@ai-ecoverse/slicc-kernel 1.88.1 → 1.90.0

package/dist/process-worker.js

@@ -1070,6 +1070,7 @@ function createSyncFsSabBridge(transport, opts = {}) {
       changing({ op: follow2 ? "chown" : "lchown", path, ...ids }, path);
     },
     ...opts.owners ? { owners: true } : {},
+    ...opts.links ? { links: true } : {},
     access: (path, mode, kind = "access", nofollow) => {
       run({ op: "access", path, mode, arg2: kind, ...nofollow ? { nofollow } : {} }, path);
     },
@@ -1540,7 +1541,12 @@ function createNodeOps(h) {
     },
     readlink(node) {
       if (!Fs.isLink(node.mode)) throw new Fs.ErrnoError(wasiErrno("EINVAL"));
-      return call2(() => bridgeOf(node).readlink(liveNodePath(node)));
+      const bridge = bridgeOf(node);
+      const path = liveNodePath(node);
+      if (bridge.links && Fs.sliccReading !== node) {
+        call2(() => bridge.access?.(path, 0, "follow", true));
+      }
+      return call2(() => bridge.readlink(path));
     }
   };
 }
@@ -1936,6 +1942,63 @@ function useLiveChown(Fs) {
     Fs.chown(target, uid, gid);
   };
 }
+function flushOne(Fs, node) {
+  const s = node.live;
+  if (!s.dirty || s.orphan || !(s.data || s.ranged)) return;
+  try {
+    if (s.ranged) s.ranged.flush();
+    else {
+      const bytes = s.data.slice(0, s.len);
+      pinnedIo(node.mount.opts.bridge, s.handle).writeFile(liveNodePath(node), bytes, true);
+    }
+  } catch (err) {
+    throw toErrno(Fs, err);
+  }
+  s.dirty = false;
+  s.stat = void 0;
+}
+function linkable(bridge, path) {
+  try {
+    return bridge.lstat(path).linkable === true;
+  } catch {
+    return false;
+  }
+}
+function linkLive(Fs, from, to, follow2) {
+  const target = to.replace(/\/+$/, "");
+  const slash = target.lastIndexOf("/");
+  const name2 = target.slice(slash + 1);
+  const source = Fs.lookupPath(from, { follow: follow2 }).node;
+  const parent = Fs.lookupPath(target.slice(0, slash) || "/", { follow: true }).node;
+  if (!source.live || !parent.live) return false;
+  flushOne(Fs, source);
+  const base = liveNodePath(parent);
+  const bridge = source.mount.opts.bridge;
+  const path = liveNodePath(source);
+  try {
+    bridge.link(path, base === "/" ? `/${name2}` : `${base}/${name2}`);
+  } catch (err) {
+    const refused = toErrno(Fs, err);
+    if (refused.errno !== wasiErrno("EPERM") || linkable(bridge, path)) throw refused;
+    throw new Fs.ErrnoError(wasiErrno("EMLINK"));
+  }
+  source.live.stat = void 0;
+  parent.live.listed = void 0;
+  return true;
+}
+function readingLinks(Fs) {
+  const readlink = Fs.readlink?.bind(Fs);
+  if (!readlink) return;
+  Fs.readlink = (path) => {
+    const was = Fs.sliccReading;
+    Fs.sliccReading = Fs.lookupPath(path).node;
+    try {
+      return readlink(path);
+    } finally {
+      Fs.sliccReading = was;
+    }
+  };
+}
 var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
@@ -1987,6 +2050,7 @@ function mountVfsIntoEmscripten(Fs, deps) {
   const { plugin, mounted } = mountLiveVfsDirs(Fs, bridge, dirs ?? [], warn);
   if (dirs) liveRoot(Fs, bridge);
   if (bridge.owners && Fs.lookupPath) useLiveChown(Fs);
+  if (bridge.links && Fs.lookupPath) readingLinks(Fs);
   try {
     Fs.chdir(deps.cwd);
   } catch (err) {
@@ -2154,21 +2218,46 @@ var init_kernel_streams = __esm({
         if (typeof this.Fs.stat !== "function") return;
         stream.stream_ops = { ...stream.stream_ops, getattr: () => this.Fs.stat?.(name2) ?? {} };
       }
+      nameDevice(stream, kind) {
+        this.nameStream(stream, kind === "sealed" ? SEALED_PATH : CLIPBOARD_PATH);
+      }
       listSealed() {
-        const { analyzePath, mkdev, makedev } = this.Fs;
+        const fs = this.Fs;
+        const { analyzePath, mkdev, makedev, registerDevice } = fs;
         if (!analyzePath || !mkdev || !makedev) return;
         const nodes = [
           [SEALED_PATH, 250, this.sys.openSealed],
           [CLIPBOARD_PATH, 251, this.sys.openClipboard]
         ];
-        for (const [path, minor, present] of nodes) {
-          if (!present || analyzePath.call(this.Fs, path).exists) continue;
+        for (const [path, minor, opener] of nodes) {
+          if (!opener) continue;
+          const dev = makedev.call(fs, 10, minor);
+          registerDevice?.call(fs, dev, {
+            open: (stream) => this.openNode(stream, path, opener)
+          });
+          if (analyzePath.call(fs, path).exists) continue;
           try {
-            mkdev.call(this.Fs, path, makedev.call(this.Fs, 10, minor));
+            const node = mkdev.call(fs, path, dev);
+            if (typeof node === "object" && node !== null) {
+              const made = node;
+              made.node_ops = { ...made.node_ops, getattr: () => sealedStat(minor) };
+            }
           } catch {
           }
         }
       }
+      openNode(stream, path, opener) {
+        let kfd;
+        try {
+          kfd = this.call(() => opener.call(this.sys, stream.flags & 3));
+        } catch (e) {
+          this.Fs.closeStream(stream.fd);
+          throw e;
+        }
+        this.attach(stream, kfd, false);
+        this.nameStream(stream, path);
+        if (path === CLIPBOARD_PATH) this.reportClose(kfd);
+      }
       reporting = /* @__PURE__ */ new Set();
       reportClose(kfd) {
         this.reporting.add(kfd);
@@ -3223,8 +3312,9 @@ function readonlyRefusal(Fs, memory, call2) {
       follow: follow2
     });
     const bridge = node.live ? node.mount.opts.bridge : void 0;
-    const stat = bridge?.stat;
-    return stat?.(liveNodePath(node)).readonly ? -wasiErrno("EROFS") : 0;
+    const stats = bridge;
+    const stat = follow2 ? stats?.stat : stats?.lstat;
+    return stat?.call(stats, liveNodePath(node)).readonly ? -wasiErrno("EROFS") : 0;
   } catch {
     return 0;
   }
@@ -3256,6 +3346,32 @@ function kernelAccess(imports, fs, memory, glue) {
     }
   });
 }
+function kernelLink(imports, fs, memory, glue) {
+  wrapImport(
+    imports,
+    "linkat",
+    glue,
+    (own) => (olddirfd, oldpath, newdirfd, newpath, flags) => {
+      const Fs = fs();
+      const heap = memory();
+      if (!Fs?.lookupPath || !heap) return own(olddirfd, oldpath, newdirfd, newpath, flags);
+      const at = (dirfd, ptr) => {
+        const name2 = cString(heap, ptr);
+        return name2.startsWith("/") ? name2 : `${baseOf(Fs, dirfd)}/${name2}`;
+      };
+      try {
+        const from = at(olddirfd, oldpath);
+        const to = at(newdirfd, newpath);
+        const follow2 = (flags & AT_SYMLINK_FOLLOW) !== 0;
+        if (linkLive(Fs, from, to, follow2)) return 0;
+      } catch (err) {
+        return -errnoOf(err);
+      }
+      return own(olddirfd, oldpath, newdirfd, newpath, flags);
+    },
+    true
+  );
+}
 function kernelChdir(Fs) {
   const { chdir, lookupPath, ErrnoError } = Fs;
   if (!chdir || !lookupPath || !ErrnoError) return;
@@ -3283,7 +3399,7 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, X_ACCESS, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, X_ACCESS, AT_SYMLINK_FOLLOW, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
@@ -3318,6 +3434,7 @@ var init_process_fds = __esm({
       mknodat: "__syscall_mknodat",
       umask: "__syscall_umask",
       faccessat: "__syscall_faccessat",
+      linkat: "__syscall_linkat",
       utimensat: "__syscall_utimensat",
       getppid: "slicc_getppid_js",
       resizeHeap: "emscripten_resize_heap",
@@ -3344,6 +3461,7 @@ var init_process_fds = __esm({
     AT_EACCESS = 512;
     W_ACCESS = 2;
     X_ACCESS = 1;
+    AT_SYMLINK_FOLLOW = 1024;
     DEVICE_MODES = [
       ["/", 493],
       ["/dev", 493],
@@ -3412,7 +3530,8 @@ function kernelEntry(stream, kernel) {
   if (stream.sliccKernelSocket) {
     return { fd: stream.fd, kernel, kind: "socket", flags: stream.flags, ...cloexec };
   }
-  const kind = stream.sliccKernelFile ? "file" : stream.tty ? "tty" : "stream";
+  const device2 = stream.path === void 0 ? void 0 : NAMED_DEVICES[stream.path];
+  const kind = stream.sliccKernelFile ? "file" : stream.tty ? "tty" : device2 ?? "stream";
   return { fd: stream.fd, kernel, kind, ...cloexec };
 }
 function describeInherited(Fs, sys, streams, livePath, actions = []) {
@@ -3462,7 +3581,8 @@ function place(Fs, stream, fd) {
 function placeholder(Fs, streams, entry) {
   if (entry.kind === "socket") return streams.socketStream(entry.flags ?? O_RDWR);
   if (entry.kind === "tty") return Fs.open("/dev/tty", O_RDWR);
-  if (entry.kind === "stream" || entry.kind === "clipboard") return Fs.open("/dev/null", O_RDWR);
+  if (entry.kind === "stream" || entry.kind === "clipboard" || entry.kind === "sealed")
+    return Fs.open("/dev/null", O_RDWR);
   Fs.mkdirTree(PLACEHOLDER_DIR);
   return Fs.open(`${PLACEHOLDER_DIR}/${entry.fd}`, O_RDWR | O_CREAT3);
 }
@@ -3487,6 +3607,7 @@ function placeKernelStream(Fs, streams, entry) {
   } else if (entry.kind === "socket") streams.attachSocket(stream, entry.kernel);
   else streams.attach(stream, entry.kernel, entry.kind === "tty");
   if (entry.kind === "clipboard") streams.reportClose(entry.kernel);
+  if (entry.kind === "sealed" || entry.kind === "clipboard") streams.nameDevice(stream, entry.kind);
   if (entry.kind === "tty") streams.nameTerminal(stream);
   if (entry.kind === "stream") {
     asFifo(stream, streams, entry.desc !== void 0 ? `d${entry.desc}` : `k${entry.kernel}`);
@@ -3512,7 +3633,7 @@ function restoreForkedStreams(Fs, streams, table) {
     }
   }
 }
-var O_RDWR, O_ACCMODE3, O_CREAT3, O_EXCL2, O_TRUNC3, PLACEHOLDER_DIR, ACCESS, DEVICES, FIFO_MODE, nextStreamIno, streamInos;
+var O_RDWR, O_ACCMODE3, O_CREAT3, O_EXCL2, O_TRUNC3, PLACEHOLDER_DIR, NAMED_DEVICES, ACCESS, DEVICES, FIFO_MODE, nextStreamIno, streamInos;
 var init_process_fork = __esm({
   "src/process/process-fork.ts"() {
     "use strict";
@@ -3523,6 +3644,10 @@ var init_process_fork = __esm({
     O_EXCL2 = 128;
     O_TRUNC3 = 512;
     PLACEHOLDER_DIR = "/dev/slicc-fd";
+    NAMED_DEVICES = {
+      "/dev/sealed": "sealed",
+      "/dev/clipboard": "clipboard"
+    };
     ACCESS = { 0: "read", 1: "write" };
     DEVICES = {
       "/dev/null": "null",
@@ -4160,7 +4285,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.88.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.90.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -4440,9 +4565,9 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
     }
     return found;
   };
-  const procOps = proc.node_ops;
-  const lookup2 = procOps.lookup?.bind(procOps);
-  const readdir = procOps.readdir?.bind(procOps);
+  const procOps2 = proc.node_ops;
+  const lookup2 = procOps2.lookup?.bind(procOps2);
+  const readdir = procOps2.readdir?.bind(procOps2);
   const listAll = (node) => {
     const names = new Set(readdir ? readdir(node) : [".", ".."]);
     for (const name2 of [...SYSTEM_FILES, "mounts", "sys"]) names.add(name2);
@@ -4450,7 +4575,7 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
     return [...names];
   };
   proc.node_ops = {
-    ...procOps,
+    ...procOps2,
     lookup: (parent, name2) => {
       if (/^[1-9]\d*$/.test(name2)) {
         if (!infoOf(Number(name2)) && !listed(Number(name2))) throw error();
@@ -4831,6 +4956,7 @@ function kernelWrappers(imports, module, deps) {
   const fsOf = () => ownValue(module, "FS");
   noFollowUtimes(imports, fsOf, kernelGlue?.utimensat ?? utimensatOf(module), memory);
   kernelAccess(imports, fsOf, memory, kernelGlue);
+  kernelLink(imports, fsOf, memory, kernelGlue);
   const glue = ownValue(module, "sliccFdImports");
   syncFsync(imports, fsOf, glue);
   positionalIo(imports, { glue, fs: fsOf, sys, memory });
@@ -4838,6 +4964,9 @@ function kernelWrappers(imports, module, deps) {
   reportGrowth(imports, grown, kernelGlue);
   holdWhileStopped(imports, new Int32Array(init.sab, 0, SAB_HEADER_I32), kernelGlue, deps.poll);
 }
+function bridgeFlags(init) {
+  return { ...init.owners ? { owners: true } : {}, ...init.links ? { links: true } : {} };
+}
 async function runWasmProcess(init, port2, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port2, {
@@ -4942,7 +5071,7 @@ async function runWasmProcess(init, port2, deps = {}) {
   if (!hasStreams(running)) return runStdioOnly(running, init);
   if (init.owners) linuxDevices(running.FS);
   const vfs = mountVfsIntoEmscripten(running.FS, {
-    bridge: createSyncFsSabBridge(transport, init.owners ? { owners: true } : {}),
+    bridge: createSyncFsSabBridge(transport, bridgeFlags(init)),
     cwd: init.cwd,
     warn: deps.warn ?? say(2)
   });
@@ -5097,7 +5226,7 @@ var init_process_runtime = __esm({
     O_ACCMODE4 = 3;
     O_DIRECTORY = 65536;
     accessMode = (access) => access === "read" ? O_RDONLY : access === "write" ? O_WRONLY3 : O_RDWR3;
-    PLACED = /* @__PURE__ */ new Set(["stream", "file", "socket", "clipboard"]);
+    PLACED = /* @__PURE__ */ new Set(["stream", "file", "socket", "clipboard", "sealed"]);
     GLUE_TRAILER = [
       "if (typeof ENV !== 'undefined') Object.assign(ENV, Module.sliccEnv);",
       "if (typeof thisProgram !== 'undefined' && Module.thisProgram === '') thisProgram = '';",
@@ -5126,6 +5255,7 @@ var init_process_runtime = __esm({
       "  mknodat: typeof ___syscall_mknodat === 'function' ? ___syscall_mknodat : undefined,",
       "  umask: typeof ___syscall_umask === 'function' ? ___syscall_umask : undefined,",
       "  faccessat: typeof ___syscall_faccessat === 'function' ? ___syscall_faccessat : undefined,",
+      "  linkat: typeof ___syscall_linkat === 'function' ? ___syscall_linkat : undefined,",
       "  utimensat: typeof ___syscall_utimensat === 'function' ? ___syscall_utimensat : undefined,",
       "  getppid: typeof _slicc_getppid_js === 'function' ? _slicc_getppid_js : undefined,",
       "  resizeHeap: typeof _emscripten_resize_heap === 'function' ? _emscripten_resize_heap : undefined,",
@@ -5314,6 +5444,7 @@ function physical(fs, path) {
     const st = fs.lstat(at);
     if (st.isSymbolicLink) {
       if (++hops > MAX_LINKS) throw new WasiError("ELOOP");
+      if (fs.links) fs.access?.(at, 0, "follow", true);
       const target = fs.readlink(at);
       if (target.startsWith("/")) done = [];
       todo = [...target.split("/").filter((p) => p !== "" && p !== "."), ...todo];
@@ -5453,6 +5584,7 @@ function cachingBridge(bridge, now = () => performance.now(), shared) {
       truncate: (p, size) => rewriting(p, () => bridge.truncate?.(p, size))
     } : {},
     ...bridge.owners ? { owners: true } : {},
+    ...bridge.links ? { links: true } : {},
     invalidate,
     touched,
     threaded
@@ -7129,6 +7261,7 @@ var init_wasi_host = __esm({
             view.setUint32(old, oldLo, true);
             view.setUint32(old + 4, oldHi, true);
           }) : E.NOSYS,
+          sigmask_poll: (lo, hi, inPtr, outPtr, n, nevents) => this.sigmask ? this.maskedPoll(this.sigmask, [lo, hi], [inPtr, outPtr, n, nevents]) : E.NOSYS,
           sigpending_get: (out) => {
             if (!this.sigmask) return E.NOSYS;
             mem.view().setBigUint64(out, BigInt(this.sigmask.pending()), true);
@@ -7136,6 +7269,47 @@ var init_wasi_host = __esm({
           }
         });
       }
+      poll(inPtr, outPtr, n, nevents) {
+        try {
+          return pollOneoff(
+            {
+              mem: this.mem,
+              fds: this.fds,
+              kernel: this.o.kernel,
+              now: (id) => this.now(id),
+              interruptWakes: this.interruptWakes
+            },
+            inPtr,
+            outPtr,
+            n,
+            nevents
+          );
+        } finally {
+          this.o.fs.invalidate?.();
+        }
+      }
+      maskedPoll(mask, set, [inPtr, outPtr, n, nevents]) {
+        const old = mask.swap(set[0], set[1]);
+        try {
+          this.mem.view().setUint32(nevents, 0, true);
+          if (mask.deliverUnblocked()) return E.INTR;
+          if (n > 0) return this.poll(inPtr, outPtr, n, nevents);
+          return this.suspend();
+        } finally {
+          mask.deliverUnblocked();
+          mask.restore(old);
+        }
+      }
+      suspend() {
+        for (; ; ) {
+          try {
+            this.o.kernel.call({ op: "fd-select", read: [], write: [], timeoutMs: -1 });
+          } catch (e) {
+            if (e.code === "EINTR") return E.INTR;
+            throw e;
+          }
+        }
+      }
       imports() {
         this.cache ??= wrap({
           ...this.processImports(),
@@ -7143,25 +7317,7 @@ var init_wasi_host = __esm({
           ...this.statImports(),
           ...this.pathImports(),
           ...this.socketImports(),
-          poll_oneoff: (inPtr, outPtr, n, nevents) => {
-            try {
-              return pollOneoff(
-                {
-                  mem: this.mem,
-                  fds: this.fds,
-                  kernel: this.o.kernel,
-                  now: (id) => this.now(id),
-                  interruptWakes: this.interruptWakes
-                },
-                inPtr,
-                outPtr,
-                n,
-                nevents
-              );
-            } finally {
-              this.o.fs.invalidate?.();
-            }
-          }
+          poll_oneoff: (inPtr, outPtr, n, nevents) => this.poll(inPtr, outPtr, n, nevents)
         });
         return this.cache;
       }
@@ -8253,15 +8409,15 @@ function procPath(fs, path, follow2) {
   return result;
 }
 function frozen(bytes) {
-  const refuse = () => {
+  const refuse2 = () => {
     throw syncError("EROFS", "/proc");
   };
   return {
     readFile: () => bytes,
     pread: (_p, at, n) => bytes.subarray(at, at + n),
-    writeFile: refuse,
-    pwrite: refuse,
-    truncate: refuse
+    writeFile: refuse2,
+    pwrite: refuse2,
+    truncate: refuse2
   };
 }
 function procfsBridge(fs, tree) {
@@ -8287,7 +8443,7 @@ function procfsBridge(fs, tree) {
       return proc(real);
     }
   };
-  const readOnly = (paths, run) => {
+  const readOnly2 = (paths, run) => {
     const physical2 = shadowing();
     for (const [p, follow2] of paths) {
       if (inProc(p) || physical2 && toProc(p, follow2) !== void 0) throw syncError("EROFS", p);
@@ -8367,15 +8523,15 @@ function procfsBridge(fs, tree) {
         return [...listed, ["proc", tree.stat("/proc")]];
       }
     ),
-    rename: (from, to) => readOnly(
+    rename: (from, to) => readOnly2(
       [
         [from, false],
         [to, false]
       ],
       () => fs.rename(from, to)
     ),
-    symlink: (target, link) => readOnly([[link, false]], () => fs.symlink(target, link)),
-    link: (from, to, follow2) => readOnly(
+    symlink: (target, link) => readOnly2([[link, false]], () => fs.symlink(target, link)),
+    link: (from, to, follow2) => readOnly2(
       [
         [from, follow2 === true],
         [to, false]
@@ -8407,12 +8563,12 @@ function procfsBridge(fs, tree) {
     for (const name2 of names) {
       const fn = fs[name2];
       if (!fn) continue;
-      over[name2] = (p, ...rest2) => readOnly([[p, follow2]], () => fn.call(fs, p, ...rest2));
+      over[name2] = (p, ...rest2) => readOnly2([[p, follow2]], () => fn.call(fs, p, ...rest2));
     }
   }
   const { chown } = fs;
   if (chown) {
-    over.chown = (p, uid, gid, follow2) => readOnly([[p, follow2 === true]], () => chown.call(fs, p, uid, gid, follow2));
+    over.chown = (p, uid, gid, follow2) => readOnly2([[p, follow2 === true]], () => chown.call(fs, p, uid, gid, follow2));
   }
   return new Proxy(fs, {
     get: (target, key, receiver) => key in over ? over[key] : Reflect.get(target, key, receiver)
@@ -8593,6 +8749,23 @@ var init_wasi_sigmask = __esm({
         if ((Atomics.load(this.header, SAB_I_SIGNALS) & ~now) !== 0) this.deliver();
         return E.SUCCESS;
       }
+      swap(setLo, setHi) {
+        const old = [this.lo, this.hi];
+        this.lo = setLo & ~LIBC_UNBLOCKABLE;
+        this.hi = setHi | 0;
+        Atomics.store(this.header, SAB_I_BLOCKED, kernelBits(this.lo));
+        return old;
+      }
+      deliverUnblocked() {
+        const now = Atomics.load(this.header, SAB_I_BLOCKED);
+        if ((Atomics.load(this.header, SAB_I_SIGNALS) & ~now) === 0) return false;
+        this.deliver();
+        return true;
+      }
+      restore([lo, hi]) {
+        this.set(SIG_SETMASK, lo, hi, () => {
+        });
+      }
       discard(sig) {
         Atomics.and(this.header, SAB_I_SIGNALS, ~sigbit(sig));
         if (this.process) Atomics.and(this.process, SAB_I_SIGNALS, ~sigbit(sig));
@@ -10878,7 +11051,7 @@ function descriptors(init, fork, threads) {
   return { inherited: init.fds ?? [], ...init.program.preopenRoot ? { preopenRoot: true } : {} };
 }
 function ownersOf(init) {
-  return init.owners ? { owners: true } : {};
+  return { ...init.owners ? { owners: true } : {}, ...init.links ? { links: true } : {} };
 }
 async function runWasiProcess(init, port2) {
   captureBacktraces(init.env);
@@ -12685,6 +12858,153 @@ var init_js_net = __esm({
   }
 });
 
+// src/process/js/js-proc.ts
+function* procStep(abs, pid, run) {
+  const listing = yield { op: "proc-list" };
+  const mounts = abs === "/proc/mounts" ? yield { op: "mount-list" } : [];
+  const tree = new ProcTree(
+    { procList: () => listing, mountList: () => mounts },
+    pid,
+    memorySource()
+  );
+  try {
+    return run(tree);
+  } catch (err) {
+    throw new JsCallError(err.code ?? "EIO", abs);
+  }
+}
+function readOnly(path) {
+  throw new JsCallError("EROFS", path);
+}
+function procWrites(options) {
+  return !!(options?.write || options?.append || options?.create || options?.truncate || options?.exclusive);
+}
+function snapshotFile(path, bytes) {
+  let closed = false;
+  const live = () => {
+    if (closed) throw new JsCallError("EBADF", path);
+  };
+  return {
+    fd: -1,
+    path,
+    size: () => {
+      live();
+      return bytes.length;
+    },
+    read: (position, length) => {
+      live();
+      index2(position, "read");
+      index2(length, "read");
+      return bytes.slice(position, position + length);
+    },
+    write: () => {
+      throw new JsCallError("EBADF", path);
+    },
+    truncate: () => {
+      throw new JsCallError("EBADF", path);
+    },
+    sync: () => live(),
+    close: () => {
+      live();
+      closed = true;
+    }
+  };
+}
+function promised(file) {
+  const out = { ...file };
+  for (const [name2, value2] of Object.entries(file)) {
+    if (typeof value2 === "function") {
+      out[name2] = (...args) => new Promise((resolve) => resolve(value2(...args)));
+    }
+  }
+  return out;
+}
+function procOps(paths, run) {
+  const at = (path) => {
+    const abs = paths.resolve(path);
+    return inProc(abs) ? abs : void 0;
+  };
+  const step = (abs, op) => run(procStep(abs, paths.pid, op));
+  return { at, step };
+}
+function withProc(fs, paths, run) {
+  const { at, step } = procOps(paths, run);
+  const out = { ...fs };
+  const pass = fs;
+  const reads = {
+    stat: (tree, abs) => tree.stat(abs, true),
+    lstat: (tree, abs) => tree.stat(abs, false),
+    exists: (tree, abs) => tree.exists(abs),
+    readdir: (tree, abs) => tree.readdir(abs),
+    readlink: (tree, abs) => tree.readlink(abs),
+    readFile: (tree, abs) => tree.read(abs)
+  };
+  for (const [name2, read2] of Object.entries(reads)) {
+    out[name2] = (path, ...rest2) => {
+      const abs = at(path);
+      return abs ? step(abs, (tree) => read2(tree, abs)) : pass[name2]?.(path, ...rest2);
+    };
+  }
+  for (const name2 of WRITES) {
+    out[name2] = (path, ...rest2) => {
+      const abs = at(path);
+      return abs ? run(refuse(abs)) : pass[name2]?.(path, ...rest2);
+    };
+  }
+  for (const name2 of TWO) {
+    out[name2] = (from, to) => {
+      const abs = at(from) ?? at(to);
+      return abs ? run(refuse(abs)) : pass[name2]?.(from, to);
+    };
+  }
+  out.symlink = (target, path) => {
+    const abs = at(path);
+    return abs ? run(refuse(abs)) : pass.symlink?.(target, path);
+  };
+  return out;
+}
+function* refuse(abs) {
+  yield* [];
+  return readOnly(abs);
+}
+function procOpen(open, paths, run, async = false) {
+  const { at, step } = procOps(paths, run);
+  return (path, options) => {
+    const abs = at(path);
+    if (!abs) return open(path, options);
+    if (procWrites(options)) return run(refuse(abs));
+    return step(abs, (tree) => {
+      const file = snapshotFile(abs, tree.read(abs));
+      return async ? promised(file) : file;
+    });
+  };
+}
+function procFsAsync(fs, kernel, paths) {
+  return withProc(fs, paths, (step) => devAsync(kernel, step));
+}
+function procFsSync(fs, kernel, paths) {
+  return withProc(fs, paths, (step) => devSync(kernel, step));
+}
+function procOpenAsync(open, kernel, paths) {
+  return procOpen(open, paths, (step) => devAsync(kernel, step), true);
+}
+function procOpenSync(open, kernel, paths) {
+  return procOpen(open, paths, (step) => devSync(kernel, step));
+}
+var WRITES, TWO;
+var init_js_proc = __esm({
+  "src/process/js/js-proc.ts"() {
+    "use strict";
+    init_procfs();
+    init_wasi_procfs();
+    init_js_dev();
+    init_js_io();
+    init_js_kernel();
+    WRITES = ["mkdir", "rm", "unlink", "chmod", "writeFile"];
+    TWO = ["rename", "link"];
+  }
+});
+
 // src/process/js/js-run.ts
 function stdioOf(how) {
   if (how === void 0) return "pipe";
@@ -12849,8 +13169,11 @@ function syncOps(kernel, shared) {
       infos.delete(fd);
       kernel.call({ op: "fd-close", fd });
     },
-    open,
-    fs: syncPathOps(kernel, resolve, statOf, open)
+    open: procOpenSync(open, kernel, { resolve, pid: shared.pid }),
+    fs: procFsSync(syncPathOps(kernel, resolve, statOf, open), kernel, {
+      resolve,
+      pid: shared.pid
+    })
   };
 }
 function syncFile(kernel, fd, path, append, forget) {
@@ -12978,6 +13301,7 @@ var init_js_sync = __esm({
     init_js_dev();
     init_js_io();
     init_js_kernel();
+    init_js_proc();
     encoder3 = new TextEncoder();
     noLane = () => ({ ok: false, errno: "ENOSYS", message: "no sync lane" });
     JsSyncKernel = class {
@@ -13441,7 +13765,7 @@ function createContext(o) {
     handles.set(fd, handle.invalidate);
     return handle.file;
   };
-  const fs = pathOps(kernel, resolve, statOf, open);
+  const fs = procFsAsync(pathOps(kernel, resolve, statOf, open), kernel, { resolve, pid: o.pid });
   const lane = o.lane ?? laneOf(void 0);
   if (o.lane && o.lane !== noLane) kernel.syncLane = o.lane;
   const syncKernel = new JsSyncKernel(lane, kernel, unwind);
@@ -13493,7 +13817,7 @@ function createContext(o) {
       return { type, tty: type === "tty", seekable: type === "file" };
     },
     isatty: async (fd) => typeOf(await info(fd)) === "tty",
-    open,
+    open: procOpenAsync(open, kernel, { resolve, pid: o.pid }),
     resolve,
     fs,
     signals: {
@@ -13700,6 +14024,7 @@ var init_js_context = __esm({
     init_js_io();
     init_js_kernel();
     init_js_net();
+    init_js_proc();
     init_js_run();
     init_js_sync();
     init_js_tty();