@ai-ecoverse/slicc-kernel 1.90.0 → 1.92.0

package/dist/process-worker.js

@@ -44,17 +44,20 @@ function hide(target, names) {
 }
 function vacate(target, names) {
   for (const name2 of names) {
-    for (let at = target; at && at !== Object.prototype; ) {
-      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
-      at = Object.getPrototypeOf(at);
+    const holders = chain(target);
+    for (const holder of holders) {
+      if (Object.getOwnPropertyDescriptor(holder, name2)?.configurable) {
+        Reflect.deleteProperty(holder, name2);
+      }
     }
-    Reflect.defineProperty(target, name2, {
+    const kept = holders.slice(1).some((holder) => Object.hasOwn(holder, name2));
+    const opened2 = Reflect.defineProperty(target, name2, {
       value: void 0,
       writable: true,
       enumerable: false,
       configurable: true
     });
-    if (Reflect.get(target, name2) !== void 0) {
+    if (kept || !opened2 || Reflect.get(target, name2) !== void 0) {
       throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
     }
   }
@@ -80,7 +83,6 @@ var init_lockdown = __esm({
       "cookieStore",
       "Worker",
       "SharedWorker",
-      "BroadcastChannel",
       "postMessage",
       "close",
       "webkitRequestFileSystem",
@@ -97,7 +99,7 @@ var init_lockdown = __esm({
       "hid",
       "serial"
     ];
-    OPEN_SLOTS = ["fetch", "WebSocket"];
+    OPEN_SLOTS = ["fetch", "WebSocket", "BroadcastChannel"];
   }
 });
 
@@ -255,6 +257,10 @@ var init_protocol = __esm({
 });
 
 // src/kernel/net/loopback-names.ts
+function isKernelLoopbackHost(hostname) {
+  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
+}
 function reserved(name2) {
   const lower = name2.toLowerCase();
   return lower === "localhost" || lower.endsWith(".localhost") || lower === HOST_LOOPBACK || lower === "wasmer.sh" || /^\d+(\.\d+){3}$/.test(lower);
@@ -278,7 +284,7 @@ function hostsFile(hostname = DEFAULT_HOSTNAME) {
     ""
   ].join("\n");
 }
-var HOST_LOOPBACK, HOST_LOOPBACK_ADDRESS, PAGE_LOOPBACK, PAGE_LOOPBACK_URL, DEFAULT_HOSTNAME, HOSTNAME_ADDRESS, LIBC_HOSTNAMES, LABEL;
+var HOST_LOOPBACK, HOST_LOOPBACK_ADDRESS, PAGE_LOOPBACK, PAGE_LOOPBACK_URL, LOOPBACK_V4, LOOPBACK_V6, MAPPED_V4, DEFAULT_HOSTNAME, HOSTNAME_ADDRESS, LIBC_HOSTNAMES, LABEL;
 var init_loopback_names = __esm({
   "src/kernel/net/loopback-names.ts"() {
     "use strict";
@@ -286,6 +292,9 @@ var init_loopback_names = __esm({
     HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
     PAGE_LOOPBACK = "kernel.localhost";
     PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
+    LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+    LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
+    MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
     DEFAULT_HOSTNAME = "slicc";
     HOSTNAME_ADDRESS = "127.0.1.1";
     LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
@@ -1128,6 +1137,7 @@ function toMs(v) {
   return v instanceof Date ? v.getTime() : v;
 }
 function wantOf(flags) {
+  if (flags & O_PATH) return 0;
   const mode = flags & O_ACCMODE;
   const read2 = mode === 1 ? 0 : HOLD_READ;
   const write2 = mode !== 0 || (flags & O_TRUNC) !== 0 ? HOLD_WRITE : 0;
@@ -3762,12 +3772,12 @@ function anySelect(Fs, transport, read2, write2, timeoutMs) {
   const kernelRead = read2.filter((fd) => !own(fd));
   const kernelWrite = write2.filter((fd) => !own(fd));
   for (; ; ) {
-    const local2 = ownReady(Fs, read2.filter(own), write2.filter(own));
-    const pending = local2.read.length > 0 || local2.write.length > 0;
+    const local3 = ownReady(Fs, read2.filter(own), write2.filter(own));
+    const pending = local3.read.length > 0 || local3.write.length > 0;
     const slice = pending ? 0 : Math.min(SELECT_SLICE_MS, Math.max(0, deadline - Date.now()));
     const got = kernelSelect(Fs, transport, kernelRead, kernelWrite, slice);
     if (typeof got === "number") return got;
-    const ready = { read: [...local2.read, ...got.read], write: [...local2.write, ...got.write] };
+    const ready = { read: [...local3.read, ...got.read], write: [...local3.write, ...got.write] };
     if (ready.read.length > 0 || ready.write.length > 0 || Date.now() >= deadline) {
       return ready;
     }
@@ -4285,7 +4295,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.90.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.92.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -6821,34 +6831,40 @@ function readyEvents(subs, ready) {
     hangup: ready.hangup?.includes(s.fd) === true
   }));
 }
+function selectOnce(deps, read2, write2, timeoutMs) {
+  try {
+    const ready = deps.kernel.call({ op: "fd-select", read: read2, write: write2, timeoutMs });
+    return { ready, interrupted: false };
+  } catch (e) {
+    if (!deps.interruptWakes || e.code !== "EINTR") throw e;
+    return { ready: { read: [], write: [] }, interrupted: true };
+  }
+}
+function waitEvents(deps, subs, { events, read: read2, write: write2 }, entered) {
+  const earliest = subs.reduce((min, s) => Math.min(min, s.deadline), Infinity);
+  const timeout = () => {
+    if (events.length > 0 || entered) return 0;
+    return earliest === Infinity ? -1 : Math.max(0, Math.ceil(earliest - performance.now()));
+  };
+  for (; ; ) {
+    const { ready, interrupted } = selectOnce(deps, read2, write2, timeout());
+    events.push(...readyEvents(subs, ready));
+    if (interrupted) return true;
+    if (events.length > 0 || entered || earliest === Infinity) return false;
+    if (performance.now() >= earliest) return false;
+  }
+}
 function pollOneoff(deps, inPtr, outPtr, nsubs, neventsPtr) {
   if (nsubs === 0) return E.INVAL;
-  const { mem, kernel } = deps;
+  const { mem } = deps;
   const subs = readSubscriptions(mem, inPtr, nsubs, deps.now);
-  const { events, read: read2, write: write2 } = classify(deps.fds, subs);
-  let interrupted = false;
-  const earliest = subs.reduce((min, s) => Math.min(min, s.deadline), Infinity);
-  const expired = () => performance.now() >= earliest;
-  if (read2.length > 0 || write2.length > 0 || events.length === 0) {
-    do {
-      let timeoutMs = -1;
-      if (events.length > 0) timeoutMs = 0;
-      else if (earliest !== Infinity)
-        timeoutMs = Math.max(0, Math.ceil(earliest - performance.now()));
-      let ready;
-      try {
-        ready = kernel.call({ op: "fd-select", read: read2, write: write2, timeoutMs });
-      } catch (e) {
-        if (!deps.interruptWakes || e.code !== "EINTR") throw e;
-        interrupted = true;
-        ready = { read: [], write: [] };
-      }
-      events.push(
-        ...readyEvents(subs, ready)
-      );
-    } while (events.length === 0 && !interrupted && earliest !== Infinity && !expired());
-  }
+  const found = classify(deps.fds, subs);
+  const { events, read: read2, write: write2 } = found;
+  const entered = deps.entered === true && deps.interruptWakes !== true;
+  const waits = read2.length > 0 || write2.length > 0 || events.length === 0;
+  const interrupted = waits && waitEvents(deps, subs, found, entered);
   const after = performance.now();
+  if (entered && events.length === 0 && !subs.some((s) => s.deadline <= after)) return E.INTR;
   for (const s of subs) {
     if (s.type === EVENTTYPE.CLOCK && (interrupted || s.deadline <= after)) {
       events.push({ userdata: s.userdata, error: E.SUCCESS, type: s.type });
@@ -7054,6 +7070,7 @@ var init_wasi_host = __esm({
       cache;
       startCwd;
       interruptWakes = false;
+      entered = false;
       onRaise;
       muted;
       signals;
@@ -7277,7 +7294,8 @@ var init_wasi_host = __esm({
               fds: this.fds,
               kernel: this.o.kernel,
               now: (id) => this.now(id),
-              interruptWakes: this.interruptWakes
+              interruptWakes: this.interruptWakes,
+              entered: this.entered
             },
             inPtr,
             outPtr,
@@ -7294,7 +7312,7 @@ var init_wasi_host = __esm({
           this.mem.view().setUint32(nevents, 0, true);
           if (mask.deliverUnblocked()) return E.INTR;
           if (n > 0) return this.poll(inPtr, outPtr, n, nevents);
-          return this.suspend();
+          return this.entered ? E.INTR : this.suspend();
         } finally {
           mask.deliverUnblocked();
           mask.restore(old);
@@ -8220,6 +8238,7 @@ function importsContext({
     fs,
     fds,
     syscall: call2,
+    net: network(raw, call2),
     ...processes(host, call2, tid !== MAIN_TID),
     async: {
       submit: (req) => call2({ op: "async-submit", req }),
@@ -8255,6 +8274,30 @@ function importsContext({
     gid: { get: () => live().gid, enumerable: true }
   });
 }
+function loopbackHost(host) {
+  if (host === "localhost") return "127.0.0.1";
+  if (typeof host === "string" && LOOPBACK.test(host)) return host;
+  throw new WasiError("EINVAL");
+}
+function network(raw, call2) {
+  return {
+    connect({ host, port: port2, nonblock = false }) {
+      const to = loopbackHost(host);
+      if (!Number.isInteger(port2) || port2 < 1 || port2 > 65535) throw new WasiError("EINVAL");
+      const fd = call2({ op: "sock-open", domain: "inet" });
+      const addr = { family: "inet", host: to, port: port2 };
+      const r = raw({ op: "sock-connect", fd, addr, ...nonblock ? { nonblock: true } : {} });
+      if (r.ok || nonblock && r.errno === "EINPROGRESS") return fd;
+      raw({ op: "fd-close", fd });
+      throw new WasiError(r.errno);
+    },
+    ready(fd) {
+      const sel = call2({ op: "fd-select", read: [], write: [fd], timeoutMs: 0 });
+      if (!sel.write.includes(fd)) return E.INPROGRESS;
+      return call2({ op: "sock-getopt", fd, level: SOL_SOCKET, name: SO_ERROR });
+    }
+  };
+}
 function processes(host, call2, inThread) {
   const close = (fd) => void call2({ op: "fd-close", fd });
   const slot2 = (n, how, mine, theirs) => {
@@ -8312,7 +8355,7 @@ function processes(host, call2, inThread) {
     }
   };
 }
-var UID2, STDIO;
+var UID2, LOOPBACK, SOL_SOCKET, SO_ERROR, STDIO;
 var init_wasi_imports = __esm({
   "src/process/wasi/wasi-imports.ts"() {
     "use strict";
@@ -8321,6 +8364,9 @@ var init_wasi_imports = __esm({
     init_wasi_threads();
     init_wasix_process();
     UID2 = 1e3;
+    LOOPBACK = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+    SOL_SOCKET = 1;
+    SO_ERROR = 4;
     STDIO = ["stdin", "stdout", "stderr"];
   }
 });
@@ -10045,7 +10091,7 @@ function readAddr(view, ptr) {
 function ipv6Host(bytes) {
   const zeros = (n) => bytes.subarray(0, n).every((b) => b === 0);
   if (zeros(16)) return "0.0.0.0";
-  if (zeros(15) && bytes[15] === 1) return LOOPBACK;
+  if (zeros(15) && bytes[15] === 1) return LOOPBACK2;
   if (zeros(10) && bytes[10] === 255 && bytes[11] === 255) return bytes.subarray(12).join(".");
   const groups = [0, 2, 4, 6, 8, 10, 12, 14].map(
     (i) => (bytes[i] << 8 | bytes[i + 1]).toString(16)
@@ -10202,7 +10248,7 @@ function wasixSocketImports(host, preview1) {
     }
   };
 }
-var INET4, INET6, UNIX, STREAM, ADDR_IP_SIZE, LOOPBACK, OPTIONS;
+var INET4, INET6, UNIX, STREAM, ADDR_IP_SIZE, LOOPBACK2, OPTIONS;
 var init_wasix_sockets = __esm({
   "src/process/wasi/wasix-sockets.ts"() {
     "use strict";
@@ -10214,7 +10260,7 @@ var init_wasix_sockets = __esm({
     UNIX = 3;
     STREAM = 1;
     ADDR_IP_SIZE = 18;
-    LOOPBACK = "127.0.0.1";
+    LOOPBACK2 = "127.0.0.1";
     OPTIONS = {
       1: [1, 15],
       2: [1, 2],
@@ -10601,10 +10647,8 @@ var init_wasix_host = __esm({
             const v = mem.view();
             const timed = timeoutPtr !== 0 && v.getUint8(timeoutPtr) === 1;
             const ms = timed ? Number(v.getBigUint64(timeoutPtr + 8, true)) / 1e6 : Number.POSITIVE_INFINITY;
-            v.setUint8(
-              wokenPtr,
-              futexWait(i32(), ptr >> 2, expected | 0, ms, host.interrupted) ? 1 : 0
-            );
+            const woken = host.entered || futexWait(i32(), ptr >> 2, expected | 0, ms, host.interrupted);
+            v.setUint8(wokenPtr, woken ? 1 : 0);
           },
           futex_wake: (ptr, wokenPtr) => {
             Atomics.notify(i32(), ptr >> 2, 1);
@@ -10772,9 +10816,10 @@ function delivering(ns, table, host, driver, before) {
     }
     const fn = value2;
     out[name2] = (...args) => {
+      host.entered = false;
       if (driver.idle) {
         before?.();
-        host.interrupted?.();
+        host.entered = host.interrupted?.() === true;
       }
       return fn(...args);
     };
@@ -11439,6 +11484,13 @@ var init_async_sab = __esm({
 });
 
 // src/process/js/js-kernel.ts
+function umaskRequest(mask) {
+  if (mask === void 0) return { op: "proc-umask" };
+  if (!Number.isInteger(mask) || mask < 0 || mask > 511) {
+    throw new JsCallError("EINVAL", "umask");
+  }
+  return { op: "proc-umask", mask };
+}
 function modeOf(mode) {
   if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
     throw new JsCallError("EINVAL", "chmod");
@@ -11920,7 +11972,8 @@ function openRequest(abs, o) {
     flags: flagsOf(o),
     position: 0,
     ...isExclusive(o) ? { exclusive: true } : o.create ? { create: true } : { existing: true },
-    ...o.truncate ? { truncate: true } : {}
+    ...o.truncate ? { truncate: true } : {},
+    ...o.create || isExclusive(o) ? { mode: o.mode === void 0 ? 438 : modeOf(o.mode) } : {}
   };
 }
 function index2(n, what) {
@@ -12383,11 +12436,20 @@ function plain(status2, text) {
     headers: { "content-type": "text/plain; charset=utf-8" }
   });
 }
+function local2(url) {
+  return isKernelLoopbackHost(new URL(url).hostname);
+}
 function rewrite(hop, status2, location) {
   const next2 = new URL(location, hop.url);
   if (next2.protocol !== "http:" && next2.protocol !== "https:") {
     throw failed3(new JsCallError("EPROTONOSUPPORT", next2.protocol));
   }
+  if (local2(next2.href) && !local2(hop.url)) {
+    const from = new URL(hop.url).origin;
+    throw failed3(
+      new JsCallError("EACCES", `a redirect from ${from} into the kernel's loopback: ${next2.href}`)
+    );
+  }
   const toGet = (status2 === 301 || status2 === 302) && hop.method === "POST" || status2 === 303 && hop.method !== "GET" && hop.method !== "HEAD";
   const crossOrigin = next2.origin !== new URL(hop.url).origin;
   const headers = hop.headers.filter(
@@ -12556,13 +12618,15 @@ async function bodyOf(request, cap, signal) {
   return out;
 }
 function fetchOp(kernel) {
-  let traits;
-  const traitsOf = () => {
-    traits ??= kernel.json({ op: "net-traits" });
-    traits.catch(() => {
-      traits = void 0;
+  const traits = /* @__PURE__ */ new Map();
+  const traitsOf = (url) => {
+    const own = local2(url);
+    const known = traits.get(own) ?? kernel.json({ op: "net-traits", url });
+    traits.set(own, known);
+    known.catch(() => {
+      traits.delete(own);
     });
-    return traits;
+    return known;
   };
   const close = (handle) => kernel.raw({ op: "net-close", handle });
   const send = async (hop, signal) => {
@@ -12649,6 +12713,13 @@ function fetchOp(kernel) {
     });
     return withMeta(response, head.url, redirected);
   };
+  const traitsAt = (at) => traitsOf(at).catch((err) => {
+    throw failed3(err);
+  });
+  const redirect = async (hop, status2, location, known) => {
+    const next2 = rewrite(hop, status2, location);
+    return [next2, local2(next2.url) === local2(hop.url) ? known : await traitsAt(next2.url)];
+  };
   return async (input, init) => {
     const request = new Request(input, init);
     const { signal } = request;
@@ -12658,9 +12729,7 @@ function fetchOp(kernel) {
     if (protocol !== "http:" && protocol !== "https:") {
       throw failed3(new JsCallError("EPROTONOSUPPORT", protocol));
     }
-    const known = await traitsOf().catch((err) => {
-      throw failed3(err);
-    });
+    let known = await traitsAt(request.url);
     if (!known.manualRedirects && request.redirect !== "follow") {
       throw failed3(new JsCallError("ENOTSUP", `redirect: ${request.redirect}`));
     }
@@ -12686,7 +12755,7 @@ function fetchOp(kernel) {
       await close(head.handle);
       if (request.redirect === "error") throw failed3(new JsCallError("EREDIRECT", hop.url));
       if (hops >= MAX_REDIRECTS) throw failed3(new JsCallError("ELOOP", hop.url));
-      hop = rewrite(hop, head.status, location);
+      [hop, known] = await redirect(hop, head.status, location, known);
     }
   };
 }
@@ -12694,6 +12763,7 @@ var CHUNK2, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTI
 var init_js_fetch = __esm({
   "src/process/js/js-fetch.ts"() {
     "use strict";
+    init_loopback_names();
     init_js_kernel();
     CHUNK2 = 64 * 1024;
     MAX_REDIRECTS = 20;
@@ -12733,7 +12803,7 @@ function port(n) {
 function netOps(kernel, io) {
   const name2 = async (fd, peer) => addressOf(await kernel.json({ op: "sock-name", fd, peer }));
   const connection = async (fd) => {
-    const [local2, remote] = [await name2(fd, false), await name2(fd, true)];
+    const [local3, remote] = [await name2(fd, false), await name2(fd, true)];
     const stop = new AbortController();
     let closed;
     const close = () => {
@@ -12758,7 +12828,7 @@ function netOps(kernel, io) {
       close: async () => void await shut(SHUT_WR),
       abort: () => close()
     });
-    return { fd, local: local2, remote, readable: readable3, writable: writable2, close };
+    return { fd, local: local3, remote, readable: readable3, writable: writable2, close };
   };
   const resolve = async (host, signal) => {
     if (IPV4.test(host)) return host;
@@ -12834,8 +12904,8 @@ function netOps(kernel, io) {
         const failed5 = await kernel.json({
           op: "sock-getopt",
           fd,
-          level: SOL_SOCKET,
-          name: SO_ERROR
+          level: SOL_SOCKET2,
+          name: SO_ERROR2
         });
         if (failed5 !== 0) throw new JsCallError(errnoName(failed5), "connect");
         return connection(fd);
@@ -12843,7 +12913,7 @@ function netOps(kernel, io) {
     }
   };
 }
-var SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET, SO_ERROR;
+var SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2;
 var init_js_net = __esm({
   "src/process/js/js-net.ts"() {
     "use strict";
@@ -12853,8 +12923,8 @@ var init_js_net = __esm({
     SHUT_WR = 1;
     IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
     NEVER = new AbortController().signal;
-    SOL_SOCKET = 1;
-    SO_ERROR = 4;
+    SOL_SOCKET2 = 1;
+    SO_ERROR2 = 4;
   }
 });
 
@@ -13257,7 +13327,8 @@ function syncPathOps(kernel, resolve, statOf, open) {
     mkdir: (path, options) => void kernel.call({
       op: "mkdir",
       path: resolve(path),
-      ...options?.recursive === false ? { exclusive: true } : {}
+      ...options?.recursive === false ? { exclusive: true } : {},
+      mode: options?.mode === void 0 ? 511 : modeOf(options.mode)
     }),
     rm: (path) => void kernel.call({ op: "rm", path: resolve(path) }),
     unlink: (path) => void kernel.call({ op: "unlink", path: resolve(path) }),
@@ -13281,8 +13352,14 @@ function syncPathOps(kernel, resolve, statOf, open) {
       kernel.call({ op: "fd-path-flush", path: abs });
       return kernel.bytes({ op: "read", path: abs });
     },
-    writeFile(path, data) {
-      const file = open(path, { write: true, create: true, truncate: true });
+    writeFile(path, data, options) {
+      const mode = options?.mode;
+      const file = open(path, {
+        write: true,
+        create: true,
+        truncate: true,
+        ...mode !== void 0 ? { mode } : {}
+      });
       try {
         file.write(0, typeof data === "string" ? encoder3.encode(data) : data);
       } finally {
@@ -13781,6 +13858,7 @@ function createContext(o) {
     },
     kill: killer({ self: o.pid, kernel, syncKernel, lane, writes, modes: terminal.modes }),
     cred: () => syncKernel.json({ op: "proc-cred" }),
+    umask: (mask) => syncKernel.json(umaskRequest(mask)),
     setcred(change) {
       if (typeof change !== "object" || change === null || Array.isArray(change)) {
         throw new JsCallError("EINVAL", "setcred");
@@ -13827,6 +13905,7 @@ function createContext(o) {
     },
     sync,
     fetch: fetchOp(kernel),
+    umask: async (mask) => await kernel.json(umaskRequest(mask)),
     sudo: async (args) => await kernel.json({
       op: "proc-sudo",
       args: [...args],
@@ -13976,7 +14055,8 @@ function pathOps(kernel, resolve, statOf, open) {
     mkdir: async (path, options) => void await kernel.call({
       op: "mkdir",
       path: resolve(path),
-      ...options?.recursive === false ? { exclusive: true } : {}
+      ...options?.recursive === false ? { exclusive: true } : {},
+      mode: options?.mode === void 0 ? 511 : modeOf(options.mode)
     }),
     rm: async (path) => void await kernel.call({ op: "rm", path: resolve(path) }),
     unlink: async (path) => void await kernel.call({ op: "unlink", path: resolve(path) }),
@@ -14000,8 +14080,14 @@ function pathOps(kernel, resolve, statOf, open) {
       await kernel.call({ op: "fd-path-flush", path: abs });
       return kernel.bytes({ op: "read", path: abs });
     },
-    async writeFile(path, data) {
-      const file = await open(path, { write: true, create: true, truncate: true });
+    async writeFile(path, data, options) {
+      const mode = options?.mode;
+      const file = await open(path, {
+        write: true,
+        create: true,
+        truncate: true,
+        ...mode !== void 0 ? { mode } : {}
+      });
       try {
         await file.write(0, typeof data === "string" ? encoder4.encode(data) : data);
       } finally {