@ai-ecoverse/slicc-kernel 1.81.0 → 1.83.0

package/dist/node.js

@@ -28,7 +28,7 @@ function serveCdpPort(port, hook, request, onDone) {
     }
   });
   port.start?.();
-  new Promise((resolve) => resolve(hook(request))).then(
+  new Promise((resolve2) => resolve2(hook(request))).then(
     (opened2) => {
       conn = opened2;
       if (done4) return opened2.close();
@@ -51,7 +51,7 @@ function serveCdpPort(port, hook, request, onDone) {
   };
 }
 function portCdpHook(ask, gone) {
-  return (request) => new Promise((resolve, reject) => {
+  return (request) => new Promise((resolve2, reject) => {
     const { port1, port2 } = new MessageChannel();
     let closed = false;
     const conn = {
@@ -69,7 +69,7 @@ function portCdpHook(ask, gone) {
     };
     port1.addEventListener("message", ({ data }) => {
       if ("m" in data) conn.onmessage?.(data.m);
-      else if ("open" in data) resolve(conn);
+      else if ("open" in data) resolve2(conn);
       else if ("error" in data) {
         closed = true;
         port1.close();
@@ -671,9 +671,9 @@ var KernelPipe = class {
     let filled = 0;
     for (const chunk2 of this.chunks) {
       if (filled === out.length) break;
-      const count = Math.min(chunk2.length, out.length - filled);
-      out.set(chunk2.subarray(0, count), filled);
-      filled += count;
+      const count2 = Math.min(chunk2.length, out.length - filled);
+      out.set(chunk2.subarray(0, count2), filled);
+      filled += count2;
     }
     return out;
   }
@@ -704,25 +704,25 @@ var KernelPipe = class {
     let filled = 0;
     while (filled < n) {
       const head = this.chunks[0];
-      const count = Math.min(head.length, n - filled);
-      out.set(head.subarray(0, count), filled);
-      filled += count;
-      if (count === head.length) this.chunks.shift();
-      else this.chunks[0] = head.subarray(count);
+      const count2 = Math.min(head.length, n - filled);
+      out.set(head.subarray(0, count2), filled);
+      filled += count2;
+      if (count2 === head.length) this.chunks.shift();
+      else this.chunks[0] = head.subarray(count2);
     }
     this.size -= n;
     return out;
   }
   changed(signal) {
     if (signal?.aborted) return Promise.reject(new PipeError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new PipeError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -731,7 +731,7 @@ var KernelPipe = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 
@@ -1192,14 +1192,14 @@ var Changes = class {
   waiters = [];
   wait(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new KernelError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -1208,7 +1208,7 @@ var Changes = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 function link(a, b) {
@@ -1376,7 +1376,7 @@ var KernelSocket = class _KernelSocket {
     });
     const { host, port } = addr;
     const dialled = new Promise(
-      (resolve) => resolve(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
+      (resolve2) => resolve2(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
     );
     dialled.then(
       (conn) => abort.signal.aborted && conn.close(),
@@ -1747,8 +1747,8 @@ var MessageQueue = class {
     this.overflow = overflow;
     this.limit = limit;
     this.taken = taken;
-    this.closed = new Promise((resolve) => {
-      this.settle = resolve;
+    this.closed = new Promise((resolve2) => {
+      this.settle = resolve2;
     });
   }
   push(message3) {
@@ -1787,8 +1787,8 @@ var MessageQueue = class {
         continue;
       }
       if (this.ended) return;
-      await new Promise((resolve) => {
-        this.waiter = resolve;
+      await new Promise((resolve2) => {
+        this.waiter = resolve2;
       });
     }
   }
@@ -1837,7 +1837,7 @@ function openWebSocket(Socket, request, withHeaders) {
   }
   socket.binaryType = "arraybuffer";
   const queue = new MessageQueue(() => socket.close(1e3, "too many waiting messages"));
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let open = false;
     let settled = false;
     const fail3 = (error) => {
@@ -1856,7 +1856,7 @@ function openWebSocket(Socket, request, withHeaders) {
       open = true;
       settled = true;
       signal.removeEventListener("abort", abort);
-      resolve({
+      resolve2({
         protocol: socket.protocol,
         get buffered() {
           return socket.bufferedAmount;
@@ -2047,8 +2047,8 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const relay = async (nid, socket) => {
     let ending;
     let late;
-    const unanswered = new Promise((resolve) => {
-      late = () => resolve("late");
+    const unanswered = new Promise((resolve2) => {
+      late = () => resolve2("late");
     });
     const flow = {
       inflight: 0,
@@ -2076,8 +2076,8 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         }
         flow.inflight += payloadSize(data);
         while (flow.inflight > INBOUND_LIMIT && !flow.closing) {
-          await new Promise((resolve) => {
-            flow.wake = resolve;
+          await new Promise((resolve2) => {
+            flow.wake = resolve2;
           });
         }
       }
@@ -2096,7 +2096,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
     if (!socket) return;
     socket.send(call.data);
     while (socket.buffered > SEND_BUFFER && sockets.has(call.nid)) {
-      await new Promise((resolve) => setTimeout(resolve, 10));
+      await new Promise((resolve2) => setTimeout(resolve2, 10));
     }
     peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
   };
@@ -3033,6 +3033,97 @@ var MemoryMeta = class {
   }
 };
 
+// src/fs/integrity.ts
+var KERNEL_CALLER = { pid: 0, uid: 0 };
+function integrityOptions(options) {
+  if (options && typeof options.lookup !== "function") {
+    throw new TypeError("protect.integrity.lookup must be a function");
+  }
+  integrityUnknown(options);
+}
+function integrityUnknown(options) {
+  const unknown = options?.unknown ?? "allow";
+  if (unknown !== "allow" && unknown !== "deny") {
+    throw new TypeError("protect.integrity.unknown must be 'allow' or 'deny'");
+  }
+  return unknown;
+}
+function hex(digest) {
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256(bytes) {
+  return hex(await crypto.subtle.digest("SHA-256", bytes));
+}
+var Integrity = class {
+  prefixes;
+  root;
+  lookup;
+  unknown;
+  report;
+  unverified = /* @__PURE__ */ new Set();
+  constructor(prefixes2, root, options, report) {
+    this.prefixes = prefixes2;
+    this.root = root;
+    this.lookup = options.lookup;
+    this.unknown = integrityUnknown(options);
+    this.report = report;
+  }
+  async real(path) {
+    const at = normalizePath(path);
+    const real = await this.root.realpath?.(at, true).catch(() => void 0) ?? at;
+    return isProtected(this.prefixes, real) ? real : void 0;
+  }
+  async key(path) {
+    const real = await this.real(path);
+    if (real === void 0 || !this.root.version) return void 0;
+    return `${real}\0${await this.root.version(real)}`;
+  }
+  async read(path, caller, plain) {
+    return (await this.readKeyed(path, caller, plain)).bytes;
+  }
+  async readKeyed(path, caller, plain) {
+    const real = await this.real(path);
+    if (real === void 0) return { bytes: await plain() };
+    const read = this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const { bytes } = read;
+    const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
+    const actual = await sha256(bytes);
+    const denial = { pid: caller.pid, uid: caller.uid, path: real, actual };
+    const tagged = caller.tag !== void 0 ? { tag: caller.tag } : {};
+    let expected;
+    try {
+      expected = await this.expected(real);
+    } catch {
+      this.say({ ...denial, ...tagged, op: "exec-integrity", errno: "EACCES" });
+      throw fsError("EACCES", `integrity lookup failed: ${real}`);
+    }
+    if (expected === void 0) {
+      if (this.unknown === "allow") {
+        if (!this.unverified.has(real)) {
+          this.unverified.add(real);
+          this.say({ ...denial, ...tagged, op: "exec-unverified", errno: "ENODATA" });
+        }
+        return keyed;
+      }
+    } else if (expected === actual) {
+      return keyed;
+    }
+    const known = expected !== void 0 ? { expected } : {};
+    this.say({ ...denial, ...tagged, ...known, op: "exec-integrity", errno: "EACCES" });
+    throw fsError("EACCES", `integrity check failed: ${real}`);
+  }
+  async expected(path) {
+    const answer = await this.lookup(path);
+    return typeof answer === "string" ? answer.toLowerCase() : void 0;
+  }
+  say(event) {
+    try {
+      this.report(event);
+    } catch {
+    }
+  }
+};
+
 // src/fs/protect.ts
 function writerTags(protection) {
   const writers = protection?.writers ?? [];
@@ -3313,11 +3404,11 @@ var RemoteWatch = class {
     const seq2 = ++this.seq;
     this.channel.postMessage({ tab: this.tab, paths: this.mine, seq: seq2 });
     if (this.peers.size === 0) return Promise.resolve();
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const done4 = () => {
         clearTimeout(timer);
         this.waiting.delete(seq2);
-        resolve();
+        resolve2();
       };
       const timer = setTimeout(() => {
         done4();
@@ -3413,7 +3504,7 @@ async function openSync(handle) {
       const delay = SYNC_BACKOFF_MS[attempt];
       if (!LOCKED.has(err?.name)) throw err;
       if (delay === void 0) return void 0;
-      await new Promise((resolve) => setTimeout(resolve, delay));
+      await new Promise((resolve2) => setTimeout(resolve2, delay));
     }
   }
 }
@@ -3866,7 +3957,7 @@ var OpfsFs = class {
         const again = name2 === "NotReadableError" || locks && LOCKED.has(name2);
         if (!again || attempt >= READ_ATTEMPTS)
           throw translate(err, path, locks ? "write" : "read");
-        await new Promise((resolve) => setTimeout(resolve, attempt * 10));
+        await new Promise((resolve2) => setTimeout(resolve2, attempt * 10));
       }
     }
   }
@@ -3885,6 +3976,29 @@ var OpfsFs = class {
       false
     );
   }
+  async readVersioned(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => {
+        const file = await handle.getFile();
+        const bytes = new Uint8Array(await file.arrayBuffer());
+        return { bytes, version: `${file.lastModified}:${file.size}` };
+      },
+      false
+    );
+  }
+  async version(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => {
+        const file = await handle.getFile();
+        return `${file.lastModified}:${file.size}`;
+      },
+      false
+    );
+  }
   async pread(path, offset, length2) {
     const handle = await this.existing(path);
     return this.retrying(
@@ -3900,8 +4014,8 @@ var OpfsFs = class {
   }
   async truncate(path, size) {
     const handle = await this.existing(path, true);
-    const resolve = this.ranged || this.remote?.watched();
-    const target = resolve ? (await this.locate(path, true)).path : path;
+    const resolve2 = this.ranged || this.remote?.watched();
+    const target = resolve2 ? (await this.locate(path, true)).path : path;
     await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
     this.written(target);
   }
@@ -4341,12 +4455,12 @@ var PathGate = class {
   tails = /* @__PURE__ */ new Map();
   async acquire(path) {
     const prev = this.tails.get(path) ?? Promise.resolve();
-    const { promise, resolve } = Promise.withResolvers();
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
     const tail = prev.then(() => promise);
     this.tails.set(path, tail);
     await prev;
     return () => {
-      resolve();
+      resolve2();
       if (this.tails.get(path) === tail) this.tails.delete(path);
     };
   }
@@ -5110,7 +5224,7 @@ var CdpFacade = class {
     const conn = await this.host(runtime);
     try {
       const reply = await new Promise(
-        (resolve, reject) => {
+        (resolve2, reject) => {
           const timer = setTimeout(
             () => reject(new HttpError(504, "the CDP host did not answer Target.getTargets")),
             this.options.listTimeout ?? LIST_TIMEOUT
@@ -5123,7 +5237,7 @@ var CdpFacade = class {
             const parsed2 = JSON.parse(message3);
             if (parsed2.id !== 1) return;
             clearTimeout(timer);
-            resolve(parsed2);
+            resolve2(parsed2);
           };
           conn.send(JSON.stringify({ id: 1, method: "Target.getTargets" }));
         }
@@ -5183,9 +5297,9 @@ var Relay = class {
   }
   async start(head) {
     await this.send(head);
-    const hostGone = new Promise((resolve) => {
+    const hostGone = new Promise((resolve2) => {
       this.host.onclose = (reason) => {
-        void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve());
+        void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve2());
       };
     });
     this.host.onmessage = (message3) => {
@@ -5199,8 +5313,8 @@ var Relay = class {
     await Promise.race([pumping, hostGone]);
     await this.writes;
     let timer;
-    const waited = new Promise((resolve) => {
-      timer = setTimeout(resolve, this.closeWaitMs);
+    const waited = new Promise((resolve2) => {
+      timer = setTimeout(resolve2, this.closeWaitMs);
     });
     await Promise.race([pumping, waited]);
     clearTimeout(timer);
@@ -5539,7 +5653,7 @@ function owned(path, st) {
 function unchanged(a, b, bytes) {
   return a.ino === b.ino && a.mtime.getTime() === b.mtime.getTime() && a.size === b.size && bytes.length === b.size;
 }
-async function sha256(bytes) {
+async function sha2562(bytes) {
   const digest = new Uint8Array(
     await crypto.subtle.digest("SHA-256", bytes)
   );
@@ -5595,7 +5709,7 @@ async function attest(fs, asked, o) {
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
-      return attested(path, after, bytes, await sha256(bytes), o, parents);
+      return attested(path, after, bytes, await sha2562(bytes), o, parents);
     }
     if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
   }
@@ -5850,16 +5964,16 @@ var FreshModules = class {
         if (head) await decide(path, head);
       };
     }
-    const bound = /* @__PURE__ */ new WeakMap();
+    const bound2 = /* @__PURE__ */ new WeakMap();
     return new Proxy(fs, {
       get(target, key, receiver) {
         if (Object.hasOwn(overrides, key)) return overrides[key];
         const value = Reflect.get(target, key, receiver);
         if (typeof value !== "function") return value;
-        let method = bound.get(value);
+        let method = bound2.get(value);
         if (method === void 0) {
           method = value.bind(target);
-          bound.set(value, method);
+          bound2.set(value, method);
         }
         return method;
       }
@@ -6188,7 +6302,7 @@ var ChildTable = class {
   }
   async nextChange(candidates, flags2, interrupt) {
     let wake;
-    const stateChange = new Promise((resolve) => wake = resolve);
+    const stateChange = new Promise((resolve2) => wake = resolve2);
     const watching = flags2.untraced || flags2.continued;
     if (watching && wake) this.stateChanged.push(wake);
     try {
@@ -6402,6 +6516,65 @@ var ClipboardBroker = class {
   }
 };
 
+// src/kernel/exec-ticket.ts
+var TICKET_ENV = "SLICC_SEALED_TICKET";
+var TICKET_TTL_MS = 3e4;
+var MAX_TICKETS = 256;
+var TICKET = /^[0-9a-f]{32}$/;
+async function argvDigest(argv) {
+  const bytes = new TextEncoder().encode(JSON.stringify(argv));
+  const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+  return [...hash].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function isStrings(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function stringRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const entries = Object.entries(value);
+  return entries.every(([, v]) => typeof v === "string") ? Object.fromEntries(entries) : void 0;
+}
+var TicketBook = class {
+  booked = /* @__PURE__ */ new Map();
+  now;
+  normalise = async (path) => path;
+  constructor(now = Date.now) {
+    this.now = now;
+  }
+  get size() {
+    return this.booked.size;
+  }
+  async record(req, reply, pid) {
+    const { ticket, error } = reply;
+    if (error !== void 0 || typeof ticket !== "string" || !TICKET.test(ticket)) return;
+    const { path, argv, cwd } = req;
+    const entry = {
+      pid,
+      path: await this.normalise(path),
+      requested: path,
+      requestedCwd: cwd,
+      argv: await argvDigest(argv),
+      cwd: await this.normalise(cwd),
+      at: this.now()
+    };
+    this.prune();
+    while (this.booked.size >= MAX_TICKETS)
+      this.booked.delete(this.booked.keys().next().value);
+    this.booked.set(ticket, entry);
+  }
+  take(ticket) {
+    const booked = this.booked.get(ticket);
+    this.booked.delete(ticket);
+    return booked && this.now() - booked.at < TICKET_TTL_MS ? booked : void 0;
+  }
+  prune() {
+    const now = this.now();
+    for (const [ticket, booked] of this.booked) {
+      if (now - booked.at >= TICKET_TTL_MS) this.booked.delete(ticket);
+    }
+  }
+};
+
 // src/mount/protocol.ts
 var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
@@ -6472,7 +6645,7 @@ var DriverConnection = class _DriverConnection {
   call(call, transfer = []) {
     if (this.failure) return Promise.reject(this.failure);
     const id2 = ++this.nextId;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = unref(
         setTimeout(() => {
           this.waiting.delete(id2);
@@ -6485,7 +6658,7 @@ var DriverConnection = class _DriverConnection {
           this.onFail?.(error);
         }, this.timeoutMs)
       );
-      this.waiting.set(id2, { resolve, reject, timer });
+      this.waiting.set(id2, { resolve: resolve2, reject, timer });
       this.port.postMessage({ ...call, id: id2 }, transfer);
     });
   }
@@ -6628,8 +6801,8 @@ var HeldPaths = class extends Map {
       this.keptHandles.delete(handle);
       if (kept) this.letGo(kept);
     }
-    const count = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
-    if (count > 0) this.opens.set(key, count);
+    const count2 = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
+    if (count2 > 0) this.opens.set(key, count2);
     else {
       this.opens.delete(key);
       for (const id2 of this.handlesAt(key)) this.handles.delete(id2);
@@ -6643,8 +6816,8 @@ var HeldPaths = class extends Map {
     return this.lastHandle;
   }
   holdWrite(path, on) {
-    const count = (this.get(path) ?? 0) + (on ? 1 : -1);
-    if (count > 0) this.set(path, count);
+    const count2 = (this.get(path) ?? 0) + (on ? 1 : -1);
+    if (count2 > 0) this.set(path, count2);
     else {
       this.delete(path);
       this.revoked.delete(path);
@@ -6666,18 +6839,18 @@ var HeldPaths = class extends Map {
     for (const path of this.keys()) if (within4(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
-    for (const [path, count] of [...this]) {
+    for (const [path, count2] of [...this]) {
       if (!within4(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
-      this.set(moved2, (this.get(moved2) ?? 0) + count);
+      this.set(moved2, (this.get(moved2) ?? 0) + count2);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
-    for (const [path, count] of [...this.opens]) {
+    for (const [path, count2] of [...this.opens]) {
       if (!within4(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.opens.delete(path);
-      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
+      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count2);
     }
     for (const [id2, key] of this.handles) {
       if (within4(key, from)) this.handles.set(id2, to + key.slice(from.length));
@@ -8998,7 +9171,7 @@ var AsyncOps = class {
     this.wake();
   }
   sleep(timeoutMs, signal) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let timer;
       const cleanup = () => {
         clearTimeout(timer);
@@ -9007,7 +9180,7 @@ var AsyncOps = class {
       };
       const wake = () => {
         cleanup();
-        resolve(true);
+        resolve2(true);
       };
       const abort = () => {
         cleanup();
@@ -9018,7 +9191,7 @@ var AsyncOps = class {
       if (timeoutMs !== void 0) {
         timer = setTimeout(() => {
           cleanup();
-          resolve(false);
+          resolve2(false);
         }, timeoutMs);
       }
     });
@@ -9102,10 +9275,10 @@ var Budget = class {
   async acquire(n, signal) {
     while (this.free < n) {
       signal.throwIfAborted();
-      await new Promise((resolve) => {
+      await new Promise((resolve2) => {
         const done4 = () => {
           signal.removeEventListener("abort", done4);
-          resolve();
+          resolve2();
         };
         this.waiters.push(done4);
         signal.addEventListener("abort", done4, { once: true });
@@ -9247,14 +9420,14 @@ async function watchHangup(conn, abort, until) {
   }
 }
 function untilAborted(response, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const onAbort = () => {
       reject(signal.reason ?? new KernelError("EINTR"));
       response.then((late) => late.cancel()).catch(() => void 0);
     };
     if (signal.aborted) return onAbort();
     signal.addEventListener("abort", onAbort, { once: true });
-    response.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    response.then(resolve2, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
 function plainResponse(status, message3) {
@@ -9287,8 +9460,8 @@ function wireCode(code) {
   return sendableCode(code) ? code : 1011;
 }
 function quietly(ms) {
-  return new Promise((resolve) => {
-    AbortSignal.timeout(ms).addEventListener("abort", () => resolve(), { once: true });
+  return new Promise((resolve2) => {
+    AbortSignal.timeout(ms).addEventListener("abort", () => resolve2(), { once: true });
   });
 }
 var RealmProxy = class {
@@ -9386,7 +9559,7 @@ var RealmProxy = class {
       return false;
     }
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
-    const keep = keepsAlive(req);
+    const keep2 = keepsAlive(req);
     const framing = requestFraming(req.headers);
     const reserve = framing.kind === "length" ? framing.length : framing.kind === "chunked" ? this.cap() : 0;
     if (reserve > this.cap()) throw new HttpError(413, `request body over ${this.cap()} bytes`);
@@ -9409,7 +9582,7 @@ var RealmProxy = class {
       } finally {
         this.bodies.release(reserve);
       }
-      return await this.relay(conn, req.method, req.minor, response, keep);
+      return await this.relay(conn, req.method, req.minor, response, keep2);
     } finally {
       this.stop.signal.removeEventListener("abort", stopExchange);
       abort.abort();
@@ -9457,8 +9630,8 @@ var RealmProxy = class {
       bodiless: bodiless2
     });
     const chunked2 = !bodiless2 && minor >= 1;
-    const keep = keepAlive && (bodiless2 || chunked2);
-    headers.push(["Connection", keep ? "keep-alive" : "close"]);
+    const keep2 = keepAlive && (bodiless2 || chunked2);
+    headers.push(["Connection", keep2 ? "keep-alive" : "close"]);
     if (chunked2) headers.push(["Transfer-Encoding", "chunked"]);
     const signal = this.stop.signal;
     await conn.write(
@@ -9467,7 +9640,7 @@ var RealmProxy = class {
     );
     if (bodiless2) {
       await response.cancel();
-      return keep;
+      return keep2;
     }
     try {
       for await (const piece of response.body) {
@@ -9478,7 +9651,7 @@ var RealmProxy = class {
       return false;
     }
     if (chunked2) await conn.write(LAST_CHUNK, signal);
-    return keep;
+    return keep2;
   }
   async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
@@ -9701,10 +9874,10 @@ function header(der, at) {
   let len = der[at + 1];
   let start2 = at + 2;
   if (len & 128) {
-    const count = len & 127;
+    const count2 = len & 127;
     len = 0;
-    for (let i = 0; i < count; i++) len = len * 256 + der[start2 + i];
-    start2 += count;
+    for (let i = 0; i < count2; i++) len = len * 256 + der[start2 + i];
+    start2 += count2;
   }
   if (start2 + len > der.length) throw new Error("truncated DER");
   return [tag, start2, start2 + len];
@@ -10761,7 +10934,7 @@ var Resolver = class {
 };
 function waitFor(lookup2, signal) {
   lookup2.waiters++;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const abort = () => {
       if (--lookup2.waiters === 0) lookup2.abort.abort(new KernelError("EINTR"));
       reject(new KernelError("EINTR"));
@@ -10771,7 +10944,7 @@ function waitFor(lookup2, signal) {
       if (signal?.aborted) return;
       lookup2.waiters--;
       signal?.removeEventListener("abort", abort);
-      resolve(value);
+      resolve2(value);
     });
   });
 }
@@ -10952,8 +11125,8 @@ var KernelTty = class {
   }
   rubOut(n) {
     const dropped2 = this.line.splice(this.line.length - n, n);
-    const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
-    const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
+    const utf83 = (this.termios.c_iflag & IUTF8) !== 0;
+    const cells = utf83 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
     if (cells > 0 && this.termios.c_lflag & ECHO) {
       this.output(encoder3.encode("\b \b".repeat(cells)), false);
     }
@@ -11023,14 +11196,14 @@ var KernelTty = class {
   }
   changed(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new KernelError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -11039,7 +11212,7 @@ var KernelTty = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 
@@ -11138,14 +11311,14 @@ var PtyPair = class {
   }
   changed(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new KernelError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -11154,7 +11327,7 @@ var PtyPair = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 var PtyTable = class {
@@ -11219,7 +11392,8 @@ function ptySyscall(req, ctx) {
       if (!ctx.ptys) throw new KernelError("ENOENT");
       const pair = ctx.ptys.get(req.n);
       ttyOpenable(ctx.guard, pair.slave);
-      const fd = ctx.fds.install(pair.openSlave(), 3);
+      const slave = pair.openSlave();
+      const fd = ctx.fds.install(ctx.ttyFilter?.(slave) ?? slave, 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
       return json4(fd);
     }
@@ -11292,8 +11466,8 @@ async function runChild(req, deps) {
   };
   const controls = [];
   const capture = () => {
-    const { promise, resolve } = Promise.withResolvers();
-    const control = { shut: false, ended: resolve, eof: promise };
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
+    const control = { shut: false, ended: resolve2, eof: promise };
     controls.push(control);
     return { capture: true, max, overflow: () => stop("ENOBUFS"), control };
   };
@@ -11386,7 +11560,7 @@ async function waitReady(fds, read, write, deadline, interrupted2) {
       return file.changed === void 0 ? [] : [file.changed(round.signal).catch(() => void 0)];
     });
     let timer;
-    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve) => timer = setTimeout(resolve, deadline - Date.now()))];
+    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve2) => timer = setTimeout(resolve2, deadline - Date.now()))];
     try {
       await Promise.race([...changes, ...expiry, interrupted2]);
     } finally {
@@ -11470,10 +11644,10 @@ async function socketSyscall(req, proc) {
   }
 }
 function interruptible2(dialing, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const abort = () => reject(new KernelError("EINTR"));
     signal.addEventListener("abort", abort, { once: true });
-    dialing.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    dialing.then(resolve2, reject).finally(() => signal.removeEventListener("abort", abort));
   });
 }
 function unnamed(domain) {
@@ -12320,7 +12494,7 @@ var WasmProcess = class {
     if (this.stopped) return "stop";
     this.stopped = sig;
     this.stops++;
-    this.resumed = new Promise((resolve) => this.wake = resolve);
+    this.resumed = new Promise((resolve2) => this.wake = resolve2);
     const blocked = this.interrupt;
     this.interrupt = new AbortController();
     blocked.abort();
@@ -12385,7 +12559,9 @@ var WasmProcess = class {
         const { ptys, jobs } = this.options;
         const owner = this.options.owners ? this.ttyOwner() : void 0;
         const guard2 = this.guarded();
-        return ptySyscall(req, { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner });
+        const { ttyFilter } = this.options;
+        const ctx = { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner, ttyFilter };
+        return ptySyscall(req, ctx);
       }
       return await this.procSyscall(req, cancelled);
     } catch (e) {
@@ -12560,7 +12736,8 @@ var WasmProcess = class {
     const tty = name2 === void 0 ? this.controllingTerminal() : this.options.jobs?.terminalNamed(name2);
     if (!tty) throw new KernelError("ENXIO");
     if (name2 !== void 0) ttyOpenable(this.guarded(), tty);
-    return this.fds.install(tty.file(), 3);
+    const file = tty.file();
+    return this.fds.install(this.options.ttyFilter?.(file) ?? file, 3);
   }
   openSealed() {
     const broker = this.options.sealed;
@@ -12600,15 +12777,8 @@ var WasmProcess = class {
   async sealedCaller() {
     const shown = await this.options.identity?.();
     const broker = this.options.sealed;
-    const tag = broker.tagOf(this.pid);
-    return {
-      pid: shown?.pid ?? this.pid,
-      ppid: shown?.ppid ?? 0,
-      uid: this.cred.euid,
-      gid: this.cred.egid,
-      ...tag !== void 0 ? { tag } : {},
-      users: broker.users
-    };
+    const ids = { pid: shown?.pid ?? this.pid, ppid: shown?.ppid ?? 0 };
+    return broker.stamp(ids, this.cred, broker.tagOf(this.pid));
   }
   guarded() {
     const { guard: guard2 } = this.options;
@@ -13116,13 +13286,13 @@ var WasmProcess = class {
     while (this.dlLock.depth > 0 && this.dlLock.owner !== owner) {
       if (this.dying) throw new KernelError("EINTR");
       const interrupt = this.interrupt.signal;
-      const gone = await new Promise((resolve) => {
+      const gone = await new Promise((resolve2) => {
         const waiter = {
           owner,
           wake: (ended) => {
             this.dlLock.waiters.delete(waiter);
             interrupt.removeEventListener("abort", recheck);
-            resolve(ended);
+            resolve2(ended);
           }
         };
         const recheck = () => waiter.wake(false);
@@ -13378,6 +13548,7 @@ function processOptions(opts, header4, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
+    ...opts.ttyFilter ? { ttyFilter: opts.ttyFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
@@ -13872,6 +14043,523 @@ function replayingHops(inner, heldMs = HELD_MS) {
   };
 }
 
+// node_modules/@ai-ecoverse/slicc-scrub/dist/index.js
+var FRAGMENT = 16;
+var MIN_VALUE = 8;
+var MIN_BASE64 = 8;
+var encoder4 = new TextEncoder();
+var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function utf82(text) {
+  return encoder4.encode(text);
+}
+function base642(bytes, padded = true) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i];
+    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const triple = a << 16 | b << 8 | c;
+    const left = bytes.length - i;
+    out += STD[triple >> 18 & 63] + STD[triple >> 12 & 63];
+    out += left > 1 ? STD[triple >> 6 & 63] : padded ? "=" : "";
+    out += left > 2 ? STD[triple & 63] : padded ? "=" : "";
+  }
+  return out;
+}
+function urlSafe(text) {
+  return text.replace(/\+/g, "-").replace(/\//g, "_");
+}
+function hex2(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function embedded(bytes, offset) {
+  const shifted = new Uint8Array(offset + bytes.length);
+  shifted.set(bytes, offset);
+  const encoded = base642(shifted);
+  const first = Math.ceil(8 * offset / 6);
+  const last = Math.floor(8 * (offset + bytes.length) / 6);
+  return encoded.slice(first, last);
+}
+function unicode(value, upper) {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const unit = value.charCodeAt(i);
+    if (unit === 34) out += '\\"';
+    else if (unit === 92) out += "\\\\";
+    else if (unit < 32 || unit > 126) {
+      const code = unit.toString(16).padStart(4, "0");
+      out += `\\u${upper ? code.toUpperCase() : code}`;
+    } else out += value[i];
+  }
+  return out;
+}
+function percent(value) {
+  let component;
+  try {
+    component = encodeURIComponent(value);
+  } catch {
+    return [];
+  }
+  const lower = component.replace(/%[0-9A-F]{2}/g, (escape) => escape.toLowerCase());
+  const plus = component.replace(/%20/g, "+");
+  let form = "";
+  for (const byte of utf82(value)) {
+    const char = String.fromCharCode(byte);
+    if (/[A-Za-z0-9*\-._]/.test(char)) form += char;
+    else if (byte === 32) form += "+";
+    else form += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+  }
+  return [component, lower, plus, form];
+}
+function html(value, apostrophe) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, apostrophe);
+}
+function encodings(bytes) {
+  const standard = [base642(bytes), base642(bytes, false)];
+  for (const offset of [0, 1, 2]) {
+    const run2 = embedded(bytes, offset);
+    if (run2.length >= MIN_BASE64) standard.push(run2);
+  }
+  return [...standard, ...standard.map(urlSafe)];
+}
+function shapes(value) {
+  const raw = utf82(value);
+  const seen = /* @__PURE__ */ new Set([value]);
+  const out = [];
+  if (raw.length < FRAGMENT) out.push({ bytes: raw, form: "raw" });
+  for (let offset = 0; raw.length >= FRAGMENT && offset + FRAGMENT <= raw.length; offset++) {
+    out.push({ bytes: raw.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
+  }
+  const add = (text, form) => {
+    if (seen.has(text)) return;
+    seen.add(text);
+    out.push({ bytes: utf82(text), form });
+  };
+  const json5 = JSON.stringify(value).slice(1, -1);
+  for (const text of [
+    json5,
+    json5.replace(/\//g, "\\/"),
+    unicode(value, false),
+    unicode(value, true)
+  ]) {
+    add(text, "json");
+  }
+  for (const text of percent(value)) add(text, "percent");
+  for (const text of [html(value, "&#39;"), html(value, "&#x27;")]) add(text, "html");
+  for (const text of encodings(raw)) add(text, "base64");
+  add(hex2(raw), "hex");
+  add(hex2(raw).toUpperCase(), "hex");
+  return out;
+}
+function wrappable(form) {
+  return form === "base64" || form === "hex";
+}
+var Automaton = class {
+  edges = /* @__PURE__ */ new Map();
+  fail = [0];
+  depth = [0];
+  children = [0];
+  out = [[]];
+  dict = [-1];
+  lengths = [];
+  add(bytes) {
+    let node = 0;
+    for (const byte of bytes) {
+      const key = node * 256 + byte;
+      let next2 = this.edges.get(key);
+      if (next2 === void 0) {
+        next2 = this.depth.length;
+        this.edges.set(key, next2);
+        this.fail.push(0);
+        this.depth.push(this.depth[node] + 1);
+        this.children.push(0);
+        this.children[node] += 1;
+        this.out.push([]);
+        this.dict.push(-1);
+      }
+      node = next2;
+    }
+    const id2 = this.lengths.length;
+    this.lengths.push(bytes.length);
+    this.out[node].push(id2);
+    return id2;
+  }
+  build() {
+    const queue = [];
+    const byNode = /* @__PURE__ */ new Map();
+    for (const [key, child] of this.edges) {
+      const parent = Math.floor(key / 256);
+      const list = byNode.get(parent) ?? [];
+      list.push([key % 256, child]);
+      byNode.set(parent, list);
+    }
+    for (const [, child] of byNode.get(0) ?? []) queue.push(child);
+    for (let head = 0; head < queue.length; head++) {
+      const node = queue[head];
+      const fallback = this.fail[node];
+      this.dict[node] = this.out[fallback].length > 0 ? fallback : this.dict[fallback];
+      for (const [byte, child] of byNode.get(node) ?? []) {
+        let state = fallback;
+        let target = this.edges.get(state * 256 + byte);
+        while (target === void 0 && state > 0) {
+          state = this.fail[state];
+          target = this.edges.get(state * 256 + byte);
+        }
+        this.fail[child] = target ?? 0;
+        queue.push(child);
+      }
+    }
+  }
+  step(state, byte) {
+    let current = state;
+    for (; ; ) {
+      const next2 = this.edges.get(current * 256 + byte);
+      if (next2 !== void 0) return next2;
+      if (current === 0) return 0;
+      current = this.fail[current];
+    }
+  }
+  matches(state, visit) {
+    for (let node = state; node > 0; node = this.dict[node]) {
+      for (const id2 of this.out[node]) visit(id2);
+    }
+  }
+  partials(state, length2, visit) {
+    for (let node = state; node > 0; node = this.fail[node]) {
+      if (this.children[node] > 0) visit(length2 - this.depth[node]);
+    }
+  }
+};
+var RANK = {
+  raw: 0,
+  fragment: 1,
+  json: 2,
+  percent: 3,
+  html: 4,
+  base64: 5,
+  hex: 6,
+  wrapped: 7
+};
+var CR2 = 13;
+var LF2 = 10;
+var EMPTY2 = new Uint8Array(0);
+function register(automaton, sources, ids, bytes, source) {
+  const key = Array.from(bytes).join(",");
+  let id2 = ids.get(key);
+  if (id2 === void 0) {
+    id2 = automaton.add(bytes);
+    ids.set(key, id2);
+    sources[id2] = [];
+  }
+  sources[id2].push(source);
+}
+function prepare(secrets) {
+  const main = new Automaton();
+  const wrap = new Automaton();
+  const sources = [];
+  const wrapSources = [];
+  const ids = /* @__PURE__ */ new Map();
+  const wrapIds = /* @__PURE__ */ new Map();
+  const values = secrets.map((secret) => utf82(secret.value));
+  secrets.forEach((secret, index) => {
+    if (typeof secret.value !== "string" || values[index].length < MIN_VALUE) {
+      throw new RangeError(`the value of ${secret.name} is shorter than ${MIN_VALUE} bytes`);
+    }
+    for (const shape of shapes(secret.value)) {
+      const source = { secret: index, form: shape.form, offset: shape.offset };
+      register(main, sources, ids, shape.bytes, source);
+      if (wrappable(shape.form)) register(wrap, wrapSources, wrapIds, shape.bytes, source);
+    }
+  });
+  main.build();
+  wrap.build();
+  const replacements = secrets.map((secret) => [
+    utf82(secret.placeholder),
+    utf82(`[redacted:${secret.name}]`)
+  ]);
+  return { secrets, values, main, wrap, sources, wrapSources, replacements };
+}
+function better(a, b) {
+  if (!b) return true;
+  if (a.end !== b.end) return a.end > b.end;
+  if (a.rank !== b.rank) return a.rank < b.rank;
+  return a.secret < b.secret;
+}
+function resolve(c, input, start2, end, source) {
+  if (source.form !== "fragment") {
+    return {
+      start: start2,
+      end,
+      secret: source.secret,
+      form: source.form,
+      rank: RANK[source.form],
+      growing: false
+    };
+  }
+  const value = c.values[source.secret];
+  let stop = end;
+  let at = source.offset + FRAGMENT;
+  while (stop < input.length && at < value.length && input[stop] === value[at]) {
+    stop++;
+    at++;
+  }
+  const form = source.offset === 0 && at === value.length ? "raw" : "fragment";
+  const growing = stop === input.length && at < value.length;
+  return { start: start2, end: stop, secret: source.secret, form, rank: RANK[form], growing };
+}
+function keep(best, candidate) {
+  if (better(candidate, best.get(candidate.start))) best.set(candidate.start, candidate);
+}
+function scanMain(c, input, best, partials) {
+  let state = 0;
+  for (let i = 0; i < input.length; i++) {
+    state = c.main.step(state, input[i]);
+    c.main.matches(state, (id2) => {
+      const start2 = i + 1 - c.main.lengths[id2];
+      for (const source of c.sources[id2]) {
+        const candidate = resolve(c, input, start2, i + 1, source);
+        if (candidate.growing) partials.push(candidate.start);
+        keep(best, candidate);
+      }
+    });
+  }
+  c.main.partials(state, input.length, (start2) => partials.push(start2));
+}
+function scanWrapped(c, input, best, partials) {
+  const map = [];
+  for (let i = 0; i < input.length; i++) if (input[i] !== CR2 && input[i] !== LF2) map.push(i);
+  if (map.length === input.length) return;
+  let state = 0;
+  for (let v = 0; v < map.length; v++) {
+    state = c.wrap.step(state, input[map[v]]);
+    c.wrap.matches(state, (id2) => {
+      const first = v + 1 - c.wrap.lengths[id2];
+      const start2 = map[first];
+      const end = map[v] + 1;
+      const wrapped = end - start2 !== c.wrap.lengths[id2];
+      for (const source of c.wrapSources[id2]) {
+        const form = wrapped ? "wrapped" : source.form;
+        keep(best, { start: start2, end, secret: source.secret, form, rank: RANK[form], growing: false });
+      }
+    });
+  }
+  c.wrap.partials(state, map.length, (start2) => partials.push(map[start2]));
+}
+function count(c, hits, candidate) {
+  const name2 = c.secrets[candidate.secret].name;
+  const key = `${name2}\0${candidate.form}`;
+  const hit = hits.get(key) ?? { name: name2, form: candidate.form, count: 0 };
+  hit.count += 1;
+  hits.set(key, hit);
+}
+function concat5(parts2) {
+  let length2 = 0;
+  for (const part of parts2) length2 += part.length;
+  const out = new Uint8Array(length2);
+  let at = 0;
+  for (const part of parts2) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+function pass(c, input, final) {
+  const best = /* @__PURE__ */ new Map();
+  const partials = [];
+  scanMain(c, input, best, partials);
+  scanWrapped(c, input, best, partials);
+  const holds = final ? [] : [...new Set(partials)].sort((a, b) => a - b);
+  const starts = [...best.keys()].sort((a, b) => a - b);
+  const parts2 = [];
+  const hits = /* @__PURE__ */ new Map();
+  let pos = 0;
+  let cut = input.length;
+  let s = 0;
+  let h = 0;
+  for (; ; ) {
+    while (s < starts.length && starts[s] < pos) s++;
+    while (h < holds.length && holds[h] < pos) h++;
+    const hold = h < holds.length ? holds[h] : Infinity;
+    const next2 = s < starts.length ? starts[s] : Infinity;
+    if (hold <= next2) {
+      cut = Math.min(hold, input.length);
+      break;
+    }
+    const candidate = best.get(next2);
+    parts2.push(
+      input.subarray(pos, next2),
+      c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
+    );
+    count(c, hits, candidate);
+    pos = candidate.end;
+  }
+  parts2.push(input.subarray(pos, cut));
+  return { output: concat5(parts2), cut, hits };
+}
+function merge(into, from) {
+  for (const [key, hit] of from) {
+    const known = into.get(key);
+    if (known) known.count += hit.count;
+    else into.set(key, { ...hit });
+  }
+}
+function compile(secrets, options = {}) {
+  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const decoder4 = new TextDecoder();
+  const idleMs = options.idleMs ?? 250;
+  const scrubBytes = (input) => {
+    if (c.secrets.length === 0) return { bytes: input.slice(), hits: [] };
+    const result = pass(c, input, true);
+    return { bytes: result.output, hits: [...result.hits.values()] };
+  };
+  return {
+    version: options.version ?? 0,
+    idleMs,
+    size: c.main.lengths.length,
+    bytes: scrubBytes,
+    text(input) {
+      const { bytes, hits } = scrubBytes(utf82(input));
+      return { text: decoder4.decode(bytes), hits };
+    },
+    stream() {
+      let pending = EMPTY2;
+      const hits = /* @__PURE__ */ new Map();
+      const run2 = (final) => {
+        if (c.secrets.length === 0 || pending.length === 0) {
+          const out = pending;
+          pending = EMPTY2;
+          return out;
+        }
+        const result = pass(c, pending, final);
+        merge(hits, result.hits);
+        pending = pending.slice(result.cut);
+        return result.output;
+      };
+      return {
+        push(chunk2) {
+          pending = concat5([pending, chunk2]);
+          return run2(false);
+        },
+        idle() {
+          return pending.length < FRAGMENT ? run2(true) : EMPTY2;
+        },
+        end() {
+          return run2(true);
+        },
+        get hits() {
+          return [...hits.values()];
+        }
+      };
+    }
+  };
+}
+
+// src/kernel/scrub-file.ts
+var SCRUB_IDLE_MS = 50;
+var encoder5 = new TextEncoder();
+function scrubberOf(secrets) {
+  const usable = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
+  return usable.length > 0 ? compile(usable, { idleMs: SCRUB_IDLE_MS }) : void 0;
+}
+async function writeAll2(file, bytes, signal) {
+  const write = file.write;
+  for (let at = 0; at < bytes.length; ) {
+    at += await write.call(file, bytes.subarray(at), at === 0 ? signal : void 0);
+  }
+}
+function bound(file, key) {
+  const method = file[key];
+  return typeof method === "function" ? { [key]: method.bind(file) } : {};
+}
+function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
+  const file = inner.file;
+  const stream2 = scrubber.stream();
+  let queue = Promise.resolve();
+  let timer;
+  let failed3;
+  const raise = () => {
+    if (failed3 === void 0) return;
+    const err = failed3;
+    failed3 = void 0;
+    throw err;
+  };
+  const enqueue = (bytes, signal) => {
+    const next2 = queue.then(() => bytes.length > 0 ? writeAll2(file, bytes, signal) : void 0);
+    queue = next2.catch(() => void 0);
+    return next2;
+  };
+  const release = () => {
+    timer = void 0;
+    enqueue(stream2.idle()).catch((err) => {
+      failed3 = err;
+    });
+  };
+  return new OpenFile({
+    ...bound(file, "read"),
+    ...bound(file, "peek"),
+    ...bound(file, "poll"),
+    ...bound(file, "changed"),
+    ...bound(file, "stat"),
+    ...file.tty ? { tty: file.tty } : {},
+    ...file.clipboard ? { clipboard: file.clipboard } : {},
+    ...file.write ? {
+      write: async (bytes, signal) => {
+        if (timer !== void 0) clearTimeout(timer);
+        raise();
+        await enqueue(stream2.push(bytes), signal);
+        timer = setTimeout(release, idleMs);
+        return bytes.length;
+      }
+    } : {},
+    flush: async () => {
+      await queue;
+      raise();
+      await file.flush?.();
+    },
+    close: async () => {
+      if (timer !== void 0) clearTimeout(timer);
+      let failure;
+      try {
+        await enqueue(stream2.end());
+        raise();
+      } catch (err) {
+        failure = { err };
+      }
+      await inner.release();
+      if (failure) throw failure.err;
+    }
+  });
+}
+function scrubbedAll(file, scrubbers) {
+  return scrubbers.reduce((inner, scrubber) => scrubbed(inner, scrubber), file);
+}
+function stdioFiles(fds) {
+  const files = /* @__PURE__ */ new Set();
+  for (const fd of [1, 2]) {
+    try {
+      files.add(fds.get(fd));
+    } catch {
+    }
+  }
+  return files;
+}
+function scrubStdio(fds, scrubber) {
+  const wrapped = /* @__PURE__ */ new Map();
+  const stdio = stdioFiles(fds);
+  for (const fd of fds.numbers()) {
+    const original = fds.get(fd);
+    if (!stdio.has(original) && !original.file.tty) continue;
+    const known = wrapped.get(original);
+    const flags2 = fds.statusFlags(fd);
+    const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
+    wrapped.set(original, wrapper);
+    fds.installAt(fd, wrapper);
+    if (flags2 !== void 0) fds.setStatusFlags(fd, flags2);
+  }
+}
+
 // src/kernel/sealed.ts
 var SEALED_MAX_BYTES = 64 * 1024;
 var SEALED_TIMEOUT_MS = 1e4;
@@ -13885,7 +14573,7 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "cancel",
   "materialize"
 ]);
-var encoder4 = new TextEncoder();
+var encoder6 = new TextEncoder();
 var decoder3 = new TextDecoder("utf-8", { fatal: true });
 function parseSealed(bytes) {
   try {
@@ -13901,11 +14589,16 @@ function parseSealed(bytes) {
     const req = parsed2;
     if (req.v !== 1 || typeof req.op !== "string" || !SEALED_OPS.has(req.op))
       throw new KernelError("EINVAL");
+    if (req.op === "materialize" && !materializable(req)) throw new KernelError("EINVAL");
     return req;
   } finally {
     bytes.fill(0);
   }
 }
+function materializable(req) {
+  if (req.shellGrants !== true && !isStrings(req.names)) return false;
+  return isStrings(req.argv) && typeof req.path === "string" && typeof req.cwd === "string";
+}
 function errorReply(code, message3) {
   return { v: 1, error: { code, message: message3 } };
 }
@@ -13949,12 +14642,14 @@ var SealedChannel = class {
     const timer = setTimeout(() => control.abort("timeout"), this.broker.timeoutMs);
     const req = { ...fields, v: 1, op: fields.op, caller };
     const flight = { control, done: Promise.resolve() };
-    flight.done = this.answer(req, control.signal).then((reply) => {
+    flight.done = this.answer(req, control.signal).then(async (reply) => {
       clearTimeout(timer);
       gone.removeEventListener("abort", withdraw);
+      if (reply && req.op === "materialize")
+        await this.broker.tickets.record(req, reply, caller.pid);
       if (this.inflight !== flight) return;
       this.inflight = void 0;
-      if (reply) this.reply = encoder4.encode(serialized(reply));
+      if (reply) this.reply = encoder6.encode(serialized(reply));
     });
     this.inflight = flight;
     return length2;
@@ -13962,8 +14657,8 @@ var SealedChannel = class {
   async answer(req, signal) {
     const hook = this.broker.hook;
     if (!hook) return errorReply("ENOTCONN", "no vault is connected");
-    const stopped = new Promise((resolve) => {
-      signal.addEventListener("abort", () => resolve(void 0), { once: true });
+    const stopped = new Promise((resolve2) => {
+      signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
@@ -14018,17 +14713,60 @@ var SealedChannel = class {
     this.reply = void 0;
   }
 };
+function swapOf(reply) {
+  if (!isRecord(reply) || reply.error !== void 0) return void 0;
+  const values = stringRecord(reply.values);
+  const placeholders = stringRecord(reply.placeholders);
+  return values && placeholders ? { values, placeholders } : void 0;
+}
 var SealedBroker = class {
   hook;
   users;
   timeoutMs;
   tagOf;
+  tickets = new TicketBook();
+  userOf = async () => void 0;
   constructor(hook, users, timeoutMs = SEALED_TIMEOUT_MS, tagOf = () => void 0) {
     this.hook = hook;
     this.users = users;
     this.timeoutMs = timeoutMs;
     this.tagOf = tagOf;
   }
+  async stamp(ids, cred, tag) {
+    const user = await this.userOf(cred.euid).catch(() => void 0);
+    return {
+      pid: ids.pid,
+      ppid: ids.ppid,
+      uid: cred.euid,
+      gid: cred.egid,
+      ...user !== void 0 ? { user } : {},
+      groups: [...cred.groups],
+      users: this.users,
+      ...tag !== void 0 ? { tag } : {}
+    };
+  }
+  async consume(fields) {
+    const { hook } = this;
+    if (!hook) return void 0;
+    const control = new AbortController();
+    const timer = setTimeout(() => control.abort("timeout"), this.timeoutMs);
+    const stopped = new Promise((resolve2) => {
+      control.signal.addEventListener("abort", () => resolve2(void 0), { once: true });
+    });
+    const req = {
+      ...fields,
+      v: 1,
+      op: "materializeConsume",
+      caller: fields.stamp
+    };
+    try {
+      const asked = Promise.resolve().then(() => hook(req, { signal: control.signal })).then(swapOf, () => void 0);
+      return await Promise.race([asked, stopped]);
+    } finally {
+      clearTimeout(timer);
+      control.abort("done");
+    }
+  }
   open() {
     const channel = new SealedChannel(this);
     return new OpenFile({
@@ -14527,11 +15265,11 @@ function codeOf3(err) {
 }
 function wait(ms, signal) {
   if (signal.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const done4 = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done4);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(done4, ms);
     signal.addEventListener("abort", done4, { once: true });
@@ -14858,11 +15596,11 @@ async function resize(h, path, size) {
   }
 }
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const done4 = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done4);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(done4, ms);
     signal.addEventListener("abort", done4);
@@ -14945,7 +15683,7 @@ var PORT_DEAD_MS = 1e4;
 var PORT_LINGER_MS = 1e3;
 function timed(transport, ms) {
   const inflight = /* @__PURE__ */ new Set();
-  const guard2 = (name2, run2, late, expire) => new Promise((resolve, reject) => {
+  const guard2 = (name2, run2, late, expire) => new Promise((resolve2, reject) => {
     let expired = false;
     const running = run2();
     inflight.add(running);
@@ -14962,7 +15700,7 @@ function timed(transport, ms) {
       (value) => {
         clearTimeout(timer);
         if (expired) late?.(value);
-        resolve(value);
+        resolve2(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -15097,7 +15835,7 @@ var PortTransport = class {
   ask(message3, bytes = 0, transfer = []) {
     const id2 = ++this.next;
     if (this.dead) return Promise.reject(fsError2("ENOTCONN", this.dead));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = setTimeout(
         () => {
           this.waiting.delete(id2);
@@ -15111,7 +15849,7 @@ var PortTransport = class {
         clearTimeout(timer);
         this.waiting.delete(id2);
         if (reply.error) reject(fsError2(reply.error.code ?? "EIO", reply.error.message ?? ""));
-        else resolve(reply);
+        else resolve2(reply);
       });
       try {
         this.port.postMessage({ id: id2, ...message3 }, transfer);
@@ -15140,7 +15878,7 @@ var PortTransport = class {
       this.fail("the folder's watch ended");
       return Promise.resolve();
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const finish = () => {
         this.waiting.delete(id2);
         signal.removeEventListener("abort", stop);
@@ -15151,7 +15889,7 @@ var PortTransport = class {
           this.port.postMessage({ id: id2, op: "unwatch" });
         } catch {
         }
-        resolve();
+        resolve2();
       };
       this.watchBeat();
       this.waiting.set(id2, (reply) => {
@@ -15159,7 +15897,7 @@ var PortTransport = class {
         if (reply.event) return onEvent(reply.event);
         finish();
         if (reply.error) reject(fsError2(reply.error.code ?? "ENOTCONN", reply.error.message ?? ""));
-        else resolve();
+        else resolve2();
       });
       signal.addEventListener("abort", stop, { once: true });
       try {
@@ -15375,10 +16113,10 @@ var ChunkedBytes = class {
   }
   truncate(size) {
     if (size < this.size) {
-      const keep = Math.ceil(size / CHUNK3);
-      this.chunks.length = Math.min(this.chunks.length, keep);
-      const tail = this.chunks[keep - 1];
-      const from = size - (keep - 1) * CHUNK3;
+      const keep2 = Math.ceil(size / CHUNK3);
+      this.chunks.length = Math.min(this.chunks.length, keep2);
+      const tail = this.chunks[keep2 - 1];
+      const from = size - (keep2 - 1) * CHUNK3;
       if (tail && from < tail.length) tail.fill(0, from);
     }
     this.size = size;
@@ -15623,8 +16361,8 @@ function importedMemory(bytes) {
       at = end;
       continue;
     }
-    const count = u32();
-    for (let i = 0; i < count; i++) {
+    const count2 = u32();
+    for (let i = 0; i < count2; i++) {
       const module = name2();
       const field3 = name2();
       const kind = bytes[at++];
@@ -16053,7 +16791,7 @@ ${lines2}
     const withdraw = () => control.abort("withdrawn");
     requester.addEventListener("abort", withdraw, { once: true });
     const aborted2 = new Promise(
-      (resolve) => control.signal.addEventListener("abort", () => resolve("aborted"), { once: true })
+      (resolve2) => control.signal.addEventListener("abort", () => resolve2("aborted"), { once: true })
     );
     try {
       const answered = Promise.resolve().then(() => approve(req, { signal: control.signal })).catch(() => "deny");
@@ -16179,7 +16917,7 @@ var LAYOUT = [
 ];
 var LOAD_SAMPLE_MS = 5e3;
 var LOAD_WINDOWS_MS = [6e4, 3e5, 9e5];
-var encoder5 = new TextEncoder();
+var encoder7 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
   if (USERS_MODES.includes(mode)) return mode;
@@ -16210,6 +16948,30 @@ function shebang(head) {
   if (head[0] !== 35 || head[1] !== 33) return void 0;
   return new TextDecoder().decode(head.subarray(0, SHEBANG_MAX)).slice(2).split("\n")[0].trim().split(/[ \t]+/);
 }
+async function rootOnly(fs, path) {
+  const names = chain(path);
+  for (const [i, at] of names.entries()) {
+    const st = await fs.lstat(at).catch(() => void 0);
+    const kind = i === names.length - 1 ? st?.isFile : st?.isDirectory;
+    if (!kind || st?.uid !== 0 || (st.mode & 18) !== 0) return false;
+  }
+  return true;
+}
+function plainEnv(words2) {
+  const next2 = words2[1];
+  if (baseName(words2[0] ?? "") !== "env" || next2 === void 0) return false;
+  return next2 === "-S" || !next2.startsWith("-") && !next2.includes("=");
+}
+function shebangCommand(words2) {
+  if (!plainEnv(words2)) {
+    const arg2 = words2.slice(1).join(" ");
+    return { interp: words2[0], args: arg2 ? [arg2] : [] };
+  }
+  const split2 = words2[1] === "-S";
+  const [interp, ...rest2] = words2.slice(split2 ? 2 : 1);
+  const arg = rest2.join(" ");
+  return { interp, args: split2 ? rest2 : arg ? [arg] : [] };
+}
 function interpreter(head) {
   const words2 = shebang(head);
   if (!words2) return "node";
@@ -16263,7 +17025,7 @@ function childHandle(handle) {
     onState: (listener) => handle.onState(listener)
   };
 }
-function concat5(chunks2) {
+function concat6(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, chunk2) => n + chunk2.length, 0));
   let offset = 0;
   for (const chunk2 of chunks2) {
@@ -16295,6 +17057,13 @@ var Launcher = class {
   unwatchScopes = () => void 0;
   warned = /* @__PURE__ */ new Set();
   compiled = /* @__PURE__ */ new Map();
+  texts = /* @__PURE__ */ new Map();
+  integrity;
+  scannedFs;
+  get scanned() {
+    this.scannedFs ??= this.verifiedFs(this.base);
+    return this.scannedFs;
+  }
   processes = /* @__PURE__ */ new Map();
   zombies = /* @__PURE__ */ new Set();
   orphans = /* @__PURE__ */ new Set();
@@ -16342,6 +17111,7 @@ var Launcher = class {
   usersMode;
   dac;
   sealed;
+  scrubs = /* @__PURE__ */ new Map();
   clipboard;
   rootFs;
   fileWatches;
@@ -16365,6 +17135,8 @@ var Launcher = class {
       void 0,
       (pid) => this.tagOf(pid)
     );
+    this.sealed.tickets.normalise = (path) => physicalPathAsync(this.base, path);
+    this.sealed.userOf = async (uid) => (await this.users.lookup(uid))?.name;
     if (this.owners) options.fs.trackOwners?.();
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
@@ -16398,7 +17170,7 @@ var Launcher = class {
     if (options.uplink) this.net.useUplink({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
-      engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
+      engine: kernelTlsEngine(packageTlsEngine(this.verifiedFs(options.fs), this.modulesDir)),
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
@@ -16433,6 +17205,16 @@ var Launcher = class {
     this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
     this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
     options.fs.protect?.(this.prefixes);
+    const integrity = options.protect?.integrity;
+    integrityOptions(integrity);
+    if (integrity && this.prefixes.length > 0) {
+      this.integrity = new Integrity(
+        this.prefixes,
+        options.fs,
+        integrity,
+        (event) => options.onDenial?.(event)
+      );
+    }
     this.users = new UserDb(this.fs, this.owners);
     this.sudoer = new Sudo({
       fs: this.fs,
@@ -16478,7 +17260,7 @@ var Launcher = class {
   commands(scope = "") {
     let found = this.catalogs.get(scope);
     if (!found) {
-      found = this.roots(scope).then((roots) => scanCommands(this.base, roots)).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
+      found = this.roots(scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
       this.catalogs.set(scope, found);
     }
     return found;
@@ -16486,7 +17268,7 @@ var Launcher = class {
   ownCommands(scope) {
     let found = this.ownCatalogs.get(scope);
     if (!found) {
-      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.base, roots)).then((commands) => new Set(commands.keys()));
+      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => new Set(commands.keys()));
       this.ownCatalogs.set(scope, found);
     }
     return found;
@@ -16495,7 +17277,7 @@ var Launcher = class {
     let found = this.binfmts.get(scope);
     if (!found) {
       found = this.roots(scope).then(
-        (roots) => scanBinfmts(this.base, roots, (message3) => {
+        (roots) => scanBinfmts(this.scanned, roots, (message3) => {
           if (this.warned.has(message3)) return;
           this.warned.add(message3);
           console.warn(message3);
@@ -16603,21 +17385,26 @@ var Launcher = class {
     const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(scope), script);
     const words2 = shebang(head) ?? (binfmt ? [binfmt] : void 0);
     if (!words2) return void 0;
-    if (baseName(words2[0]) === "env") words2.shift();
-    const [interp, ...rest2] = words2;
-    const arg = rest2.join(" ");
-    const passed = [...arg ? [arg] : [], command ? script : file, ...argv.slice(1)];
-    const found = interp ? await this.resolve(interp, interp, cwd, scope) : void 0;
+    const { interp, args } = shebangCommand(words2);
+    const passed = [...args, command ? script : file, ...argv.slice(1)];
+    if (!interp) return void 0;
+    const found = await this.resolve(interp, interp, cwd, scope);
     if (!found) {
-      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp, cwd, scope)) {
+      if (depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp, cwd, scope)) {
         return void 0;
       }
       const inner = await this.interpreted(interp, [interp, ...passed], cwd, scope, depth + 1);
       const via = [interp, ...inner?.via ?? []];
-      return inner && { ...inner, target: withScriptEnv(inner.target, command), via };
+      const sources = [script, ...inner?.sources ?? []];
+      return inner && { ...inner, target: withScriptEnv(inner.target, command), via, sources };
     }
     const target = withScriptEnv(found, command);
-    return { target, args: [...target.prefix ?? [], ...passed], via: [interp] };
+    return {
+      target,
+      args: [...target.prefix ?? [], ...passed],
+      via: [interp],
+      sources: [script]
+    };
   }
   async plan(file, argv, cwd, scope, argv0) {
     const found = await this.resolve(file, argv[0] ?? file, cwd, scope);
@@ -16643,13 +17430,106 @@ var Launcher = class {
       await need(g, "exec", this.fs.resolvePath(req.cwd, file), want);
     }
   }
+  async checkedPlan(req, { ppid, cred, scope }, fds) {
+    const planned = await this.plan(req.file, req.argv, req.cwd, scope, req.argv0);
+    try {
+      await this.mayExec(cred, { ...req, pid: ppid }, planned);
+    } catch (err) {
+      await fds.closeAll();
+      throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+    }
+    if (planned) return planned;
+    await fds.closeAll();
+    throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
+  }
+  async ticketFile(req, fds) {
+    if (req.file.startsWith("/")) return physicalPathAsync(this.base, req.file);
+    await fds.closeAll();
+    throw new SpawnError("EACCES");
+  }
+  takeTicket(req) {
+    if (!(TICKET_ENV in req.env)) return void 0;
+    return this.sealed.tickets.take(req.env[TICKET_ENV] ?? "") ?? null;
+  }
+  async redeemed(req, who, planned, fds) {
+    if (who.booked === void 0) return { env: req.env };
+    try {
+      const redeemed = await this.redeem(req, who, planned);
+      if (redeemed.scrub) scrubStdio(fds, redeemed.scrub);
+      return redeemed;
+    } catch {
+      await fds.closeAll();
+      throw new SpawnError("EACCES");
+    }
+  }
+  async redeem(req, { ppid, cred, scope, booked }, planned) {
+    const { [TICKET_ENV]: ticket = "", ...env } = req.env;
+    const caller = this.jobs.shown(ppid);
+    const named = typeof req.argv0 === "string" && !planned.script && !planned.target.fixed;
+    const argv = named ? [req.argv0, ...req.argv.slice(1)] : req.argv;
+    const exact = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
+    if (!exact) throw new SpawnError("EACCES");
+    const { requested: path, requestedCwd: cwd, path: resolved2 } = booked;
+    const pid = this.nextPid++;
+    const ids = { pid: req.exec ? caller : pid, ppid: caller };
+    const stamp = await this.sealed.stamp(ids, cred, this.tagOf(ppid));
+    const interpreters = await this.interpreterChain(planned, booked.cwd, scope);
+    const trusted = this.usersMode === "enforce" && await this.trustedFiles(planned, req.file, booked.cwd, scope);
+    const swap = await this.sealed.consume({
+      ticket,
+      stamp,
+      path,
+      resolved: resolved2,
+      argv,
+      cwd,
+      interpreters,
+      trusted
+    });
+    if (!swap) throw new SpawnError("EACCES");
+    const secrets = [];
+    for (const [name2, placeholder] of Object.entries(swap.placeholders)) {
+      const value = swap.values[name2];
+      if (value === void 0 || env[name2] !== placeholder) continue;
+      env[name2] = value;
+      secrets.push({ name: name2, value, placeholder });
+    }
+    const scrub = scrubberOf(secrets);
+    return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {} };
+  }
+  async interpreterChain(planned, cwd, scope) {
+    const out = [];
+    for (const entry of planned.via ?? []) {
+      if (entry.includes("/")) {
+        out.push(await physicalPathAsync(this.base, this.fs.resolvePath(cwd, entry)));
+        continue;
+      }
+      const script = (await this.scriptCommand(entry, cwd, scope))?.script;
+      out.push(
+        await physicalPathAsync(this.base, script ?? await this.commandFile(entry, cwd, scope))
+      );
+    }
+    return out;
+  }
+  async commandFile(name2, cwd, scope) {
+    const scoped = await this.resolve(name2, name2, cwd, scope);
+    const system = scope === "" ? scoped : await this.resolve(name2, name2, cwd, "");
+    if (!scoped || system?.glue === scoped.glue) return `/usr/bin/${name2}`;
+    return scoped.glue;
+  }
+  async trustedFiles(planned, file, cwd, scope) {
+    const files = await this.backingOf(planned, file, cwd, scope);
+    for (const at of files) {
+      if (!await rootOnly(this.base, await physicalPathAsync(this.base, at))) return false;
+    }
+    return true;
+  }
   async grantedCwd(caller, cwd) {
     const real = await physicalPathAsync(this.base, cwd).catch(() => void 0);
     return real === cwd && await this.sudoer.reachable(caller, cwd);
   }
   async binfmtManifests(scripts) {
     const sources = /* @__PURE__ */ new Map();
-    const binfmts = await scanBinfmts(this.base, await this.roots(), void 0, sources);
+    const binfmts = await scanBinfmts(this.scanned, await this.roots(), void 0, sources);
     const manifests = [];
     for (const script of scripts) {
       const head = await this.head(script);
@@ -16661,13 +17541,15 @@ var Launcher = class {
   }
   async backing(file, cwd) {
     const planned = await this.plan(file, [file], cwd, "");
-    if (!planned) return void 0;
+    return planned && this.backingOf(planned, file, cwd, "");
+  }
+  async backingOf(planned, file, cwd, scope) {
     const { glue, wasm, imports } = planned.target;
     const files = [glue, wasm, ...imports ? [imports] : []];
     const scripts = [];
     for (const name2 of [file, ...planned.via ?? []]) {
       if (name2.includes("/") && !COMMAND2.test(name2)) scripts.push(this.fs.resolvePath(cwd, name2));
-      const script = (await this.scriptCommand(name2, cwd, ""))?.script;
+      const script = (await this.scriptCommand(name2, cwd, scope))?.script;
       if (script) scripts.push(script);
     }
     files.push(...scripts, ...await this.binfmtManifests(scripts));
@@ -16684,25 +17566,72 @@ var Launcher = class {
     if (!head || head[0] === 35 && head[1] === 33) return "ENOENT";
     return binfmtOf(await this.interpreters(scope), path) ? "ENOENT" : "ENOEXEC";
   }
-  module(path) {
-    return this.base.stat(path).then((st) => {
-      const key = `${path}:${st.size}:${st.mtime.getTime()}`;
-      let module = this.compiled.get(key);
-      if (!module) {
-        module = this.base.readFileBuffer(path).then(async (bytes) => {
-          const memory = importedMemory(bytes);
-          const foreign = foreignImports(bytes);
-          const compiled = await WebAssembly.compile(bytes);
-          return {
-            module: compiled,
-            ...memory ? { memory } : {},
-            foreign
-          };
-        });
-        this.compiled.set(key, module);
-        module.catch(() => this.compiled.delete(key));
-      }
-      return module;
+  verifiedFs(fs) {
+    const read = (path) => this.verified(path, KERNEL_CALLER, fs);
+    return Object.assign(Object.create(fs), {
+      readFileBuffer: read,
+      readFile: (path) => this.integrity ? this.text(path, KERNEL_CALLER) : fs.readFile(path)
+    });
+  }
+  async cacheKey(path) {
+    const verified = await this.integrity?.key(path);
+    if (verified !== void 0) return verified;
+    const st = await this.base.stat(path);
+    return `${path}:${st.size}:${st.mtime.getTime()}`;
+  }
+  verified(path, caller, fs = this.base) {
+    const plain = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain) : plain();
+  }
+  keyed(path, caller) {
+    const plain = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain) : plain().then((bytes) => ({ bytes }));
+  }
+  cached(cache, key, load) {
+    const hit = cache.get(key);
+    if (hit !== void 0) return hit;
+    const loading2 = load();
+    const found = loading2.then(({ value }) => value);
+    cache.set(key, found);
+    loading2.then(
+      (done4) => {
+        if (done4.key === key || done4.key === void 0 && !key.includes("\0")) return;
+        if (cache.get(key) === found) cache.delete(key);
+        if (done4.key !== void 0) cache.set(done4.key, found);
+      },
+      () => cache.delete(key)
+    );
+    return found;
+  }
+  async module(path, caller) {
+    const key = await this.cacheKey(path);
+    return this.cached(this.compiled, key, async () => {
+      const { bytes, key: read } = await this.keyed(path, caller);
+      const memory = importedMemory(bytes);
+      const foreign = foreignImports(bytes);
+      const compiled = await WebAssembly.compile(bytes);
+      return { value: { module: compiled, ...memory ? { memory } : {}, foreign }, key: read };
+    });
+  }
+  async checkedSources(planned, caller) {
+    const { target } = planned;
+    const files = [target.wasm, target.glue, target.imports, ...planned.sources ?? []];
+    const manifests = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      const root = file === void 0 ? void 0 : PACKAGE_ROOT.exec(file)?.[1];
+      if (root !== void 0) manifests.add(`${root}/package.json`);
+    }
+    for (const source of planned.sources ?? []) await this.text(source, caller);
+    for (const manifest of manifests) {
+      if (await this.base.exists(manifest)) await this.text(manifest, caller);
+    }
+  }
+  async text(path, caller) {
+    if (!this.integrity) return this.base.readFile(path);
+    const key = await this.cacheKey(path);
+    return this.cached(this.texts, key, async () => {
+      const { bytes, key: read } = await this.keyed(path, caller);
+      return { value: new TextDecoder().decode(bytes), key: read };
     });
   }
   async names(path, module) {
@@ -16714,23 +17643,23 @@ var Launcher = class {
     const optional = `${root}-names${beside.slice(root.length)}`;
     return await this.base.exists(optional) ? optional : void 0;
   }
-  async program(target, env) {
+  async program(target, env, caller) {
     if (target.abi === "js" && target.wasm === SUDO_PATH) {
       return { abi: "js", glue: SUDO_SOURCE, path: SUDO_PATH };
     }
     if (target.abi === "js") {
-      return { abi: "js", glue: await this.base.readFile(target.wasm), path: target.wasm };
+      return { abi: "js", glue: await this.text(target.wasm, caller), path: target.wasm };
     }
     if (target.abi !== "wasi") {
       const [glue, { module: module2 }] = await Promise.all([
-        this.base.readFile(target.glue),
-        this.module(target.wasm)
+        this.text(target.glue, caller),
+        this.module(target.wasm, caller)
       ]);
       return { glue, module: module2 };
     }
-    const { module, memory, foreign } = await this.module(target.wasm);
+    const { module, memory, foreign } = await this.module(target.wasm, caller);
     const names = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
-    const imports = target.imports ? await this.base.readFile(target.imports) : void 0;
+    const imports = target.imports ? await this.text(target.imports, caller) : void 0;
     return {
       abi: "wasi",
       glue: "",
@@ -16749,10 +17678,13 @@ var Launcher = class {
     const seen = { ...req.env, HOSTNAME: this.hostname, cwd };
     const env = { ...expandDefaults(target.env, seen), ...req.env };
     for (const key of target.unset ?? []) delete env[key];
+    delete env[TICKET_ENV];
     env.HOSTNAME = this.hostname;
     let program;
     try {
-      program = await this.program(target, env);
+      const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tag };
+      if (this.integrity) await this.checkedSources(planned, caller);
+      program = await this.program(target, env, caller);
     } catch (err) {
       await req.fds.closeAll();
       throw err;
@@ -16762,16 +17694,23 @@ var Launcher = class {
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
+  treeScrubs(pid, req) {
+    const inherited2 = req.ppid !== void 0 ? this.scrubs.get(req.ppid) : void 0;
+    const scrubs = req.scrub ? [...inherited2 ?? [], req.scrub] : inherited2;
+    if (scrubs) this.scrubs.set(pid, scrubs);
+    return scrubs;
+  }
   start(req) {
     this.sampling();
     if (req.pgid !== void 0 && this.jobs.sessionOf(req.pgid) === void 0) {
       throw new SpawnError("ESRCH");
     }
-    const pid = this.nextPid++;
+    const pid = req.pid ?? this.nextPid++;
+    const scrubs = this.treeScrubs(pid, req);
     const stack = this.stackFor(req.tag);
     const terminal = req.fds.stdioTerminal();
     const decided = req.decided ?? Promise.resolve(true);
-    const count = (byParent) => {
+    const count2 = (byParent) => {
       this.identities.asked++;
       if (!byParent) this.identities.timedOut++;
     };
@@ -16779,7 +17718,7 @@ var Launcher = class {
     const handle = spawnWasmProcess({
       pid,
       identity: async () => {
-        await (asked ??= decided.then(count));
+        await (asked ??= decided.then(count2));
         return this.identityOf(pid);
       },
       onSyscall: (call) => {
@@ -16793,6 +17732,7 @@ var Launcher = class {
       ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
+      ...scrubs ? { ttyFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
@@ -16859,6 +17799,7 @@ var Launcher = class {
       if (spent) addTimes(this.imageTimes, this.jobs.shown(pid), spent);
       this.stopped.delete(pid);
       this.processes.delete(pid);
+      this.scrubs.delete(pid);
       if (this.processes.size === 0) {
         clearInterval(this.sampler);
         this.sampler = void 0;
@@ -17030,6 +17971,7 @@ var Launcher = class {
   }
   spawner(ppid, report) {
     return async (req, fds, grant) => {
+      const booked = this.takeTicket(req);
       if (grant && !await this.grantedCwd(grant.caller, req.cwd)) {
         await fds.closeAll();
         throw new SpawnError("EACCES");
@@ -17041,23 +17983,20 @@ var Launcher = class {
       }
       const cred = grant ? grant.cred : this.credOf(ppid);
       const scope = grant ? "" : await this.scopeOf(cred.euid);
-      const planned = await this.plan(req.file, req.argv, req.cwd, scope, req.argv0);
-      try {
-        await this.mayExec(cred, { ...req, pid: ppid }, planned);
-      } catch (err) {
-        await fds.closeAll();
-        throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
-      }
-      if (!planned) {
-        await fds.closeAll();
-        throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
-      }
+      const file = booked === void 0 ? req.file : await this.ticketFile(req, fds);
+      const planned = await this.checkedPlan({ ...req, file }, { ppid, cred, scope }, fds);
+      const redeemed = await this.redeemed(
+        { ...req, file },
+        { ppid, cred, scope, booked },
+        planned,
+        fds
+      );
       const exec = req.exec ? { exec: true } : {};
       const deciding = req.exec ? void 0 : this.undecided(ppid);
       const handle = await this.launch(planned, {
         ...deciding ? { decided: deciding.promise } : {},
-        env: req.env,
         cwd: req.cwd,
+        ...redeemed,
         fds,
         report,
         ppid,
@@ -17110,11 +18049,11 @@ var Launcher = class {
     if (!waiting) return;
     this.deciding.delete(ppid);
     setTimeout(() => {
-      for (const resolve of waiting) resolve(true);
+      for (const resolve2 of waiting) resolve2(true);
     }, 0);
   }
   forker(ppid, parent) {
-    const { exec: _exec, pgid: _pgid, group: _group, ...image } = parent;
+    const { exec: _exec, pgid: _pgid, group: _group, pid: _pid, scrub: _scrub, ...image } = parent;
     return async (state, fds) => childHandle(
       this.start({
         ...image,
@@ -17244,11 +18183,14 @@ var Launcher = class {
         }
       };
     }
-    const module = (await scanFilesystems(this.base, await this.roots())).get(type);
+    const module = (await scanFilesystems(this.scanned, await this.roots())).get(type);
     if (!module) throw fsError("ENODEV", `unknown file system type ${type}`);
     if (!this.createDriverWorker)
       throw fsError("ENODEV", `this kernel cannot start ${type} drivers`);
-    const code = await this.base.readFile(module);
+    const root = PACKAGE_ROOT.exec(module)?.[1];
+    if (this.integrity && root !== void 0)
+      await this.text(`${root}/package.json`, KERNEL_CALLER);
+    const code = new TextDecoder().decode(await this.verified(module, KERNEL_CALLER));
     const worker = this.createDriverWorker();
     const driver = new MessageChannel();
     const client = new MessageChannel();
@@ -17488,7 +18430,14 @@ var Launcher = class {
     );
   }
   environment(cwd, extra, account) {
-    return { ...this.env, ...userEnv(account, this.pnpmHome), PWD: cwd, ...extra };
+    const env = {
+      ...this.env,
+      ...userEnv(account, this.pnpmHome),
+      PWD: cwd,
+      ...extra
+    };
+    delete env[TICKET_ENV];
+    return env;
   }
   async account(user) {
     if (typeof user === "object") return user;
@@ -17584,7 +18533,7 @@ var Launcher = class {
       },
       account
     );
-    const report = (message3) => options.onData(encoder5.encode(`${message3}\r
+    const report = (message3) => options.onData(encoder7.encode(`${message3}\r
 `));
     const handle = await this.launch(planned, {
       env,
@@ -17615,18 +18564,18 @@ var Launcher = class {
     const env = this.environment(cwd, options.env, account);
     const out = [];
     const err = [];
-    const keep = options.collect !== false;
+    const keep2 = options.collect !== false;
     const collect = (chunks2, tee) => (bytes) => {
-      if (keep) chunks2.push(bytes);
+      if (keep2) chunks2.push(bytes);
       tee?.(bytes);
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message3) => stderr(encoder5.encode(`${message3}
+    const report = (message3) => stderr(encoder7.encode(`${message3}
 `));
     if (!planned) {
       report(`${file}: command not found`);
-      return { status: NOT_FOUND, stdout: concat5(out), stderr: concat5(err) };
+      return { status: NOT_FOUND, stdout: concat6(out), stderr: concat6(err) };
     }
     const fds = new FdTable();
     fds.installAt(0, options.stdin ? bytesSource(options.stdin) : deviceFile("null"));
@@ -17644,7 +18593,7 @@ var Launcher = class {
     options.onStarted?.(handle.pid);
     const status = await handle.exited;
     const signal = handle.termsig();
-    return { status, ...signal ? { signal } : {}, stdout: concat5(out), stderr: concat5(err) };
+    return { status, ...signal ? { signal } : {}, stdout: concat6(out), stderr: concat6(err) };
   }
 };
 
@@ -17713,10 +18662,10 @@ var Chunks = class {
       this.grow(size);
       return;
     }
-    const keep = Math.ceil(size / CHUNK4);
-    this.blobs.length = keep;
-    if (keep > 0)
-      this.blobs[keep - 1] = this.blobs[keep - 1].slice(0, size - (keep - 1) * CHUNK4);
+    const keep2 = Math.ceil(size / CHUNK4);
+    this.blobs.length = keep2;
+    if (keep2 > 0)
+      this.blobs[keep2 - 1] = this.blobs[keep2 - 1].slice(0, size - (keep2 - 1) * CHUNK4);
     this.size = size;
   }
 };
@@ -17865,12 +18814,12 @@ function codeOf5(e) {
   return typeof code === "string" ? code : void 0;
 }
 function probe(secure, host, port, ms) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const socket = secure ? tls({ host, port, ...isIP(host) ? {} : { servername: host } }) : tcp({ host, port });
     const done4 = (code) => {
       clearTimeout(timer);
       socket.destroy();
-      resolve(code);
+      resolve2(code);
     };
     const timer = setTimeout(() => done4("ETIMEDOUT"), ms);
     socket.once(secure ? "secureConnect" : "connect", () => done4("EPROTO"));
@@ -17962,8 +18911,8 @@ var RemoteTransport = class {
   }
   ask(call) {
     if (this.failure) return Promise.reject(this.failure);
-    return new Promise((resolve, reject) => {
-      this.waiting.set(call.nid, { resolve, reject });
+    return new Promise((resolve2, reject) => {
+      this.waiting.set(call.nid, { resolve: resolve2, reject });
       this.port.postMessage(call);
     });
   }
@@ -18143,7 +19092,7 @@ function dialStream(port, onClose) {
     write(chunk2) {
       if (closed) throw errorWithCode("EPIPE: the connection is closed");
       const copy = fresh(chunk2);
-      const acked = new Promise((resolve, reject) => acks.push({ resolve, reject }));
+      const acked = new Promise((resolve2, reject) => acks.push({ resolve: resolve2, reject }));
       port.postMessage(copy, [copy.buffer]);
       return acked;
     },
@@ -18163,7 +19112,7 @@ function dialStream(port, onClose) {
 
 // src/client/loopback-fetch.ts
 var OWN_HEADERS = /* @__PURE__ */ new Set(["host", "connection", "content-length", "transfer-encoding"]);
-var encoder6 = new TextEncoder();
+var encoder8 = new TextEncoder();
 var latin12 = new TextDecoder("latin1");
 var ByteSource = class {
   buffered = new Uint8Array(0);
@@ -18181,7 +19130,7 @@ var ByteSource = class {
     return true;
   }
   async until(marker) {
-    const needle = encoder6.encode(marker);
+    const needle = encoder8.encode(marker);
     for (; ; ) {
       const at = indexOf(this.buffered, needle);
       if (at >= 0) return this.take(at + needle.length);
@@ -18192,13 +19141,13 @@ var ByteSource = class {
     if (this.buffered.length === 0 && !await this.more()) return void 0;
     return this.take(Math.min(max, this.buffered.length));
   }
-  async exactly(count) {
-    while (this.buffered.length < count) if (!await this.more()) return void 0;
-    return this.take(count);
+  async exactly(count2) {
+    while (this.buffered.length < count2) if (!await this.more()) return void 0;
+    return this.take(count2);
   }
-  take(count) {
-    const out = this.buffered.slice(0, count);
-    this.buffered = this.buffered.slice(count);
+  take(count2) {
+    const out = this.buffered.slice(0, count2);
+    this.buffered = this.buffered.slice(count2);
     return out;
   }
 };
@@ -18289,7 +19238,7 @@ async function requestBytes(request) {
   });
   if (body) lines2.push(`Content-Length: ${body.length}`);
   lines2.push("Connection: close", "", "");
-  const head = encoder6.encode(lines2.join("\r\n"));
+  const head = encoder8.encode(lines2.join("\r\n"));
   const out = new Uint8Array(head.length + (body?.length ?? 0));
   out.set(head);
   if (body) out.set(body, head.length);
@@ -18343,8 +19292,8 @@ var KernelCallError = class extends Error {
     this.code = code;
   }
 };
-var encoder7 = new TextEncoder();
-var bytesOf2 = (data) => typeof data === "string" ? encoder7.encode(data) : data;
+var encoder9 = new TextEncoder();
+var bytesOf2 = (data) => typeof data === "string" ? encoder9.encode(data) : data;
 var UNAVAILABLE = {
   manualRedirects: false,
   encodedBodies: false,
@@ -18364,7 +19313,7 @@ async function holdLock(locks) {
   await granted2.promise;
   return { name: name2, release: () => held.resolve() };
 }
-function concat6(chunks2) {
+function concat7(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let at = 0;
   for (const chunk2 of chunks2) {
@@ -18415,8 +19364,8 @@ var Channel = class {
     const id2 = ++this.nextId;
     const { failure } = this;
     if (failure) return { id: id2, done: Promise.reject(failure) };
-    const done4 = new Promise((resolve, reject) => {
-      this.pending.set(id2, { resolve, reject, ...handlers });
+    const done4 = new Promise((resolve2, reject) => {
+      this.pending.set(id2, { resolve: resolve2, reject, ...handlers });
       this.port.postMessage({ ...call, id: id2 });
     });
     return { id: id2, done: done4 };
@@ -18554,7 +19503,7 @@ async function runOn(channel, argv, opts) {
     onStderr: tee(2, onStderr)
   });
   const { status, signal } = await child.ended;
-  const text = (fd) => new TextDecoder().decode(concat6(chunks2[fd]));
+  const text = (fd) => new TextDecoder().decode(concat7(chunks2[fd]));
   return {
     pid: child.pid,
     status,
@@ -18833,10 +19782,10 @@ async function createNodeKernel(options = {}) {
     ...options.approve ? { approve: options.approve } : {}
   });
   await launcher.prepare();
-  const guard2 = (work) => new Promise((resolve, reject) => {
+  const guard2 = (work) => new Promise((resolve2, reject) => {
     if (terminated) return reject(new Error(TERMINATED));
     pending.add(reject);
-    work().then(resolve, reject).finally(() => pending.delete(reject));
+    work().then(resolve2, reject).finally(() => pending.delete(reject));
   });
   const decoder4 = new TextDecoder();
   return {