@ai-ecoverse/slicc-kernel 1.74.0 → 1.75.1

package/dist/node.js

@@ -736,9 +736,11 @@ var KernelPipe = class {
 // src/kernel/fd-table.ts
 var KernelError = class extends Error {
   code;
-  constructor(code) {
+  detail;
+  constructor(code, detail) {
     super(code);
     this.code = code;
+    if (detail !== void 0) this.detail = detail;
   }
 };
 function pollFile(file) {
@@ -881,6 +883,7 @@ function kernelFdKind(file) {
   if (file.heldMeta && "device" in file.heldMeta) return "device";
   if (file.tty) return "tty";
   if (file.sealed) return "sealed";
+  if (file.clipboard) return "clipboard";
   return file.seek ? "file" : "stream";
 }
 var FdTable = class _FdTable {
@@ -3425,6 +3428,7 @@ async function positioned(handle, op) {
 function isHandle(child) {
   return "kind" in child;
 }
+var FILE_TIMES_MS = 100;
 var OpfsFs = class {
   root;
   meta;
@@ -3695,8 +3699,50 @@ var OpfsFs = class {
     const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
     return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
   }
+  id = crypto.randomUUID();
   dirTimes = /* @__PURE__ */ new Map();
   dirDirty = /* @__PURE__ */ new Set();
+  fileTimes = /* @__PURE__ */ new Map();
+  written(target) {
+    this.committed(target);
+    if (!this.ranged) return;
+    this.fileTimes.set(target, Date.now());
+    this.scheduleFileTimes();
+  }
+  scheduleFileTimes() {
+    if (this.flushing.file || this.fileTimes.size === 0) return;
+    this.flushing.file = setTimeout(() => {
+      void this.flushFileTimes().catch(() => void 0).finally(() => {
+        this.flushing.file = void 0;
+        this.scheduleFileTimes();
+      });
+    }, FILE_TIMES_MS);
+    this.flushing.file.unref?.();
+  }
+  async flushFileTimes() {
+    for (const [path, ms] of [...this.fileTimes]) {
+      const mtimeFor = await this.modified(path).catch(() => 0);
+      await this.meta.update(
+        path,
+        (entry) => this.fileTimes.get(path) !== ms || this.explicitWins(entry, ms) ? entry : { ...entry, path, mtimeMs: ms, mtimeFor, ctimeMs: ms }
+      );
+      if (this.fileTimes.get(path) === ms) this.fileTimes.delete(path);
+    }
+  }
+  timesOf(path) {
+    return this.dirTimes.get(path) ?? this.fileTimes.get(path);
+  }
+  explicitWins(entry, ms) {
+    if (entry?.timesAt === void 0 || entry.timesBy === this.id) return false;
+    return entry.timesAt >= ms;
+  }
+  movePending(from, to) {
+    for (const [path, ms] of [...this.fileTimes]) {
+      if (!within2(path, from)) continue;
+      this.fileTimes.delete(path);
+      if (to !== void 0) this.fileTimes.set(to + path.slice(from.length), ms);
+    }
+  }
   flushing = {};
   touch(...dirs) {
     const now = Date.now();
@@ -3720,11 +3766,10 @@ var OpfsFs = class {
       if (this.dirTimes.get(path) === ms) this.dirTimes.delete(path);
     }
   }
-  async statOf(path, handle, meta) {
+  async statOf(path, handle, meta, touched) {
     const directory = handle.kind === "directory";
     const file = directory ? void 0 : await handle.getFile();
     const modified = file?.lastModified ?? 0;
-    const touched = directory ? this.dirTimes.get(path) : void 0;
     const kept = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
     const mtime = touched ?? kept;
     return {
@@ -3756,13 +3801,14 @@ var OpfsFs = class {
   }
   async describe(found) {
     if (found.link) return this.owned(this.linkStat(found.link), found.path, found.link);
+    const touched = this.timesOf(found.path);
     if (!this.owners) {
       const [meta2] = await this.meta.get([found.path]);
-      return this.statOf(found.path, found.handle, meta2);
+      return this.statOf(found.path, found.handle, meta2, touched);
     }
     const entries = await this.meta.get(chain(found.path));
     const meta = entries.pop();
-    const stat = await this.statOf(found.path, found.handle, meta);
+    const stat = await this.statOf(found.path, found.handle, meta, touched);
     return { ...stat, ...ownOf(meta) ?? inherit(entries) };
   }
   async stat(path) {
@@ -3819,13 +3865,14 @@ var OpfsFs = class {
   async pwrite(path, offset, bytes) {
     const [handle, , target] = await this.fileFor(path);
     await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
-    this.committed(target);
+    this.written(target);
   }
   async truncate(path, size) {
     const handle = await this.existing(path, true);
-    const target = this.remote?.watched() ? (await this.locate(path, true)).path : path;
+    const resolve = this.ranged || this.remote?.watched();
+    const target = resolve ? (await this.locate(path, true)).path : path;
     await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
-    this.committed(target);
+    this.written(target);
   }
   async writeSession(path, truncate) {
     const [handle, , target] = await this.fileFor(path);
@@ -3915,13 +3962,16 @@ var OpfsFs = class {
   async readdirStat(path) {
     const [dir, children2] = await this.listing(path);
     const base = dir === "/" ? "" : dir;
+    const touched = children2.map(([name2]) => this.timesOf(`${base}/${name2}`));
     const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
     const handed2 = this.owners ? await this.handedTo(dir) : void 0;
     const owned4 = (stat, entry) => handed2 ? { ...stat, ...ownOf(entry) ?? handed2 } : stat;
     return Promise.all(
       children2.map(async ([name2, child], i) => {
         if (!isHandle(child)) return [name2, owned4(this.linkStat(child), child)];
-        const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
+        const stat = await this.statOf(`${base}/${name2}`, child, metas[i], touched[i]).catch(
+          () => null
+        );
         return [name2, stat && owned4(stat, metas[i])];
       })
     );
@@ -3979,6 +4029,7 @@ var OpfsFs = class {
         throw translate(err, path);
       }
       this.changed(found.path);
+      this.movePending(found.path);
     }
     await this.meta.remove([found.path]);
     this.touch(parentOf4(found.path));
@@ -4042,6 +4093,7 @@ var OpfsFs = class {
     const moved2 = await this.place(source.handle, dir, staging);
     if (swap) await this.rm(destination, { recursive: true });
     await this.meta.move(source.path, destination, carry);
+    this.movePending(source.path, destination);
     if (!moved2) await this.rm(source.path, { recursive: true });
     let copied = !moved2;
     if (swap) {
@@ -4163,6 +4215,7 @@ var OpfsFs = class {
     const handle = found.handle;
     const file = handle.kind === "file" ? await handle.getFile() : void 0;
     this.dirTimes.delete(found.path);
+    this.fileTimes.delete(found.path);
     const ctimeMs = Date.now();
     await this.meta.update(found.path, (entry) => ({
       ...entry,
@@ -4171,7 +4224,8 @@ var OpfsFs = class {
       mtimeMs: mtime.getTime(),
       mtimeFor: file?.lastModified ?? 0,
       ctimeMs,
-      timesAt: ctimeMs
+      timesAt: ctimeMs,
+      timesBy: this.id
     }));
   }
   async reconcile() {
@@ -6070,6 +6124,173 @@ var ChildTable = class {
   }
 };
 
+// src/kernel/clipboard.ts
+var CLIPBOARD_MAX_BYTES = 1024 * 1024;
+var CLIPBOARD_TIMEOUT_MS = 1e4;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var READY = { readable: true, writable: true, hangup: false };
+function lineOf(err) {
+  const text = err instanceof Error ? err.message : String(err);
+  return (text.split("\n")[0] ?? "").slice(0, 200);
+}
+function clipboardFailure(err) {
+  if (err instanceof KernelError) return err;
+  const name2 = err?.name;
+  return new KernelError(name2 === "NotAllowedError" ? "EACCES" : "EIO", lineOf(err));
+}
+function joined2(chunks2, size) {
+  if (chunks2.length === 1) return chunks2[0];
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const chunk2 of chunks2) {
+    out.set(chunk2, at);
+    at += chunk2.length;
+  }
+  return out;
+}
+async function interruptible(work, signal) {
+  if (!signal) return work;
+  if (signal.aborted) throw new KernelError("EINTR");
+  let stop = () => {
+  };
+  const interrupted2 = new Promise((_, reject) => {
+    stop = () => reject(new KernelError("EINTR"));
+    signal.addEventListener("abort", stop, { once: true });
+  });
+  try {
+    return await Promise.race([work, interrupted2]);
+  } finally {
+    signal.removeEventListener("abort", stop);
+  }
+}
+var ClipboardChannel = class {
+  stamp;
+  access;
+  broker;
+  snapshot;
+  taken;
+  offset = 0;
+  chunks = [];
+  size = 0;
+  wrote = false;
+  failed = false;
+  constructor(broker, access2, stamp) {
+    this.broker = broker;
+    this.access = access2;
+    this.stamp = stamp;
+  }
+  get unread() {
+    return this.taken === void 0 && this.snapshot === void 0;
+  }
+  get settled() {
+    return this.taken !== void 0;
+  }
+  async read(max, signal) {
+    if (this.access === "write") throw new KernelError("EBADF");
+    if (!this.taken) {
+      if (!this.snapshot) {
+        const stamp = this.stamp;
+        const asked = this.broker.ask(async (hook) => {
+          const text = await hook.read(stamp);
+          if (typeof text !== "string") throw new KernelError("EIO", "the clipboard gave no text");
+          return encoder.encode(text);
+        });
+        this.snapshot = asked;
+        asked.then(
+          (bytes) => {
+            if (this.snapshot === asked) this.taken = bytes;
+          },
+          () => {
+            if (this.snapshot === asked) this.snapshot = void 0;
+          }
+        );
+      }
+      this.taken = await interruptible(this.snapshot, signal);
+    }
+    const out = this.taken.subarray(this.offset, this.offset + max);
+    this.offset += out.length;
+    return out;
+  }
+  write(bytes) {
+    if (this.access === "read") throw new KernelError("EBADF");
+    this.wrote = true;
+    if (this.failed) throw new KernelError("EFBIG");
+    if (this.size + bytes.length > CLIPBOARD_MAX_BYTES) {
+      this.failed = true;
+      this.chunks = [];
+      this.size = 0;
+      throw new KernelError("EFBIG");
+    }
+    if (bytes.length > 0) this.chunks.push(bytes.slice());
+    this.size += bytes.length;
+    return bytes.length;
+  }
+  poll() {
+    return READY;
+  }
+  async close() {
+    this.snapshot = void 0;
+    this.taken = void 0;
+    const commits = this.access === "write" || this.access === "both" && this.wrote;
+    if (!commits || this.failed) return;
+    const bytes = joined2(this.chunks, this.size);
+    this.chunks = [];
+    this.size = 0;
+    let text;
+    try {
+      text = decoder.decode(bytes);
+    } catch {
+      throw new KernelError("EILSEQ", "the text is not valid UTF-8");
+    }
+    const stamp = this.stamp;
+    await this.broker.ask(async (hook) => {
+      await hook.write(text, stamp);
+    });
+  }
+};
+var ClipboardBroker = class {
+  hook;
+  users;
+  timeoutMs;
+  tagOf;
+  constructor(hook, users, timeoutMs = CLIPBOARD_TIMEOUT_MS, tagOf = () => void 0) {
+    this.hook = hook;
+    this.users = users;
+    this.timeoutMs = timeoutMs;
+    this.tagOf = tagOf;
+  }
+  async ask(work) {
+    const hook = this.hook;
+    if (!hook) throw new KernelError("ENOTSUP", "no clipboard in this embedder");
+    let timer;
+    const late = new Promise((_, reject) => {
+      timer = setTimeout(
+        () => reject(new KernelError("EIO", "clipboard timed out")),
+        this.timeoutMs
+      );
+    });
+    const asked = Promise.resolve().then(() => work(hook)).catch((err) => {
+      throw clipboardFailure(err);
+    });
+    try {
+      return await Promise.race([asked, late]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  open(access2, stamp) {
+    const channel = new ClipboardChannel(this, access2, stamp);
+    return new OpenFile({
+      read: (max, signal) => channel.read(max, signal),
+      write: async (bytes) => channel.write(bytes),
+      poll: () => channel.poll(),
+      close: () => channel.close(),
+      clipboard: channel
+    });
+  }
+};
+
 // src/mount/protocol.ts
 var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
@@ -7607,20 +7828,20 @@ var SAB_DEFAULT_WINDOW_BYTES = 1024 * 1024;
 var SAB_MIN_BYTES = SAB_HEADER_BYTES + 4096;
 var SYNC_SAB_REQ_MSG = "sync-sab-req";
 var SYNC_SAB_NEXT_MSG = "sync-sab-next";
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+var decoder2 = new TextDecoder();
 function encodeSabResult(result) {
   if (!result.ok) {
     return {
       status: SAB_STATUS_ERRNO,
-      payload: encoder.encode(JSON.stringify({ errno: result.errno, message: result.message }))
+      payload: encoder2.encode(JSON.stringify({ errno: result.errno, message: result.message }))
     };
   }
   switch (result.kind) {
     case "bytes":
       return { status: SAB_STATUS_BYTES, payload: result.bytes };
     case "json":
-      return { status: SAB_STATUS_JSON, payload: encoder.encode(JSON.stringify(result.json)) };
+      return { status: SAB_STATUS_JSON, payload: encoder2.encode(JSON.stringify(result.json)) };
     default:
       return { status: SAB_STATUS_VOID, payload: new Uint8Array(0) };
   }
@@ -10442,7 +10663,7 @@ function defaultTermios() {
     c_cc: cCc
   };
 }
-var encoder2 = new TextEncoder();
+var encoder3 = new TextEncoder();
 function isContinuation(byte) {
   return (byte & 192) === 128;
 }
@@ -10564,7 +10785,7 @@ var KernelTty = class {
       this.line.push(byte);
       this.readable.push(Uint8Array.from(this.line));
       this.line = [];
-      if (echo) this.output(encoder2.encode("\n"));
+      if (echo) this.output(encoder3.encode("\n"));
     } else {
       this.line.push(byte);
       if (echo) this.echo(byte);
@@ -10589,7 +10810,7 @@ var KernelTty = class {
     const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
     const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
     if (cells > 0 && this.termios.c_lflag & ECHO) {
-      this.output(encoder2.encode("\b \b".repeat(cells)), false);
+      this.output(encoder3.encode("\b \b".repeat(cells)), false);
     }
   }
   echo(byte) {
@@ -11078,7 +11299,7 @@ async function socketSyscall(req, proc) {
         dialing?.catch(() => void 0);
         throw new KernelError("EINPROGRESS");
       }
-      if (dialing !== void 0) await interruptible(dialing, proc.blocking());
+      if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
       return ok();
     }
     case "sock-shutdown":
@@ -11102,7 +11323,7 @@ async function socketSyscall(req, proc) {
     }
   }
 }
-function interruptible(dialing, signal) {
+function interruptible2(dialing, signal) {
   return new Promise((resolve, reject) => {
     const abort = () => reject(new KernelError("EINTR"));
     signal.addEventListener("abort", abort, { once: true });
@@ -11769,6 +11990,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-tty-names",
   "fd-tty-owner",
   "fd-open-sealed",
+  "fd-open-clipboard",
   "tty-get",
   "tty-set",
   "tty-winsz",
@@ -12011,7 +12233,7 @@ var WasmProcess = class {
       return await this.procSyscall(req, cancelled);
     } catch (e) {
       if (e instanceof KernelError || e instanceof SpawnError) {
-        return { ok: false, errno: e.code, message: e.code };
+        return { ok: false, errno: e.code, message: e.detail ?? e.code };
       }
       const code = e?.code;
       if (typeof code === "string" && /^E[A-Z]+$/.test(code)) {
@@ -12054,6 +12276,7 @@ var WasmProcess = class {
     const read = req.peek ? file.peek : file.read;
     if (!read) throw new KernelError(req.peek && file.read ? "EOPNOTSUPP" : "EBADF");
     if (file.tty) this.checkForeground(file.tty);
+    if (file.clipboard) return this.readClipboard(file.clipboard, req, cancelled);
     if (req.max <= 0) return new Uint8Array(0);
     if (file instanceof KernelSocket && file.unconnected) throw new KernelError("ENOTCONN");
     const ready2 = pollFile(file).readable;
@@ -12061,6 +12284,13 @@ var WasmProcess = class {
     const signal = ready2 ? this.interrupt.signal : this.blockingSignal(cancelled);
     return read.call(file, Math.max(0, Math.min(req.max, MAX_READ)), signal);
   }
+  async readClipboard(channel, req, cancelled) {
+    if (channel.access === "write") throw new KernelError("EBADF");
+    if (req.max <= 0) return new Uint8Array(0);
+    if (channel.unread) channel.stamp = await this.clipboardStamp();
+    const signal = channel.settled ? this.interrupt.signal : this.blockingSignal(cancelled);
+    return channel.read(Math.min(req.max, MAX_READ), signal);
+  }
   async write(fd, body, nonblock = false, cancelled) {
     const file = this.fds.get(fd).file;
     if (file.sealed) return file.sealed.send(body, await this.sealedCaller(), this.gone.signal);
@@ -12164,6 +12394,36 @@ var WasmProcess = class {
     if (!broker) throw new KernelError("ENOENT");
     return this.fds.install(broker.open(), 3);
   }
+  async openClipboard(flags2) {
+    const broker = this.options.clipboard;
+    if (!broker) throw new KernelError("ENOENT");
+    const mode = flags2 & WRITE_ACCESS;
+    const access2 = mode === 0 ? "read" : mode === 1 ? "write" : "both";
+    return this.fds.install(broker.open(access2, await this.clipboardStamp()), 3);
+  }
+  async clipboardStamp() {
+    const shown = await this.options.identity?.();
+    const broker = this.options.clipboard;
+    const tag = broker.tagOf(this.pid);
+    return {
+      pid: shown?.pid ?? this.pid,
+      uid: this.cred.euid,
+      gid: this.cred.egid,
+      users: broker.users,
+      ...tag !== void 0 ? { tag } : {}
+    };
+  }
+  async stampClipboards() {
+    if (!this.options.clipboard) return;
+    const open = this.fds.numbers().filter((fd) => this.fds.get(fd).file.clipboard);
+    if (open.length === 0) return;
+    const stamp = await this.clipboardStamp().catch(() => void 0);
+    if (!stamp) return;
+    for (const fd of open) {
+      const channel = this.fds.get(fd).file.clipboard;
+      if (channel) channel.stamp = stamp;
+    }
+  }
   async sealedCaller() {
     const shown = await this.options.identity?.();
     const broker = this.options.sealed;
@@ -12238,10 +12498,13 @@ var WasmProcess = class {
           kind: "json",
           json: await this.write(req.fd, req.body, req.nonblock, cancelled)
         };
-      case "fd-close":
+      case "fd-close": {
         this.options.locks?.closed(this.pid, req.fd);
+        const channel = this.fds.get(req.fd).file.clipboard;
+        if (channel) channel.stamp = await this.clipboardStamp();
         await Promise.resolve(this.fds.close(req.fd));
         return { ok: true, kind: "void" };
+      }
       case "fd-pipe": {
         const pipe = openPipe();
         const read = this.fds.install(pipe.read, 3);
@@ -12299,6 +12562,8 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: this.options.jobs?.terminalNames() ?? [] };
       case "fd-open-sealed":
         return { ok: true, kind: "json", json: this.openSealed() };
+      case "fd-open-clipboard":
+        return { ok: true, kind: "json", json: await this.openClipboard(req.flags) };
       case "fd-tty-owner":
         return { ok: true, kind: "json", json: this.terminalByName(req.name).owner ?? null };
       case "fd-select": {
@@ -12750,6 +13015,7 @@ var WasmProcess = class {
     this.options.locks?.release(this.pid);
     this.asyncOps.close();
     for (const pid of this.children.pids()) this.options.onReap?.(pid);
+    await this.stampClipboards();
     await this.fds.closeAll();
     if (!this.options.nodes) this.options.openFiles?.delete(this.nodes);
     await this.options.http?.closeAll();
@@ -12932,6 +13198,7 @@ function processOptions(opts, header4, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
+    ...opts.clipboard ? { clipboard: opts.clipboard } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
@@ -13436,14 +13703,14 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "cancel",
   "materialize"
 ]);
-var encoder3 = new TextEncoder();
-var decoder2 = new TextDecoder("utf-8", { fatal: true });
+var encoder4 = new TextEncoder();
+var decoder3 = new TextDecoder("utf-8", { fatal: true });
 function parseSealed(bytes) {
   try {
     if (bytes.length > SEALED_MAX_BYTES) throw new KernelError("EMSGSIZE");
     let parsed2;
     try {
-      parsed2 = JSON.parse(decoder2.decode(bytes));
+      parsed2 = JSON.parse(decoder3.decode(bytes));
     } catch {
       throw new KernelError("EINVAL");
     }
@@ -13469,13 +13736,13 @@ function serialized(reply) {
     const text = JSON.stringify(reply);
     plain = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
-    return JSON.stringify(errorReply("EIO", lineOf(err)));
+    return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
   if (!isRecord(plain)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
   const { v: _, ...rest2 } = plain;
   return JSON.stringify({ v: 1, ...rest2 });
 }
-function lineOf(err) {
+function lineOf2(err) {
   const text = err instanceof Error ? err.message : String(err);
   return (text.split("\n")[0] ?? "").slice(0, 200);
 }
@@ -13505,7 +13772,7 @@ var SealedChannel = class {
       gone.removeEventListener("abort", withdraw);
       if (this.inflight !== flight) return;
       this.inflight = void 0;
-      if (reply) this.reply = encoder3.encode(serialized(reply));
+      if (reply) this.reply = encoder4.encode(serialized(reply));
     });
     this.inflight = flight;
     return length2;
@@ -13519,7 +13786,7 @@ var SealedChannel = class {
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
       (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf(err))
+      (err) => errorReply("EIO", lineOf2(err))
     );
     const reply = await Promise.race([asked, stopped]);
     if (!signal.aborted) return reply;
@@ -14242,13 +14509,13 @@ var HostfsClient = class {
     const response = await this.send("/api/hostfs/watch", { method: "POST", signal });
     onOpen();
     const reader = response.body.getReader();
-    const decoder3 = new TextDecoder();
+    const decoder4 = new TextDecoder();
     let buffered = "";
     try {
       for (; ; ) {
         const { done: done4, value } = await reader.read();
         if (done4) return;
-        buffered += decoder3.decode(value, { stream: true });
+        buffered += decoder4.decode(value, { stream: true });
         let end = buffered.indexOf("\n");
         while (end >= 0) {
           const line = buffered.slice(0, end).trim();
@@ -15730,7 +15997,7 @@ var LAYOUT = [
 ];
 var LOAD_SAMPLE_MS = 5e3;
 var LOAD_WINDOWS_MS = [6e4, 3e5, 9e5];
-var encoder4 = new TextEncoder();
+var encoder5 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
   if (USERS_MODES.includes(mode)) return mode;
@@ -15887,6 +16154,7 @@ var Launcher = class {
   usersMode;
   dac;
   sealed;
+  clipboard;
   rootFs;
   fileWatches;
   nextPid = 1e3;
@@ -15897,6 +16165,12 @@ var Launcher = class {
     this.rootFs = options.fs;
     this.dac = this.usersMode === "off" ? void 0 : new Dac(this.usersMode, options.onDenial);
     if (this.dac) this.dac.tagOf = (pid) => this.tagOf(pid);
+    this.clipboard = new ClipboardBroker(
+      options.clipboard,
+      this.usersMode,
+      void 0,
+      (pid) => this.tagOf(pid)
+    );
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -16313,6 +16587,7 @@ var Launcher = class {
       cred: req.cred,
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
+      clipboard: this.clipboard,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
       argv0: req.argv0,
@@ -17073,7 +17348,7 @@ var Launcher = class {
       },
       account
     );
-    const report = (message3) => options.onData(encoder4.encode(`${message3}\r
+    const report = (message3) => options.onData(encoder5.encode(`${message3}\r
 `));
     const handle = await this.launch(planned, {
       env,
@@ -17110,7 +17385,7 @@ var Launcher = class {
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message3) => stderr(encoder4.encode(`${message3}
+    const report = (message3) => stderr(encoder5.encode(`${message3}
 `));
     if (!planned) {
       report(`${file}: command not found`);
@@ -17647,7 +17922,7 @@ function dialStream(port, onClose) {
 
 // src/client/loopback-fetch.ts
 var OWN_HEADERS = /* @__PURE__ */ new Set(["host", "connection", "content-length", "transfer-encoding"]);
-var encoder5 = new TextEncoder();
+var encoder6 = new TextEncoder();
 var latin12 = new TextDecoder("latin1");
 var ByteSource = class {
   buffered = new Uint8Array(0);
@@ -17658,14 +17933,14 @@ var ByteSource = class {
   async more() {
     const { done: done4, value } = await this.reader.read();
     if (done4) return false;
-    const joined2 = new Uint8Array(this.buffered.length + value.length);
-    joined2.set(this.buffered);
-    joined2.set(value, this.buffered.length);
-    this.buffered = joined2;
+    const joined3 = new Uint8Array(this.buffered.length + value.length);
+    joined3.set(this.buffered);
+    joined3.set(value, this.buffered.length);
+    this.buffered = joined3;
     return true;
   }
   async until(marker) {
-    const needle = encoder5.encode(marker);
+    const needle = encoder6.encode(marker);
     for (; ; ) {
       const at = indexOf(this.buffered, needle);
       if (at >= 0) return this.take(at + needle.length);
@@ -17773,7 +18048,7 @@ async function requestBytes(request) {
   });
   if (body) lines2.push(`Content-Length: ${body.length}`);
   lines2.push("Connection: close", "", "");
-  const head = encoder5.encode(lines2.join("\r\n"));
+  const head = encoder6.encode(lines2.join("\r\n"));
   const out = new Uint8Array(head.length + (body?.length ?? 0));
   out.set(head);
   if (body) out.set(body, head.length);
@@ -17827,8 +18102,8 @@ var KernelCallError = class extends Error {
     this.code = code;
   }
 };
-var encoder6 = new TextEncoder();
-var bytesOf2 = (data) => typeof data === "string" ? encoder6.encode(data) : data;
+var encoder7 = new TextEncoder();
+var bytesOf2 = (data) => typeof data === "string" ? encoder7.encode(data) : data;
 var UNAVAILABLE = {
   manualRedirects: false,
   encodedBodies: false,
@@ -18246,8 +18521,8 @@ function nodeWorker(file, live, closed) {
 }
 function textOf(on) {
   if (!on) return void 0;
-  const decoder3 = new TextDecoder();
-  return (bytes) => on(decoder3.decode(bytes, { stream: true }));
+  const decoder4 = new TextDecoder();
+  return (bytes) => on(decoder4.decode(bytes, { stream: true }));
 }
 async function createNodeKernel(options = {}) {
   const root = options.root ?? memoryRoot();
@@ -18282,6 +18557,7 @@ async function createNodeKernel(options = {}) {
     ...options.onDenial ? { onDenial: options.onDenial } : {},
     ...options.protect ? { protect: options.protect } : {},
     ...options.sealed ? { sealed: options.sealed } : {},
+    ...options.clipboard ? { clipboard: options.clipboard } : {},
     ...options.approve ? { approve: options.approve } : {}
   });
   await launcher.prepare();
@@ -18290,7 +18566,7 @@ async function createNodeKernel(options = {}) {
     pending.add(reject);
     work().then(resolve, reject).finally(() => pending.delete(reject));
   });
-  const decoder3 = new TextDecoder();
+  const decoder4 = new TextDecoder();
   return {
     root,
     async run(argv, opts = {}) {
@@ -18307,8 +18583,8 @@ async function createNodeKernel(options = {}) {
       );
       return {
         status: result.status,
-        stdout: decoder3.decode(result.stdout),
-        stderr: decoder3.decode(result.stderr)
+        stdout: decoder4.decode(result.stdout),
+        stderr: decoder4.decode(result.stderr)
       };
     },
     async openTerminal(argv, opts = {}) {