@ai-ecoverse/slicc-kernel 1.88.0 → 1.89.0

package/dist/kernel-worker.js

@@ -383,6 +383,14 @@ function inodeOf(path) {
   h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
   return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
 }
+function redirected(of, to) {
+  return Object.assign(fsError("EXDEV", `${of} leads to the mount at ${to}`), {
+    redirect: { of: normalizePath(of), to: normalizePath(to) }
+  });
+}
+function redirectOf(err) {
+  return err?.redirect;
+}
 
 // src/fs/owners.ts
 var ROOT_OWNER = Object.freeze({ uid: 0, gid: 0 });
@@ -476,39 +484,47 @@ var Integrity = class {
     this.unknown = integrityUnknown(options);
     this.report = report;
   }
-  async real(path) {
+  async real(path, asked) {
     const at = normalizePath(path);
     const real = await this.root.realpath?.(at, true).catch(() => void 0) ?? at;
-    return isProtected(this.prefixes, real) ? real : void 0;
-  }
-  async key(path) {
-    const real = await this.real(path);
-    if (real === void 0 || !this.root.version) return void 0;
+    if (isProtected(this.prefixes, real)) return { real, name: real };
+    const names = asked === void 0 ? [] : await namesOf(this.root, asked);
+    if (real !== at) names.push(...await namesOf(this.root, at));
+    const name2 = names.findLast((p) => isProtected(this.prefixes, p));
+    return name2 === void 0 ? void 0 : { real, name: name2 };
+  }
+  async key(path, asked) {
+    const found = await this.real(path, asked);
+    if (found === void 0) return void 0;
+    const { real, name: name2 } = found;
+    if (name2 !== real) return `${name2}\0${real}\0`;
+    if (!this.root.version) return void 0;
     return `${real}\0${await this.root.version(real)}`;
   }
-  async read(path, caller, plain) {
-    return (await this.readKeyed(path, caller, plain)).bytes;
+  async read(path, caller, plain, asked) {
+    return (await this.readKeyed(path, caller, plain, asked)).bytes;
   }
-  async readKeyed(path, caller, plain) {
-    const real = await this.real(path);
-    if (real === void 0) return { bytes: await plain() };
-    const read = this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+  async readKeyed(path, caller, plain, asked) {
+    const found = await this.real(path, asked);
+    if (found === void 0) return { bytes: await plain() };
+    const { real, name: name2 } = found;
+    const read = name2 !== real ? { bytes: await plain(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
     const { bytes } = read;
     const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
     const actual = await sha256(bytes);
-    const denial = { pid: caller.pid, uid: caller.uid, path: real, actual };
+    const denial = { pid: caller.pid, uid: caller.uid, path: name2, actual };
     const tagged = caller.tag !== void 0 ? { tag: caller.tag } : {};
     let expected;
     try {
-      expected = await this.expected(real);
+      expected = await this.expected(name2);
     } catch {
       this.say({ ...denial, ...tagged, op: "exec-integrity", errno: "EACCES" });
-      throw fsError("EACCES", `integrity lookup failed: ${real}`);
+      throw fsError("EACCES", `integrity lookup failed: ${name2}`);
     }
     if (expected === void 0) {
       if (this.unknown === "allow") {
-        if (!this.unverified.has(real)) {
-          this.unverified.add(real);
+        if (!this.unverified.has(name2)) {
+          this.unverified.add(name2);
           this.say({ ...denial, ...tagged, op: "exec-unverified", errno: "ENODATA" });
         }
         return keyed;
@@ -518,7 +534,12 @@ var Integrity = class {
     }
     const known = expected !== void 0 ? { expected } : {};
     this.say({ ...denial, ...tagged, ...known, op: "exec-integrity", errno: "EACCES" });
-    throw fsError("EACCES", `integrity check failed: ${real}`);
+    throw fsError("EACCES", `integrity check failed: ${name2}`);
+  }
+  forget(path) {
+    for (const name2 of [...this.unverified]) {
+      if (path === void 0 || isProtected([path], name2)) this.unverified.delete(name2);
+    }
   }
   async expected(path) {
     const answer = await this.lookup(path);
@@ -572,10 +593,10 @@ function missing(err) {
   const code = err?.code;
   return code === "ENOENT" || code === "ENOTDIR";
 }
-async function resolved(fs, path, follow2) {
+async function resolved(fs, path, follow2, hops = []) {
   let done4 = [];
   let todo = partsOf(path);
-  for (let hops = 0; todo.length > 0; ) {
+  for (let links = 0; todo.length > 0; ) {
     const part = todo.shift();
     if (part === "..") {
       done4.pop();
@@ -597,13 +618,20 @@ async function resolved(fs, path, follow2) {
       done4.push(part);
       continue;
     }
-    if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
+    if (++links > MAX_LINKS) throw fsError("ELOOP", path);
+    hops.push(normalizePath([at, ...todo].join("/")));
     const link2 = await fs.readlink(at);
     if (link2.startsWith("/")) done4 = [];
     todo = [...partsOf(link2), ...todo];
   }
   return `/${done4.join("/")}`;
 }
+async function namesOf(fs, path) {
+  const lexical2 = normalizePath(path);
+  const hops = [];
+  await resolved(fs, lexical2, true, hops).catch(() => void 0);
+  return [lexical2, ...hops];
+}
 var ProtectedFs = class {
   prefixes;
   constructor(prefixes2) {
@@ -656,8 +684,8 @@ var ProtectedFs = class {
         await check(path, true);
         return fs.utimes(path, atime, mtime);
       },
-      async mayChange(path, follow2) {
-        await check(path, follow2);
+      async mayChange(path, follow2, whole = false) {
+        await check(path, follow2, whole);
       },
       async stat(path) {
         return marked(path, await fs.stat(path));
@@ -984,6 +1012,7 @@ var OpfsFs = class {
   remote;
   ranged;
   owners = false;
+  mounts = {};
   constructor(root, meta = new MemoryMeta(), channel, options = {}) {
     this.root = root;
     this.meta = sidecar(meta);
@@ -1057,6 +1086,12 @@ var OpfsFs = class {
   trackOwners() {
     this.owners = true;
   }
+  crossings(mounted) {
+    this.mounts.mounted = mounted;
+  }
+  crossing(of, to) {
+    if (this.mounts.mounted?.(to)) throw redirected(of, to);
+  }
   async hasOwner(path) {
     return ownOf((await this.meta.get([path]))[0]) !== void 0;
   }
@@ -1251,12 +1286,13 @@ var OpfsFs = class {
         if (!link2) throw err;
         if (link2.path === current && !follow2) return { path: current, link: link2 };
         const target = `${link2.link}${current.slice(link2.path.length)}`;
-        current = target.split("/").includes("..") ? await this.physical(parentOf3(link2.path), target, hops + 1) : resolvePath(parentOf3(link2.path), target);
+        current = target.split("/").includes("..") ? await this.physical(parentOf3(link2.path), target, hops + 1, path) : resolvePath(parentOf3(link2.path), target);
+        this.crossing(path, current);
       }
     }
     throw fsError("ELOOP", path);
   }
-  async physical(base, path, used) {
+  async physical(base, path, used, of) {
     let done4 = [];
     let todo = (path.startsWith("/") ? path : `${base}/${path}`).split("/").filter((p) => p !== "" && p !== ".");
     for (let hops = used; todo.length > 0; ) {
@@ -1265,6 +1301,7 @@ var OpfsFs = class {
       else if (!todo.includes("..")) done4.push(part);
       else {
         const at = `/${[...done4, part].join("/")}`;
+        this.crossing(of, [at, ...todo].join("/"));
         const st = await this.lstat(at);
         if (!st.isSymbolicLink && !st.isDirectory) throw fsError("ENOTDIR", at);
         if (!st.isSymbolicLink) done4.push(part);
@@ -2159,7 +2196,10 @@ var Perms = class {
 function parts(path) {
   return path.split("/").filter((part) => part !== "" && part !== ".");
 }
-async function walk(fs, cred, path, follow2) {
+function trustedLink(perm, links) {
+  return links === void 0 || perm.uid === 0 || perm.uid === links;
+}
+async function walk(fs, cred, path, follow2, links) {
   const perms = new Perms(fs);
   await perms.learn(path);
   const queue = parts(path);
@@ -2177,6 +2217,7 @@ async function walk(fs, cred, path, follow2) {
     const perm = await perms.at(next2);
     const last = queue.length === 0;
     if (perm?.link !== void 0 && (!last || follow2)) {
+      if (!trustedLink(perm, links)) return { path, perm: void 0, denied: next2, link: true };
       if (++hops > MAX_LINKS4) return { path: next2, perm: void 0 };
       queue.unshift(...parts(perm.link));
       if (perm.link.startsWith("/")) at = "/";
@@ -2201,9 +2242,9 @@ async function finalOf(fs, walked, want, options) {
   return st ? [permOf(st), st.isDirectory] : [perm, false];
 }
 async function access(fs, cred, path, want, options = {}) {
-  const walked = await walk(fs, cred, path, options.follow !== false);
+  const walked = await walk(fs, cred, path, options.follow !== false, options.links);
   if (walked.denied !== void 0) {
-    if (await present(fs, walked.denied, true)) return walked;
+    if (walked.link || await present(fs, walked.denied, true)) return walked;
     return { path, perm: void 0, missing: true };
   }
   if (!walked.perm) return { ...walked, missing: true };
@@ -2270,6 +2311,9 @@ var Created = class {
     return this.paths.delete(normalizePath(path));
   }
 };
+function linked(g, options) {
+  return g.links === void 0 ? options : { ...options, links: g.links };
+}
 function deny(g, op, path, errno = "EACCES") {
   const tag = g.tag === void 0 ? {} : { tag: g.tag };
   g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno, ...tag });
@@ -2280,8 +2324,8 @@ function ttyOpenable(g, tty) {
   deny(g, "open", tty.name ?? "/dev/tty");
 }
 async function need(g, op, path, want, options = {}, shown = path) {
-  const walked = await access(g.fs, g.cred, path, want, options);
-  if (walked.denied !== void 0) deny(g, op, shown);
+  const walked = await access(g.fs, g.cred, path, want, linked(g, options));
+  if (walked.denied !== void 0) deny(g, op, walked.link ? walked.denied : shown);
   return walked;
 }
 function entryIn(dir, path) {
@@ -2300,14 +2344,16 @@ async function inParent(g, op, path, old = false) {
     return dir2.denied === void 0 ? stickyEntry(g, op, path, dir2) : void 0;
   }
   if (!old) return void await need(g, op, parentOf4(path), W_OK | X_OK, DIR, path);
-  const dir = await access(g.fs, g.cred, parentOf4(path), W_OK | X_OK, DIR);
+  const dir = await access(g.fs, g.cred, parentOf4(path), W_OK | X_OK, linked(g, DIR));
   if (dir.denied === void 0) return stickyEntry(g, op, path, dir);
+  if (dir.link) return deny(g, op, dir.denied);
   const lookup = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
   if (!lookup || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
 }
 async function makeIn(g, op, path) {
   for (let dir = parentOf4(path); ; dir = parentOf4(dir)) {
-    const walked = await access(g.fs, g.cred, dir, W_OK | X_OK, DIR);
+    const walked = await access(g.fs, g.cred, dir, W_OK | X_OK, linked(g, DIR));
+    if (walked.link) return deny(g, op, walked.denied);
     if (walked.denied !== void 0) {
       if (!await present(g.fs, path, true)) deny(g, op, path);
       return;
@@ -4580,12 +4626,12 @@ async function interruptible(work, signal) {
   if (signal.aborted) throw new KernelError("EINTR");
   let stop = () => {
   };
-  const interrupted2 = new Promise((_, reject) => {
+  const interrupted3 = new Promise((_, reject) => {
     stop = () => reject(new KernelError("EINTR"));
     signal.addEventListener("abort", stop, { once: true });
   });
   try {
-    return await Promise.race([work, interrupted2]);
+    return await Promise.race([work, interrupted3]);
   } finally {
     signal.removeEventListener("abort", stop);
   }
@@ -6599,7 +6645,7 @@ var RemoteTransport = class {
       finish();
       throw e;
     }
-    const { status, statusText, headers, url, redirected, redirects } = head;
+    const { status, statusText, headers, url, redirected: redirected2, redirects } = head;
     const read = async () => {
       if (finished) return void 0;
       const reply = await this.ask({ net: "read", nid }).catch((e) => {
@@ -6616,7 +6662,7 @@ var RemoteTransport = class {
       this.cancel(nid);
     };
     return {
-      ...redirected ? { url, redirected } : {},
+      ...redirected2 ? { url, redirected: redirected2 } : {},
       ...redirects ? { redirects } : {},
       status,
       statusText,
@@ -7641,14 +7687,14 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     const own = await userDir(dir);
     return own?.has(path.slice(slash + 1)) ? owned4(synthetic(false, path), dir) : void 0;
   }
-  async function linked(path) {
+  async function linked2(path) {
     return await virtual(path) ?? virtual(await followLinks(fs, path));
   }
   async function stat(path, real) {
     try {
       return await real(path);
     } catch (err) {
-      const found = missing3(err) ? await linked(path) : void 0;
+      const found = missing3(err) ? await linked2(path) : void 0;
       if (found) return found;
       throw err;
     }
@@ -7660,7 +7706,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
       try {
         return await fs.readFileBuffer(path);
       } catch (err) {
-        if (missing3(err) && (await linked(path))?.isFile) return new Uint8Array(0);
+        if (missing3(err) && (await linked2(path))?.isFile) return new Uint8Array(0);
         throw err;
       }
     },
@@ -7668,7 +7714,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     link: (from, to, follow2) => fs.link(from, to, follow2),
     links: (path) => mayLink(fs, path),
     async exists(path) {
-      return await fs.exists(path) || await linked(path) !== void 0;
+      return await fs.exists(path) || await linked2(path) !== void 0;
     },
     stat: (path) => stat(path, (p) => fs.stat(p)),
     lstat: (path) => stat(path, (p) => fs.lstat(p)),
@@ -9093,6 +9139,7 @@ var MountTable = class {
     return { quota: st.blocks * st.bsize, usage: (st.blocks - st.bfree) * st.bsize };
   }
   wrap(base) {
+    base.crossings?.((path) => this.locate(normalizePath(path)) !== void 0);
     return new MountFs(this, base);
   }
 };
@@ -9116,6 +9163,37 @@ var MountFs = class {
   writable(mount, path) {
     if (readonly(mount)) throw errnoError("EROFS", path);
   }
+  async through(path) {
+    const real = normalizePath(path);
+    if (this.at(real)) return real;
+    try {
+      await this.base.stat(parentOf7(real));
+      return real;
+    } catch (err) {
+      const moved2 = redirectOf(err);
+      return moved2 ? normalizePath(moved2.to + real.slice(moved2.of.length)) : real;
+    }
+  }
+  async across(from, to, redirects) {
+    const moved2 = [await this.through(from), await this.through(to)];
+    const same = moved2[0] === normalizePath(from) && moved2[1] === normalizePath(to);
+    if (same || redirects >= MAX_LINKS7) throw errnoError("EXDEV", `${from} -> ${to}`);
+    return moved2;
+  }
+  async based(paths, redirects, run2, again) {
+    try {
+      return await run2();
+    } catch (err) {
+      const moved2 = redirectOf(err);
+      if (!moved2) throw err;
+      if (redirects >= MAX_LINKS7) throw errnoError("ELOOP", paths[0]);
+      const at = paths.map((path) => {
+        const real = normalizePath(path);
+        return within6(real, moved2.of) ? normalizePath(moved2.to + real.slice(moved2.of.length)) : real;
+      });
+      return again(at, redirects + 1);
+    }
+  }
   async follow(path, hops = 0, create = false) {
     const found = this.at(path);
     if (!found) return path;
@@ -9163,10 +9241,17 @@ var MountFs = class {
   async readFile(path) {
     return new TextDecoder().decode(await this.readFileBuffer(path));
   }
-  async readFileBuffer(path) {
+  async readFileBuffer(path, redirects = 0) {
     const real = await this.follow(path);
     const found = this.at(real);
-    if (!found) return this.base.readFileBuffer(real);
+    if (!found) {
+      return this.based(
+        [real],
+        redirects,
+        () => this.base.readFileBuffer(real),
+        ([to], n) => this.readFileBuffer(to, n)
+      );
+    }
     for (let attempt = 1; ; attempt++) {
       try {
         return await this.readWhole(found.mount, real, found.rel);
@@ -9205,10 +9290,18 @@ var MountFs = class {
     }
     return concat4(chunks, total);
   }
-  async writeFile(path, content, owner) {
+  async writeFile(path, content, owner, redirects = 0) {
     const real = await this.follow(path, 0, true);
     const found = this.at(real);
-    if (!found) return this.base.writeFile(real, content, owner);
+    if (!found) {
+      const write = () => this.base.writeFile(real, content, owner);
+      return this.based(
+        [real],
+        redirects,
+        write,
+        ([to], n) => this.writeFile(to, content, owner, n)
+      );
+    }
     const { mount, rel: rel2 } = found;
     this.writable(mount, real);
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
@@ -9242,10 +9335,18 @@ var MountFs = class {
       this.table.forget(mount, real);
     }
   }
-  async pread(path, offset, length2, version) {
+  async pread(path, offset, length2, version, redirects = 0) {
     const real = await this.follow(path);
     const found = this.at(real);
-    if (!found && this.base.pread) return this.base.pread(real, offset, length2);
+    const { pread } = this.base;
+    if (!found && pread) {
+      return this.based(
+        [real],
+        redirects,
+        () => pread.call(this.base, real, offset, length2),
+        ([to], n) => this.pread(to, offset, length2, version, n)
+      );
+    }
     if (!found) return (await this.base.readFileBuffer(real)).slice(offset, offset + length2);
     const { mount, rel: rel2 } = found;
     if ((await this.table.getattr(mount, real, rel2)).kind === "directory") {
@@ -9292,10 +9393,18 @@ var MountFs = class {
       );
     }
   }
-  async pwrite(path, offset, bytes, transfer = false) {
+  async pwrite(path, offset, bytes, transfer = false, redirects = 0) {
     const real = await this.follow(path, 0, true);
     const found = this.at(real);
-    if (!found && this.base.pwrite) return this.base.pwrite(real, offset, bytes);
+    const { pwrite } = this.base;
+    if (!found && pwrite) {
+      return this.based(
+        [real],
+        redirects,
+        () => pwrite.call(this.base, real, offset, bytes),
+        ([to], n) => this.pwrite(to, offset, bytes, transfer, n)
+      );
+    }
     if (!found)
       return this.base.writeFile(
         real,
@@ -9335,10 +9444,18 @@ var MountFs = class {
       await mount.conn.call({ op: "write", fh, offset: offset + at, bytes: part }, [part.buffer]);
     }
   }
-  async truncate(path, size) {
+  async truncate(path, size, redirects = 0) {
     const real = await this.follow(path);
     const found = this.at(real);
-    if (!found && this.base.truncate) return this.base.truncate(real, size);
+    const { truncate } = this.base;
+    if (!found && truncate) {
+      return this.based(
+        [real],
+        redirects,
+        () => truncate.call(this.base, real, size),
+        ([to], n) => this.truncate(to, size, n)
+      );
+    }
     if (!found?.mount.caps.ranges) {
       return this.writeFile(real, resized(await this.readFileBuffer(real), size));
     }
@@ -9354,8 +9471,15 @@ var MountFs = class {
       this.table.forget(mount, real);
     }
   }
-  async exists(path) {
-    if (!this.at(path)) return this.base.exists(path);
+  async exists(path, redirects = 0) {
+    if (!this.at(path)) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.exists(path),
+        ([to], n) => this.exists(to, n)
+      );
+    }
     try {
       await this.stat(path);
       return true;
@@ -9365,9 +9489,16 @@ var MountFs = class {
       throw err;
     }
   }
-  async lstat(path) {
+  async lstat(path, redirects = 0) {
     const found = this.at(path);
-    if (!found) return this.base.lstat(path);
+    if (!found) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.lstat(path),
+        ([to], n) => this.lstat(to, n)
+      );
+    }
     const real = normalizePath(path);
     if (this.table.writing(real)?.truncated) await this.table.commit(real);
     return this.statWriting(
@@ -9380,9 +9511,15 @@ var MountFs = class {
     const ends = (this.table.writing(real)?.extents ?? []).map(([, end]) => end);
     return statOf({ ...attr2, size: Math.max(attr2.size, ...ends) }, real, mount);
   }
-  async stat(path) {
+  async stat(path, redirects = 0) {
     const real = await this.follow(path);
-    return this.at(real) ? this.lstat(real) : this.base.stat(real);
+    if (this.at(real)) return this.lstat(real);
+    return this.based(
+      [real],
+      redirects,
+      () => this.base.stat(real),
+      ([to], n) => this.stat(to, n)
+    );
   }
   async entries(path) {
     const real = await this.follow(path);
@@ -9394,12 +9531,26 @@ var MountFs = class {
       list: await this.table.readdir(found.mount, real, found.rel)
     };
   }
-  async readdir(path) {
-    if (!this.at(path)) return this.base.readdir(path);
+  async readdir(path, redirects = 0) {
+    if (!this.at(path)) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.readdir(path),
+        ([to], n) => this.readdir(to, n)
+      );
+    }
     return (await this.entries(path)).list.map((e) => e.name);
   }
-  async readdirStat(path) {
-    if (!this.at(path)) return this.base.readdirStat(path);
+  async readdirStat(path, redirects = 0) {
+    if (!this.at(path)) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.readdirStat(path),
+        ([to], n) => this.readdirStat(to, n)
+      );
+    }
     const { real, mount, list } = await this.entries(path);
     return Promise.all(
       list.map(async (entry) => {
@@ -9411,9 +9562,16 @@ var MountFs = class {
       })
     );
   }
-  async mkdir(path, options = {}) {
+  async mkdir(path, options = {}, redirects = 0) {
     const found = this.at(path);
-    if (!found) return this.base.mkdir(path, options);
+    if (!found) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.mkdir(path, options),
+        ([to], n) => this.mkdir(to, options, n)
+      );
+    }
     const { mount, rel: rel2 } = found;
     const real = normalizePath(path);
     this.writable(mount, real);
@@ -9438,11 +9596,18 @@ var MountFs = class {
       await mount.conn.call({ op: "mkdir", path: sub, ...made2 });
     }
   }
-  async rm(path, options = {}) {
+  async rm(path, options = {}, redirects = 0) {
     const found = this.at(path);
     if (!found && options.recursive && this.table.under(normalizePath(path)))
       return this.rmAround(normalizePath(path), options);
-    if (!found) return this.base.rm(path, options);
+    if (!found) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.rm(path, options),
+        ([to], n) => this.rm(to, options, n)
+      );
+    }
     const { mount, rel: rel2 } = found;
     const real = normalizePath(path);
     if (rel2 === "/" && options.recursive) await this.rmEach(real, mount, rel2, options);
@@ -9483,11 +9648,22 @@ var MountFs = class {
     }
     throw first ?? errnoError("EBUSY", `${path} holds a mount point`);
   }
-  async rename(from, to) {
+  async rename(from, to, redirects = 0) {
     const a = this.at(from);
     const b = this.at(to);
-    if (!a && !b) return this.base.rename(from, to);
-    if (!a || !b || a.mount !== b.mount) throw errnoError("EXDEV", `${from} -> ${to}`);
+    if (!a && !b) {
+      return this.based(
+        [from, to],
+        redirects,
+        () => this.base.rename(from, to),
+        ([f, t], n) => this.rename(f, t, n)
+      );
+    }
+    if (!a || !b) {
+      const [f, t] = await this.across(from, to, redirects);
+      return this.rename(f, t, redirects + 1);
+    }
+    if (a.mount !== b.mount) throw errnoError("EXDEV", `${from} -> ${to}`);
     this.writable(a.mount, normalizePath(to));
     await this.table.commitUnder(from);
     await this.table.commitUnder(to);
@@ -9528,9 +9704,17 @@ var MountFs = class {
       this.table.forget(a.mount, normalizePath(to));
     }
   }
-  async symlink(target, path, owner) {
+  async symlink(target, path, owner, redirects = 0) {
     const found = this.at(path);
-    if (!found) return this.base.symlink(target, path, owner);
+    if (!found) {
+      const make = () => this.base.symlink(target, path, owner);
+      return this.based(
+        [path],
+        redirects,
+        make,
+        ([to], n) => this.symlink(target, to, owner, n)
+      );
+    }
     this.writable(found.mount, normalizePath(path));
     if (!found.mount.caps.symlinks)
       throw errnoError("EPERM", `${path}: this file system has no symlinks`);
@@ -9540,8 +9724,11 @@ var MountFs = class {
     await found.mount.conn.call({ op: "symlink", target, path: found.rel, ...made2 });
   }
   async realpath(path, follow2) {
-    if (this.at(path) || !this.base.realpath) throw errnoError("ENOSYS", path);
-    const real = await this.base.realpath(path, follow2);
+    const { realpath: realpath2 } = this.base;
+    if (this.at(path) || !realpath2) throw errnoError("ENOSYS", path);
+    const real = await realpath2.call(this.base, path, follow2).catch((err) => {
+      throw redirectOf(err) ? errnoError("ENOSYS", path) : err;
+    });
     if (this.at(real)) throw errnoError("ENOSYS", path);
     return real;
   }
@@ -9563,17 +9750,30 @@ var MountFs = class {
     }
     return out;
   }
-  async readlink(path) {
+  async readlink(path, redirects = 0) {
     const found = this.at(path);
-    if (!found) return this.base.readlink(path);
+    if (!found) {
+      return this.based(
+        [path],
+        redirects,
+        () => this.base.readlink(path),
+        ([to], n) => this.readlink(to, n)
+      );
+    }
     return await found.mount.conn.call({ op: "readlink", path: found.rel });
   }
-  async chown(path, change) {
+  async chown(path, change, redirects = 0) {
     const real = change.follow === false || change.kind === "new" ? path : await this.follow(path);
     const found = this.at(real);
     if (found) return this.chownMounted(found, normalizePath(real), change);
-    if (!this.base.chown) throw errnoError("EPERM", path);
-    return this.base.chown(real, change);
+    const { chown: chown2 } = this.base;
+    if (!chown2) throw errnoError("EPERM", path);
+    return this.based(
+      [real],
+      redirects,
+      () => chown2.call(this.base, real, change),
+      ([to], n) => this.chown(to, change, n)
+    );
   }
   async chownMounted(found, real, change) {
     const { mount, rel: rel2 } = found;
@@ -9593,23 +9793,47 @@ var MountFs = class {
       ...Object.fromEntries(attrs.filter(([, value]) => value !== void 0))
     });
   }
-  async chmod(path, mode) {
-    const found = this.at(path);
-    if (!found) return this.base.chmod(path, mode);
-    this.writable(found.mount, normalizePath(path));
+  async chmod(path, mode, redirects = 0) {
+    const real = await this.follow(path);
+    const found = this.at(real);
+    if (!found) {
+      return this.based(
+        [real],
+        redirects,
+        () => this.base.chmod(real, mode),
+        ([to], n) => this.chmod(to, mode, n)
+      );
+    }
+    this.writable(found.mount, real);
     if (!found.mount.caps.chmod) return;
-    this.table.forget(found.mount, normalizePath(path));
+    this.table.forget(found.mount, real);
     await found.mount.conn.call({ op: "setattr", path: found.rel, mode });
   }
-  async utimes(path, atime, mtime) {
+  async utimes(path, atime, mtime, redirects = 0) {
     const real = await this.follow(path);
     const found = this.at(real);
-    if (!found) return this.base.utimes(real, atime, mtime);
+    if (!found) {
+      const set2 = () => this.base.utimes(real, atime, mtime);
+      return this.based(
+        [real],
+        redirects,
+        set2,
+        ([to], n) => this.utimes(to, atime, mtime, n)
+      );
+    }
     await this.setMtime(found, real, mtime);
   }
-  async lutimes(path, atime, mtime) {
+  async lutimes(path, atime, mtime, redirects = 0) {
     const found = this.at(path);
-    if (!found) return lutimesOf(this.base, path, atime, mtime);
+    if (!found) {
+      const set2 = () => lutimesOf(this.base, path, atime, mtime);
+      return this.based(
+        [path],
+        redirects,
+        set2,
+        ([to], n) => this.lutimes(to, atime, mtime, n)
+      );
+    }
     const real = normalizePath(path);
     if (!found.mount.caps.linkTimes && (await this.lstat(real)).isSymbolicLink) {
       throw errnoError("EOPNOTSUPP", path);
@@ -9828,7 +10052,8 @@ async function run(entry, path, req) {
 function guardOf(entry) {
   const cred = entry.dac && entry.cred?.();
   if (!cred || !entry.dac) return void 0;
-  return { fs: entry.fs, cred, pid: entry.pid ?? 0, dac: entry.dac };
+  const links = entry.links === void 0 ? {} : { links: entry.links };
+  return { fs: entry.fs, cred, pid: entry.pid ?? 0, dac: entry.dac, ...links };
 }
 var FOLLOWING = /* @__PURE__ */ new Set(["exists", "stat", "chown", "statfs"]);
 var LOOKS = /* @__PURE__ */ new Set(["exists", "stat", "lstat"]);
@@ -9889,9 +10114,15 @@ async function holdOp(entry, path, req) {
   entry.hold?.(path, on, open, void 0, req.handle);
   return done;
 }
+async function followed(g, path) {
+  const st = await g.fs.lstat(path).catch(() => void 0);
+  if (st?.isSymbolicLink && !trustedLink(permOf(st), g.links)) deny(g, "follow", path);
+  return done;
+}
 async function accessOp(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return done;
+  if (req.arg2 === "follow") return followed(g, path);
   const open = req.arg2 === "open";
   const cred = open || req.arg2 === "eaccess" ? g.cred : realIds(g.cred);
   const options = { follow: req.nofollow !== true, ...open ? { directory: false } : {} };
@@ -9914,15 +10145,18 @@ var CHANGING = /* @__PURE__ */ new Set([
   "lchown"
 ]);
 var CONTENT = /* @__PURE__ */ new Set(["write", "pwrite", "truncate"]);
+var REMOVING = /* @__PURE__ */ new Set(["unlink", "rmdir", "rm", "rename"]);
 async function mayChange(entry, path, req) {
   const { mayChange: mayChange2 } = entry.fs;
   if (!mayChange2) return;
   const { op } = req;
   if (CONTENT.has(op) && req.handle === void 0) return mayChange2.call(entry.fs, path, true);
   if (!CHANGING.has(op)) return;
-  await mayChange2.call(entry.fs, path, op === "utimes" || op === "chmod" || op === "chown");
+  const follow2 = op === "utimes" || op === "chmod" || op === "chown";
+  await mayChange2.call(entry.fs, path, follow2, REMOVING.has(op));
   if (op === "rename" || op === "link") {
-    await mayChange2.call(entry.fs, entry.fs.resolvePath(entry.cwd, req.arg2 ?? ""), false);
+    const to = entry.fs.resolvePath(entry.cwd, req.arg2 ?? "");
+    await mayChange2.call(entry.fs, to, false, op === "rename");
   }
 }
 async function guarded(entry, path, req) {
@@ -10615,7 +10849,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.88.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.89.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12182,16 +12416,16 @@ function interruption(signal) {
 }
 async function selectFds(fds, read, write, timeoutMs, interrupt) {
   const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : Date.now() + timeoutMs;
-  const interrupted2 = interruption(interrupt);
-  interrupted2.promise.catch(() => {
+  const interrupted3 = interruption(interrupt);
+  interrupted3.promise.catch(() => {
   });
   try {
-    return await waitReady(fds, read, write, deadline, interrupted2.promise);
+    return await waitReady(fds, read, write, deadline, interrupted3.promise);
   } finally {
-    interrupted2.done();
+    interrupted3.done();
   }
 }
-async function waitReady(fds, read, write, deadline, interrupted2) {
+async function waitReady(fds, read, write, deadline, interrupted3) {
   for (; ; ) {
     const now = ready(fds, read, write);
     if (now.read.length > 0 || now.write.length > 0 || Date.now() >= deadline) return now;
@@ -12203,7 +12437,7 @@ async function waitReady(fds, read, write, deadline, interrupted2) {
     let timer;
     const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve2) => timer = setTimeout(resolve2, deadline - Date.now()))];
     try {
-      await Promise.race([...changes, ...expiry, interrupted2]);
+      await Promise.race([...changes, ...expiry, interrupted3]);
     } finally {
       round.abort();
       clearTimeout(timer);
@@ -13386,7 +13620,7 @@ var WasmProcess = class {
     const { guard: guard2 } = this.options;
     const inherited2 = req.orphan || req.contents !== void 0 || req.handle !== void 0;
     if (!guard2 || inherited2 || req.pin !== void 0) return;
-    const g = { fs: guard2.fs, dac: guard2.dac, cred: this.cred, pid: this.pid };
+    const g = { fs: guard2.fs, dac: guard2.dac, cred: this.cred, pid: this.pid, links: guard2.links };
     if (req.exclusive) return inParent(g, "open", req.path);
     if (req.created && guard2.created?.take(req.path)) return;
     const access2 = req.flags & WRITE_ACCESS;
@@ -13442,7 +13676,7 @@ var WasmProcess = class {
   }
   guarded() {
     const { guard: guard2 } = this.options;
-    return guard2 && { fs: guard2.fs, dac: guard2.dac, cred: this.cred, pid: this.pid };
+    return guard2 && { fs: guard2.fs, dac: guard2.dac, cred: this.cred, pid: this.pid, links: guard2.links };
   }
   ttyOwner() {
     return { uid: this.cred.euid, gid: this.cred.egid, mode: TTY_MODE };
@@ -14168,6 +14402,7 @@ function processInit(opts, sab, umask, cred, lane) {
     umask,
     cred,
     ...opts.owners ? { owners: true } : {},
+    ...opts.links !== void 0 ? { links: true } : {},
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {}
   };
   if (opts.program.abi === "js") {
@@ -14195,6 +14430,7 @@ function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
     ...opts.owners ? caller : {},
     ...opts.dac ? { dac: opts.dac, pid: opts.pid, created: caller.created } : {},
+    ...opts.links !== void 0 ? { links: opts.links } : {},
     ...opts.fresh ? { fresh: (path) => opts.fresh?.(path, caller.umask()) } : {},
     fs: opts.fs,
     cwd: opts.cwd,
@@ -14208,6 +14444,9 @@ function holdingToken(opts, holds, caller) {
     renamed: (from, to) => holds.renamed(from, to)
   });
 }
+function linksOf(opts) {
+  return opts.links === void 0 ? {} : { links: opts.links };
+}
 function clipboardName(opts) {
   return opts.program.abi === "js" ? {} : { clipboardName: opts.argv0 };
 }
@@ -14219,7 +14458,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...opts.outputFilter ? { outputFilter: opts.outputFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
-    ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
+    ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3, ...linksOf(opts) } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
     ...opts.settling ? { settling: opts.settling } : {},
@@ -14265,6 +14504,7 @@ function threadInit(opts, program, sab, cred, thread, main) {
     sab,
     cred: copyCred(cred),
     owners: opts.owners === true,
+    ...opts.links !== void 0 ? { links: true } : {},
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {},
     thread,
     signals: main
@@ -15132,63 +15372,137 @@ function compile(secrets, options = {}) {
 
 // src/kernel/scrub-file.ts
 var SCRUB_IDLE_MS = 50;
+var SCRUB_NONBLOCK_MAX = 64 * 1024;
 var encoder5 = new TextEncoder();
 function scrubberOf(secrets) {
   const usable = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
   return usable.length > 0 ? compile(usable, { idleMs: SCRUB_IDLE_MS }) : void 0;
 }
-async function writeAll2(file, bytes, signal) {
+async function writeAll2(file, bytes) {
   const write = file.write;
-  for (let at = 0; at < bytes.length; ) {
-    at += await write.call(file, bytes.subarray(at), at === 0 ? signal : void 0);
-  }
+  for (let at = 0; at < bytes.length; ) at += await write.call(file, bytes.subarray(at));
 }
 function bound(file, key) {
   const method = file[key];
   return typeof method === "function" ? { [key]: method.bind(file) } : {};
 }
+function interrupted2(err) {
+  const code = err?.code;
+  return code === "EINTR" || code === "EAGAIN";
+}
 function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   const file = inner.file;
   const stream = scrubber.stream();
-  let queue = Promise.resolve();
+  let tail = Promise.resolve();
+  let pending = 0;
+  let busy = false;
   let timer;
   let failed3;
+  const waiters = /* @__PURE__ */ new Set();
+  const quiet = () => !busy && pending === 0;
+  const wake = () => {
+    for (const waiter of [...waiters]) waiter();
+  };
   const raise = () => {
     if (failed3 === void 0) return;
     const err = failed3;
     failed3 = void 0;
     throw err;
   };
-  const enqueue = (bytes, signal) => {
-    const next2 = queue.then(() => bytes.length > 0 ? writeAll2(file, bytes, signal) : void 0);
-    queue = next2.catch(() => void 0);
-    return next2;
+  const later = (bytes) => {
+    if (bytes.length === 0) return;
+    pending += 1;
+    tail = tail.then(() => writeAll2(file, bytes)).catch((err) => {
+      if (failed3 === void 0) failed3 = err;
+    }).finally(() => {
+      pending -= 1;
+      if (quiet()) wake();
+    });
+  };
+  const settling = (signal) => new Promise((resolve2, reject) => {
+    const done4 = () => {
+      waiters.delete(done4);
+      signal?.removeEventListener("abort", stop);
+      resolve2();
+    };
+    const stop = () => {
+      waiters.delete(done4);
+      reject(new KernelError("EINTR"));
+    };
+    if (signal?.aborted) return stop();
+    waiters.add(done4);
+    signal?.addEventListener("abort", stop, { once: true });
+  });
+  const settled = async () => {
+    while (!quiet()) await settling();
+  };
+  const changed = async (signal) => {
+    const round = new AbortController();
+    const stop = signal ? AbortSignal.any([signal, round.signal]) : round.signal;
+    try {
+      const own = settling(stop);
+      await Promise.race(file.changed ? [own, file.changed(stop)] : [own]);
+    } catch (err) {
+      throw signal?.aborted ? new KernelError("EINTR") : err;
+    } finally {
+      round.abort();
+    }
+  };
+  const turn = async (signal) => {
+    for (let waited = false; ; waited = true) {
+      if (quiet() && (pollFile(file).writable || !file.changed)) {
+        busy = true;
+        return;
+      }
+      if (signal?.aborted) throw new KernelError(waited ? "EINTR" : "EAGAIN");
+      await changed(signal);
+    }
+  };
+  const send = async (out, signal) => {
+    const write = file.write;
+    for (let at = 0; at < out.length; ) {
+      try {
+        at += await write.call(file, out.subarray(at), signal);
+      } catch (err) {
+        if (!signal?.aborted || !interrupted2(err)) throw err;
+      }
+      if (at < out.length && signal?.aborted) return later(out.subarray(at));
+    }
   };
   const release = () => {
     timer = void 0;
-    enqueue(stream.idle()).catch((err) => {
-      failed3 = err;
-    });
+    later(stream.idle());
   };
   return new OpenFile({
     ...bound(file, "read"),
     ...bound(file, "peek"),
-    ...bound(file, "poll"),
-    ...bound(file, "changed"),
     ...bound(file, "stat"),
+    poll: () => {
+      const state = pollFile(file);
+      return quiet() ? state : { ...state, writable: false };
+    },
+    changed,
     ...file.tty ? { tty: file.tty } : {},
     ...file.clipboard ? { clipboard: file.clipboard } : {},
     ...file.write ? {
       write: async (bytes, signal) => {
-        if (timer !== void 0) clearTimeout(timer);
-        raise();
-        await enqueue(stream.push(bytes), signal);
+        await turn(signal);
+        const taken = signal?.aborted && bytes.length > SCRUB_NONBLOCK_MAX ? bytes.subarray(0, SCRUB_NONBLOCK_MAX) : bytes;
+        try {
+          raise();
+          if (timer !== void 0) clearTimeout(timer);
+          timer = void 0;
+          await send(stream.push(taken), signal);
+        } finally {
+          busy = false;
+          if (quiet()) wake();
+        }
         timer = setTimeout(release, idleMs);
-        return bytes.length;
+        return taken.length;
       }
     } : {},
     flush: async () => {
-      await queue;
+      await settled();
       raise();
       await file.flush?.();
     },
@@ -15196,7 +15510,9 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
       if (timer !== void 0) clearTimeout(timer);
       let failure2;
       try {
-        await enqueue(stream.end());
+        await settled();
+        later(stream.end());
+        await settled();
         raise();
       } catch (err) {
         failure2 = { err };
@@ -15372,12 +15688,12 @@ var SealedChannel = class {
     if (signal.aborted) throw new KernelError("EINTR");
     let stop = () => {
     };
-    const interrupted2 = new Promise((_, reject) => {
+    const interrupted3 = new Promise((_, reject) => {
       stop = () => reject(new KernelError("EINTR"));
       signal.addEventListener("abort", stop, { once: true });
     });
     try {
-      await Promise.race([flight.done, interrupted2]);
+      await Promise.race([flight.done, interrupted3]);
     } finally {
       signal.removeEventListener("abort", stop);
     }
@@ -17489,6 +17805,9 @@ var SUDO_SOURCE = [
 ].join("\n");
 
 // src/launcher.ts
+function linksOf2(req) {
+  return req.links === void 0 ? {} : { links: req.links };
+}
 var COMMAND2 = /^\/(?:usr\/)?bin\/([^/]+)$/;
 var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
 var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
@@ -17664,6 +17983,7 @@ var Launcher = class {
   warned = /* @__PURE__ */ new Set();
   compiled = /* @__PURE__ */ new Map();
   texts = /* @__PURE__ */ new Map();
+  revocations = 0;
   integrity;
   scannedFs;
   get scanned() {
@@ -17676,6 +17996,7 @@ var Launcher = class {
   described = /* @__PURE__ */ new Map();
   creds = /* @__PURE__ */ new Map();
   tags = /* @__PURE__ */ new Map();
+  links = /* @__PURE__ */ new Map();
   freshModules = new FreshModules();
   granted = /* @__PURE__ */ new Map();
   users;
@@ -17978,14 +18299,16 @@ var Launcher = class {
     }
     const path = this.fs.resolvePath(cwd, file);
     const glue = await followLinks(this.base, path);
-    const linked = COMMAND2.exec(glue)?.[1];
-    if (linked !== void 0) {
-      const target = await this.resolve(`/bin/${linked}`, argv0, cwd);
-      const byPath = !COMMAND2.test(path) && (await this.commands()).get(linked)?.argv0Path === true;
+    const asked = glue === path ? {} : { asked: path };
+    const linked2 = COMMAND2.exec(glue)?.[1];
+    if (linked2 !== void 0) {
+      const found = await this.resolve(`/bin/${linked2}`, argv0, cwd);
+      const target = found && { ...found, ...asked };
+      const byPath = !COMMAND2.test(path) && (await this.commands()).get(linked2)?.argv0Path === true;
       return target && byPath ? { ...target, argv0: path } : target;
     }
     const own = await this.commandAt(glue, scope);
-    if (own) return own.script ? void 0 : targetOf(own);
+    if (own) return own.script ? void 0 : { ...targetOf(own), ...asked };
     const head = await this.head(glue);
     if (!head) return void 0;
     if (isWasm(head)) {
@@ -17993,13 +18316,14 @@ var Launcher = class {
         abi: "wasi",
         glue,
         wasm: glue,
-        argv0: baseName(argv0 || file).replace(/\.wasm$/, "")
+        argv0: baseName(argv0 || file).replace(/\.wasm$/, ""),
+        ...asked
       };
     }
     if (interpreter(head) !== "node") return void 0;
     const wasm = modulePath(glue);
     if (!await this.base.exists(wasm)) return void 0;
-    return { abi: "emscripten", glue, wasm, argv0: baseName(argv0 || file) };
+    return { abi: "emscripten", glue, wasm, argv0: baseName(argv0 || file), ...asked };
   }
   async head(path) {
     try {
@@ -18017,6 +18341,8 @@ var Launcher = class {
   async interpreted(file, argv, cwd, scope, depth = 0) {
     const command = await this.scriptCommand(file, cwd, scope);
     const script = command?.script ?? this.fs.resolvePath(cwd, file);
+    const byPath = command && file.includes("/") && !COMMAND2.test(file);
+    const named = byPath ? { [script]: this.fs.resolvePath(cwd, file) } : {};
     const head = await this.head(script);
     if (!head) return void 0;
     const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(scope), script);
@@ -18039,7 +18365,8 @@ var Launcher = class {
         target: withScriptEnv(inner.target, command),
         via,
         sources,
-        ...bins.length > 0 ? { bins } : {}
+        ...bins.length > 0 ? { bins } : {},
+        asked: { ...inner.asked, ...named }
       };
     }
     const target = withScriptEnv(found, command);
@@ -18048,7 +18375,8 @@ var Launcher = class {
       args: [...target.prefix ?? [], ...passed],
       via: [interp],
       sources: [script],
-      ...command?.bin ? { bins: [script] } : {}
+      ...command?.bin ? { bins: [script] } : {},
+      asked: named
     };
   }
   async plan(file, argv, cwd, scope, argv0) {
@@ -18062,7 +18390,14 @@ var Launcher = class {
   async mayExec(cred, req, planned) {
     const { dac } = this;
     if (!dac) return;
-    const g = { fs: this.fs, cred, pid: req.pid, dac, tag: req.tag };
+    const g = {
+      fs: this.fs,
+      cred,
+      pid: req.pid,
+      dac,
+      tag: req.tag,
+      links: this.links.get(req.pid)
+    };
     const byPath = (file) => file.includes("/") && !COMMAND2.test(file);
     if (byPath(req.file)) {
       const path = this.fs.resolvePath(req.cwd, req.file);
@@ -18219,8 +18554,8 @@ var Launcher = class {
       readFile: (path) => this.integrity ? this.text(path, KERNEL_CALLER) : fs.readFile(path)
     });
   }
-  async cacheKey(path) {
-    const verified = await this.integrity?.key(path);
+  async cacheKey(path, asked) {
+    const verified = await this.integrity?.key(path, asked);
     if (verified !== void 0) return verified;
     const st = await this.base.stat(path);
     return `${path}:${st.size}:${st.mtime.getTime()}`;
@@ -18229,30 +18564,31 @@ var Launcher = class {
     const plain = () => fs.readFileBuffer(path);
     return this.integrity ? this.integrity.read(path, caller, plain) : plain();
   }
-  keyed(path, caller) {
+  keyed(path, caller, asked) {
     const plain = async () => this.base.readFileBuffer(path);
-    return this.integrity ? this.integrity.readKeyed(path, caller, plain) : plain().then((bytes) => ({ bytes }));
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain, asked) : plain().then((bytes) => ({ bytes }));
   }
   cached(cache, key, load) {
     const hit = cache.get(key);
     if (hit !== void 0) return hit;
+    const revocations = this.revocations;
     const loading2 = load();
     const found = loading2.then(({ value }) => value);
     cache.set(key, found);
-    loading2.then(
-      (done4) => {
-        if (done4.key === key || done4.key === void 0 && !key.includes("\0")) return;
-        if (cache.get(key) === found) cache.delete(key);
-        if (done4.key !== void 0) cache.set(done4.key, found);
-      },
-      () => cache.delete(key)
-    );
+    const drop = () => {
+      if (cache.get(key) === found) cache.delete(key);
+    };
+    loading2.then((done4) => {
+      if (done4.key === key || done4.key === void 0 && !key.includes("\0")) return;
+      drop();
+      if (done4.key !== void 0 && revocations === this.revocations) cache.set(done4.key, found);
+    }, drop);
     return found;
   }
-  async module(path, caller) {
-    const key = await this.cacheKey(path);
+  async module(path, caller, asked) {
+    const key = await this.cacheKey(path, asked);
     return this.cached(this.compiled, key, async () => {
-      const { bytes, key: read } = await this.keyed(path, caller);
+      const { bytes, key: read } = await this.keyed(path, caller, asked);
       const memory = importedMemory(bytes);
       const foreign = foreignImports(bytes);
       const compiled = await WebAssembly.compile(bytes);
@@ -18261,22 +18597,30 @@ var Launcher = class {
   }
   async checkedSources(planned, caller) {
     const { target } = planned;
-    const files = [target.wasm, target.glue, target.imports, ...planned.sources ?? []];
+    const files = [
+      target.wasm,
+      target.glue,
+      target.imports,
+      target.asked,
+      ...planned.sources ?? []
+    ];
     const manifests = /* @__PURE__ */ new Set();
     for (const file of files) {
       const root = file === void 0 ? void 0 : PACKAGE_ROOT.exec(file)?.[1];
       if (root !== void 0) manifests.add(`${root}/package.json`);
     }
-    for (const source of planned.sources ?? []) await this.text(source, caller);
+    for (const source of planned.sources ?? []) {
+      await this.text(source, caller, planned.asked?.[source]);
+    }
     for (const manifest of manifests) {
       if (await this.base.exists(manifest)) await this.text(manifest, caller);
     }
   }
-  async text(path, caller) {
+  async text(path, caller, asked) {
     if (!this.integrity) return this.base.readFile(path);
-    const key = await this.cacheKey(path);
+    const key = await this.cacheKey(path, asked);
     return this.cached(this.texts, key, async () => {
-      const { bytes, key: read } = await this.keyed(path, caller);
+      const { bytes, key: read } = await this.keyed(path, caller, asked);
       return { value: new TextDecoder().decode(bytes), key: read };
     });
   }
@@ -18293,17 +18637,18 @@ var Launcher = class {
     if (target.abi === "js" && target.wasm === SUDO_PATH) {
       return { abi: "js", glue: SUDO_SOURCE, path: SUDO_PATH };
     }
+    const { asked } = target;
     if (target.abi === "js") {
-      return { abi: "js", glue: await this.text(target.wasm, caller), path: target.wasm };
+      return { abi: "js", glue: await this.text(target.wasm, caller, asked), path: target.wasm };
     }
     if (target.abi !== "wasi") {
       const [glue, { module: module2 }] = await Promise.all([
-        this.text(target.glue, caller),
-        this.module(target.wasm, caller)
+        this.text(target.glue, caller, asked),
+        this.module(target.wasm, caller, asked && modulePath(asked))
       ]);
       return { glue, module: module2 };
     }
-    const { module, memory, foreign } = await this.module(target.wasm, caller);
+    const { module, memory, foreign } = await this.module(target.wasm, caller, asked);
     const names = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
     const imports = target.imports ? await this.text(target.imports, caller) : void 0;
     return {
@@ -18340,11 +18685,13 @@ var Launcher = class {
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
-  treeScrubs(pid, req) {
+  treeScrubs(req) {
     const inherited2 = req.ppid !== void 0 ? this.scrubs.get(req.ppid) : void 0;
-    const scrubs = req.scrub ? [...inherited2 ?? [], req.scrub] : inherited2;
-    if (scrubs) this.scrubs.set(pid, scrubs);
-    return scrubs;
+    return req.scrub ? [...inherited2 ?? [], req.scrub] : inherited2;
+  }
+  marks(pid, req) {
+    if (req.tag !== void 0) this.tags.set(pid, req.tag);
+    if (req.links !== void 0) this.links.set(pid, req.links);
   }
   start(req) {
     this.sampling();
@@ -18352,7 +18699,7 @@ var Launcher = class {
       throw new SpawnError("ESRCH");
     }
     const pid = req.pid ?? this.nextPid++;
-    const scrubs = this.treeScrubs(pid, req);
+    const scrubs = this.treeScrubs(req);
     const stack = this.stackFor(req.tag);
     const terminal = req.fds.stdioTerminal();
     const decided = req.decided ?? Promise.resolve(true);
@@ -18378,6 +18725,7 @@ var Launcher = class {
       cred: req.cred,
       ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
+      ...linksOf2(req),
       sealed: this.sealed,
       ...scrubs ? { outputFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
@@ -18422,9 +18770,10 @@ var Launcher = class {
       ...this.shownIds(req)
     });
     this.processes.set(pid, handle);
+    if (scrubs) this.scrubs.set(pid, scrubs);
     const { cred } = req;
     this.creds.set(pid, () => handle.cred?.() ?? copyCred(cred));
-    if (req.tag !== void 0) this.tags.set(pid, req.tag);
+    this.marks(pid, req);
     if (req.ppid !== void 0 && this.controlsJobs(req.ppid)) this.settling.started(pid, req.ppid);
     this.jobs.add(pid, req.ppid, (sig) => handle.signal(sig), terminal);
     if (req.exec && req.ppid !== void 0) this.jobs.exec(req.ppid, pid, true);
@@ -18477,6 +18826,7 @@ var Launcher = class {
     this.childTimes.delete(pid);
     this.creds.delete(pid);
     this.tags.delete(pid);
+    this.links.delete(pid);
     this.granted.delete(pid);
   }
   reaped(pid, parent) {
@@ -18652,6 +19002,7 @@ var Launcher = class {
         umask: this.umaskOf(ppid),
         cred,
         tag: this.tagOf(ppid),
+        links: grant ? grant.cred.euid : this.links.get(ppid),
         ...group,
         ...exec
       });
@@ -18713,7 +19064,8 @@ var Launcher = class {
         blocked: this.blockedBy(ppid),
         umask: this.umaskOf(ppid),
         cred: this.credOf(ppid),
-        tag: this.tagOf(ppid)
+        tag: this.tagOf(ppid),
+        links: this.links.get(ppid)
       })
     );
   }
@@ -18893,6 +19245,23 @@ var Launcher = class {
       }
     };
   }
+  async revokeIntegrity(path) {
+    if (path !== void 0 && (typeof path !== "string" || !path.startsWith("/"))) {
+      throw new TypeError("integrity.revoke takes an absolute path");
+    }
+    if (!this.integrity) return;
+    const at = path === void 0 ? void 0 : normalizePath(path);
+    const real = at && await this.base.realpath?.(at, true).catch(() => void 0);
+    const roots = [at, real].filter((p) => p !== void 0);
+    this.revocations++;
+    const hit = (key) => key.includes("\0") && (at === void 0 || key.split("\0").slice(0, 2).some((part) => isProtected(roots, part)));
+    for (const cache of [this.compiled, this.texts]) {
+      for (const key of [...cache.keys()]) if (hit(key)) cache.delete(key);
+    }
+    if (at === void 0) this.integrity.forget();
+    for (const root of roots) this.integrity.forget(root);
+    this.resetCatalogs();
+  }
   attest(path) {
     return attest(this.rootFs, path, {
       users: this.usersMode,
@@ -19390,7 +19759,8 @@ var ATTEST_OPS = /* @__PURE__ */ new Set([
   "attest",
   "watch-files",
   "unwatch-files",
-  "chmod"
+  "chmod",
+  "integrity-revoke"
 ]);
 function isAttestRequest(req) {
   return ATTEST_OPS.has(req.op);
@@ -19408,6 +19778,7 @@ function attestOps(port) {
   return async (l, req) => {
     if (req.op === "attest") return l.attest(req.path);
     if (req.op === "chmod") return l.fs.chmod(req.path, modeOption(req.mode)).then(() => true);
+    if (req.op === "integrity-revoke") return l.revokeIntegrity(req.path).then(() => true);
     if (req.op === "unwatch-files") {
       watches.get(req.watch)?.();
       return watches.delete(req.watch);