@ai-ecoverse/slicc-kernel 1.83.0 → 1.84.1

package/dist/node.js

@@ -448,8 +448,8 @@ async function inParent(g, op, path, old = false) {
   if (!old) return void await need(g, op, parentOf(path), W_OK | X_OK, DIR, path);
   const dir = await access(g.fs, g.cred, parentOf(path), W_OK | X_OK, DIR);
   if (dir.denied === void 0) return stickyEntry(g, op, path, dir);
-  const lookup2 = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
-  if (!lookup2 || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
+  const lookup3 = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
+  if (!lookup3 || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
 }
 async function makeIn(g, op, path) {
   for (let dir = parentOf(path); ; dir = parentOf(dir)) {
@@ -3022,6 +3022,9 @@ var MemoryMeta = class {
   async remove(paths) {
     for (const path of paths) this.entries.deleteTree(path);
   }
+  absent(path) {
+    return !this.entries.has(path);
+  }
   async links(dir) {
     return [...this.entries.entries()].map(([, e]) => e).filter((entry) => entry.dir === dir);
   }
@@ -3467,10 +3470,17 @@ function translate(err, path, op = "lookup", mapped = true) {
 var META_OPS = ["get", "update", "move", "remove", "links", "under", "all"];
 function sidecar(meta) {
   const pathOf = ([first]) => [first, "/"].flat().find((p) => typeof p === "string");
-  const guarded2 = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
+  const guarded3 = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
     throw translate(err, pathOf(args), "sidecar", false);
   });
-  return Object.fromEntries(META_OPS.map((op) => [op, guarded2(op)]));
+  const ops = Object.fromEntries(META_OPS.map((op) => [op, guarded3(op)]));
+  if (meta.absent) ops.absent = meta.absent.bind(meta);
+  const { removeFile } = meta;
+  if (removeFile)
+    ops.removeFile = (path) => removeFile.call(meta, path).catch((err) => {
+      throw translate(err, path, "sidecar", false);
+    });
+  return ops;
 }
 function missing2(err) {
   const code = err?.code;
@@ -4163,6 +4173,7 @@ var OpfsFs = class {
       throw error;
     }
     this.refuse(found.path, true);
+    if (options.file && found.handle?.kind === "directory") throw fsError("EISDIR", path);
     if (found.handle) {
       const [dir, name2] = await this.parent(found.path);
       try {
@@ -4173,8 +4184,19 @@ var OpfsFs = class {
       } catch (err) {
         throw translate(err, path);
       }
-      this.changed(found.path);
+      const file = found.handle.kind === "file";
+      if (!file || this.remote?.watched()) this.changed(found.path);
+      else this.forget(found.path);
       this.movePending(found.path);
+      if (file && this.meta.absent?.(found.path)) {
+        this.touch(parentOf4(found.path));
+        return;
+      }
+      if (file && this.meta.removeFile) {
+        await this.meta.removeFile(found.path);
+        this.touch(parentOf4(found.path));
+        return;
+      }
     }
     await this.meta.remove([found.path]);
     this.touch(parentOf4(found.path));
@@ -5907,9 +5929,13 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
 // src/fs/fresh-modules.ts
 var MAGIC = [0, 97, 115, 109];
 var MAX_FRESH = 65536;
+var DEFAULT_UMASK = 18;
 function isModule(bytes) {
   return MAGIC.every((b, i) => bytes[i] === b);
 }
+function within4(path, dir) {
+  return path.startsWith(dir === "/" ? "/" : `${dir}/`);
+}
 var FreshModules = class {
   fresh = /* @__PURE__ */ new Map();
   add(path, umask, pid) {
@@ -5917,17 +5943,40 @@ var FreshModules = class {
     this.fresh.delete(key);
     const oldest = this.fresh.size >= MAX_FRESH ? this.fresh.keys().next().value : void 0;
     if (oldest !== void 0) this.fresh.delete(oldest);
-    this.fresh.set(key, { umask: umask & 511, pid, added: 0 });
+    const mask = umask & 511;
+    this.fresh.set(key, { umask: mask, pid, added: 0, setup: mask !== DEFAULT_UMASK });
   }
   forget(pid) {
     for (const [path, fresh2] of this.fresh) if (fresh2.pid === pid) this.fresh.delete(path);
   }
+  drop(fresh2) {
+    for (const [key, note] of [...this.fresh]) if (note === fresh2) this.fresh.delete(key);
+  }
+  moved(from, to) {
+    const source = normalizePath(from);
+    const target = normalizePath(to);
+    if (source === target) return;
+    for (const key of [...this.fresh.keys()]) {
+      if (key === target || within4(key, target)) this.fresh.delete(key);
+    }
+    for (const [key, fresh2] of [...this.fresh]) {
+      if (key !== source && !within4(key, source)) continue;
+      this.fresh.delete(key);
+      this.fresh.set(target + key.slice(source.length), fresh2);
+    }
+  }
   wrap(fs) {
-    const decide = async (given, bytes) => {
+    const head = async (path) => {
+      if (fs.pread) return fs.pread(path, 0, MAGIC.length);
+      return (await fs.readFileBuffer(path)).subarray(0, MAGIC.length);
+    };
+    const decide = async (given, known) => {
       const path = normalizePath(given);
       const fresh2 = this.fresh.get(path);
-      if (!fresh2 || typeof bytes === "string" || bytes.length < MAGIC.length) return;
+      if (!fresh2) return;
+      const bytes = known && known.length >= MAGIC.length ? known : await head(path);
       const want = isModule(bytes) ? 73 & ~fresh2.umask : 0;
+      fresh2.setup = false;
       if (want === fresh2.added) return;
       const mode = (await fs.stat(path)).mode & 4095;
       await fs.chmod(path, mode & ~fresh2.added | want);
@@ -5936,32 +5985,47 @@ var FreshModules = class {
     const overrides = {
       writeFile: async (path, content, owner) => {
         await fs.writeFile(path, content, owner);
-        await decide(path, content);
+        if (this.fresh.has(normalizePath(path))) {
+          await decide(
+            path,
+            typeof content === "string" ? new TextEncoder().encode(content) : content
+          );
+        }
       },
       chmod: async (path, mode) => {
         const fresh2 = this.fresh.get(normalizePath(path));
-        const creating = fresh2?.added === 0 && (mode & 4095) === (438 & ~fresh2.umask);
-        if (!creating) this.fresh.delete(normalizePath(path));
+        if (fresh2?.setup && (mode & 4095) === (438 & ~fresh2.umask)) fresh2.setup = false;
+        else if (fresh2) this.drop(fresh2);
         await fs.chmod(path, mode);
       },
       rm: async (path, options) => {
-        this.fresh.delete(normalizePath(path));
         await fs.rm(path, options);
+        const at = normalizePath(path);
+        for (const key of [...this.fresh.keys()]) {
+          if (key === at || within4(key, at)) this.fresh.delete(key);
+        }
       },
       rename: async (from, to) => {
         await fs.rename(from, to);
-        const fresh2 = this.fresh.get(normalizePath(from));
-        this.fresh.delete(normalizePath(from));
-        this.fresh.delete(normalizePath(to));
+        this.moved(from, to);
+      },
+      link: async (from, to, follow2) => {
+        await fs.link(from, to, follow2);
+        const source = follow2 && fs.realpath ? await fs.realpath(from, true) : from;
+        const fresh2 = this.fresh.get(normalizePath(source));
         if (fresh2) this.fresh.set(normalizePath(to), fresh2);
       }
     };
     const ranged2 = rangedOps(fs);
     if (ranged2) {
       overrides.pwrite = async (path, at, bytes, transfer) => {
-        const head = at === 0 && this.fresh.has(normalizePath(path)) ? bytes.slice(0, 4) : void 0;
+        const touches2 = at < MAGIC.length && this.fresh.has(normalizePath(path));
         await ranged2.pwrite(path, at, bytes, transfer);
-        if (head) await decide(path, head);
+        if (touches2) await decide(path);
+      };
+      overrides.truncate = async (path, size) => {
+        await ranged2.truncate(path, size);
+        if (size < MAGIC.length && this.fresh.has(normalizePath(path))) await decide(path);
       };
     }
     const bound2 = /* @__PURE__ */ new WeakMap();
@@ -6701,7 +6765,7 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within5 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -6720,7 +6784,7 @@ var HeldSet = class extends Set {
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within4(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within5(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
@@ -6836,24 +6900,24 @@ var HeldPaths = class extends Map {
     return this.owning === path;
   }
   revoke(prefix) {
-    for (const path of this.keys()) if (within4(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within5(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count2] of [...this]) {
-      if (!within4(path, from)) continue;
+      if (!within5(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count2);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
     for (const [path, count2] of [...this.opens]) {
-      if (!within4(path, from)) continue;
+      if (!within5(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.opens.delete(path);
       this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count2);
     }
     for (const [id2, key] of this.handles) {
-      if (within4(key, from)) this.handles.set(id2, to + key.slice(from.length));
+      if (within5(key, from)) this.handles.set(id2, to + key.slice(from.length));
     }
   }
   isRevoked(path) {
@@ -6957,10 +7021,14 @@ var MountTable = class {
       ...error ? { error } : {}
     });
   }
+  under(path) {
+    for (const mount of this.mounts.values()) if (within5(mount.target, path)) return true;
+    return false;
+  }
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within4(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within5(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -7103,7 +7171,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within4(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within5(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -7138,10 +7206,10 @@ var MountTable = class {
   }
   forget(mount, path) {
     mount.epoch++;
-    for (const key of [...mount.attrs.keys()]) if (within4(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within5(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
     mount.lists.delete(parentOf7(path));
-    for (const key of [...mount.lists.keys()]) if (within4(key, path)) mount.lists.delete(key);
+    for (const key of [...mount.lists.keys()]) if (within5(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2, settled = false) {
     for (let round = 1; ; round++) {
@@ -7526,9 +7594,12 @@ var MountFs = class {
   }
   async rm(path, options = {}) {
     const found = this.at(path);
+    if (!found && options.recursive && this.table.under(normalizePath(path)))
+      return this.rmAround(normalizePath(path), options);
     if (!found) return this.base.rm(path, options);
     const { mount, rel: rel2 } = found;
     const real = normalizePath(path);
+    if (rel2 === "/" && options.recursive) await this.rmEach(real, mount, rel2, options);
     if (rel2 === "/") throw errnoError("EBUSY", `${real} is a mount point`);
     this.writable(mount, real);
     await this.table.commitUnder(real);
@@ -7539,16 +7610,33 @@ var MountFs = class {
       if (options.force && err.code === "ENOENT") return;
       throw err;
     }
+    if (options.file && attr2.kind === "directory") throw errnoError("EISDIR", real);
     this.table.forget(mount, real);
     if (attr2.kind === "directory" && options.recursive) {
-      for (const entry of await this.table.readdir(mount, real, rel2)) {
-        await this.rm(`${real}/${entry.name}`, { recursive: true, force: options.force ?? false });
-      }
+      await this.rmEach(real, mount, rel2, { recursive: true, force: options.force ?? false });
       this.table.forget(mount, real);
     }
     await mount.conn.call({ op: attr2.kind === "directory" ? "rmdir" : "unlink", path: rel2 });
     this.table.forget(mount, real);
   }
+  async rmEach(real, mount, rel2, options) {
+    let first;
+    for (const entry of await this.table.readdir(mount, real, rel2)) {
+      await this.rm(joinName(real, entry.name), options).catch((err) => {
+        first ??= err;
+      });
+    }
+    if (first) throw first;
+  }
+  async rmAround(path, options) {
+    let first;
+    for (const name2 of await this.base.readdir(path)) {
+      await this.rm(joinName(path, name2), options).catch((err) => {
+        first ??= err;
+      });
+    }
+    throw first ?? errnoError("EBUSY", `${path} holds a mount point`);
+  }
   async rename(from, to) {
     const a = this.at(from);
     const b = this.at(to);
@@ -7776,6 +7864,11 @@ function statJson(s) {
 async function readdirStat(fs, dir) {
   return (await fs.readdirStat(dir)).map(([name2, stat]) => [name2, stat && statJson(stat)]);
 }
+async function usageAt(entry, path) {
+  if (!entry.statfs) return void 0;
+  const real = await realTarget(entry.fs, path).catch(() => path);
+  return entry.statfs(real);
+}
 async function storageUsage() {
   const estimate = await globalThis.navigator?.storage?.estimate?.();
   if (typeof estimate?.quota !== "number") return null;
@@ -7847,8 +7940,7 @@ async function run(entry, path, req) {
       await fs.link(path, fs.resolvePath(cwd, req.arg2 ?? ""), req.mode === 1);
       return done;
     case "unlink":
-      if ((await fs.lstat(path)).isDirectory) throw syncError("EISDIR", path);
-      await fs.rm(path);
+      await fs.rm(path, { file: true });
       return done;
     case "rmdir":
       if (!(await fs.lstat(path)).isDirectory) throw syncError("ENOTDIR", path);
@@ -7996,8 +8088,8 @@ async function guarded(entry, path, req) {
     await guard(g, path, req, entry.cwd);
     return void 0;
   } catch (err) {
-    const refusal = err.code === "EACCES";
-    return req.op === "exists" && refusal ? json2(false) : toErrno(err);
+    const refusal2 = err.code === "EACCES";
+    return req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
   }
 }
 async function createExclusive(fs, path, owner) {
@@ -8082,6 +8174,26 @@ async function dispatchSyncFs(req) {
     return toErrno(err);
   }
 }
+var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
+async function rmPermitted(entry, path, req, refused2) {
+  const st = await entry.fs.lstat(path).catch(() => void 0);
+  if (!st?.isDirectory) return refused2;
+  const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
+  if (unlisted) return unlisted;
+  const names = await entry.fs.readdir(path).catch(() => void 0);
+  if (!names) return refused2;
+  let first;
+  for (const name2 of names) {
+    const child = await dispatchOne(entry, {
+      ...req,
+      path: joinName(path, name2)
+    });
+    if (!child.ok) first ??= child;
+  }
+  if (first) return first;
+  const again = await guarded(entry, path, req);
+  return again ?? await run(entry, path, req);
+}
 async function dispatchOne(entry, req) {
   const { fs, cwd } = entry;
   try {
@@ -8091,8 +8203,11 @@ async function dispatchOne(entry, req) {
     if (req.op === "access") return await accessOp(entry, path, req);
     if (req.op === "hold") return await holdOp(entry, path, req);
     const refused2 = await guarded(entry, path, req);
+    if (refused2 && req.op === "rm" && !refused2.ok && DENIED.has(refused2.errno)) {
+      return await rmPermitted(entry, path, req, refused2);
+    }
     if (refused2) return refused2;
-    if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
+    if (req.op === "statfs") return json2(await usageAt(entry, path) ?? await storageUsage());
     if (entry.revoked?.(path)) return { ok: false, errno: "EIO", message: `${path} was unmounted` };
     if (req.op === "write" && req.mode === 1 || UNLINKED_OPS.has(req.op)) {
       const serve = async () => run(entry, await keptOr(entry, path, req.handle), req);
@@ -10776,7 +10891,7 @@ function parsePrefix(text) {
   if (length2 < 0 || length2 > max) return void 0;
   return { ...parsed2, length: length2 };
 }
-function within5(prefix, addr) {
+function within6(prefix, addr) {
   if (prefix.v6 !== addr.v6) return false;
   const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
   return addr.bits >> shift === prefix.bits >> shift;
@@ -10816,9 +10931,9 @@ var Routes = class {
     if (!addr) return "unreachable";
     if (addr.v6 && addr.bits === 1n) return "loopback";
     if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within5(p, addr))) return "reserved";
+    if (RESERVED.some((p) => within6(p, addr))) return "reserved";
     if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within5(p, addr))) return "uplink";
+    if (this.exit || this.table.some((p) => within6(p, addr))) return "uplink";
     return "unreachable";
   }
 };
@@ -10884,14 +10999,14 @@ var Resolver = class {
     if (hit && hit.expires > this.now()) return hit.addresses;
     const signal = blocking?.();
     if (signal?.aborted) throw new KernelError("EINTR");
-    let lookup2 = this.pending.get(id2);
-    if (!lookup2) {
+    let lookup3 = this.pending.get(id2);
+    if (!lookup3) {
       const abort = new AbortController();
-      lookup2 = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
-      this.pending.set(id2, lookup2);
-      void lookup2.work.then(() => this.pending.delete(id2));
+      lookup3 = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
+      this.pending.set(id2, lookup3);
+      void lookup3.work.then(() => this.pending.delete(id2));
     }
-    return waitFor(lookup2, signal);
+    return waitFor(lookup3, signal);
   }
   async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
@@ -10932,17 +11047,17 @@ var Resolver = class {
     }
   }
 };
-function waitFor(lookup2, signal) {
-  lookup2.waiters++;
+function waitFor(lookup3, signal) {
+  lookup3.waiters++;
   return new Promise((resolve2, reject) => {
     const abort = () => {
-      if (--lookup2.waiters === 0) lookup2.abort.abort(new KernelError("EINTR"));
+      if (--lookup3.waiters === 0) lookup3.abort.abort(new KernelError("EINTR"));
       reject(new KernelError("EINTR"));
     };
     signal?.addEventListener("abort", abort, { once: true });
-    void lookup2.work.then((value) => {
+    void lookup3.work.then((value) => {
       if (signal?.aborted) return;
-      lookup2.waiters--;
+      lookup3.waiters--;
       signal?.removeEventListener("abort", abort);
       resolve2(value);
     });
@@ -11674,7 +11789,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within6(path, root) {
+function within7(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -11995,12 +12110,12 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within6(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within7(path, prefix)) return true;
     return false;
   }
   writes(prefix) {
     for (const [path, node] of this.byPath)
-      if (node.writers > 0 && within6(path, prefix)) return true;
+      if (node.writers > 0 && within7(path, prefix)) return true;
     return false;
   }
   closed(node, writable2 = false) {
@@ -12044,11 +12159,11 @@ var VfsNodes = class {
     this.kept.delete(node);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within6(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within7(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within6(held, path)) continue;
+      if (!within7(held, path)) continue;
       await node.serial(async () => {
         await Promise.all([this.keepsOnDisk || node.keep(), node.limit()]);
       });
@@ -12056,14 +12171,14 @@ var VfsNodes = class {
   }
   revoke(prefix) {
     for (const [path, node] of [...this.byPath]) {
-      if (!within6(path, prefix)) continue;
+      if (!within7(path, prefix)) continue;
       node.revoke();
       this.forget(node);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within6(held, path) || this.byPath.get(held) !== node) continue;
+      if (!within7(held, path) || this.byPath.get(held) !== node) continue;
       if (!this.dropName(held, node)) this.orphan(node);
     }
   }
@@ -12071,8 +12186,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of [...this.byPath]) {
-      if (within6(p, from)) moved2.push([p, node]);
-      else if (within6(p, to) && this.byPath.get(p) === node && !this.dropName(p, node)) {
+      if (within7(p, from)) moved2.push([p, node]);
+      else if (within7(p, to) && this.byPath.get(p) === node && !this.dropName(p, node)) {
         this.orphan(node);
       }
     }
@@ -12351,7 +12466,7 @@ function isWasmSyscall(req) {
 var MAX_READ = 1024 * 1024;
 var WRITE_ACCESS = 3;
 var KEYBOARD = /* @__PURE__ */ new Set([SIG.INT, SIG.QUIT, SIG.TSTP]);
-var DEFAULT_UMASK = 18;
+var DEFAULT_UMASK2 = 18;
 function words(value) {
   if (!Array.isArray(value) || !value.every((w) => typeof w === "string")) {
     throw new KernelError("EINVAL");
@@ -12379,7 +12494,7 @@ var WasmProcess = class {
   interrupt = new AbortController();
   gone = new AbortController();
   dying = false;
-  umask = DEFAULT_UMASK;
+  umask = DEFAULT_UMASK2;
   cred;
   execChild;
   killed = false;
@@ -12401,7 +12516,7 @@ var WasmProcess = class {
     this.fds = fds;
     this.options = options;
     this.inherited = options.ignored ?? 0;
-    this.umask = options.umask ?? DEFAULT_UMASK;
+    this.umask = options.umask ?? DEFAULT_UMASK2;
     this.cred = copyCred(options.cred ?? ROOT);
     this.children = new ChildTable(fds, options.spawner, options.forker);
     this.nodes = options.nodes ?? new VfsNodes(options.fs);
@@ -18087,7 +18202,7 @@ var Launcher = class {
     }
   }
   umaskOf(pid) {
-    return this.processes.get(pid)?.umask?.() ?? DEFAULT_UMASK;
+    return this.processes.get(pid)?.umask?.() ?? DEFAULT_UMASK2;
   }
   imageOf(pid) {
     const members = this.jobs.list();
@@ -18597,6 +18712,111 @@ var Launcher = class {
   }
 };
 
+// src/node/loopback.ts
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+var DEVTOOLS_PORTS = [9222, 9223, 9224, 9225, 9226, 9227, 9228, 9229];
+var METADATA_V6 = [64768, 3778, 0, 0, 0, 0, 0, 596].join(":");
+var resolveHost = async (host) => (await lookup(host, { all: true, verbatim: true })).map((a) => a.address);
+function ipv4Place(address) {
+  const [a, b] = address.split(".").map(Number);
+  if (a === 127 || a === 0) return "loopback";
+  if (a === 169 && b === 254) return "link-local";
+  return void 0;
+}
+function placeOf(address) {
+  const plain = address.replace(/^\[(.*)\]$/, "$1").toLowerCase();
+  const kind = isIP(plain);
+  if (kind === 4) return ipv4Place(plain);
+  if (kind !== 6) return void 0;
+  const words2 = hextets2(plain);
+  const embedded2 = words2.slice(0, 5).every((w) => w === 0) && (words2[5] === 65535 || words2[5] === 0);
+  if (embedded2 && (words2[5] === 65535 || words2[6] !== 0)) return ipv4Place(ipv4Of(words2));
+  if (words2.slice(0, 7).every((w) => w === 0) && (words2[7] ?? 0) <= 1) return "loopback";
+  if (((words2[0] ?? 0) & 65472) === 65152) return "link-local";
+  if (words2.join(":") === METADATA_V6) return "link-local";
+  return void 0;
+}
+function ipv4Of(words2) {
+  const [high = 0, low = 0] = words2.slice(6);
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+function hextets2(address) {
+  const dotted = /(\d+\.\d+\.\d+\.\d+)$/.exec(address)?.[1];
+  let text = address;
+  if (dotted) {
+    const [a, b, c, d] = dotted.split(".").map(Number);
+    text = `${address.slice(0, -dotted.length)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const [head = "", tail] = text.split("::");
+  const part = (side) => side ? side.split(":").map((w) => Number.parseInt(w, 16)) : [];
+  const left = part(head);
+  const right = tail === void 0 ? [] : part(tail);
+  const gap = Array(8 - left.length - right.length).fill(0);
+  return [...left, ...gap, ...right];
+}
+function loopbackName2(host) {
+  const name2 = host.toLowerCase().replace(/\.$/, "");
+  return name2 === "localhost" || name2.endsWith(".localhost");
+}
+function portOf(url) {
+  if (url.port) return Number(url.port);
+  return url.protocol === "https:" || url.protocol === "wss:" ? 443 : 80;
+}
+function allows(policy, port) {
+  if (Array.isArray(policy)) return policy.includes(port);
+  return policy === true && !DEVTOOLS_PORTS.includes(port);
+}
+function refusal(url, address, place) {
+  const where = `${address}:${portOf(url)}`;
+  const why = place === "link-local" ? `nodeTransport refuses link-local ${where}` : `nodeTransport refuses the host's loopback ${where} (see nodeTransport({ hostLoopback }))`;
+  return Object.assign(new Error(why), { status: 403, code: "EACCES" });
+}
+async function addressesOf(host, resolve2) {
+  const plain = host.replace(/^\[(.*)\]$/, "$1");
+  if (isIP(plain)) return [plain];
+  if (loopbackName2(plain)) return ["127.0.0.1"];
+  return resolve2(plain).catch(() => []);
+}
+async function checkDestination(target, policy, resolve2 = resolveHost) {
+  const url = new URL(target);
+  for (const address of await addressesOf(url.hostname, resolve2)) {
+    const place = placeOf(address);
+    if (!place) continue;
+    if (place === "loopback" && allows(policy, portOf(url))) continue;
+    throw refusal(url, address, place);
+  }
+}
+function guarded2(check, signal) {
+  if (!signal) return check;
+  signal.throwIfAborted();
+  let stop = () => {
+  };
+  const aborted2 = new Promise((_, reject) => {
+    stop = () => reject(signal.reason);
+    signal.addEventListener("abort", stop, { once: true });
+  });
+  return Promise.race([check, aborted2]).finally(() => signal.removeEventListener("abort", stop));
+}
+function guardedLoopback(transport, policy, resolve2) {
+  const open = transport.websocket?.bind(transport);
+  return {
+    get traits() {
+      return transport.traits;
+    },
+    fetch: async (request, owner) => {
+      await guarded2(checkDestination(request.url, policy, resolve2), request.signal);
+      return transport.fetch(request, owner);
+    },
+    ...open ? {
+      websocket: async (request) => {
+        await guarded2(checkDestination(request.url, policy, resolve2), request.signal);
+        return open(request);
+      }
+    } : {}
+  };
+}
+
 // src/node/memory-root.ts
 var fail2 = (name2) => {
   throw new DOMException(name2, name2);
@@ -18803,8 +19023,8 @@ function isMemoryRoot(handle) {
 }
 
 // src/node/ws-diagnose.ts
-import { lookup } from "node:dns/promises";
-import { isIP, connect as tcp } from "node:net";
+import { lookup as lookup2 } from "node:dns/promises";
+import { isIP as isIP2, connect as tcp } from "node:net";
 import { connect as tls } from "node:tls";
 var PROBE_MS = 3e3;
 var PASSED = /* @__PURE__ */ new Set(["ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ETIMEDOUT", "ECONNRESET"]);
@@ -18815,7 +19035,7 @@ function codeOf5(e) {
 }
 function probe(secure, host, port, ms) {
   return new Promise((resolve2) => {
-    const socket = secure ? tls({ host, port, ...isIP(host) ? {} : { servername: host } }) : tcp({ host, port });
+    const socket = secure ? tls({ host, port, ...isIP2(host) ? {} : { servername: host } }) : tcp({ host, port });
     const done4 = (code) => {
       clearTimeout(timer);
       socket.destroy();
@@ -18835,7 +19055,7 @@ async function diagnose(url, ms = PROBE_MS) {
   const secure = at.protocol === "wss:";
   const port = Number(at.port) || (secure ? 443 : 80);
   try {
-    await lookup(host);
+    await lookup2(host);
   } catch (e) {
     return NO_NAME.has(codeOf5(e) ?? "") ? "EAI_NONAME" : void 0;
   }
@@ -19684,9 +19904,10 @@ function hostfsFetchOf(options) {
     }
   };
 }
-function nodeTransport() {
+function nodeTransport(options = {}) {
   const transport = fetchTransport({ webSocket: true, webSocketHeaders: true, redirect: "manual" });
-  return diagnosing({ ...transport, traits: { ...transport.traits, crossOrigin: "any" } });
+  const open = { ...transport, traits: { ...transport.traits, crossOrigin: "any" } };
+  return diagnosing(guardedLoopback(open, options.hostLoopback ?? false));
 }
 var TERMINATED = "the kernel is terminated";
 var EXIT_GRACE_MS = 50;