@ai-ecoverse/slicc-kernel 1.89.0 → 1.91.0

package/dist/kernel-worker.js

@@ -2052,7 +2052,7 @@ function portCdpHook(ask, gone) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 10];
+var PROTOCOL = [1, 11];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -2083,6 +2083,52 @@ function fresh(bytes, start2 = 0, end = bytes.length) {
   return new Uint8Array(bytes.subarray(start2, end));
 }
 
+// src/facade/port.ts
+var FACADE_GONE = "the facade host is gone";
+function portFacadeHook(ask, gone) {
+  return (stamp, { name: name2 }) => new Promise((resolve2, reject) => {
+    const { port1, port2 } = new MessageChannel();
+    let closed = false;
+    const shut = () => {
+      closed = true;
+      port1.close();
+    };
+    const conn = {
+      send: (bytes) => {
+        if (closed) return;
+        const copy = bytes.slice();
+        port1.postMessage({ b: copy }, [copy.buffer]);
+      },
+      onmessage: null,
+      onclose: null,
+      close: (reason) => {
+        if (closed) return;
+        port1.postMessage({ close: reason ?? true });
+        shut();
+      }
+    };
+    port1.addEventListener("message", ({ data }) => {
+      if ("b" in data) conn.onmessage?.(data.b);
+      else if ("open" in data) resolve2(conn);
+      else if ("error" in data) {
+        shut();
+        reject(new Error(data.error));
+      } else if (!closed) {
+        shut();
+        conn.onclose?.();
+      }
+    });
+    port1.start();
+    void gone?.then(() => {
+      if (closed) return;
+      shut();
+      reject(new Error(FACADE_GONE));
+      conn.onclose?.(FACADE_GONE);
+    });
+    ask({ name: name2, stamp }, port2);
+  });
+}
+
 // src/fs/walk.ts
 var MAX_LINKS3 = 40;
 function parentOf4(path) {
@@ -2253,8 +2299,8 @@ async function access(fs, cred, path, want, options = {}) {
   if (await present(fs, walked.path, false)) return { ...walked, denied: walked.path };
   return { ...walked, missing: true };
 }
-function refused(path, errno = "EACCES") {
-  return fsError(errno, path);
+function refused(path, errno2 = "EACCES") {
+  return fsError(errno2, path);
 }
 
 // src/fs/dac.ts
@@ -2314,9 +2360,9 @@ var Created = class {
 function linked(g, options) {
   return g.links === void 0 ? options : { ...options, links: g.links };
 }
-function deny(g, op, path, errno = "EACCES") {
+function deny(g, op, path, errno2 = "EACCES") {
   const tag = g.tag === void 0 ? {} : { tag: g.tag };
-  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno, ...tag });
+  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno: errno2, ...tag });
 }
 var TTY_MODE = 400;
 function ttyOpenable(g, tty) {
@@ -2983,7 +3029,7 @@ var WASI_SIGNAL_TO_POSIX = Object.fromEntries(
 
 // src/process/wasi-errno.ts
 var WASI_ERRNO = {
-  ...Object.fromEntries(Object.entries(E).map(([name2, errno]) => [`E${name2}`, errno])),
+  ...Object.fromEntries(Object.entries(E).map(([name2, errno2]) => [`E${name2}`, errno2])),
   EWOULDBLOCK: E.AGAIN,
   ENOTSUP: 138,
   EOPNOTSUPP: 138,
@@ -3080,7 +3126,7 @@ function dialError(e, timedOut, closed) {
   if (timedOut) return new KernelError("ETIMEDOUT");
   if (closed) return new KernelError("ECONNABORTED");
   const code = e?.code;
-  const known = DIAL_ERRORS.find((errno) => errno === code);
+  const known = DIAL_ERRORS.find((errno2) => errno2 === code);
   return new KernelError(known ?? "EHOSTUNREACH");
 }
 function isLoopback(host) {
@@ -3137,6 +3183,7 @@ var KernelSocket = class _KernelSocket {
   local;
   peer;
   peerCred;
+  peerStamp;
   listenerCred;
   link;
   readShut = false;
@@ -3207,10 +3254,10 @@ var KernelSocket = class _KernelSocket {
     for (const wait2 of waits) wait2.catch(() => void 0);
     return pipeCall(() => Promise.race(waits));
   }
-  bind(addr) {
+  bind(addr, kernel = false) {
     if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    this.local = this.net.bind(this, addr);
+    this.local = this.net.bind(this, addr, kernel);
     this.boundAt = this.local;
   }
   listen(backlog, cred) {
@@ -3239,7 +3286,7 @@ var KernelSocket = class _KernelSocket {
     this.changes.wake();
     return true;
   }
-  connect(addr, viaUplink = true, cred) {
+  connect(addr, viaUplink = true, cred, stamp) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
@@ -3258,6 +3305,7 @@ var KernelSocket = class _KernelSocket {
     server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
     server.peer = this.local;
     server.peerCred = cred;
+    server.peerStamp = stamp;
     this.peer = server.local;
     this.peerCred = target.listenerCred;
     link(this, server);
@@ -3398,6 +3446,8 @@ var LoopbackNet = class {
   bound = /* @__PURE__ */ new Map();
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
+  reserved = /* @__PURE__ */ new Set();
+  facades = /* @__PURE__ */ new Map();
   nextEphemeral = EPHEMERAL_FIRST;
   route;
   useUplink(route) {
@@ -3412,6 +3462,18 @@ var LoopbackNet = class {
     if (reserve) this.internal.add(port);
     return this.internal.has(port);
   }
+  reserve(port) {
+    this.reserved.add(port);
+  }
+  facade(port, name2) {
+    this.reserve(port);
+    this.kernelOnly(port, true);
+    this.facades.set(port, name2);
+  }
+  facadeAt(addr) {
+    if (addr.family !== "inet" || !isLoopback(canonicalHost(addr.host))) return void 0;
+    return this.facades.get(addr.port);
+  }
   activate(addr, start2) {
     this.activators.set(keyOf(addr), start2);
   }
@@ -3420,7 +3482,7 @@ var LoopbackNet = class {
   }
   listen(addr, backlog = 128) {
     const socket = this.socket(addr.family);
-    socket.bind(addr);
+    socket.bind(addr, true);
     socket.listen(backlog);
     return socket;
   }
@@ -3429,11 +3491,13 @@ var LoopbackNet = class {
     void socket.connect(addr, false);
     return socket;
   }
-  bind(socket, addr) {
+  bind(socket, addr, kernel = false) {
     if (addr.family === "unix") {
       if (addr.path === "") throw new KernelError("EINVAL");
     } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
       throw new KernelError("EADDRNOTAVAIL");
+    } else if (!kernel && this.reserved.has(addr.port)) {
+      throw new KernelError("EADDRINUSE");
     }
     const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
     const key = keyOf(named);
@@ -3460,7 +3524,7 @@ var LoopbackNet = class {
     for (let i = 0; i < span; i++) {
       const port = this.nextEphemeral;
       this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
-      if (!this.bound.has(`inet:${port}`)) return port;
+      if (!this.bound.has(`inet:${port}`) && !this.reserved.has(port)) return port;
     }
     throw new KernelError("EADDRINUSE");
   }
@@ -3729,11 +3793,11 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   };
   const sockets = /* @__PURE__ */ new Map();
   const credit = /* @__PURE__ */ new Map();
-  const refill = (nid, n, closing = false) => {
+  const refill = (nid, n, closing2 = false) => {
     const flow = credit.get(nid);
     if (!flow) return;
     flow.inflight -= n;
-    if (closing && !flow.closing) {
+    if (closing2 && !flow.closing) {
       flow.closing = true;
       flow.deadline();
     }
@@ -3756,12 +3820,12 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
       }
       sockets.set(call.nid, socket);
       peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
-      void relay(call.nid, socket);
+      void relay2(call.nid, socket);
     } catch (e) {
       fail2(call.nid, e);
     }
   };
-  const relay = async (nid, socket) => {
+  const relay2 = async (nid, socket) => {
     let ending;
     let late;
     const unanswered = new Promise((resolve2) => {
@@ -4395,6 +4459,45 @@ function cdpRegistry(send, gone) {
     }
   };
 }
+function facadeRegistry(send, gone) {
+  const registered = /* @__PURE__ */ new Map();
+  const drop = (id2) => {
+    registered.get(id2)?.();
+    return registered.delete(id2);
+  };
+  return {
+    serve(l, req) {
+      const hook = portFacadeHook(
+        (request2, facade) => send({ facadeOpen: { ...request2, registration: req.id }, port: facade }, [
+          facade
+        ]),
+        gone
+      );
+      registered.set(req.id, l.facades.register(req.name, hook));
+      return req.id;
+    },
+    drop,
+    close: () => {
+      for (const id2 of [...registered.keys()]) drop(id2);
+    }
+  };
+}
+function hostRegistries(send, gone) {
+  const cdps = cdpRegistry(send, gone);
+  const facades = facadeRegistry(send, gone);
+  return {
+    answer(l, req) {
+      if (req.op === "serve-cdp") return cdps.serve(l, req);
+      if (req.op === "unserve-cdp") return cdps.drop(req.registration);
+      if (req.op === "serve-facade") return facades.serve(l, req);
+      return facades.drop(req.registration);
+    },
+    close() {
+      cdps.close();
+      facades.close();
+    }
+  };
+}
 function visibleTo(g, notify) {
   if (!g?.dac.enforcing) return notify;
   let queue = Promise.resolve();
@@ -4438,7 +4541,7 @@ function serveClient(port, host) {
     if (state !== "closed") port.postMessage(message3, transfer);
   };
   const reply = (id2, body, transfer) => send({ id: id2, ...body }, transfer);
-  const cdps = cdpRegistry(send, ended.promise);
+  const hosts = hostRegistries(send, ended.promise);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
     send({ bye });
@@ -4446,7 +4549,7 @@ function serveClient(port, host) {
     net?.close();
     for (const unwatch of watches.values()) unwatch();
     watches.clear();
-    cdps.close();
+    hosts.close();
     for (const session of terminals.values()) session.close();
     terminals.clear();
     if (kill) killGroups(host, [...groups]);
@@ -4543,16 +4646,16 @@ function serveClient(port, host) {
       case "mount":
         return { result: await l.mountAs(clientCred(self), req.spec) };
       case "umount":
-        await l.umountAs(clientCred(self), req.target);
-        return { result: true };
+        return { result: await l.umountAs(clientCred(self), req.target).then(() => true) };
       case "mounts":
         return { result: l.mounts.list() };
       case "dial":
         return dialFor(l, req, watches);
       case "serve-cdp":
-        return { result: cdps.serve(l, req) };
       case "unserve-cdp":
-        return { result: cdps.drop(req.registration) };
+      case "serve-facade":
+      case "unserve-facade":
+        return { result: hosts.answer(l, req) };
       case "detach":
         return { result: true };
       default:
@@ -4825,6 +4928,33 @@ function toHostLoopback(href) {
   url.hostname = "127.0.0.1";
   return url.href;
 }
+var LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+var LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
+var MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
+var KERNEL_PORT = /^(\d{1,5})\.kernel\.localhost$/;
+var SCHEMES = {
+  "http:": 80,
+  "ws:": 80,
+  "https:": 443,
+  "wss:": 443
+};
+function isKernelLoopbackHost(hostname) {
+  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
+}
+function kernelLoopbackPort(href) {
+  let url;
+  try {
+    url = new URL(href);
+  } catch {
+    return void 0;
+  }
+  const fallback = SCHEMES[url.protocol];
+  if (fallback === void 0 || !isKernelLoopbackHost(url.hostname)) return void 0;
+  const named = KERNEL_PORT.exec(url.hostname.replace(/\.$/, "").toLowerCase())?.[1];
+  const port = Number(named ?? (url.port || fallback));
+  return port >= 1 && port <= 65535 ? port : void 0;
+}
 var DEFAULT_HOSTNAME = "slicc";
 var HOSTNAME_ADDRESS = "127.0.1.1";
 var LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
@@ -5130,6 +5260,9 @@ async function acceptKey(headers) {
   }
   const key = field(headers, "sec-websocket-key") ?? "";
   if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
+  return acceptFor(key);
+}
+async function acceptFor(key) {
   const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
   return btoa(String.fromCharCode(...new Uint8Array(digest)));
 }
@@ -5153,6 +5286,19 @@ function frame(opcode, payload) {
   out.set(payload, size);
   return out;
 }
+function clientFrame(opcode, payload) {
+  const plain = frame(opcode, payload);
+  const head = plain.length - payload.length;
+  const mask = crypto.getRandomValues(new Uint8Array(4));
+  const out = new Uint8Array(plain.length + 4);
+  out.set(plain.subarray(0, head));
+  out[1] = out[1] | 128;
+  out.set(mask, head);
+  for (let i = 0; i < payload.length; i++) {
+    out[head + 4 + i] = payload[i] ^ mask[i & 3];
+  }
+  return out;
+}
 function closeFrame(code, reason = "") {
   let bytes = new TextEncoder().encode(reason);
   if (bytes.length > 123) {
@@ -5192,10 +5338,12 @@ var WsReader = class {
   continuing = false;
   binaryMessage = false;
   binary;
-  constructor(incoming, max = MAX_MESSAGE, binary) {
+  fromServer;
+  constructor(incoming, max = MAX_MESSAGE, binary, fromServer = false) {
     this.incoming = incoming;
     this.max = max;
     this.binary = binary;
+    this.fromServer = fromServer;
   }
   async next(signal) {
     for (; ; ) {
@@ -5207,7 +5355,7 @@ var WsReader = class {
       const fin = (head[0] & 128) !== 0;
       const opcode = head[0] & 15;
       if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
-      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
+      const masked = this.masking(head[1]);
       const length2 = await this.length(head[1] & 127, signal);
       const control = opcode >= 8;
       if (control && (length2 > 125 || !fin)) {
@@ -5216,15 +5364,19 @@ var WsReader = class {
       if (!control && this.size + length2 > this.max) {
         throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
       }
-      const mask = new Uint8Array(4);
-      await fill(this.incoming, mask, signal);
-      const payload = new Uint8Array(length2);
-      await fill(this.incoming, payload, signal);
-      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+      const payload = await this.payload(length2, masked, signal);
       const event = this.take(opcode, fin, payload);
       if (event) return event;
     }
   }
+  masking(second) {
+    const masked = (second & 128) !== 0;
+    if (masked !== this.fromServer) return masked;
+    throw new WsError(
+      CLOSE.protocol,
+      this.fromServer ? "server frames must not be masked" : "client frames must be masked"
+    );
+  }
   data(opcode, fin, payload) {
     if (opcode === OP.continuation !== this.continuing) {
       throw new WsError(CLOSE.protocol, "unexpected continuation frame");
@@ -5239,6 +5391,14 @@ var WsReader = class {
     this.size = 0;
     return this.binaryMessage ? { kind: "binary", bytes: whole } : { kind: "text", text: decode(whole) };
   }
+  async payload(length2, masked, signal) {
+    const mask = new Uint8Array(4);
+    if (masked) await fill(this.incoming, mask, signal);
+    const payload = new Uint8Array(length2);
+    await fill(this.incoming, payload, signal);
+    if (masked) for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+    return payload;
+  }
   async length(short, signal) {
     if (short < 126) return short;
     const ext = new Uint8Array(short === 126 ? 2 : 8);
@@ -5674,10 +5834,10 @@ var RealmProxy = class {
       encodedBodies: this.options.transport.traits.encodedBodies,
       bodiless: bodiless2
     });
-    const chunked = !bodiless2 && minor >= 1;
-    const keep2 = keepAlive && (bodiless2 || chunked);
+    const chunked2 = !bodiless2 && minor >= 1;
+    const keep2 = keepAlive && (bodiless2 || chunked2);
     headers.push(["Connection", keep2 ? "keep-alive" : "close"]);
-    if (chunked) headers.push(["Transfer-Encoding", "chunked"]);
+    if (chunked2) headers.push(["Transfer-Encoding", "chunked"]);
     const signal = this.stop.signal;
     await conn.write(
       responseHead(status, response.statusText || REASON[status] || "", headers),
@@ -5689,13 +5849,13 @@ var RealmProxy = class {
     }
     try {
       for await (const piece of response.body) {
-        if (piece.length > 0) await conn.write(chunked ? chunk(piece) : piece, signal);
+        if (piece.length > 0) await conn.write(chunked2 ? chunk(piece) : piece, signal);
       }
     } catch {
       await response.cancel().catch(() => void 0);
       return false;
     }
-    if (chunked) await conn.write(LAST_CHUNK, signal);
+    if (chunked2) await conn.write(LAST_CHUNK, signal);
     return keep2;
   }
   async connect(conn, incoming, req, idle) {
@@ -7127,6 +7287,7 @@ var Relay = class {
 function enableCdp(net, hosts) {
   let facade;
   net.kernelOnly(CDP_PORT, true);
+  net.reserve(CDP_PORT);
   net.activate({ family: "inet", host: "127.0.0.1", port: CDP_PORT }, () => {
     const started = new CdpFacade({ net, hosts });
     facade = started;
@@ -7441,9 +7602,9 @@ async function scanFilesystems(fs, modules) {
     } catch {
       continue;
     }
-    const declared = manifest.slicc?.filesystems;
-    if (!declared || typeof declared !== "object") continue;
-    for (const [type, entry] of Object.entries(declared)) {
+    const declared2 = manifest.slicc?.filesystems;
+    if (!declared2 || typeof declared2 !== "object") continue;
+    for (const [type, entry] of Object.entries(declared2)) {
       const module = inside(pkg, entry?.module);
       if (NAME2.test(type) && module && !found.has(type)) found.set(type, module);
     }
@@ -7461,9 +7622,9 @@ async function scanBinfmts(fs, modules, warn = () => {
     } catch {
       continue;
     }
-    const declared = manifest.slicc?.binfmt;
-    if (!declared || typeof declared !== "object") continue;
-    for (const [suffix, command] of Object.entries(declared)) {
+    const declared2 = manifest.slicc?.binfmt;
+    if (!declared2 || typeof declared2 !== "object") continue;
+    for (const [suffix, command] of Object.entries(declared2)) {
       if (!SUFFIX.test(suffix) || typeof command !== "string" || !NAME2.test(command)) continue;
       const owner = owners.get(suffix);
       if (owner === void 0) {
@@ -7493,6 +7654,132 @@ function binfmtOf(binfmts, path) {
   return best === void 0 ? void 0 : binfmts.get(best);
 }
 
+// src/facade/types.ts
+var FACADE_NAME = /^[a-z][a-z0-9-]*$/;
+function facadeEnvName(name2) {
+  return `SLICC_${name2.toUpperCase().replaceAll("-", "_")}_URL`;
+}
+function facadeUrl(port) {
+  return `tcp://127.0.0.1:${port}`;
+}
+
+// src/facade/hosts.ts
+var TAKEN_PORTS = /* @__PURE__ */ new Set([CDP_PORT, REALM_PROXY_PORT]);
+var READ_CHUNK = 64 * 1024;
+var FACADE_MAX_PENDING = 16 * 1024 * 1024;
+var FACADE_FLOODED = `slicc-kernel: more than ${FACADE_MAX_PENDING} bytes are waiting for the program to read`;
+function declared(specs) {
+  const out = /* @__PURE__ */ new Map();
+  const ports = /* @__PURE__ */ new Set();
+  for (const [name2, spec] of Object.entries(specs ?? {})) {
+    if (!FACADE_NAME.test(name2)) throw new TypeError(`facades: not a facade name: ${name2}`);
+    const port = spec?.port;
+    if (!Number.isInteger(port) || port < 1 || port > 65535 || TAKEN_PORTS.has(port)) {
+      throw new TypeError(`facades.${name2}: not a free port: ${String(port)}`);
+    }
+    if (ports.has(port)) throw new TypeError(`facades.${name2}: port ${port} is taken twice`);
+    if (spec.hook !== void 0 && typeof spec.hook !== "function") {
+      throw new TypeError(`facades.${name2}: hook must be a function`);
+    }
+    ports.add(port);
+    out.set(name2, { port, embedder: spec.hook, clients: [] });
+  }
+  return out;
+}
+var FacadeHosts = class {
+  facades;
+  constructor(specs) {
+    this.facades = declared(specs);
+  }
+  env() {
+    const env = {};
+    for (const [name2, { port }] of this.facades) env[facadeEnvName(name2)] = facadeUrl(port);
+    return env;
+  }
+  enable(net) {
+    for (const [name2, { port }] of this.facades) {
+      net.facade(port, name2);
+      net.activate({ family: "inet", host: "127.0.0.1", port }, () => {
+        const listener = net.listen({ family: "inet", host: "127.0.0.1", port });
+        void acceptAll(listener, (socket) => this.serve(name2, socket));
+      });
+    }
+  }
+  register(name2, hook) {
+    const entry = this.facades.get(name2);
+    if (!entry || typeof hook !== "function") throw new KernelError("EINVAL");
+    entry.clients.push(hook);
+    return () => {
+      const at = entry.clients.indexOf(hook);
+      if (at >= 0) entry.clients.splice(at, 1);
+    };
+  }
+  async serve(name2, socket) {
+    const entry = this.facades.get(name2);
+    const hook = entry.clients.at(-1) ?? entry.embedder;
+    const stamp = socket.peerStamp;
+    if (!hook || !stamp) return socket.close();
+    let conn;
+    try {
+      conn = await hook(structuredClone(stamp), { name: name2 });
+    } catch {
+      return socket.close();
+    }
+    await relay(socket, conn);
+  }
+};
+async function acceptAll(listener, serve) {
+  for (; ; ) {
+    const socket = await listener.accept();
+    void serve(socket);
+  }
+}
+async function relay(socket, conn) {
+  let ended = false;
+  let pending = 0;
+  let writes = Promise.resolve();
+  const end = () => {
+    if (ended) return;
+    ended = true;
+    socket.close();
+  };
+  conn.onmessage = (bytes) => {
+    if (ended) return;
+    const chunk2 = bytes.slice();
+    pending += chunk2.length;
+    if (pending > FACADE_MAX_PENDING) {
+      end();
+      conn.close(FACADE_FLOODED);
+      return;
+    }
+    writes = writes.then(async () => {
+      if (ended) return;
+      let at = 0;
+      while (at < chunk2.length) at += await socket.write(chunk2.subarray(at));
+      pending -= chunk2.length;
+    });
+    writes.catch(() => {
+      end();
+      conn.close();
+    });
+  };
+  conn.onclose = () => {
+    writes.then(end, end);
+  };
+  try {
+    for (; ; ) {
+      const bytes = await socket.read(READ_CHUNK);
+      if (bytes.length === 0 || ended) break;
+      conn.send(bytes);
+    }
+  } catch {
+  }
+  if (!ended) {
+    end();
+    conn.close();
+  }
+}
+
 // src/fs/attest.ts
 var ATTEST_MAX = 1024 * 1024;
 var UNOWNED = 1e3;
@@ -7995,15 +8282,15 @@ var UnlinkedKeeper = class {
   wrap(fs = this.fs) {
     const keeper = this;
     const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
-    const counted = (st) => {
+    const counted2 = (st) => {
       const hidden = keeper.links.get(`${st.dev ?? 0}:${st.ino}`) ?? 0;
       return hidden === 0 || st.nlink === void 0 ? st : { ...st, nlink: Math.max(0, st.nlink - hidden) };
     };
     return {
       ...fs,
       links: (path) => mayLink(fs, path),
-      stat: async (path) => counted(await fs.stat(path)),
-      lstat: async (path) => counted(await fs.lstat(path)),
+      stat: async (path) => counted2(await fs.stat(path)),
+      lstat: async (path) => counted2(await fs.lstat(path)),
       async rm(path, options) {
         const target = fs.resolvePath("/", path);
         const pinned = await keeper.pin(target);
@@ -8017,7 +8304,7 @@ var UnlinkedKeeper = class {
         await keeper.settle(pinned, () => fs.rename(from, to));
       },
       readdir: async (path) => visible(await fs.readdir(path)),
-      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR).map(([name2, st]) => [name2, st && counted(st)])
+      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR).map(([name2, st]) => [name2, st && counted2(st)])
     };
   }
   async settle(pinned, op) {
@@ -10849,7 +11136,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.89.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.91.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -11437,6 +11724,339 @@ async function hostSyscall(req, ctx) {
   }
 }
 
+// src/kernel/net/loopback-transport.ts
+var LOOPBACK_TRAITS = {
+  manualRedirects: true,
+  encodedBodies: true,
+  maxRequestBody: 64 * 1024 * 1024,
+  crossOrigin: "any",
+  websocket: true
+};
+var MAX_HEAD2 = 64 * 1024;
+var OWN_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "upgrade",
+  "sec-websocket-key",
+  "sec-websocket-version",
+  "sec-websocket-protocol",
+  "sec-websocket-extensions"
+]);
+var OP_CLOSE = 8;
+var OP_PONG = 10;
+var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var SAFE_VALUE = /^[^\r\n\0]*$/;
+var CLOSE_WAIT_MS3 = 5e3;
+var MAX_UNREAD = 16 * 1024 * 1024;
+function errno(code, message3) {
+  return Object.assign(new Error(`${code}: ${message3}`), { code });
+}
+function requestHead(method, url, headers, extra) {
+  if (!TOKEN3.test(method)) throw errno("EINVAL", `method ${method}`);
+  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `Host: ${url.host}`];
+  for (const [name2, value] of headers) {
+    if (OWN_HEADERS.has(name2.toLowerCase())) continue;
+    if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value)) throw errno("EINVAL", `header ${name2}`);
+    lines2.push(`${name2}: ${value}`);
+  }
+  for (const [name2, value] of extra) lines2.push(`${name2}: ${value}`);
+  return latin1Bytes(`${lines2.join("\r\n")}\r
+\r
+`);
+}
+function parseHead(bytes) {
+  const [statusLine = "", ...lines2] = latin1(bytes).split(/\r?\n/);
+  const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
+  if (!match) throw errno("EPROTO", `not an HTTP/1.x response: ${statusLine.slice(0, 80)}`);
+  const headers = [];
+  for (const line of lines2) {
+    const colon = line.indexOf(":");
+    if (colon > 0) headers.push([line.slice(0, colon).trim(), line.slice(colon + 1).trim()]);
+  }
+  return { status: Number(match[1]), statusText: match[2] ?? "", headers };
+}
+async function readHead(incoming, signal) {
+  for (; ; ) {
+    let raw;
+    try {
+      raw = await incoming.head(MAX_HEAD2, signal);
+    } catch (err) {
+      if (err instanceof KernelError) throw err;
+      throw errno("EPROTO", "the response head is malformed or too large");
+    }
+    if (!raw) throw errno("ECONNRESET", "the connection closed before a response");
+    const head = parseHead(raw);
+    if (head.status < 100 || head.status >= 200 || head.status === 101) return head;
+  }
+}
+async function* chunked(incoming, signal) {
+  for (; ; ) {
+    const line = await incoming.line(4096, signal);
+    const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(line);
+    if (!size) throw errno("EPROTO", "a malformed chunk size");
+    const n = Number.parseInt(size[1], 16);
+    if (n === 0) {
+      while (await incoming.line(MAX_HEAD2, signal) !== "") ;
+      return;
+    }
+    yield await incoming.exactly(n, signal);
+    if (await incoming.line(2, signal) !== "") throw errno("EPROTO", "a malformed chunk");
+  }
+}
+async function* counted(incoming, length2, signal) {
+  for (let left = length2; left > 0; ) {
+    const data = await incoming.some(Math.min(left, 64 * 1024), signal);
+    if (data.length === 0) throw errno("EPROTO", "the body ended early");
+    left -= data.length;
+    yield data;
+  }
+}
+async function* untilClose(incoming, signal) {
+  for (; ; ) {
+    const data = await incoming.some(64 * 1024, signal);
+    if (data.length === 0) return;
+    yield data;
+  }
+}
+function bodyOf(incoming, head, method, signal) {
+  if (method === "HEAD" || head.status === 204 || head.status === 304) return [];
+  if (fieldTokens(head.headers, "transfer-encoding").includes("chunked")) {
+    return chunked(incoming, signal);
+  }
+  const lengths = fieldValues(head.headers, "content-length");
+  if (lengths.length === 0) return untilClose(incoming, signal);
+  const length2 = lengths[0]?.trim() ?? "";
+  if (!/^\d{1,15}$/.test(length2) || lengths.some((l) => l.trim() !== length2)) {
+    throw errno("EPROTO", `a malformed Content-Length: ${lengths.join(", ")}`);
+  }
+  return counted(incoming, Number(length2), signal);
+}
+var KernelLoopback = class {
+  net;
+  cred;
+  constructor(net, cred) {
+    this.net = net;
+    this.cred = cred;
+  }
+  port(url) {
+    return kernelLoopbackPort(url);
+  }
+  connect(url, port, signal) {
+    if (url.protocol === "https:" || url.protocol === "wss:") {
+      throw errno("ENOTSUP", `TLS to the kernel's loopback is not supported: ${url.origin}`);
+    }
+    signal.throwIfAborted();
+    const socket = this.net.socket("inet");
+    try {
+      void socket.connect({ family: "inet", host: "127.0.0.1", port }, false, this.cred());
+    } catch (err) {
+      socket.close();
+      const refused2 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused2 ? errno("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+    }
+    signal.addEventListener("abort", () => socket.close(), { once: true });
+    return socket;
+  }
+  async fetch(req, port) {
+    const url = new URL(req.url);
+    const body = req.body ?? (/^(POST|PUT|PATCH)$/i.test(req.method) ? new Uint8Array(0) : void 0);
+    const length2 = body ? [["Content-Length", String(body.length)]] : [];
+    const head = requestHead(req.method, url, req.headers, [...length2, ["Connection", "close"]]);
+    const socket = this.connect(url, port, req.signal);
+    try {
+      await writeAll2(socket, body ? concat([head, body]) : head, req.signal);
+      const incoming = new Incoming(socket);
+      const response = await readHead(incoming, req.signal);
+      const chunks = bodyOf(incoming, response, req.method, req.signal);
+      return {
+        url: req.url,
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+        body: closing(chunks, socket),
+        cancel: async () => socket.close()
+      };
+    } catch (err) {
+      socket.close();
+      throw err;
+    }
+  }
+  async websocket(req, port) {
+    const url = new URL(req.url);
+    const socket = this.connect(url, port, req.signal);
+    try {
+      const key = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))));
+      const extra = [
+        ["Upgrade", "websocket"],
+        ["Connection", "Upgrade"],
+        ["Sec-WebSocket-Key", key],
+        ["Sec-WebSocket-Version", "13"]
+      ];
+      if (req.protocols.length > 0)
+        extra.push(["Sec-WebSocket-Protocol", req.protocols.join(", ")]);
+      await writeAll2(socket, requestHead("GET", url, req.headers, extra), req.signal);
+      const incoming = new Incoming(socket);
+      const head = await readHead(incoming, req.signal);
+      if (head.status !== 101) {
+        throw errno(
+          "EPROTO",
+          `the server answered ${head.status} ${head.statusText}, not an upgrade`
+        );
+      }
+      const upgraded = fieldTokens(head.headers, "upgrade").includes("websocket") && fieldTokens(head.headers, "connection").includes("upgrade");
+      const accept2 = fieldValues(head.headers, "sec-websocket-accept")[0];
+      if (!upgraded || accept2 !== await acceptFor(key)) {
+        throw errno("EPROTO", "the server did not accept the WebSocket key");
+      }
+      const protocol = fieldValues(head.headers, "sec-websocket-protocol")[0] ?? "";
+      return new LoopbackWebSocket(socket, incoming, protocol);
+    } catch (err) {
+      socket.close();
+      throw err;
+    }
+  }
+};
+async function writeAll2(socket, bytes, signal) {
+  for (let at = 0; at < bytes.length; ) at += await socket.write(bytes.subarray(at), signal);
+}
+async function* closing(chunks, socket) {
+  try {
+    yield* chunks;
+  } catch (err) {
+    if (typeof err?.code === "string") throw err;
+    throw errno("EPROTO", err instanceof Error ? err.message : String(err));
+  } finally {
+    socket.close();
+  }
+}
+var LoopbackWebSocket = class {
+  protocol;
+  messages;
+  closed;
+  pending = 0;
+  writes = Promise.resolve();
+  sentClose = false;
+  stop = new AbortController();
+  socket;
+  settle;
+  unread = 0;
+  room;
+  constructor(socket, incoming, protocol) {
+    this.socket = socket;
+    this.protocol = protocol;
+    this.closed = new Promise((resolve2) => {
+      this.settle = resolve2;
+    });
+    this.stop.signal.addEventListener("abort", () => this.room?.(), { once: true });
+    const queue = [];
+    let wake;
+    let ended = false;
+    void this.pump(new WsReader(incoming, void 0, true, true), (message3) => {
+      queue.push(message3);
+      this.unread += message3.length;
+      wake?.();
+    }).finally(() => {
+      ended = true;
+      wake?.();
+    });
+    const taken = (message3) => {
+      this.unread -= message3.length;
+      const room = this.room;
+      this.room = void 0;
+      room?.();
+    };
+    this.messages = {
+      [Symbol.asyncIterator]: async function* () {
+        for (; ; ) {
+          const next2 = queue.shift();
+          if (next2 !== void 0) {
+            taken(next2);
+            yield next2;
+            continue;
+          }
+          if (ended) return;
+          await new Promise((resolve2) => {
+            wake = resolve2;
+          });
+          wake = void 0;
+        }
+      }
+    };
+  }
+  async space() {
+    while (this.unread > MAX_UNREAD && !this.stop.signal.aborted) {
+      await new Promise((resolve2) => {
+        this.room = resolve2;
+      });
+    }
+  }
+  get buffered() {
+    return this.pending;
+  }
+  write(bytes) {
+    this.pending += bytes.length;
+    const previous = this.writes;
+    this.writes = (async () => {
+      await previous;
+      try {
+        await writeAll2(this.socket, bytes, this.stop.signal);
+      } catch {
+        this.stop.abort();
+      }
+      this.pending -= bytes.length;
+    })();
+  }
+  async pump(reader, deliver) {
+    let close = { code: 1006, reason: "" };
+    try {
+      for (; ; ) {
+        await this.space();
+        const event = await reader.next(this.stop.signal);
+        if (!event) break;
+        if (event.kind === "text") deliver(event.text);
+        else if (event.kind === "binary") deliver(event.bytes);
+        else if (event.kind === "ping") this.write(clientFrame(OP_PONG, event.payload));
+        else {
+          close = { code: event.code, reason: event.reason };
+          if (!this.sentClose) this.sendClose(event.code === 1005 ? 1e3 : event.code, "");
+          break;
+        }
+      }
+    } catch (err) {
+      if (err instanceof WsError) this.sendClose(err.code, err.message);
+      close = { code: err instanceof WsError ? err.code : 1006, reason: "" };
+    } finally {
+      const late = setTimeout(() => this.stop.abort(), CLOSE_WAIT_MS3);
+      await this.writes;
+      clearTimeout(late);
+      this.socket.close();
+      this.settle(close);
+    }
+  }
+  sendClose(code, reason) {
+    if (this.sentClose) return;
+    this.sentClose = true;
+    const late = setTimeout(() => this.stop.abort(), CLOSE_WAIT_MS3);
+    void this.closed.then(() => clearTimeout(late));
+    const bytes = new TextEncoder().encode(reason).subarray(0, 123);
+    const payload = new Uint8Array(2 + bytes.length);
+    new DataView(payload.buffer).setUint16(0, sendableCode(code) ? code : CLOSE.error);
+    payload.set(bytes, 2);
+    this.write(clientFrame(OP_CLOSE, payload));
+  }
+  send(data) {
+    if (this.sentClose) throw errno("EPIPE", "the websocket is closing");
+    const text = typeof data === "string";
+    const payload = text ? new TextEncoder().encode(data) : data;
+    this.write(clientFrame(text ? OP_TEXT : OP_BINARY, payload));
+  }
+  close(code = 1e3, reason = "") {
+    this.sendClose(code, reason);
+  }
+};
+
 // src/kernel/net/ws-syscalls.ts
 var WS_OPS = [
   "net-ws-open",
@@ -11446,7 +12066,7 @@ var WS_OPS = [
   "net-ws-send",
   "net-ws-close"
 ];
-var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var TOKEN4 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 function message(e) {
   return e instanceof Error ? e.message : String(e);
 }
@@ -11455,16 +12075,18 @@ function errnoOf(e) {
   const code = e?.code;
   return typeof code === "string" && ERRNO.test(code) ? code : "ECONNREFUSED";
 }
-function fail(errno, text) {
-  return { ok: false, errno, message: text };
+function fail(errno2, text) {
+  return { ok: false, errno: errno2, message: text };
 }
 var WsHandles = class {
   transport;
   open = /* @__PURE__ */ new Map();
   next;
-  constructor(transport, next2) {
+  local;
+  constructor(transport, next2, local) {
     this.transport = transport;
     this.next = next2;
+    this.local = local;
   }
   owns(handle) {
     return this.open.has(handle);
@@ -11493,16 +12115,18 @@ var WsHandles = class {
     return { ok: true, kind: "json", json: handle };
   }
   async connect(handle, req, entry) {
-    const { transport } = this;
-    if (!transport.traits.websocket || !transport.websocket) return fail("ENOTSUP", NO_WEBSOCKET2);
+    const { transport, local } = this;
+    const port = local?.port(req.url);
+    const open = { protocols: req.protocols, headers: req.headers, signal: entry.abort.signal };
+    if (port === void 0 && (!transport.traits.websocket || !transport.websocket)) {
+      return fail("ENOTSUP", NO_WEBSOCKET2);
+    }
     let socket;
     try {
-      socket = await transport.websocket({
+      socket = port === void 0 ? await transport.websocket({
         url: toHostLoopback(req.url),
-        protocols: req.protocols,
-        headers: req.headers,
-        signal: entry.abort.signal
-      });
+        ...open
+      }) : await local.websocket({ url: req.url, ...open }, port);
     } catch (e) {
       return fail(errnoOf(e), message(e));
     }
@@ -11510,7 +12134,7 @@ var WsHandles = class {
       socket.close(1001, "the program went away");
       return fail("EBADF", `no websocket ${handle}`);
     }
-    if (socket.protocol && !(req.protocols.includes(socket.protocol) && TOKEN3.test(socket.protocol))) {
+    if (socket.protocol && !(req.protocols.includes(socket.protocol) && TOKEN4.test(socket.protocol))) {
       socket.close(1002, "subprotocol not offered");
       return fail("EPROTO", "the far end chose a subprotocol the program did not offer");
     }
@@ -11573,6 +12197,10 @@ var EMPTY = new Uint8Array(0);
 function message2(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function codeOf2(e) {
+  const code = e?.code;
+  return typeof code === "string" && /^E[A-Z]+$/.test(code) ? code : "EIO";
+}
 async function* once(bytes) {
   yield bytes;
 }
@@ -11582,10 +12210,12 @@ var HttpHandles = class {
   nextHandle = 0;
   ws;
   owner;
-  constructor(transport, owner) {
+  local;
+  constructor(transport, owner, local) {
     this.transport = transport;
     this.owner = owner;
-    this.ws = new WsHandles(transport, () => ++this.nextHandle);
+    this.local = local;
+    this.ws = new WsHandles(transport, () => ++this.nextHandle, local);
   }
   syscall(req) {
     if (req.op.startsWith("net-ws-")) return this.ws.syscall(req);
@@ -11593,10 +12223,13 @@ var HttpHandles = class {
     if (req.op === "net-open") return Promise.resolve(this.opened(req));
     if (req.op === "net-head") return this.head(req.handle);
     if (req.op === "net-read") return this.read(req.handle, req.max);
-    if (req.op === "net-traits") return Promise.resolve(this.traits());
+    if (req.op === "net-traits") return Promise.resolve(this.traits(req.url));
     return this.close(req.handle);
   }
-  traits() {
+  traits(url) {
+    if (url !== void 0 && this.local?.port(url) !== void 0) {
+      return { ok: true, kind: "json", json: LOOPBACK_TRAITS };
+    }
     const { unavailable, crossOrigin = "any", ...rest2 } = this.transport.traits;
     if (unavailable) return { ok: false, errno: "ENETUNREACH", message: NO_TRANSPORT };
     return { ok: true, kind: "json", json: { ...rest2, crossOrigin } };
@@ -11627,28 +12260,30 @@ var HttpHandles = class {
     return { handle, head: entry.head };
   }
   async respond(handle, req, entry) {
+    const port = this.local?.port(req.url);
     try {
-      const response = await this.transport.fetch(
-        {
-          url: req.url,
-          method: req.method,
-          headers: req.headers,
-          ...req.body ? { body: req.body } : {},
-          signal: entry.abort.signal
-        },
-        this.owner
-      );
+      const target = port === void 0 ? toHostLoopback(req.url) : req.url;
+      const request2 = {
+        url: target,
+        method: req.method,
+        headers: req.headers,
+        ...req.body ? { body: req.body } : {},
+        signal: entry.abort.signal
+      };
+      const response = port === void 0 ? await this.transport.fetch(request2, this.owner) : await this.local.fetch(request2, port);
       entry.body = response.body[Symbol.asyncIterator]();
       entry.cancel = () => response.cancel();
       if (!this.open.has(handle)) await entry.cancel().catch(() => void 0);
-      const head = this.headOf(handle, response.url ?? req.url, response);
+      const shown = response.url && response.url !== target ? response.url : req.url;
+      const head = this.headOf(handle, shown, response);
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
       const text = message2(e);
+      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
       const status = e.status;
       if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
-        const errno = text === NO_TRANSPORT ? "ENETUNREACH" : "ECONNREFUSED";
-        return { ok: false, errno, message: text };
+        const errno2 = text === NO_TRANSPORT ? "ENETUNREACH" : "ECONNREFUSED";
+        return { ok: false, errno: errno2, message: text };
       }
       entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
       return this.headOf(handle, req.url, {
@@ -12489,7 +13124,9 @@ async function socketSyscall(req, proc) {
     case "sock-accept":
       return ok(await accept(proc, req.fd, req.nonblock));
     case "sock-connect": {
-      const dialing = socketAt(fds, req.fd).connect(req.addr, true, proc.cred?.());
+      const socket = socketAt(fds, req.fd);
+      const stamp = net.facadeAt(req.addr) && await proc.stamp?.();
+      const dialing = socket.connect(req.addr, true, proc.cred?.(), stamp || void 0);
       if (req.nonblock) {
         dialing?.catch(() => void 0);
         throw new KernelError("EINPROGRESS");
@@ -13668,6 +14305,9 @@ var WasmProcess = class {
       if (channel) channel.stamp = stamp;
     }
   }
+  connectorStamp() {
+    return this.sealedCaller();
+  }
   async sealedCaller() {
     const shown = await this.options.identity?.();
     const broker = this.options.sealed;
@@ -14006,7 +14646,8 @@ var WasmProcess = class {
       net: this.net,
       blocking: () => this.blockingSignal(cancelled),
       resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
-      cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid })
+      cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid }),
+      stamp: () => this.connectorStamp()
     });
   }
   tty(fd) {
@@ -15378,7 +16019,7 @@ function scrubberOf(secrets) {
   const usable = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
   return usable.length > 0 ? compile(usable, { idleMs: SCRUB_IDLE_MS }) : void 0;
 }
-async function writeAll2(file, bytes) {
+async function writeAll3(file, bytes) {
   const write = file.write;
   for (let at = 0; at < bytes.length; ) at += await write.call(file, bytes.subarray(at));
 }
@@ -15412,7 +16053,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   const later = (bytes) => {
     if (bytes.length === 0) return;
     pending += 1;
-    tail = tail.then(() => writeAll2(file, bytes)).catch((err) => {
+    tail = tail.then(() => writeAll3(file, bytes)).catch((err) => {
       if (failed3 === void 0) failed3 = err;
     }).finally(() => {
       pending -= 1;
@@ -16043,8 +16684,8 @@ var FSA_CAPABILITIES = {
   ranges: true,
   sessions: true
 };
-var codeOf2 = (err) => err?.code;
-var denied = (err) => codeOf2(err) === "EACCES" || err?.name === "NotAllowedError";
+var codeOf3 = (err) => err?.code;
+var denied = (err) => codeOf3(err) === "EACCES" || err?.name === "NotAllowedError";
 function attrOf(st) {
   return {
     kind: st.isDirectory ? "directory" : st.isSymbolicLink ? "symlink" : "file",
@@ -16066,7 +16707,7 @@ function kernelFsHandlers(fs) {
     try {
       return await fs.stat(path);
     } catch (err) {
-      if (codeOf2(err) === "ENOENT") return void 0;
+      if (codeOf3(err) === "ENOENT") return void 0;
       throw err;
     }
   }
@@ -16259,7 +16900,7 @@ function parseFstab(text) {
   });
   return lines2;
 }
-function codeOf3(err) {
+function codeOf4(err) {
   const code = err?.code;
   return typeof code === "string" ? code : "EIO";
 }
@@ -16297,18 +16938,18 @@ async function mountLine({ line, spec, invalid }, mount, signal, retries, discar
       break;
     } catch (err) {
       failed3 = err;
-      if (FINAL.has(codeOf3(err)) || attempt === retries.length) break;
+      if (FINAL.has(codeOf4(err)) || attempt === retries.length) break;
       await wait(retries[attempt], signal);
     }
   }
-  const code = codeOf3(failed3);
+  const code = codeOf4(failed3);
   return { line, target: spec.target, code, error: String(failed3?.message ?? code) };
 }
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf4 = (err) => err?.code;
-var unreachable = (err) => codeOf4(err) === "ENOTCONN";
+var codeOf5 = (err) => err?.code;
+var unreachable = (err) => codeOf5(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -16368,9 +17009,9 @@ var HostfsClient = class {
         throw fsError2("ESTALE", "the folder was granted again, so its open files are gone");
       return this.send(path, init, false, true);
     }
-    const errno = response.headers.get("X-Hostfs-Errno") ?? "EIO";
+    const errno2 = response.headers.get("X-Hostfs-Errno") ?? "EIO";
     const body = await response.json().catch(() => ({}));
-    throw fsError2(errno, typeof body.message === "string" ? body.message : errno);
+    throw fsError2(errno2, typeof body.message === "string" ? body.message : errno2);
   }
   async call(op, body = {}, handle = false) {
     const response = await this.send(
@@ -16485,7 +17126,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     try {
       return { opened: await opening2(), restore: void 0 };
     } catch (err) {
-      if (!flags2.write || codeOf4(err) !== "EACCES") throw err;
+      if (!flags2.write || codeOf5(err) !== "EACCES") throw err;
       const was = await client.call("stat", { path: rel(path) });
       const mode = was.mode ?? 0;
       if (mode & 128) throw err;
@@ -17398,8 +18039,8 @@ var RULE = new RegExp(
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
-function failed2(errno, error) {
-  return { error, errno };
+function failed2(errno2, error) {
+  return { error, errno: errno2 };
 }
 function unescaped(double) {
   return double.replace(/\\(["\\$`])/g, "$1");
@@ -18010,6 +18651,7 @@ var Launcher = class {
   );
   net = new LoopbackNet();
   cdp;
+  facades;
   ca;
   transport;
   uplink;
@@ -18084,10 +18726,16 @@ var Launcher = class {
     this.modulesDir = options.modules ?? "/node_modules";
     this.appended = appendedRoots(options.commands);
     this.cdp = new CdpHosts(options.cdp);
+    this.facades = new FacadeHosts(options.facades);
     const hostname = options.hostname ?? DEFAULT_HOSTNAME;
     if (!isHostname(hostname)) throw new Error(`not a host name: ${String(hostname)}`);
     this.hostname = hostname;
-    this.env = { ...networkEnv(hostname), SLICC_CDP_URL: this.cdp.url, ...options.env };
+    this.env = {
+      ...networkEnv(hostname),
+      SLICC_CDP_URL: this.cdp.url,
+      ...this.facades.env(),
+      ...options.env
+    };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = replayingHops(options.transport ?? missingTransport());
     this.announcedTraits = JSON.stringify(this.transport.traits);
@@ -18102,6 +18750,7 @@ var Launcher = class {
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
+    this.facades.enable(this.net);
     const fs = withCommandDirs(
       this.base,
       async () => new Set((await this.commands()).keys()),
@@ -18685,6 +19334,12 @@ var Launcher = class {
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
+  loopbackFor(pid) {
+    return new KernelLoopback(this.net, () => {
+      const cred = this.credOf(pid);
+      return { pid, uid: cred.euid, gid: cred.egid };
+    });
+  }
   treeScrubs(req) {
     const inherited2 = req.ppid !== void 0 ? this.scrubs.get(req.ppid) : void 0;
     return req.scrub ? [...inherited2 ?? [], req.scrub] : inherited2;
@@ -18762,7 +19417,7 @@ var Launcher = class {
       jobs: this.jobs,
       ptys: this.ptys,
       net: this.net,
-      http: new HttpHandles(this.transport, pid),
+      http: new HttpHandles(this.transport, pid, this.loopbackFor(pid)),
       locks: this.locks,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child, pid),
@@ -19035,6 +19690,9 @@ var Launcher = class {
       }
     };
   }
+  connectorStamp(pid) {
+    return this.sealed.stamp(this.identityOf(pid), this.credOf(pid), this.tagOf(pid));
+  }
   identityOf(pid) {
     const parent = this.jobs.shownParent(pid);
     const alive = parent !== void 0 && this.running(parent);
@@ -19706,6 +20364,20 @@ function cdpOption(req, port) {
     )
   };
 }
+function pageHooks(req, port) {
+  return { ...cdpOption(req, port), ...facadesOption(req, port) };
+}
+function facadesOption(req, port) {
+  if (!req.facades) return {};
+  const hook = portFacadeHook(
+    (request2, facade) => port.postMessage({ facadeOpen: request2, port: facade }, [facade])
+  );
+  const facades = {};
+  for (const [name2, spec] of Object.entries(req.facades)) {
+    facades[name2] = { port: spec.port, ...spec.hook ? { hook } : {} };
+  }
+  return { facades };
+}
 function remotes(port, req) {
   return {
     ...req.transport ? { transport: new RemoteTransport(port, req.transport) } : {},
@@ -19919,7 +20591,7 @@ function serveKernel(port, deps) {
         ...media ? { media } : {},
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
-        ...cdpOption(req, port),
+        ...pageHooks(req, port),
         ...mountPolicy(req.processMounts),
         caStore: caStore(deps.metadata ? caDb(req) : false)
       });