@ai-ecoverse/slicc-kernel 1.90.0 → 1.92.0

package/dist/kernel-worker.js

@@ -2299,8 +2299,8 @@ async function access(fs, cred, path, want, options = {}) {
   if (await present(fs, walked.path, false)) return { ...walked, denied: walked.path };
   return { ...walked, missing: true };
 }
-function refused(path, errno = "EACCES") {
-  return fsError(errno, path);
+function refused(path, errno2 = "EACCES") {
+  return fsError(errno2, path);
 }
 
 // src/fs/dac.ts
@@ -2360,9 +2360,9 @@ var Created = class {
 function linked(g, options) {
   return g.links === void 0 ? options : { ...options, links: g.links };
 }
-function deny(g, op, path, errno = "EACCES") {
+function deny(g, op, path, errno2 = "EACCES") {
   const tag = g.tag === void 0 ? {} : { tag: g.tag };
-  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno, ...tag });
+  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno: errno2, ...tag });
 }
 var TTY_MODE = 400;
 function ttyOpenable(g, tty) {
@@ -3029,7 +3029,7 @@ var WASI_SIGNAL_TO_POSIX = Object.fromEntries(
 
 // src/process/wasi-errno.ts
 var WASI_ERRNO = {
-  ...Object.fromEntries(Object.entries(E).map(([name2, errno]) => [`E${name2}`, errno])),
+  ...Object.fromEntries(Object.entries(E).map(([name2, errno2]) => [`E${name2}`, errno2])),
   EWOULDBLOCK: E.AGAIN,
   ENOTSUP: 138,
   EOPNOTSUPP: 138,
@@ -3126,7 +3126,7 @@ function dialError(e, timedOut, closed) {
   if (timedOut) return new KernelError("ETIMEDOUT");
   if (closed) return new KernelError("ECONNABORTED");
   const code = e?.code;
-  const known = DIAL_ERRORS.find((errno) => errno === code);
+  const known = DIAL_ERRORS.find((errno2) => errno2 === code);
   return new KernelError(known ?? "EHOSTUNREACH");
 }
 function isLoopback(host) {
@@ -3793,11 +3793,11 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   };
   const sockets = /* @__PURE__ */ new Map();
   const credit = /* @__PURE__ */ new Map();
-  const refill = (nid, n, closing = false) => {
+  const refill = (nid, n, closing2 = false) => {
     const flow = credit.get(nid);
     if (!flow) return;
     flow.inflight -= n;
-    if (closing && !flow.closing) {
+    if (closing2 && !flow.closing) {
       flow.closing = true;
       flow.deadline();
     }
@@ -4928,6 +4928,33 @@ function toHostLoopback(href) {
   url.hostname = "127.0.0.1";
   return url.href;
 }
+var LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+var LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
+var MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
+var KERNEL_PORT = /^(\d{1,5})\.kernel\.localhost$/;
+var SCHEMES = {
+  "http:": 80,
+  "ws:": 80,
+  "https:": 443,
+  "wss:": 443
+};
+function isKernelLoopbackHost(hostname) {
+  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
+}
+function kernelLoopbackPort(href) {
+  let url;
+  try {
+    url = new URL(href);
+  } catch {
+    return void 0;
+  }
+  const fallback = SCHEMES[url.protocol];
+  if (fallback === void 0 || !isKernelLoopbackHost(url.hostname)) return void 0;
+  const named = KERNEL_PORT.exec(url.hostname.replace(/\.$/, "").toLowerCase())?.[1];
+  const port = Number(named ?? (url.port || fallback));
+  return port >= 1 && port <= 65535 ? port : void 0;
+}
 var DEFAULT_HOSTNAME = "slicc";
 var HOSTNAME_ADDRESS = "127.0.1.1";
 var LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
@@ -5233,6 +5260,9 @@ async function acceptKey(headers) {
   }
   const key = field(headers, "sec-websocket-key") ?? "";
   if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
+  return acceptFor(key);
+}
+async function acceptFor(key) {
   const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
   return btoa(String.fromCharCode(...new Uint8Array(digest)));
 }
@@ -5256,6 +5286,19 @@ function frame(opcode, payload) {
   out.set(payload, size);
   return out;
 }
+function clientFrame(opcode, payload) {
+  const plain = frame(opcode, payload);
+  const head = plain.length - payload.length;
+  const mask = crypto.getRandomValues(new Uint8Array(4));
+  const out = new Uint8Array(plain.length + 4);
+  out.set(plain.subarray(0, head));
+  out[1] = out[1] | 128;
+  out.set(mask, head);
+  for (let i = 0; i < payload.length; i++) {
+    out[head + 4 + i] = payload[i] ^ mask[i & 3];
+  }
+  return out;
+}
 function closeFrame(code, reason = "") {
   let bytes = new TextEncoder().encode(reason);
   if (bytes.length > 123) {
@@ -5295,10 +5338,12 @@ var WsReader = class {
   continuing = false;
   binaryMessage = false;
   binary;
-  constructor(incoming, max = MAX_MESSAGE, binary) {
+  fromServer;
+  constructor(incoming, max = MAX_MESSAGE, binary, fromServer = false) {
     this.incoming = incoming;
     this.max = max;
     this.binary = binary;
+    this.fromServer = fromServer;
   }
   async next(signal) {
     for (; ; ) {
@@ -5310,7 +5355,7 @@ var WsReader = class {
       const fin = (head[0] & 128) !== 0;
       const opcode = head[0] & 15;
       if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
-      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
+      const masked = this.masking(head[1]);
       const length2 = await this.length(head[1] & 127, signal);
       const control = opcode >= 8;
       if (control && (length2 > 125 || !fin)) {
@@ -5319,15 +5364,19 @@ var WsReader = class {
       if (!control && this.size + length2 > this.max) {
         throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
       }
-      const mask = new Uint8Array(4);
-      await fill(this.incoming, mask, signal);
-      const payload = new Uint8Array(length2);
-      await fill(this.incoming, payload, signal);
-      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+      const payload = await this.payload(length2, masked, signal);
       const event = this.take(opcode, fin, payload);
       if (event) return event;
     }
   }
+  masking(second) {
+    const masked = (second & 128) !== 0;
+    if (masked !== this.fromServer) return masked;
+    throw new WsError(
+      CLOSE.protocol,
+      this.fromServer ? "server frames must not be masked" : "client frames must be masked"
+    );
+  }
   data(opcode, fin, payload) {
     if (opcode === OP.continuation !== this.continuing) {
       throw new WsError(CLOSE.protocol, "unexpected continuation frame");
@@ -5342,6 +5391,14 @@ var WsReader = class {
     this.size = 0;
     return this.binaryMessage ? { kind: "binary", bytes: whole } : { kind: "text", text: decode(whole) };
   }
+  async payload(length2, masked, signal) {
+    const mask = new Uint8Array(4);
+    if (masked) await fill(this.incoming, mask, signal);
+    const payload = new Uint8Array(length2);
+    await fill(this.incoming, payload, signal);
+    if (masked) for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+    return payload;
+  }
   async length(short, signal) {
     if (short < 126) return short;
     const ext = new Uint8Array(short === 126 ? 2 : 8);
@@ -5777,10 +5834,10 @@ var RealmProxy = class {
       encodedBodies: this.options.transport.traits.encodedBodies,
       bodiless: bodiless2
     });
-    const chunked = !bodiless2 && minor >= 1;
-    const keep2 = keepAlive && (bodiless2 || chunked);
+    const chunked2 = !bodiless2 && minor >= 1;
+    const keep2 = keepAlive && (bodiless2 || chunked2);
     headers.push(["Connection", keep2 ? "keep-alive" : "close"]);
-    if (chunked) headers.push(["Transfer-Encoding", "chunked"]);
+    if (chunked2) headers.push(["Transfer-Encoding", "chunked"]);
     const signal = this.stop.signal;
     await conn.write(
       responseHead(status, response.statusText || REASON[status] || "", headers),
@@ -5792,13 +5849,13 @@ var RealmProxy = class {
     }
     try {
       for await (const piece of response.body) {
-        if (piece.length > 0) await conn.write(chunked ? chunk(piece) : piece, signal);
+        if (piece.length > 0) await conn.write(chunked2 ? chunk(piece) : piece, signal);
       }
     } catch {
       await response.cancel().catch(() => void 0);
       return false;
     }
-    if (chunked) await conn.write(LAST_CHUNK, signal);
+    if (chunked2) await conn.write(LAST_CHUNK, signal);
     return keep2;
   }
   async connect(conn, incoming, req, idle) {
@@ -8225,15 +8282,15 @@ var UnlinkedKeeper = class {
   wrap(fs = this.fs) {
     const keeper = this;
     const visible = (names) => names.filter((name2) => name2 !== UNLINKED_DIR);
-    const counted = (st) => {
+    const counted2 = (st) => {
       const hidden = keeper.links.get(`${st.dev ?? 0}:${st.ino}`) ?? 0;
       return hidden === 0 || st.nlink === void 0 ? st : { ...st, nlink: Math.max(0, st.nlink - hidden) };
     };
     return {
       ...fs,
       links: (path) => mayLink(fs, path),
-      stat: async (path) => counted(await fs.stat(path)),
-      lstat: async (path) => counted(await fs.lstat(path)),
+      stat: async (path) => counted2(await fs.stat(path)),
+      lstat: async (path) => counted2(await fs.lstat(path)),
       async rm(path, options) {
         const target = fs.resolvePath("/", path);
         const pinned = await keeper.pin(target);
@@ -8247,7 +8304,7 @@ var UnlinkedKeeper = class {
         await keeper.settle(pinned, () => fs.rename(from, to));
       },
       readdir: async (path) => visible(await fs.readdir(path)),
-      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR).map(([name2, st]) => [name2, st && counted(st)])
+      readdirStat: async (path) => (await fs.readdirStat(path)).filter(([name2]) => name2 !== UNLINKED_DIR).map(([name2, st]) => [name2, st && counted2(st)])
     };
   }
   async settle(pinned, op) {
@@ -10174,6 +10231,7 @@ async function storageUsage() {
   if (typeof estimate?.quota !== "number") return null;
   return { quota: estimate.quota, usage: estimate.usage ?? 0 };
 }
+var PLAIN_DIR_MODE = 493;
 var done = { ok: true, kind: "void" };
 function json2(value) {
   return { ok: true, kind: "json", json: value };
@@ -10183,6 +10241,11 @@ function ownerFor2(entry, mode) {
   if (!cred) return void 0;
   return ownerOf(cred, mode === void 0 ? void 0 : mode & ~(entry.umask?.() ?? 18));
 }
+function plainDirMode(entry, mode) {
+  if (entry.cred || mode === void 0) return void 0;
+  const wanted = mode & 4095 & ~(entry.umask?.() ?? 18);
+  return wanted === PLAIN_DIR_MODE ? void 0 : wanted;
+}
 function mkdirOptions(entry, mode = 511) {
   const owner = ownerFor2(entry, mode);
   if (!owner) return { recursive: true };
@@ -10224,9 +10287,13 @@ async function run(entry, path, req) {
       return json2(await fs.readdir(path));
     case "readdir-stat":
       return json2(await readdirStat(fs, path));
-    case "mkdir":
+    case "mkdir": {
+      const plain = plainDirMode(entry, req.mode);
+      const fresh2 = plain !== void 0 && !await fs.exists(path);
       await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
+      if (fresh2) await fs.chmod(path, plain);
       return done;
+    }
     case "rm":
       await fs.rm(path, { recursive: true });
       return done;
@@ -11079,7 +11146,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.90.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.92.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -11667,6 +11734,339 @@ async function hostSyscall(req, ctx) {
   }
 }
 
+// src/kernel/net/loopback-transport.ts
+var LOOPBACK_TRAITS = {
+  manualRedirects: true,
+  encodedBodies: true,
+  maxRequestBody: 64 * 1024 * 1024,
+  crossOrigin: "any",
+  websocket: true
+};
+var MAX_HEAD2 = 64 * 1024;
+var OWN_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "upgrade",
+  "sec-websocket-key",
+  "sec-websocket-version",
+  "sec-websocket-protocol",
+  "sec-websocket-extensions"
+]);
+var OP_CLOSE = 8;
+var OP_PONG = 10;
+var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var SAFE_VALUE = /^[^\r\n\0]*$/;
+var CLOSE_WAIT_MS3 = 5e3;
+var MAX_UNREAD = 16 * 1024 * 1024;
+function errno(code, message3) {
+  return Object.assign(new Error(`${code}: ${message3}`), { code });
+}
+function requestHead(method, url, headers, extra) {
+  if (!TOKEN3.test(method)) throw errno("EINVAL", `method ${method}`);
+  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `Host: ${url.host}`];
+  for (const [name2, value] of headers) {
+    if (OWN_HEADERS.has(name2.toLowerCase())) continue;
+    if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value)) throw errno("EINVAL", `header ${name2}`);
+    lines2.push(`${name2}: ${value}`);
+  }
+  for (const [name2, value] of extra) lines2.push(`${name2}: ${value}`);
+  return latin1Bytes(`${lines2.join("\r\n")}\r
+\r
+`);
+}
+function parseHead(bytes) {
+  const [statusLine = "", ...lines2] = latin1(bytes).split(/\r?\n/);
+  const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
+  if (!match) throw errno("EPROTO", `not an HTTP/1.x response: ${statusLine.slice(0, 80)}`);
+  const headers = [];
+  for (const line of lines2) {
+    const colon = line.indexOf(":");
+    if (colon > 0) headers.push([line.slice(0, colon).trim(), line.slice(colon + 1).trim()]);
+  }
+  return { status: Number(match[1]), statusText: match[2] ?? "", headers };
+}
+async function readHead(incoming, signal) {
+  for (; ; ) {
+    let raw;
+    try {
+      raw = await incoming.head(MAX_HEAD2, signal);
+    } catch (err) {
+      if (err instanceof KernelError) throw err;
+      throw errno("EPROTO", "the response head is malformed or too large");
+    }
+    if (!raw) throw errno("ECONNRESET", "the connection closed before a response");
+    const head = parseHead(raw);
+    if (head.status < 100 || head.status >= 200 || head.status === 101) return head;
+  }
+}
+async function* chunked(incoming, signal) {
+  for (; ; ) {
+    const line = await incoming.line(4096, signal);
+    const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(line);
+    if (!size) throw errno("EPROTO", "a malformed chunk size");
+    const n = Number.parseInt(size[1], 16);
+    if (n === 0) {
+      while (await incoming.line(MAX_HEAD2, signal) !== "") ;
+      return;
+    }
+    yield await incoming.exactly(n, signal);
+    if (await incoming.line(2, signal) !== "") throw errno("EPROTO", "a malformed chunk");
+  }
+}
+async function* counted(incoming, length2, signal) {
+  for (let left = length2; left > 0; ) {
+    const data = await incoming.some(Math.min(left, 64 * 1024), signal);
+    if (data.length === 0) throw errno("EPROTO", "the body ended early");
+    left -= data.length;
+    yield data;
+  }
+}
+async function* untilClose(incoming, signal) {
+  for (; ; ) {
+    const data = await incoming.some(64 * 1024, signal);
+    if (data.length === 0) return;
+    yield data;
+  }
+}
+function bodyOf(incoming, head, method, signal) {
+  if (method === "HEAD" || head.status === 204 || head.status === 304) return [];
+  if (fieldTokens(head.headers, "transfer-encoding").includes("chunked")) {
+    return chunked(incoming, signal);
+  }
+  const lengths = fieldValues(head.headers, "content-length");
+  if (lengths.length === 0) return untilClose(incoming, signal);
+  const length2 = lengths[0]?.trim() ?? "";
+  if (!/^\d{1,15}$/.test(length2) || lengths.some((l) => l.trim() !== length2)) {
+    throw errno("EPROTO", `a malformed Content-Length: ${lengths.join(", ")}`);
+  }
+  return counted(incoming, Number(length2), signal);
+}
+var KernelLoopback = class {
+  net;
+  cred;
+  constructor(net, cred) {
+    this.net = net;
+    this.cred = cred;
+  }
+  port(url) {
+    return kernelLoopbackPort(url);
+  }
+  connect(url, port, signal) {
+    if (url.protocol === "https:" || url.protocol === "wss:") {
+      throw errno("ENOTSUP", `TLS to the kernel's loopback is not supported: ${url.origin}`);
+    }
+    signal.throwIfAborted();
+    const socket = this.net.socket("inet");
+    try {
+      void socket.connect({ family: "inet", host: "127.0.0.1", port }, false, this.cred());
+    } catch (err) {
+      socket.close();
+      const refused2 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused2 ? errno("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+    }
+    signal.addEventListener("abort", () => socket.close(), { once: true });
+    return socket;
+  }
+  async fetch(req, port) {
+    const url = new URL(req.url);
+    const body = req.body ?? (/^(POST|PUT|PATCH)$/i.test(req.method) ? new Uint8Array(0) : void 0);
+    const length2 = body ? [["Content-Length", String(body.length)]] : [];
+    const head = requestHead(req.method, url, req.headers, [...length2, ["Connection", "close"]]);
+    const socket = this.connect(url, port, req.signal);
+    try {
+      await writeAll2(socket, body ? concat([head, body]) : head, req.signal);
+      const incoming = new Incoming(socket);
+      const response = await readHead(incoming, req.signal);
+      const chunks = bodyOf(incoming, response, req.method, req.signal);
+      return {
+        url: req.url,
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+        body: closing(chunks, socket),
+        cancel: async () => socket.close()
+      };
+    } catch (err) {
+      socket.close();
+      throw err;
+    }
+  }
+  async websocket(req, port) {
+    const url = new URL(req.url);
+    const socket = this.connect(url, port, req.signal);
+    try {
+      const key = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))));
+      const extra = [
+        ["Upgrade", "websocket"],
+        ["Connection", "Upgrade"],
+        ["Sec-WebSocket-Key", key],
+        ["Sec-WebSocket-Version", "13"]
+      ];
+      if (req.protocols.length > 0)
+        extra.push(["Sec-WebSocket-Protocol", req.protocols.join(", ")]);
+      await writeAll2(socket, requestHead("GET", url, req.headers, extra), req.signal);
+      const incoming = new Incoming(socket);
+      const head = await readHead(incoming, req.signal);
+      if (head.status !== 101) {
+        throw errno(
+          "EPROTO",
+          `the server answered ${head.status} ${head.statusText}, not an upgrade`
+        );
+      }
+      const upgraded = fieldTokens(head.headers, "upgrade").includes("websocket") && fieldTokens(head.headers, "connection").includes("upgrade");
+      const accept2 = fieldValues(head.headers, "sec-websocket-accept")[0];
+      if (!upgraded || accept2 !== await acceptFor(key)) {
+        throw errno("EPROTO", "the server did not accept the WebSocket key");
+      }
+      const protocol = fieldValues(head.headers, "sec-websocket-protocol")[0] ?? "";
+      return new LoopbackWebSocket(socket, incoming, protocol);
+    } catch (err) {
+      socket.close();
+      throw err;
+    }
+  }
+};
+async function writeAll2(socket, bytes, signal) {
+  for (let at = 0; at < bytes.length; ) at += await socket.write(bytes.subarray(at), signal);
+}
+async function* closing(chunks, socket) {
+  try {
+    yield* chunks;
+  } catch (err) {
+    if (typeof err?.code === "string") throw err;
+    throw errno("EPROTO", err instanceof Error ? err.message : String(err));
+  } finally {
+    socket.close();
+  }
+}
+var LoopbackWebSocket = class {
+  protocol;
+  messages;
+  closed;
+  pending = 0;
+  writes = Promise.resolve();
+  sentClose = false;
+  stop = new AbortController();
+  socket;
+  settle;
+  unread = 0;
+  room;
+  constructor(socket, incoming, protocol) {
+    this.socket = socket;
+    this.protocol = protocol;
+    this.closed = new Promise((resolve2) => {
+      this.settle = resolve2;
+    });
+    this.stop.signal.addEventListener("abort", () => this.room?.(), { once: true });
+    const queue = [];
+    let wake;
+    let ended = false;
+    void this.pump(new WsReader(incoming, void 0, true, true), (message3) => {
+      queue.push(message3);
+      this.unread += message3.length;
+      wake?.();
+    }).finally(() => {
+      ended = true;
+      wake?.();
+    });
+    const taken = (message3) => {
+      this.unread -= message3.length;
+      const room = this.room;
+      this.room = void 0;
+      room?.();
+    };
+    this.messages = {
+      [Symbol.asyncIterator]: async function* () {
+        for (; ; ) {
+          const next2 = queue.shift();
+          if (next2 !== void 0) {
+            taken(next2);
+            yield next2;
+            continue;
+          }
+          if (ended) return;
+          await new Promise((resolve2) => {
+            wake = resolve2;
+          });
+          wake = void 0;
+        }
+      }
+    };
+  }
+  async space() {
+    while (this.unread > MAX_UNREAD && !this.stop.signal.aborted) {
+      await new Promise((resolve2) => {
+        this.room = resolve2;
+      });
+    }
+  }
+  get buffered() {
+    return this.pending;
+  }
+  write(bytes) {
+    this.pending += bytes.length;
+    const previous = this.writes;
+    this.writes = (async () => {
+      await previous;
+      try {
+        await writeAll2(this.socket, bytes, this.stop.signal);
+      } catch {
+        this.stop.abort();
+      }
+      this.pending -= bytes.length;
+    })();
+  }
+  async pump(reader, deliver) {
+    let close = { code: 1006, reason: "" };
+    try {
+      for (; ; ) {
+        await this.space();
+        const event = await reader.next(this.stop.signal);
+        if (!event) break;
+        if (event.kind === "text") deliver(event.text);
+        else if (event.kind === "binary") deliver(event.bytes);
+        else if (event.kind === "ping") this.write(clientFrame(OP_PONG, event.payload));
+        else {
+          close = { code: event.code, reason: event.reason };
+          if (!this.sentClose) this.sendClose(event.code === 1005 ? 1e3 : event.code, "");
+          break;
+        }
+      }
+    } catch (err) {
+      if (err instanceof WsError) this.sendClose(err.code, err.message);
+      close = { code: err instanceof WsError ? err.code : 1006, reason: "" };
+    } finally {
+      const late = setTimeout(() => this.stop.abort(), CLOSE_WAIT_MS3);
+      await this.writes;
+      clearTimeout(late);
+      this.socket.close();
+      this.settle(close);
+    }
+  }
+  sendClose(code, reason) {
+    if (this.sentClose) return;
+    this.sentClose = true;
+    const late = setTimeout(() => this.stop.abort(), CLOSE_WAIT_MS3);
+    void this.closed.then(() => clearTimeout(late));
+    const bytes = new TextEncoder().encode(reason).subarray(0, 123);
+    const payload = new Uint8Array(2 + bytes.length);
+    new DataView(payload.buffer).setUint16(0, sendableCode(code) ? code : CLOSE.error);
+    payload.set(bytes, 2);
+    this.write(clientFrame(OP_CLOSE, payload));
+  }
+  send(data) {
+    if (this.sentClose) throw errno("EPIPE", "the websocket is closing");
+    const text = typeof data === "string";
+    const payload = text ? new TextEncoder().encode(data) : data;
+    this.write(clientFrame(text ? OP_TEXT : OP_BINARY, payload));
+  }
+  close(code = 1e3, reason = "") {
+    this.sendClose(code, reason);
+  }
+};
+
 // src/kernel/net/ws-syscalls.ts
 var WS_OPS = [
   "net-ws-open",
@@ -11676,7 +12076,7 @@ var WS_OPS = [
   "net-ws-send",
   "net-ws-close"
 ];
-var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var TOKEN4 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 function message(e) {
   return e instanceof Error ? e.message : String(e);
 }
@@ -11685,16 +12085,18 @@ function errnoOf(e) {
   const code = e?.code;
   return typeof code === "string" && ERRNO.test(code) ? code : "ECONNREFUSED";
 }
-function fail(errno, text) {
-  return { ok: false, errno, message: text };
+function fail(errno2, text) {
+  return { ok: false, errno: errno2, message: text };
 }
 var WsHandles = class {
   transport;
   open = /* @__PURE__ */ new Map();
   next;
-  constructor(transport, next2) {
+  local;
+  constructor(transport, next2, local) {
     this.transport = transport;
     this.next = next2;
+    this.local = local;
   }
   owns(handle) {
     return this.open.has(handle);
@@ -11723,16 +12125,18 @@ var WsHandles = class {
     return { ok: true, kind: "json", json: handle };
   }
   async connect(handle, req, entry) {
-    const { transport } = this;
-    if (!transport.traits.websocket || !transport.websocket) return fail("ENOTSUP", NO_WEBSOCKET2);
+    const { transport, local } = this;
+    const port = local?.port(req.url);
+    const open = { protocols: req.protocols, headers: req.headers, signal: entry.abort.signal };
+    if (port === void 0 && (!transport.traits.websocket || !transport.websocket)) {
+      return fail("ENOTSUP", NO_WEBSOCKET2);
+    }
     let socket;
     try {
-      socket = await transport.websocket({
+      socket = port === void 0 ? await transport.websocket({
         url: toHostLoopback(req.url),
-        protocols: req.protocols,
-        headers: req.headers,
-        signal: entry.abort.signal
-      });
+        ...open
+      }) : await local.websocket({ url: req.url, ...open }, port);
     } catch (e) {
       return fail(errnoOf(e), message(e));
     }
@@ -11740,7 +12144,7 @@ var WsHandles = class {
       socket.close(1001, "the program went away");
       return fail("EBADF", `no websocket ${handle}`);
     }
-    if (socket.protocol && !(req.protocols.includes(socket.protocol) && TOKEN3.test(socket.protocol))) {
+    if (socket.protocol && !(req.protocols.includes(socket.protocol) && TOKEN4.test(socket.protocol))) {
       socket.close(1002, "subprotocol not offered");
       return fail("EPROTO", "the far end chose a subprotocol the program did not offer");
     }
@@ -11803,6 +12207,10 @@ var EMPTY = new Uint8Array(0);
 function message2(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function codeOf2(e) {
+  const code = e?.code;
+  return typeof code === "string" && /^E[A-Z]+$/.test(code) ? code : "EIO";
+}
 async function* once(bytes) {
   yield bytes;
 }
@@ -11812,10 +12220,12 @@ var HttpHandles = class {
   nextHandle = 0;
   ws;
   owner;
-  constructor(transport, owner) {
+  local;
+  constructor(transport, owner, local) {
     this.transport = transport;
     this.owner = owner;
-    this.ws = new WsHandles(transport, () => ++this.nextHandle);
+    this.local = local;
+    this.ws = new WsHandles(transport, () => ++this.nextHandle, local);
   }
   syscall(req) {
     if (req.op.startsWith("net-ws-")) return this.ws.syscall(req);
@@ -11823,10 +12233,13 @@ var HttpHandles = class {
     if (req.op === "net-open") return Promise.resolve(this.opened(req));
     if (req.op === "net-head") return this.head(req.handle);
     if (req.op === "net-read") return this.read(req.handle, req.max);
-    if (req.op === "net-traits") return Promise.resolve(this.traits());
+    if (req.op === "net-traits") return Promise.resolve(this.traits(req.url));
     return this.close(req.handle);
   }
-  traits() {
+  traits(url) {
+    if (url !== void 0 && this.local?.port(url) !== void 0) {
+      return { ok: true, kind: "json", json: LOOPBACK_TRAITS };
+    }
     const { unavailable, crossOrigin = "any", ...rest2 } = this.transport.traits;
     if (unavailable) return { ok: false, errno: "ENETUNREACH", message: NO_TRANSPORT };
     return { ok: true, kind: "json", json: { ...rest2, crossOrigin } };
@@ -11857,28 +12270,30 @@ var HttpHandles = class {
     return { handle, head: entry.head };
   }
   async respond(handle, req, entry) {
+    const port = this.local?.port(req.url);
     try {
-      const response = await this.transport.fetch(
-        {
-          url: req.url,
-          method: req.method,
-          headers: req.headers,
-          ...req.body ? { body: req.body } : {},
-          signal: entry.abort.signal
-        },
-        this.owner
-      );
+      const target = port === void 0 ? toHostLoopback(req.url) : req.url;
+      const request2 = {
+        url: target,
+        method: req.method,
+        headers: req.headers,
+        ...req.body ? { body: req.body } : {},
+        signal: entry.abort.signal
+      };
+      const response = port === void 0 ? await this.transport.fetch(request2, this.owner) : await this.local.fetch(request2, port);
       entry.body = response.body[Symbol.asyncIterator]();
       entry.cancel = () => response.cancel();
       if (!this.open.has(handle)) await entry.cancel().catch(() => void 0);
-      const head = this.headOf(handle, response.url ?? req.url, response);
+      const shown = response.url && response.url !== target ? response.url : req.url;
+      const head = this.headOf(handle, shown, response);
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
       const text = message2(e);
+      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
       const status = e.status;
       if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
-        const errno = text === NO_TRANSPORT ? "ENETUNREACH" : "ECONNREFUSED";
-        return { ok: false, errno, message: text };
+        const errno2 = text === NO_TRANSPORT ? "ENETUNREACH" : "ECONNREFUSED";
+        return { ok: false, errno: errno2, message: text };
       }
       entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
       return this.headOf(handle, req.url, {
@@ -13347,6 +13762,7 @@ function aborted(signal) {
     signal.addEventListener("abort", () => reject(new KernelError("EINTR")), { once: true });
   });
 }
+var PLAIN_FILE_MODE = 420;
 var JOB_OPS = /* @__PURE__ */ new Set([
   "proc-setpgid",
   "proc-getpgid",
@@ -13801,15 +14217,21 @@ var WasmProcess = class {
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open = { ...req, path };
+      const plain = this.plainMode(req.mode);
       if (req.exclusive) {
-        await nodes.createExclusive(path, this.newOwner());
+        await nodes.createExclusive(path, this.newOwner(req.mode));
+        if (plain !== void 0) await this.options.fs.chmod?.(path, plain);
         this.fds.installAt(fd, this.openVfsFile(open));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const fresh2 = this.options.owners && !await present2(this.options.fs, path, true);
+          const marks = this.options.owners || plain !== void 0;
+          const fresh2 = marks && !await present2(this.options.fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path)));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2) await this.options.fs.chown?.(path, { ...this.newOwner(), kind: "new" });
+          if (fresh2 && plain !== void 0) await this.options.fs.chmod?.(path, plain);
+          else if (fresh2) {
+            await this.options.fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
+          }
         });
       } else {
         this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path)));
@@ -13922,9 +14344,14 @@ var WasmProcess = class {
     if (!tty) throw new KernelError("ENOENT");
     return tty;
   }
-  newOwner() {
+  plainMode(mode) {
+    if (this.options.owners || mode === void 0) return void 0;
+    const wanted = mode & 4095 & ~this.umask;
+    return wanted === PLAIN_FILE_MODE ? void 0 : wanted;
+  }
+  newOwner(mode = 438) {
     if (!this.options.owners) return void 0;
-    return { uid: this.cred.euid, gid: this.cred.egid, mode: 438 & ~this.umask };
+    return { uid: this.cred.euid, gid: this.cred.egid, mode: mode & 4095 & ~this.umask };
   }
   async openProc(req, path) {
     return this.fds.install(await this.procFile(req, path), 3);
@@ -14664,7 +15091,7 @@ function inherited(opts) {
 }
 function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
-    ...opts.owners ? caller : {},
+    ...opts.owners ? caller : { umask: caller.umask },
     ...opts.dac ? { dac: opts.dac, pid: opts.pid, created: caller.created } : {},
     ...opts.links !== void 0 ? { links: opts.links } : {},
     ...opts.fresh ? { fresh: (path) => opts.fresh?.(path, caller.umask()) } : {},
@@ -15614,7 +16041,7 @@ function scrubberOf(secrets) {
   const usable = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
   return usable.length > 0 ? compile(usable, { idleMs: SCRUB_IDLE_MS }) : void 0;
 }
-async function writeAll2(file, bytes) {
+async function writeAll3(file, bytes) {
   const write = file.write;
   for (let at = 0; at < bytes.length; ) at += await write.call(file, bytes.subarray(at));
 }
@@ -15648,7 +16075,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   const later = (bytes) => {
     if (bytes.length === 0) return;
     pending += 1;
-    tail = tail.then(() => writeAll2(file, bytes)).catch((err) => {
+    tail = tail.then(() => writeAll3(file, bytes)).catch((err) => {
       if (failed3 === void 0) failed3 = err;
     }).finally(() => {
       pending -= 1;
@@ -16279,8 +16706,8 @@ var FSA_CAPABILITIES = {
   ranges: true,
   sessions: true
 };
-var codeOf2 = (err) => err?.code;
-var denied = (err) => codeOf2(err) === "EACCES" || err?.name === "NotAllowedError";
+var codeOf3 = (err) => err?.code;
+var denied = (err) => codeOf3(err) === "EACCES" || err?.name === "NotAllowedError";
 function attrOf(st) {
   return {
     kind: st.isDirectory ? "directory" : st.isSymbolicLink ? "symlink" : "file",
@@ -16302,7 +16729,7 @@ function kernelFsHandlers(fs) {
     try {
       return await fs.stat(path);
     } catch (err) {
-      if (codeOf2(err) === "ENOENT") return void 0;
+      if (codeOf3(err) === "ENOENT") return void 0;
       throw err;
     }
   }
@@ -16495,7 +16922,7 @@ function parseFstab(text) {
   });
   return lines2;
 }
-function codeOf3(err) {
+function codeOf4(err) {
   const code = err?.code;
   return typeof code === "string" ? code : "EIO";
 }
@@ -16533,18 +16960,18 @@ async function mountLine({ line, spec, invalid }, mount, signal, retries, discar
       break;
     } catch (err) {
       failed3 = err;
-      if (FINAL.has(codeOf3(err)) || attempt === retries.length) break;
+      if (FINAL.has(codeOf4(err)) || attempt === retries.length) break;
       await wait(retries[attempt], signal);
     }
   }
-  const code = codeOf3(failed3);
+  const code = codeOf4(failed3);
   return { line, target: spec.target, code, error: String(failed3?.message ?? code) };
 }
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf4 = (err) => err?.code;
-var unreachable = (err) => codeOf4(err) === "ENOTCONN";
+var codeOf5 = (err) => err?.code;
+var unreachable = (err) => codeOf5(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -16604,9 +17031,9 @@ var HostfsClient = class {
         throw fsError2("ESTALE", "the folder was granted again, so its open files are gone");
       return this.send(path, init, false, true);
     }
-    const errno = response.headers.get("X-Hostfs-Errno") ?? "EIO";
+    const errno2 = response.headers.get("X-Hostfs-Errno") ?? "EIO";
     const body = await response.json().catch(() => ({}));
-    throw fsError2(errno, typeof body.message === "string" ? body.message : errno);
+    throw fsError2(errno2, typeof body.message === "string" ? body.message : errno2);
   }
   async call(op, body = {}, handle = false) {
     const response = await this.send(
@@ -16721,7 +17148,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     try {
       return { opened: await opening2(), restore: void 0 };
     } catch (err) {
-      if (!flags2.write || codeOf4(err) !== "EACCES") throw err;
+      if (!flags2.write || codeOf5(err) !== "EACCES") throw err;
       const was = await client.call("stat", { path: rel(path) });
       const mode = was.mode ?? 0;
       if (mode & 128) throw err;
@@ -17634,8 +18061,8 @@ var RULE = new RegExp(
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
-function failed2(errno, error) {
-  return { error, errno };
+function failed2(errno2, error) {
+  return { error, errno: errno2 };
 }
 function unescaped(double) {
   return double.replace(/\\(["\\$`])/g, "$1");
@@ -18929,6 +19356,12 @@ var Launcher = class {
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
+  loopbackFor(pid) {
+    return new KernelLoopback(this.net, () => {
+      const cred = this.credOf(pid);
+      return { pid, uid: cred.euid, gid: cred.egid };
+    });
+  }
   treeScrubs(req) {
     const inherited2 = req.ppid !== void 0 ? this.scrubs.get(req.ppid) : void 0;
     return req.scrub ? [...inherited2 ?? [], req.scrub] : inherited2;
@@ -19006,7 +19439,7 @@ var Launcher = class {
       jobs: this.jobs,
       ptys: this.ptys,
       net: this.net,
-      http: new HttpHandles(this.transport, pid),
+      http: new HttpHandles(this.transport, pid, this.loopbackFor(pid)),
       locks: this.locks,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child, pid),