]);
+  } finally {
+    signal.removeEventListener("abort", stop);
+  }
+}
+var ClipboardChannel = class {
+  stamp;
+  access;
+  broker;
+  snapshot;
+  taken;
+  offset = 0;
+  chunks = [];
+  size = 0;
+  wrote = false;
+  failed = false;
+  constructor(broker, access2, stamp) {
+    this.broker = broker;
+    this.access = access2;
+    this.stamp = stamp;
+  }
+  get unread() {
+    return this.taken === void 0 && this.snapshot === void 0;
+  }
+  get settled() {
+    return this.taken !== void 0;
+  }
+  async read(max, signal) {
+    if (this.access === "write") throw new KernelError("EBADF");
+    if (!this.taken) {
+      if (!this.snapshot) {
+        const stamp = this.stamp;
+        const asked = this.broker.ask(async (hook) => {
+          const text = await hook.read(stamp);
+          if (typeof text !== "string") throw new KernelError("EIO", "the clipboard gave no text");
+          return encoder.encode(text);
+        });
+        this.snapshot = asked;
+        asked.then(
+          (bytes) => {
+            if (this.snapshot === asked) this.taken = bytes;
+          },
+          () => {
+            if (this.snapshot === asked) this.snapshot = void 0;
+          }
+        );
+      }
+      this.taken = await interruptible(this.snapshot, signal);
+    }
+    const out = this.taken.subarray(this.offset, this.offset + max);
+    this.offset += out.length;
+    return out;
+  }
+  write(bytes) {
+    if (this.access === "read") throw new KernelError("EBADF");
+    this.wrote = true;
+    if (this.failed) throw new KernelError("EFBIG");
+    if (this.size + bytes.length > CLIPBOARD_MAX_BYTES) {
+      this.failed = true;
+      this.chunks = [];
+      this.size = 0;
+      throw new KernelError("EFBIG");
+    }
+    if (bytes.length > 0) this.chunks.push(bytes.slice());
+    this.size += bytes.length;
+    return bytes.length;
+  }
+  poll() {
+    return READY;
+  }
+  async close() {
+    this.snapshot = void 0;
+    this.taken = void 0;
+    const commits = this.access === "write" || this.access === "both" && this.wrote;
+    if (!commits || this.failed) return;
+    const bytes = joined2(this.chunks, this.size);
+    this.chunks = [];
+    this.size = 0;
+    let text;
+    try {
+      text = decoder.decode(bytes);
+    } catch {
+      throw new KernelError("EILSEQ", "the text is not valid UTF-8");
+    }
+    const stamp = this.stamp;
+    await this.broker.ask(async (hook) => {
+      await hook.write(text, stamp);
+    });
+  }
+};
+var ClipboardBroker = class {
+  hook;
+  users;
+  timeoutMs;
+  tagOf;
+  constructor(hook, users, timeoutMs = CLIPBOARD_TIMEOUT_MS, tagOf = () => void 0) {
+    this.hook = hook;
+    this.users = users;
+    this.timeoutMs = timeoutMs;
+    this.tagOf = tagOf;
+  }
+  async ask(work) {
+    const hook = this.hook;
+    if (!hook) throw new KernelError("ENOTSUP", "no clipboard in this embedder");
+    let timer;
+    const late = new Promise((_, reject) => {
+      timer = setTimeout(
+        () => reject(new KernelError("EIO", "clipboard timed out")),
+        this.timeoutMs
+      );
+    });
+    const asked = Promise.resolve().then(() => work(hook)).catch((err) => {
+      throw clipboardFailure(err);
+    });
+    try {
+      return await Promise.race([asked, late]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  open(access2, stamp) {
+    const channel = new ClipboardChannel(this, access2, stamp);
+    return new OpenFile({
+      read: (max, signal) => channel.read(max, signal),
+      write: async (bytes) => channel.write(bytes),
+      poll: () => channel.poll(),
+      close: () => channel.close(),
+      clipboard: channel
+    });
+  }
+};
+
+// src/clipboard-relay.ts
+function clipboardAsker(port) {
+  const asks = /* @__PURE__ */ new Map();
+  let next2 = 0;
+  const ask = (op, stamp, text) => {
+    const id2 = ++next2;
+    const waiting = Promise.withResolvers();
+    asks.set(id2, waiting);
+    const timer = setTimeout(() => {
+      if (asks.delete(id2)) waiting.reject(new Error("clipboard timed out"));
+    }, CLIPBOARD_TIMEOUT_MS + 1e3);
+    port.postMessage({ clipboardAsk: { id: id2, op, stamp, ...text !== void 0 ? { text } : {} } });
+    return waiting.promise.finally(() => clearTimeout(timer));
+  };
+  const hook = {
+    read: async (stamp) => await ask("read", stamp) ?? "",
+    write: async (text, stamp) => {
+      await ask("write", stamp, text);
+    }
+  };
+  const answer = ({ id: id2, text, error }) => {
+    const waiting = asks.get(id2);
+    if (!waiting) return;
+    asks.delete(id2);
+    if (error) waiting.reject(Object.assign(new Error(error.message), { name: error.name }));
+    else waiting.resolve(text);
+  };
+  return { hook, answer };
+}
+
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
 var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
@@ -9191,20 +9391,20 @@ var SAB_DEFAULT_WINDOW_BYTES = 1024 * 1024;
 var SAB_MIN_BYTES = SAB_HEADER_BYTES + 4096;
 var SYNC_SAB_REQ_MSG = "sync-sab-req";
 var SYNC_SAB_NEXT_MSG = "sync-sab-next";
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+var decoder2 = new TextDecoder();
 function encodeSabResult(result) {
   if (!result.ok) {
     return {
       status: SAB_STATUS_ERRNO,
-      payload: encoder.encode(JSON.stringify({ errno: result.errno, message: result.message }))
+      payload: encoder2.encode(JSON.stringify({ errno: result.errno, message: result.message }))
     };
   }
   switch (result.kind) {
     case "bytes":
       return { status: SAB_STATUS_BYTES, payload: result.bytes };
     case "json":
-      return { status: SAB_STATUS_JSON, payload: encoder.encode(JSON.stringify(result.json)) };
+      return { status: SAB_STATUS_JSON, payload: encoder2.encode(JSON.stringify(result.json)) };
     default:
       return { status: SAB_STATUS_VOID, payload: new Uint8Array(0) };
   }
@@ -10678,7 +10878,7 @@ function defaultTermios() {
     c_cc: cCc
   };
 }
-var encoder2 = new TextEncoder();
+var encoder3 = new TextEncoder();
 function isContinuation(byte) {
   return (byte & 192) === 128;
 }
@@ -10800,7 +11000,7 @@ var KernelTty = class {
       this.line.push(byte);
       this.readable.push(Uint8Array.from(this.line));
       this.line = [];
-      if (echo) this.output(encoder2.encode("\n"));
+      if (echo) this.output(encoder3.encode("\n"));
     } else {
       this.line.push(byte);
       if (echo) this.echo(byte);
@@ -10825,7 +11025,7 @@ var KernelTty = class {
     const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
     const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
     if (cells > 0 && this.termios.c_lflag & ECHO) {
-      this.output(encoder2.encode("\b \b".repeat(cells)), false);
+      this.output(encoder3.encode("\b \b".repeat(cells)), false);
     }
   }
   echo(byte) {
@@ -11175,7 +11375,14 @@ async function runChild(req, deps) {
   ];
   try {
     pid = await deps.children.spawn(
-      { file: req.file, argv: req.argv, env: req.env, cwd: req.cwd },
+      {
+        file: req.file,
+        argv: req.argv,
+        env: req.env,
+        cwd: req.cwd,
+        ...req.pgid !== void 0 ? { pgid: req.pgid } : {},
+        ...req.session ? { session: req.session } : {}
+      },
       stdio
     );
   } catch (e) {
@@ -11307,7 +11514,7 @@ async function socketSyscall(req, proc) {
         dialing?.catch(() => void 0);
         throw new KernelError("EINPROGRESS");
       }
-      if (dialing !== void 0) await interruptible(dialing, proc.blocking());
+      if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
       return ok();
     }
     case "sock-shutdown":
@@ -11331,7 +11538,7 @@ async function socketSyscall(req, proc) {
     }
   }
 }
-function interruptible(dialing, signal) {
+function interruptible2(dialing, signal) {
   return new Promise((resolve, reject) => {
     const abort = () => reject(new KernelError("EINTR"));
     signal.addEventListener("abort", abort, { once: true });
@@ -11998,6 +12205,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-tty-names",
   "fd-tty-owner",
   "fd-open-sealed",
+  "fd-open-clipboard",
   "tty-get",
   "tty-set",
   "tty-winsz",
@@ -12128,8 +12336,9 @@ var WasmProcess = class {
     return "deliver";
   }
   async spawn(req) {
-    const { file, argv, env, cwd, stdio, inherit: inherit2, exec } = req;
-    const spawned = { file, argv, env, cwd, ...exec ? { exec } : {} };
+    const { file, argv, env, cwd, stdio, inherit: inherit2, exec, pgid, session } = req;
+    const group = { ...pgid !== void 0 ? { pgid } : {}, ...session ? { session } : {} };
+    const spawned = { file, argv, env, cwd, ...group, ...exec ? { exec } : {} };
     const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (!exec) return pid;
     if (this.killed) void Promise.allSettled([this.options.kill?.(pid, SIG.KILL)]);
@@ -12239,7 +12448,7 @@ var WasmProcess = class {
       return await this.procSyscall(req, cancelled);
     } catch (e) {
       if (e instanceof KernelError || e instanceof SpawnError) {
-        return { ok: false, errno: e.code, message: e.code };
+        return { ok: false, errno: e.code, message: e.detail ?? e.code };
       }
       const code = e?.code;
       if (typeof code === "string" && /^E[A-Z]+$/.test(code)) {
@@ -12282,6 +12491,7 @@ var WasmProcess = class {
     const read = req.peek ? file.peek : file.read;
     if (!read) throw new KernelError(req.peek && file.read ? "EOPNOTSUPP" : "EBADF");
     if (file.tty) this.checkForeground(file.tty);
+    if (file.clipboard) return this.readClipboard(file.clipboard, req, cancelled);
     if (req.max <= 0) return new Uint8Array(0);
     if (file instanceof KernelSocket && file.unconnected) throw new KernelError("ENOTCONN");
     const ready2 = pollFile(file).readable;
@@ -12289,6 +12499,13 @@ var WasmProcess = class {
     const signal = ready2 ? this.interrupt.signal : this.blockingSignal(cancelled);
     return read.call(file, Math.max(0, Math.min(req.max, MAX_READ)), signal);
   }
+  async readClipboard(channel, req, cancelled) {
+    if (channel.access === "write") throw new KernelError("EBADF");
+    if (req.max <= 0) return new Uint8Array(0);
+    if (channel.unread) channel.stamp = await this.clipboardStamp();
+    const signal = channel.settled ? this.interrupt.signal : this.blockingSignal(cancelled);
+    return channel.read(Math.min(req.max, MAX_READ), signal);
+  }
   async write(fd, body, nonblock = false, cancelled) {
     const file = this.fds.get(fd).file;
     if (file.sealed) return file.sealed.send(body, await this.sealedCaller(), this.gone.signal);
@@ -12392,6 +12609,36 @@ var WasmProcess = class {
     if (!broker) throw new KernelError("ENOENT");
     return this.fds.install(broker.open(), 3);
   }
+  async openClipboard(flags2) {
+    const broker = this.options.clipboard;
+    if (!broker) throw new KernelError("ENOENT");
+    const mode = flags2 & WRITE_ACCESS;
+    const access2 = mode === 0 ? "read" : mode === 1 ? "write" : "both";
+    return this.fds.install(broker.open(access2, await this.clipboardStamp()), 3);
+  }
+  async clipboardStamp() {
+    const shown = await this.options.identity?.();
+    const broker = this.options.clipboard;
+    const tag = broker.tagOf(this.pid);
+    return {
+      pid: shown?.pid ?? this.pid,
+      uid: this.cred.euid,
+      gid: this.cred.egid,
+      users: broker.users,
+      ...tag !== void 0 ? { tag } : {}
+    };
+  }
+  async stampClipboards() {
+    if (!this.options.clipboard) return;
+    const open = this.fds.numbers().filter((fd) => this.fds.get(fd).file.clipboard);
+    if (open.length === 0) return;
+    const stamp = await this.clipboardStamp().catch(() => void 0);
+    if (!stamp) return;
+    for (const fd of open) {
+      const channel = this.fds.get(fd).file.clipboard;
+      if (channel) channel.stamp = stamp;
+    }
+  }
   async sealedCaller() {
     const shown = await this.options.identity?.();
     const broker = this.options.sealed;
@@ -12466,10 +12713,13 @@ var WasmProcess = class {
           kind: "json",
           json: await this.write(req.fd, req.body, req.nonblock, cancelled)
         };
-      case "fd-close":
+      case "fd-close": {
         this.options.locks?.closed(this.pid, req.fd);
+        const channel = this.fds.get(req.fd).file.clipboard;
+        if (channel) channel.stamp = await this.clipboardStamp();
         await Promise.resolve(this.fds.close(req.fd));
         return { ok: true, kind: "void" };
+      }
       case "fd-pipe": {
         const pipe = openPipe();
         const read = this.fds.install(pipe.read, 3);
@@ -12527,6 +12777,8 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: this.options.jobs?.terminalNames() ?? [] };
       case "fd-open-sealed":
         return { ok: true, kind: "json", json: this.openSealed() };
+      case "fd-open-clipboard":
+        return { ok: true, kind: "json", json: await this.openClipboard(req.flags) };
       case "fd-tty-owner":
         return { ok: true, kind: "json", json: this.terminalByName(req.name).owner ?? null };
       case "fd-select": {
@@ -12978,6 +13230,7 @@ var WasmProcess = class {
     this.options.locks?.release(this.pid);
     this.asyncOps.close();
     for (const pid of this.children.pids()) this.options.onReap?.(pid);
+    await this.stampClipboards();
     await this.fds.closeAll();
     if (!this.options.nodes) this.options.openFiles?.delete(this.nodes);
     await this.options.http?.closeAll();
@@ -13160,6 +13413,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
+    ...opts.clipboard ? { clipboard: opts.clipboard } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
@@ -13423,6 +13677,9 @@ var JobTable = class {
     member.pgid = pgid;
     member.sid = sid;
   }
+  lead(pid) {
+    this.member(pid).pgid = this.idOf(pid);
+  }
   pgidOf(pid) {
     return this.members.get(pid)?.pgid;
   }
@@ -13661,14 +13918,14 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "cancel",
   "materialize"
 ]);
-var encoder3 = new TextEncoder();
-var decoder2 = new TextDecoder("utf-8", { fatal: true });
+var encoder4 = new TextEncoder();
+var decoder3 = new TextDecoder("utf-8", { fatal: true });
 function parseSealed(bytes) {
   try {
     if (bytes.length > SEALED_MAX_BYTES) throw new KernelError("EMSGSIZE");
     let parsed2;
     try {
-      parsed2 = JSON.parse(decoder2.decode(bytes));
+      parsed2 = JSON.parse(decoder3.decode(bytes));
     } catch {
       throw new KernelError("EINVAL");
     }
@@ -13694,13 +13951,13 @@ function serialized(reply) {
     const text = JSON.stringify(reply);
     plain = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
-    return JSON.stringify(errorReply("EIO", lineOf(err)));
+    return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
   if (!isRecord(plain)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
   const { v: _, ...rest2 } = plain;
   return JSON.stringify({ v: 1, ...rest2 });
 }
-function lineOf(err) {
+function lineOf2(err) {
   const text = err instanceof Error ? err.message : String(err);
   return (text.split("\n")[0] ?? "").slice(0, 200);
 }
@@ -13730,7 +13987,7 @@ var SealedChannel = class {
       gone.removeEventListener("abort", withdraw);
       if (this.inflight !== flight) return;
       this.inflight = void 0;
-      if (reply) this.reply = encoder3.encode(serialized(reply));
+      if (reply) this.reply = encoder4.encode(serialized(reply));
     });
     this.inflight = flight;
     return length2;
@@ -13744,7 +14001,7 @@ var SealedChannel = class {
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
       (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf(err))
+      (err) => errorReply("EIO", lineOf2(err))
     );
     const reply = await Promise.race([asked, stopped]);
     if (!signal.aborted) return reply;
@@ -14467,13 +14724,13 @@ var HostfsClient = class {
     const response = await this.send("/api/hostfs/watch", { method: "POST", signal });
     onOpen();
     const reader = response.body.getReader();
-    const decoder3 = new TextDecoder();
+    const decoder4 = new TextDecoder();
     let buffered = "";
     try {
       for (; ; ) {
         const { done: done4, value } = await reader.read();
         if (done4) return;
-        buffered += decoder3.decode(value, { stream: true });
+        buffered += decoder4.decode(value, { stream: true });
         let end = buffered.indexOf("\n");
         while (end >= 0) {
           const line = buffered.slice(0, end).trim();
@@ -15852,7 +16109,7 @@ var LAYOUT = [
 ];
 var LOAD_SAMPLE_MS = 5e3;
 var LOAD_WINDOWS_MS = [6e4, 3e5, 9e5];
-var encoder4 = new TextEncoder();
+var encoder5 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
   if (USERS_MODES.includes(mode)) return mode;
@@ -16009,6 +16266,7 @@ var Launcher = class {
   usersMode;
   dac;
   sealed;
+  clipboard;
   rootFs;
   fileWatches;
   nextPid = 1e3;
@@ -16019,6 +16277,12 @@ var Launcher = class {
     this.rootFs = options.fs;
     this.dac = this.usersMode === "off" ? void 0 : new Dac(this.usersMode, options.onDenial);
     if (this.dac) this.dac.tagOf = (pid) => this.tagOf(pid);
+    this.clipboard = new ClipboardBroker(
+      options.clipboard,
+      this.usersMode,
+      void 0,
+      (pid) => this.tagOf(pid)
+    );
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -16408,7 +16672,7 @@ var Launcher = class {
   start(req) {
     this.sampling();
     if (req.pgid !== void 0 && this.jobs.sessionOf(req.pgid) === void 0) {
-      throw fsError("ESRCH", `no process group ${req.pgid}`);
+      throw new SpawnError("ESRCH");
     }
     const pid = this.nextPid++;
     const stack = this.stackFor(req.tag);
@@ -16435,6 +16699,7 @@ var Launcher = class {
       cred: req.cred,
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
+      clipboard: this.clipboard,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
       argv0: req.argv0,
@@ -16483,6 +16748,8 @@ var Launcher = class {
     this.jobs.add(pid, req.ppid, (sig) => handle.signal(sig), terminal);
     if (req.exec && req.ppid !== void 0) this.jobs.exec(req.ppid, pid, true);
     if (req.pgid !== void 0) this.jobs.join(pid, req.pgid);
+    if (req.group === "lead") this.jobs.lead(pid);
+    if (req.group === "session") this.jobs.setsid(pid);
     this.described.set(pid, {
       argv: [req.argv0, ...req.args],
       tty: terminal?.name ?? null,
@@ -16644,6 +16911,11 @@ var Launcher = class {
         await fds.closeAll();
         throw new SpawnError("EACCES");
       }
+      const group = this.childGroup(ppid, req);
+      if (typeof group === "string") {
+        await fds.closeAll();
+        throw new SpawnError(group);
+      }
       const cred = grant ? grant.cred : this.credOf(ppid);
       const scope = grant ? "" : await this.scopeOf(cred.euid);
       const planned = await this.plan(req.file, req.argv, req.cwd, scope);
@@ -16670,6 +16942,7 @@ var Launcher = class {
         umask: this.umaskOf(ppid),
         cred,
         tag: this.tagOf(ppid),
+        ...group,
         ...exec
       });
       deciding?.attach();
@@ -16677,6 +16950,17 @@ var Launcher = class {
       return childHandle(handle);
     };
   }
+  childGroup(ppid, req) {
+    const { pgid, session } = req;
+    if (pgid === void 0 && session === void 0) return {};
+    const valid = pgid === void 0 || Number.isInteger(pgid) && pgid >= 0;
+    if (req.exec || !valid || session !== void 0 && session !== true) return "EINVAL";
+    if (session) return pgid === void 0 ? { group: "session" } : "EINVAL";
+    if (pgid === 0) return { group: "lead" };
+    const sid = this.jobs.sessionOf(pgid);
+    if (sid === void 0) return "ESRCH";
+    return sid === this.jobs.sidOf(ppid) ? { pgid } : "EPERM";
+  }
   undecided(ppid) {
     const decided = Promise.withResolvers();
     return {
@@ -16707,7 +16991,7 @@ var Launcher = class {
     }, 0);
   }
   forker(ppid, parent) {
-    const { exec: _exec, ...image } = parent;
+    const { exec: _exec, pgid: _pgid, group: _group, ...image } = parent;
     return async (state, fds) => childHandle(
       this.start({
         ...image,
@@ -17176,7 +17460,7 @@ var Launcher = class {
       },
       account
     );
-    const report = (message3) => options.onData(encoder4.encode(`${message3}\r
+    const report = (message3) => options.onData(encoder5.encode(`${message3}\r
 `));
     const handle = await this.launch(planned, {
       env,
@@ -17213,7 +17497,7 @@ var Launcher = class {
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message3) => stderr(encoder4.encode(`${message3}
+    const report = (message3) => stderr(encoder5.encode(`${message3}
 `));
     if (!planned) {
       report(`${file}: command not found`);
@@ -17401,13 +17685,14 @@ function usersOp(l, req) {
   if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();
 }
-function hostOptions(req, port, sealed) {
+function hostOptions(req, port, sealed, clipboard) {
   return {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
     ...req.protect ? { protect: protectInit(req.protect) } : {},
-    ...req.sealed ? { sealed } : {}
+    ...req.sealed ? { sealed } : {},
+    ...req.clipboard ? { clipboard } : {}
   };
 }
 function policyAsker(port) {
@@ -17437,6 +17722,7 @@ function serveKernel(port, deps) {
   const reply = (id2, body, transfer) => port.postMessage({ id: id2, ...body }, transfer);
   const clients = /* @__PURE__ */ new Set();
   const sealed = sealedAsker(port);
+  const clipboard = clipboardAsker(port);
   const approvals = sudoApprovals(port);
   const locks = deps.locks === null ? void 0 : deps.locks ?? locksOf();
   let holding;
@@ -17501,7 +17787,7 @@ function serveKernel(port, deps) {
         ...deps.createDriverWorker ? { createDriverWorker: deps.createDriverWorker } : {},
         ...req.modules ? { modules: req.modules } : {},
         ...req.env ? { env: req.env } : {},
-        ...hostOptions(req, port, sealed.hook),
+        ...hostOptions(req, port, sealed.hook, clipboard.hook),
         ...req.approve ? { approve: approvals.ask } : {},
         ...net,
         ...media ? { media } : {},
@@ -17570,6 +17856,8 @@ function serveKernel(port, deps) {
   port.addEventListener("message", (event) => {
     const sealedReply = event.data.sealedReply;
     if (sealedReply) return sealed.answer(sealedReply);
+    const clipboardReply = event.data.clipboardReply;
+    if (clipboardReply) return clipboard.answer(clipboardReply);
     const grant = event.data.hostfsGrant;
     if (grant) return granted2(grant);
     if (allowed(event.data)) return;