@ai-ecoverse/slicc-kernel 1.85.1 → 1.87.0

package/dist/node-process-worker.js

@@ -1984,12 +1984,10 @@ var init_wasi_fds = __esm({
         let fd;
         let kind;
         if (path === SEALED_PATH && openSealed) {
-          if (oflags & OFLAGS.DIRECTORY) throw new WasiError("ENOTDIR");
-          if (oflags & OFLAGS.CREAT && oflags & OFLAGS.EXCL) throw new WasiError("EEXIST");
-          fd = openSealed.call(this.kernel.sys);
+          fd = this.openCharDevice(openSealed, oflags, rights);
           kind = "sealed";
         } else if (path === CLIPBOARD_PATH && openClipboard) {
-          fd = this.openClipboard(openClipboard, oflags, rights);
+          fd = this.openCharDevice(openClipboard, oflags, rights);
           kind = "clipboard";
         } else if (path === "/dev/tty" || /^\/dev\/tty\d+$/.test(path)) {
           fd = openTty?.call(this.kernel.sys, path === "/dev/tty" ? void 0 : path);
@@ -2000,12 +1998,12 @@ var init_wasi_fds = __esm({
         this.bump();
         return fd;
       }
-      openClipboard(openClipboard, oflags, rights) {
+      openCharDevice(openDevice2, oflags, rights) {
         if (oflags & OFLAGS.DIRECTORY) throw new WasiError("ENOTDIR");
         if (oflags & OFLAGS.CREAT && oflags & OFLAGS.EXCL) throw new WasiError("EEXIST");
         const want = wantOf(oflags, rights);
         const flags = want === 6 ? O_RDWR : want === 2 ? O_WRONLY : 0;
-        return openClipboard.call(this.kernel.sys, flags);
+        return openDevice2.call(this.kernel.sys, flags);
       }
       open(path, oflags, rights, fdflags) {
         const device2 = deviceOf(path);
@@ -2591,7 +2589,7 @@ var init_wasi_host = __esm({
           }
           return path;
         };
-        const modeOf = (st) => (st.mode ?? 0) & 4095;
+        const modeOf2 = (st) => (st.mode ?? 0) & 4095;
         const chown = (path, uid, gid, follow2) => {
           const { chown: own } = this.o.fs;
           if (!own) throw new WasiError("ENOSYS");
@@ -2670,7 +2668,7 @@ var init_wasi_host = __esm({
           fd_mode: (fd, out) => {
             const e = fds.get(fd);
             const kind = e.type === "kernel" ? fds.kind(fd, e) : void 0;
-            const mode = kind === "stream" ? S_IFIFO | 384 : kind === "sealed" || kind === "clipboard" ? SEALED_MODE : modeOf(this.o.fs.stat(pathOf(fd)));
+            const mode = kind === "stream" ? S_IFIFO | 384 : kind === "sealed" || kind === "clipboard" ? SEALED_MODE : modeOf2(this.o.fs.stat(pathOf(fd)));
             mem.view().setUint32(out, mode, true);
           },
           path_mode: (dirfd, p, l, flags, out) => {
@@ -2678,7 +2676,7 @@ var init_wasi_host = __esm({
             if (this.synthetic(path) && deviceOf(path) === void 0)
               return void mem.view().setUint32(out, SEALED_MODE, true);
             const st = flags & AT_SYMLINK_NOFOLLOW ? this.o.fs.lstat(path) : this.o.fs.stat(path);
-            mem.view().setUint32(out, modeOf(st), true);
+            mem.view().setUint32(out, modeOf2(st), true);
           }
         });
       }
@@ -3621,7 +3619,7 @@ function importsContext({
 }
 function processes(host, call2, inThread) {
   const close = (fd) => void call2({ op: "fd-close", fd });
-  const slot = (n, how, mine, theirs) => {
+  const slot2 = (n, how, mine, theirs) => {
     if (how === "inherit") return { fd: n };
     if (how === "null") return { none: true };
     const [read2, write2] = call2({ op: "fd-pipe" });
@@ -3635,7 +3633,7 @@ function processes(host, call2, inThread) {
       const theirs = [];
       host.fds.promoteFiles();
       try {
-        const stdio = STDIO.map((name2, n) => slot(n, o[name2] ?? "inherit", mine, theirs));
+        const stdio = STDIO.map((name2, n) => slot2(n, o[name2] ?? "inherit", mine, theirs));
         const req = {
           op: "proc-spawn",
           file: o.argv[0],
@@ -3822,6 +3820,12 @@ var init_signals = __esm({
 });
 
 // src/process/js/js-kernel.ts
+function modeOf(mode) {
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
+    throw new JsCallError("EINVAL", "chmod");
+  }
+  return mode;
+}
 function callError(result, op) {
   const { errno: errno2, message: message2 } = result;
   const detailed = typeof message2 === "string" && message2 !== errno2 && DETAILED.has(op);
@@ -4075,7 +4079,7 @@ function writable(io, fd) {
     abort: () => io.close(fd)
   });
 }
-function childOps(kernel, io, defaults) {
+function childOps(kernel, io, defaults, sync) {
   const wait2 = async (pid) => {
     const r = await kernel.blocking({ op: "proc-wait", pid, nohang: false });
     const [, status2] = r.ok && r.kind === "json" ? r.json : [0, 0];
@@ -4095,25 +4099,43 @@ function childOps(kernel, io, defaults) {
       kill: (signal) => kill(pid, signal)
     };
   };
-  const spawn = async (o) => {
+  const request = (o) => {
     const [file] = o.argv;
     if (file === void 0) throw new JsCallError("EINVAL", "spawn");
     const group = groupOf(o, "spawn");
     const named = argv0Of(o.argv0, "spawn");
+    return (stdio) => ({
+      op: "proc-spawn",
+      file,
+      argv: [...o.argv],
+      ...named,
+      env: { ...o.env ?? defaults.env },
+      cwd: o.cwd ?? defaults.cwd,
+      stdio,
+      ...group
+    });
+  };
+  const spawnSync = (o) => {
+    const spawning = request(o);
+    const mine = [];
+    const theirs = [];
+    try {
+      const stdio = slotsSync(sync, o, mine, theirs);
+      return childOf(sync.json(spawning(stdio)), mine);
+    } catch (err) {
+      closeAllSync(sync, mine);
+      throw err;
+    } finally {
+      closeAllSync(sync, theirs);
+    }
+  };
+  const spawn = async (o) => {
+    const spawning = request(o);
     const mine = [];
     const theirs = [];
     try {
       const stdio = await slots2(kernel, o, mine, theirs);
-      const pid = await kernel.json({
-        op: "proc-spawn",
-        file,
-        argv: [...o.argv],
-        ...named,
-        env: { ...o.env ?? defaults.env },
-        cwd: o.cwd ?? defaults.cwd,
-        stdio,
-        ...group
-      });
+      const pid = await kernel.json(spawning(stdio));
       return childOf(pid, mine);
     } catch (err) {
       await closeAll(io, mine);
@@ -4122,7 +4144,7 @@ function childOps(kernel, io, defaults) {
       await closeAll(io, theirs);
     }
   };
-  return { spawn, wait: wait2, kill };
+  return { spawn, wait: wait2, kill, spawnSync };
 }
 function groupOf(o, call2) {
   const { pgid, session } = o;
@@ -4141,27 +4163,43 @@ function argv0Of(argv0, call2) {
 async function closeAll(io, fds) {
   for (const fd of fds) if (fd !== void 0) await io.close(fd).catch(() => void 0);
 }
-async function preflight(kernel, hows) {
+function closeAllSync(sync, fds) {
+  for (const fd of fds) if (fd !== void 0) sync.raw({ op: "fd-close", fd });
+}
+function checked(hows) {
+  const fds = [];
   for (const [n, how] of hows.entries()) {
     if (how === "pipe" || how === "null") continue;
     if (how !== "inherit" && typeof how !== "number") throw new JsCallError("EINVAL", "spawn");
-    await kernel.json({ op: "fd-info", fd: how === "inherit" ? n : how });
+    fds.push(how === "inherit" ? n : how);
   }
+  return fds;
+}
+async function preflight(kernel, hows) {
+  for (const fd of checked(hows)) await kernel.json({ op: "fd-info", fd });
+}
+function slot(n, how, pipe, mine, theirs) {
+  if (how === "inherit") return { fd: n };
+  if (how === "null") return { none: true };
+  if (typeof how === "number") return { fd: how };
+  const [read2, write2] = pipe();
+  mine[n] = n === 0 ? write2 : read2;
+  theirs.push(n === 0 ? read2 : write2);
+  return { fd: n === 0 ? read2 : write2 };
+}
+function slotsSync(sync, o, mine, theirs) {
+  const hows = STDIO2.map((name2) => o[name2] ?? "inherit");
+  for (const fd of checked(hows)) sync.json({ op: "fd-info", fd });
+  const pipe = () => sync.json({ op: "fd-pipe" });
+  return hows.map((how, n) => slot(n, how, pipe, mine, theirs));
 }
 async function slots2(kernel, o, mine, theirs) {
   const hows = STDIO2.map((name2) => o[name2] ?? "inherit");
   await preflight(kernel, hows);
   const stdio = [];
   for (const [n, how] of hows.entries()) {
-    if (how === "inherit") stdio.push({ fd: n });
-    else if (how === "null") stdio.push({ none: true });
-    else if (typeof how === "number") stdio.push({ fd: how });
-    else {
-      const [read2, write2] = await kernel.json({ op: "fd-pipe" });
-      mine[n] = n === 0 ? write2 : read2;
-      theirs.push(n === 0 ? read2 : write2);
-      stdio.push({ fd: n === 0 ? read2 : write2 });
-    }
+    const pair = how === "pipe" ? await kernel.json({ op: "fd-pipe" }) : [];
+    stdio.push(slot(n, how, () => pair, mine, theirs));
   }
   return stdio;
 }
@@ -4427,6 +4465,10 @@ function* aliasOf(fd, abs, o) {
   }
   return { fd: copy2, file };
 }
+function accessFlags(o) {
+  const write2 = o.write === true || o.append === true || o.truncate === true;
+  return write2 ? o.read === true ? 2 : 1 : 0;
+}
 function* opened(abs, o) {
   const node = yield* lookup(abs);
   if (isExclusive(o)) throw new JsCallError("EEXIST", abs);
@@ -4435,13 +4477,13 @@ function* opened(abs, o) {
       return { fd: yield openRequest(abs, { ...o, create: false }), file: false };
     case "tty":
       return { fd: yield { op: "fd-open-tty" }, file: false };
-    case "clipboard": {
-      const write2 = o.write === true || o.append === true || o.truncate === true;
-      const flags = write2 ? o.read === true ? 2 : 1 : 0;
-      return { fd: yield { op: "fd-open-clipboard", flags }, file: false };
-    }
+    case "clipboard":
+      return {
+        fd: yield { op: "fd-open-clipboard", flags: accessFlags(o) },
+        file: false
+      };
     case "sealed":
-      return { fd: yield { op: "fd-open-sealed" }, file: false };
+      return { fd: yield { op: "fd-open-sealed", flags: accessFlags(o) }, file: false };
     case "terminal": {
       const req = node.pts === void 0 ? { op: "fd-open-tty", name: node.name } : { op: "pty-slave-open", n: node.pts, noctty: true };
       return { fd: yield req, file: false };
@@ -5655,10 +5697,15 @@ function syncPathOps(kernel, resolve, statOf, open) {
       if (inDev(abs)) return devSync(kernel, devReaddir(abs));
       return kernel.json({ op: "readdir", path: abs });
     },
-    mkdir: (path) => void kernel.call({ op: "mkdir", path: resolve(path) }),
+    mkdir: (path, options) => void kernel.call({
+      op: "mkdir",
+      path: resolve(path),
+      ...options?.recursive === false ? { exclusive: true } : {}
+    }),
     rm: (path) => void kernel.call({ op: "rm", path: resolve(path) }),
     unlink: (path) => void kernel.call({ op: "unlink", path: resolve(path) }),
     rename: (from, to) => void kernel.call({ op: "rename", path: resolve(from), arg2: resolve(to) }),
+    chmod: (path, mode) => void kernel.call({ op: "chmod", path: resolve(path), mode: modeOf(mode) }),
     link: (from, to) => void kernel.call({ op: "link", path: resolve(from), arg2: resolve(to) }),
     symlink: (target, path) => void kernel.call({ op: "symlink", path: resolve(path), arg2: target }),
     readlink(path) {
@@ -6154,6 +6201,7 @@ function createContext(o) {
   const sync = {
     ...syncOps(syncKernel, { pid: o.pid, resolve, random, infos, handles }),
     run: (options) => runSync(syncKernel, { env: o.env, cwd: o.cwd, resolve, signal: signalNumber }, options),
+    spawn: (options) => spawnSync(options),
     exit: (status2 = 0) => {
       exiting ??= status2 & 255;
       return exitAtOnce(lane, [...writes], terminal.modes(), exiting);
@@ -6161,12 +6209,15 @@ function createContext(o) {
     kill: killer({ self: o.pid, kernel, syncKernel, lane, writes, modes: terminal.modes }),
     cred: () => syncKernel.json({ op: "proc-cred" }),
     setcred(change) {
-      if (typeof change !== "object" || change === null) throw new JsCallError("EINVAL", "setcred");
+      if (typeof change !== "object" || change === null || Array.isArray(change)) {
+        throw new JsCallError("EINVAL", "setcred");
+      }
       return syncKernel.json({ op: "proc-setcred", change: { ...change } });
     }
   };
   const io = { read: read2, send: writeAll, close: (fd) => ctx.close(fd) };
-  const children = childOps(kernel, io, { env: o.env, cwd: o.cwd, signal: signalNumber });
+  const defaults = { env: o.env, cwd: o.cwd, signal: signalNumber };
+  const { spawnSync, ...children } = childOps(kernel, io, defaults, syncKernel);
   const strays = o.strays ?? { exception: /* @__PURE__ */ new Set(), rejection: /* @__PURE__ */ new Set() };
   const ctx = {
     argv: o.argv,
@@ -6357,10 +6408,15 @@ function pathOps(kernel, resolve, statOf, open) {
       if (inDev(abs)) return devAsync(kernel, devReaddir(abs));
       return await kernel.json({ op: "readdir", path: abs });
     },
-    mkdir: async (path) => void await kernel.call({ op: "mkdir", path: resolve(path) }),
+    mkdir: async (path, options) => void await kernel.call({
+      op: "mkdir",
+      path: resolve(path),
+      ...options?.recursive === false ? { exclusive: true } : {}
+    }),
     rm: async (path) => void await kernel.call({ op: "rm", path: resolve(path) }),
     unlink: async (path) => void await kernel.call({ op: "unlink", path: resolve(path) }),
     rename: async (from, to) => void await kernel.call({ op: "rename", path: resolve(from), arg2: resolve(to) }),
+    chmod: async (path, mode) => void await kernel.call({ op: "chmod", path: resolve(path), mode: modeOf(mode) }),
     link: async (from, to) => void await kernel.call({ op: "link", path: resolve(from), arg2: resolve(to) }),
     symlink: async (target, path) => void await kernel.call({ op: "symlink", path: resolve(path), arg2: target }),
     async readlink(path) {
@@ -6617,10 +6673,14 @@ function liveNodePath(node) {
   const root = node.mount.opts.root.replace(/\/+$/, "");
   return parts.length === 0 ? root || "/" : `${root}/${parts.reverse().join("/")}`;
 }
-function modeFromStat(st) {
+function exactIn(node) {
+  return node?.mount.opts.bridge.owners === true;
+}
+function modeFromStat(st, exact = false) {
   const type = st.isSymbolicLink ? S_IFLNK : st.isDirectory ? S_IFDIR : S_IFREG;
   const fallback = st.isDirectory || st.isSymbolicLink ? 511 : 438;
-  return type | ((st.mode ?? fallback) & PERM_MASK || fallback);
+  const perm = (st.mode ?? fallback) & PERM_MASK;
+  return type | (exact ? perm : perm || fallback);
 }
 function toMs(v) {
   if (v === void 0 || v === null) return void 0;
@@ -6728,7 +6788,7 @@ function createHelpers(Fs, ops) {
     return { ...stat ? { stat, statAt } : {}, len: 0, loaded: false, dirty: false, openCount: 0 };
   }
   function makeNode(parent, name2, st) {
-    const node = Fs.createNode(parent, name2, modeFromStat(st), 0);
+    const node = Fs.createNode(parent, name2, modeFromStat(st, exactIn(parent)), 0);
     node.node_ops = ops.node;
     node.stream_ops = ops.stream;
     node.live = freshState(st);
@@ -6742,7 +6802,7 @@ function createHelpers(Fs, ops) {
     if (!cachedStat(node.live, Fs.isDir(node.mode))) {
       const st = call2(() => bridgeOf(node).lstat(liveNodePath(linked.holder(node))));
       Object.assign(node.live, { stat: st, statAt: syncCallCount() });
-      node.mode = modeFromStat(st);
+      node.mode = modeFromStat(st, exactIn(node));
     }
     return node.live.stat;
   }
@@ -7080,9 +7140,21 @@ function createStreamOps(h) {
     }
     return want;
   };
+  const directory = (stream) => {
+    const bridge = bridgeOf(stream.node);
+    if (!bridge.owners || !Fs.isDir(stream.node.mode) || stream.flags & O_PATH) return;
+    try {
+      h.call(
+        () => bridge.access?.(liveNodePath(stream.node), accessOf(wantOf2(stream.flags)), "open")
+      );
+    } catch (err) {
+      if (stream.fd !== void 0) Fs.closeStream?.(stream.fd);
+      throw err;
+    }
+  };
   return {
     open(stream) {
-      if (!Fs.isFile(stream.node.mode)) return;
+      if (!Fs.isFile(stream.node.mode)) return directory(stream);
       const s = stream.node.live;
       const created = s.created === true;
       s.created = void 0;
@@ -7214,6 +7286,7 @@ function createLiveVfsPlugin(Fs) {
       const st = h.call(() => mount.opts.bridge.stat(mount.opts.root));
       if (!st.isDirectory) throw new Fs.ErrnoError(wasiErrno("ENOTDIR"));
       const root = h.makeNode(null, "/", st);
+      root.mode = modeFromStat(st, mount.opts.bridge.owners === true);
       mounts.add(mount);
       return root;
     }
@@ -7423,7 +7496,7 @@ function useLiveChown(Fs) {
     Fs.chown(target, uid, gid);
   };
 }
-var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, stale;
+var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
     "use strict";
@@ -7443,6 +7516,7 @@ var init_live_vfs_fs = __esm({
     EARLY_WHOLE_FILE = 64 * 1024;
     O_ACCMODE = 3;
     O_TRUNC = 512;
+    O_PATH = 2097152;
     stale = (s) => !!s.orphan && !s.kept;
   }
 });
@@ -7865,7 +7939,7 @@ var init_kernel_streams = __esm({
       openSealed(open, path, flags, mode) {
         const { openSealed } = this.sys;
         if (path !== SEALED_PATH2 || !openSealed) return void 0;
-        const kfd = this.call(() => openSealed.call(this.sys));
+        const kfd = this.call(() => openSealed.call(this.sys, flags & 3));
         return this.vessel(open, kfd, { path, flags, mode }, false);
       }
       openClipboard(open, path, flags, mode) {
@@ -8262,7 +8336,7 @@ function pathOpensLinks(Fs) {
   const fs = Fs;
   const { mayOpen, isLink } = fs;
   if (!mayOpen || !isLink) return;
-  fs.mayOpen = (node, flags) => flags & O_PATH && isLink.call(fs, node.mode) ? 0 : mayOpen.call(fs, node, flags);
+  fs.mayOpen = (node, flags) => flags & O_PATH2 && isLink.call(fs, node.mode) ? 0 : mayOpen.call(fs, node, flags);
 }
 function importKey(namespace, name2, glue) {
   const own = glue?.[name2];
@@ -8739,7 +8813,24 @@ function kernelAccess(imports, fs, memory, glue) {
     }
   });
 }
+function kernelChdir(Fs) {
+  const { chdir, lookupPath, ErrnoError } = Fs;
+  if (!chdir || !lookupPath || !ErrnoError) return;
+  Fs.chdir = (path) => {
+    const { node } = lookupPath.call(Fs, path, { follow: true });
+    const directory = Fs.isDir?.(node.mode) === true;
+    const bridge = node.live && directory ? node.mount.opts.bridge : void 0;
+    try {
+      bridge?.access?.(liveNodePath(node), X_ACCESS, "eaccess", false);
+    } catch (err) {
+      throw new ErrnoError(errnoOf(err));
+    }
+    chdir.call(Fs, path);
+  };
+}
 function linuxDevices(Fs) {
+  Fs.ignorePermissions = true;
+  kernelChdir(Fs);
   const { chmod } = Fs;
   if (!chmod) return;
   for (const [path, mode] of DEVICE_MODES) {
@@ -8749,7 +8840,7 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW2, EMSCRIPTEN_EPERM, O_PATH, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY4, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS2, W_ACCESS, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW2, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY4, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS2, W_ACCESS, X_ACCESS, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
@@ -8777,7 +8868,7 @@ var init_process_fds = __esm({
     EBADF = 8;
     AT_SYMLINK_NOFOLLOW2 = 256;
     EMSCRIPTEN_EPERM = 63;
-    O_PATH = 2097152;
+    O_PATH2 = 2097152;
     LITERALS = {
       openat: "__syscall_openat",
       mkdirat: "__syscall_mkdirat",
@@ -8809,6 +8900,7 @@ var init_process_fds = __esm({
     AT_FDCWD = -100;
     AT_EACCESS2 = 512;
     W_ACCESS = 2;
+    X_ACCESS = 1;
     DEVICE_MODES = [
       ["/", 493],
       ["/dev", 493],
@@ -8899,8 +8991,8 @@ function describeInherited(Fs, sys, streams, livePath, actions = []) {
   const out = [];
   for (const [fd, stream] of slots3) {
     promote(stream);
-    const slot = inheritedSlot(fd, stream);
-    if (slot) out.push(slot);
+    const slot2 = inheritedSlot(fd, stream);
+    if (slot2) out.push(slot2);
   }
   return out;
 }
@@ -9118,7 +9210,7 @@ function createProcessKernel(deps) {
   const reaped = /* @__PURE__ */ new Map();
   const call2 = (req, label) => transport.call(req, Infinity, label);
   const at = (path) => path === "" || path.startsWith("/") ? path : `${Fs.cwd()}/${path}`;
-  const slot = (fd, n, promote) => {
+  const slot2 = (fd, n, promote) => {
     const stream = fd >= 0 ? Fs.getStream(fd) : null;
     if (!stream) return { none: true };
     promote?.(stream);
@@ -9167,7 +9259,7 @@ function createProcessKernel(deps) {
     const unflushed = flushed(deps.beforeSpawn);
     if (unflushed < 0) return unflushed;
     const promote = deps.stdioPromoter?.();
-    const stdio = [0, 1, 2].map((n) => slot(fds[n] ?? -1, n, promote));
+    const stdio = [0, 1, 2].map((n) => slot2(fds[n] ?? -1, n, promote));
     const inherit = deps.inherit?.(actions) ?? [];
     const req = {
       op: "proc-spawn",
@@ -10092,8 +10184,8 @@ function kernelSys(transport) {
     openPts(n, noctty) {
       return json2(call2({ op: "pty-slave-open", n, noctty }, `pty-slave-open ${n}`));
     },
-    openSealed() {
-      return json2(call2({ op: "fd-open-sealed" }, "fd-open-sealed"));
+    openSealed(flags) {
+      return json2(call2({ op: "fd-open-sealed", flags }, "fd-open-sealed"));
     },
     openClipboard(flags) {
       return json2(call2({ op: "fd-open-clipboard", flags }, "fd-open-clipboard"));