@ai-ecoverse/slicc-kernel 1.91.0 → 1.93.0

package/dist/node-process-worker.js

@@ -44,17 +44,20 @@ function hide(target, names) {
 }
 function vacate(target, names) {
   for (const name2 of names) {
-    for (let at = target; at && at !== Object.prototype; ) {
-      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
-      at = Object.getPrototypeOf(at);
+    const holders = chain(target);
+    for (const holder of holders) {
+      if (Object.getOwnPropertyDescriptor(holder, name2)?.configurable) {
+        Reflect.deleteProperty(holder, name2);
+      }
     }
-    Reflect.defineProperty(target, name2, {
+    const kept = holders.slice(1).some((holder) => Object.hasOwn(holder, name2));
+    const opened2 = Reflect.defineProperty(target, name2, {
       value: void 0,
       writable: true,
       enumerable: false,
       configurable: true
     });
-    if (Reflect.get(target, name2) !== void 0) {
+    if (kept || !opened2 || Reflect.get(target, name2) !== void 0) {
       throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
     }
   }
@@ -80,7 +83,6 @@ var init_lockdown = __esm({
       "cookieStore",
       "Worker",
       "SharedWorker",
-      "BroadcastChannel",
       "postMessage",
       "close",
       "webkitRequestFileSystem",
@@ -97,7 +99,7 @@ var init_lockdown = __esm({
       "hid",
       "serial"
     ];
-    OPEN_SLOTS = ["fetch", "WebSocket"];
+    OPEN_SLOTS = ["fetch", "WebSocket", "BroadcastChannel"];
   }
 });
 
@@ -653,9 +655,11 @@ function cachingBridge(bridge, now = () => performance.now(), shared) {
     ...bridge.kept ? { kept: bridge.kept.bind(bridge) } : {},
     ...bridge.keptStat ? { keptStat: bridge.keptStat.bind(bridge) } : {},
     ...bridge.pinned ? { pinned: (handle) => pinnedIo(bridge, handle, rewriting) } : {},
-    ...bridge.create ? { create: (p) => mutating(() => bridge.create?.(p), ...entry(p)) } : {},
+    ...bridge.create ? {
+      create: (p, mode, opening2) => mutating(() => bridge.create?.(p, mode, opening2), ...entry(p))
+    } : {},
     ...chown ? {
-      chown: (p, uid, gid, follow2) => rewriting(p, () => chown.call(bridge, p, uid, gid, follow2))
+      chown: (p, ...rest2) => rewriting(p, () => chown.call(bridge, p, ...rest2))
     } : {},
     ...bridge.pread && bridge.pwrite && bridge.truncate ? {
       pread: bridge.pread.bind(bridge),
@@ -993,6 +997,100 @@ var init_protocol = __esm({
   }
 });
 
+// src/realm/sync-sab-wire.ts
+function loadBlocked(header) {
+  return [Atomics.load(header, SAB_I_BLOCKED), Atomics.load(header, SAB_I_BLOCKED_HI)];
+}
+function storeBlocked(header, [low, high]) {
+  Atomics.store(header, SAB_I_BLOCKED_HI, high);
+  Atomics.store(header, SAB_I_BLOCKED, low);
+}
+function loadU53(header, lo, hi) {
+  return (Atomics.load(header, lo) >>> 0) + Atomics.load(header, hi) * U32;
+}
+function publishMemory(sab, bytes) {
+  if (bytes > 0)
+    Atomics.store(new Int32Array(sab, 0, SAB_HEADER_I32), SAB_I_MEMORY, Math.ceil(bytes / 65536));
+}
+function decodeSabResult(status2, payload) {
+  switch (status2) {
+    case SAB_STATUS_BYTES:
+      return { ok: true, kind: "bytes", bytes: payload };
+    case SAB_STATUS_VOID:
+      return { ok: true, kind: "void" };
+    case SAB_STATUS_JSON: {
+      try {
+        return { ok: true, kind: "json", json: JSON.parse(decoder.decode(payload)) };
+      } catch {
+        return { ok: false, errno: "EIO", message: "sync-sab: malformed json payload" };
+      }
+    }
+    case SAB_STATUS_ERRNO: {
+      try {
+        const parsed = JSON.parse(decoder.decode(payload));
+        const errno2 = typeof parsed.errno === "string" && /^E[A-Z]+$|^EAI_[A-Z]+$/.test(parsed.errno) ? parsed.errno : "EIO";
+        return { ok: false, errno: errno2, message: String(parsed.message ?? errno2) };
+      } catch {
+        return { ok: false, errno: "EIO", message: "sync-sab: malformed errno payload" };
+      }
+    }
+    default:
+      return { ok: false, errno: "EIO", message: `sync-sab: unknown status ${status2}` };
+  }
+}
+function sabViews(sab) {
+  if (sab.byteLength < SAB_MIN_BYTES) {
+    throw new Error(`sync-sab: buffer too small (${sab.byteLength} < ${SAB_MIN_BYTES})`);
+  }
+  return {
+    header: new Int32Array(sab, 0, SAB_HEADER_I32),
+    window: new Uint8Array(sab, SAB_HEADER_BYTES)
+  };
+}
+var SAB_HEADER_I32, SAB_CLOCK_OFFSET, SAB_CLOCK_I64, SAB_HEADER_BYTES, SAB_I_STATE, SAB_I_SEQ, SAB_I_STATUS, SAB_I_TOTAL, SAB_I_CHUNK, SAB_I_OFFSET, SAB_I_REQ, SAB_I_PUB, SAB_I_SIGNALS, SAB_I_TIMERS, SAB_I_MEMORY, SAB_I_TOTAL_HI, SAB_I_OFFSET_HI, SAB_I_KILLED, SAB_I_ASYNC, SAB_I_STOP, SAB_I_BLOCKED, SAB_I_BLOCKED_HI, anyBlocked, U32, SAB_STATE_IDLE, SAB_STATE_PENDING, SAB_STATE_READY, SAB_STATUS_BYTES, SAB_STATUS_JSON, SAB_STATUS_VOID, SAB_STATUS_ERRNO, SAB_DEFAULT_WINDOW_BYTES, SAB_MIN_BYTES, SYNC_SAB_REQ_MSG, SYNC_SAB_NEXT_MSG, encoder, decoder;
+var init_sync_sab_wire = __esm({
+  "src/realm/sync-sab-wire.ts"() {
+    "use strict";
+    SAB_HEADER_I32 = 18;
+    SAB_CLOCK_OFFSET = SAB_HEADER_I32 * 4;
+    SAB_CLOCK_I64 = 3;
+    SAB_HEADER_BYTES = SAB_CLOCK_OFFSET + SAB_CLOCK_I64 * 8;
+    SAB_I_STATE = 0;
+    SAB_I_SEQ = 1;
+    SAB_I_STATUS = 2;
+    SAB_I_TOTAL = 3;
+    SAB_I_CHUNK = 4;
+    SAB_I_OFFSET = 5;
+    SAB_I_REQ = 6;
+    SAB_I_PUB = 7;
+    SAB_I_SIGNALS = 8;
+    SAB_I_TIMERS = 9;
+    SAB_I_MEMORY = 10;
+    SAB_I_TOTAL_HI = 11;
+    SAB_I_OFFSET_HI = 12;
+    SAB_I_KILLED = 13;
+    SAB_I_ASYNC = 14;
+    SAB_I_STOP = 15;
+    SAB_I_BLOCKED = 16;
+    SAB_I_BLOCKED_HI = 17;
+    anyBlocked = (mask) => mask !== void 0 && (mask[0] !== 0 || mask[1] !== 0);
+    U32 = 2 ** 32;
+    SAB_STATE_IDLE = 0;
+    SAB_STATE_PENDING = 1;
+    SAB_STATE_READY = 2;
+    SAB_STATUS_BYTES = 1;
+    SAB_STATUS_JSON = 2;
+    SAB_STATUS_VOID = 3;
+    SAB_STATUS_ERRNO = 4;
+    SAB_DEFAULT_WINDOW_BYTES = 1024 * 1024;
+    SAB_MIN_BYTES = SAB_HEADER_BYTES + 4096;
+    SYNC_SAB_REQ_MSG = "sync-sab-req";
+    SYNC_SAB_NEXT_MSG = "sync-sab-next";
+    encoder = new TextEncoder();
+    decoder = new TextDecoder();
+  }
+});
+
 // src/process/wasi/wasi-threads.ts
 function threadCap(env) {
   const asked = Number.parseInt(env.SLICC_WASM_THREADS ?? "", 10);
@@ -1003,6 +1101,7 @@ var init_wasi_threads = __esm({
   "src/process/wasi/wasi-threads.ts"() {
     "use strict";
     init_protocol();
+    init_sync_sab_wire();
     init_wasi_files();
     LAST_TID = 0;
     RUNNING = 1;
@@ -1038,7 +1137,7 @@ var init_wasi_threads = __esm({
         this.beforeSpawn?.();
         const tid = Atomics.add(this.ids, LAST_TID, 1) + 1;
         const modules = this.modules?.();
-        const blocked = this.blocked?.() ?? 0;
+        const blocked = this.blocked?.();
         this.port.postMessage({
           type: WASM_THREAD_SPAWN,
           thread: {
@@ -1047,7 +1146,7 @@ var init_wasi_threads = __esm({
             memory: this.memory,
             ids: this.ids.buffer,
             ...modules ? { modules } : {},
-            ...blocked ? { blocked } : {}
+            ...anyBlocked(blocked) ? { blocked } : {}
           }
         });
         return tid;
@@ -1114,6 +1213,21 @@ function physicalPath(fs, path) {
   }
   return `/${walk.done.join("/")}`;
 }
+async function physicalPathAsync(fs, path) {
+  const walk = start(path);
+  for (let part = next(walk); part !== void 0; part = next(walk)) {
+    const at = `/${[...walk.done, part].join("/")}`;
+    let target;
+    try {
+      target = (await fs.lstat(at)).isSymbolicLink ? await fs.readlink(at) : void 0;
+    } catch {
+      return rest(walk, part);
+    }
+    if (target === void 0) walk.done.push(part);
+    else if (!follow(walk, target)) return lexical(path);
+  }
+  return `/${walk.done.join("/")}`;
+}
 var MAX_HOPS;
 var init_physical_path = __esm({
   "src/fs/physical-path.ts"() {
@@ -1122,88 +1236,18 @@ var init_physical_path = __esm({
   }
 });
 
-// src/realm/sync-sab-wire.ts
-function loadU53(header, lo, hi) {
-  return (Atomics.load(header, lo) >>> 0) + Atomics.load(header, hi) * U32;
+// src/fs/dev-removal.ts
+function inDevTree(path) {
+  return path === "/dev" || path.startsWith("/dev/");
 }
-function publishMemory(sab, bytes) {
-  if (bytes > 0)
-    Atomics.store(new Int32Array(sab, 0, SAB_HEADER_I32), SAB_I_MEMORY, Math.ceil(bytes / 65536));
-}
-function decodeSabResult(status2, payload) {
-  switch (status2) {
-    case SAB_STATUS_BYTES:
-      return { ok: true, kind: "bytes", bytes: payload };
-    case SAB_STATUS_VOID:
-      return { ok: true, kind: "void" };
-    case SAB_STATUS_JSON: {
-      try {
-        return { ok: true, kind: "json", json: JSON.parse(decoder.decode(payload)) };
-      } catch {
-        return { ok: false, errno: "EIO", message: "sync-sab: malformed json payload" };
-      }
-    }
-    case SAB_STATUS_ERRNO: {
-      try {
-        const parsed = JSON.parse(decoder.decode(payload));
-        const errno2 = typeof parsed.errno === "string" && /^E[A-Z]+$|^EAI_[A-Z]+$/.test(parsed.errno) ? parsed.errno : "EIO";
-        return { ok: false, errno: errno2, message: String(parsed.message ?? errno2) };
-      } catch {
-        return { ok: false, errno: "EIO", message: "sync-sab: malformed errno payload" };
-      }
-    }
-    default:
-      return { ok: false, errno: "EIO", message: `sync-sab: unknown status ${status2}` };
-  }
+function devRemoval(path, cred) {
+  if (!inDevTree(path)) return void 0;
+  if (cred && cred.euid !== 0) return "EACCES";
+  return path === "/dev" ? "EBUSY" : "EPERM";
 }
-function sabViews(sab) {
-  if (sab.byteLength < SAB_MIN_BYTES) {
-    throw new Error(`sync-sab: buffer too small (${sab.byteLength} < ${SAB_MIN_BYTES})`);
-  }
-  return {
-    header: new Int32Array(sab, 0, SAB_HEADER_I32),
-    window: new Uint8Array(sab, SAB_HEADER_BYTES)
-  };
-}
-var SAB_HEADER_I32, SAB_CLOCK_OFFSET, SAB_CLOCK_I64, SAB_HEADER_BYTES, SAB_I_STATE, SAB_I_SEQ, SAB_I_STATUS, SAB_I_TOTAL, SAB_I_CHUNK, SAB_I_OFFSET, SAB_I_REQ, SAB_I_PUB, SAB_I_SIGNALS, SAB_I_TIMERS, SAB_I_MEMORY, SAB_I_TOTAL_HI, SAB_I_OFFSET_HI, SAB_I_KILLED, SAB_I_ASYNC, SAB_I_STOP, SAB_I_BLOCKED, U32, SAB_STATE_IDLE, SAB_STATE_PENDING, SAB_STATE_READY, SAB_STATUS_BYTES, SAB_STATUS_JSON, SAB_STATUS_VOID, SAB_STATUS_ERRNO, SAB_DEFAULT_WINDOW_BYTES, SAB_MIN_BYTES, SYNC_SAB_REQ_MSG, SYNC_SAB_NEXT_MSG, encoder, decoder;
-var init_sync_sab_wire = __esm({
-  "src/realm/sync-sab-wire.ts"() {
+var init_dev_removal = __esm({
+  "src/fs/dev-removal.ts"() {
     "use strict";
-    SAB_HEADER_I32 = 18;
-    SAB_CLOCK_OFFSET = SAB_HEADER_I32 * 4;
-    SAB_CLOCK_I64 = 3;
-    SAB_HEADER_BYTES = SAB_CLOCK_OFFSET + SAB_CLOCK_I64 * 8;
-    SAB_I_STATE = 0;
-    SAB_I_SEQ = 1;
-    SAB_I_STATUS = 2;
-    SAB_I_TOTAL = 3;
-    SAB_I_CHUNK = 4;
-    SAB_I_OFFSET = 5;
-    SAB_I_REQ = 6;
-    SAB_I_PUB = 7;
-    SAB_I_SIGNALS = 8;
-    SAB_I_TIMERS = 9;
-    SAB_I_MEMORY = 10;
-    SAB_I_TOTAL_HI = 11;
-    SAB_I_OFFSET_HI = 12;
-    SAB_I_KILLED = 13;
-    SAB_I_ASYNC = 14;
-    SAB_I_STOP = 15;
-    SAB_I_BLOCKED = 16;
-    U32 = 2 ** 32;
-    SAB_STATE_IDLE = 0;
-    SAB_STATE_PENDING = 1;
-    SAB_STATE_READY = 2;
-    SAB_STATUS_BYTES = 1;
-    SAB_STATUS_JSON = 2;
-    SAB_STATUS_VOID = 3;
-    SAB_STATUS_ERRNO = 4;
-    SAB_DEFAULT_WINDOW_BYTES = 1024 * 1024;
-    SAB_MIN_BYTES = SAB_HEADER_BYTES + 4096;
-    SYNC_SAB_REQ_MSG = "sync-sab-req";
-    SYNC_SAB_NEXT_MSG = "sync-sab-next";
-    encoder = new TextEncoder();
-    decoder = new TextDecoder();
   }
 });
 
@@ -1830,6 +1874,7 @@ var init_wasi_fds = __esm({
         const { buffer } = e.file;
         try {
           buffer.flush();
+          this.reported.delete(buffer);
         } catch (err) {
           this.reported.add(buffer);
           this.drop(buffer);
@@ -1895,6 +1940,7 @@ var init_wasi_fds = __esm({
         for (const buffer of this.buffers.values()) {
           try {
             buffer.flush();
+            this.reported.delete(buffer);
           } catch (err) {
             if (!this.reported.has(buffer)) throw err;
           }
@@ -2117,7 +2163,7 @@ var init_wasi_fds = __esm({
           return true;
         }
         try {
-          this.fs.create(path);
+          this.fs.create(path, void 0, true);
           return true;
         } catch (err) {
           if (oflags & OFLAGS.EXCL || err.code !== "EEXIST") throw err;
@@ -2508,6 +2554,7 @@ var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW, AT_EACCESS, ROOT_IDS, GONE, S
 var init_wasi_host = __esm({
   "src/process/wasi/wasi-host.ts"() {
     "use strict";
+    init_dev_removal();
     init_physical_path();
     init_cpu_clock();
     init_cred();
@@ -2605,10 +2652,10 @@ var init_wasi_host = __esm({
           return path;
         };
         const modeOf2 = (st) => (st.mode ?? 0) & 4095;
-        const chown = (path, uid, gid, follow2) => {
+        const chown = (path, uid, gid, follow2, handle) => {
           const { chown: own } = this.o.fs;
           if (!own) throw new WasiError("ENOSYS");
-          own.call(this.o.fs, path, idOf(uid), idOf(gid), follow2);
+          own.call(this.o.fs, path, idOf(uid), idOf(gid), follow2, handle);
         };
         const caller = () => {
           const cred = this.o.kernel.call({ op: "proc-cred" });
@@ -2639,7 +2686,11 @@ var init_wasi_host = __esm({
           return follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path);
         };
         return wrap({
-          fd_chown: (fd, uid, gid) => void chown(pathOf(fd), uid, gid, true),
+          fd_chown: (fd, uid, gid) => {
+            const e = fds.get(fd);
+            const handle = e.type === "file" ? e.file.buffer.handle : void 0;
+            void chown(pathOf(fd), uid, gid, true, handle);
+          },
           path_chown: (dirfd, p, l, uid, gid, flags) => void chown(at(dirfd, p, l), uid, gid, (flags & AT_SYMLINK_NOFOLLOW) === 0),
           fd_owner: (fd, out) => {
             if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
@@ -2651,14 +2702,14 @@ var init_wasi_host = __esm({
             owner(fdOwned(fd), out);
           },
           path_filestat_owner: (dirfd, lookup2, p, l, statOut, out) => {
-            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             const path = at(dirfd, p, l);
+            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             this.writeFilestat(statOut, this.pathFilestat(path, lookup2));
             owner(pathOwned(path, (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0), out);
           },
           path_owner: (dirfd, p, l, flags, out) => {
-            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             const path = at(dirfd, p, l);
+            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             owner(pathOwned(path, (flags & AT_SYMLINK_NOFOLLOW) === 0), out);
           },
           path_access: (dirfd, p, l, amode, flags) => {
@@ -2915,14 +2966,35 @@ var init_wasi_host = __esm({
         const { mem, fds, o } = this;
         const at = (dirfd, p, l) => fds.resolve(dirfd, mem.string(p, l));
         return {
-          path_open: (dirfd, _lookup, p, l, oflags, rights, _inheriting, fdflags, out) => {
-            const path = at(dirfd, p, l);
-            if (deviceOf(path)) this.interrupted?.();
-            const fresh = (oflags & OFLAGS.CREAT) !== 0 && !this.synthetic(path) && !o.fs.exists(path);
-            mem.view().setUint32(out, fds.open(path, oflags, rights, fdflags), true);
-            if (fresh) this.created(path, 438);
+          path_open: (dirfd, lookup2, p, l, oflags, rights, _inheriting, fdflags, out) => {
+            const follow2 = (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0;
+            try {
+              const path = at(dirfd, p, l);
+              if (deviceOf(path)) this.interrupted?.();
+              const fresh = (oflags & OFLAGS.CREAT) !== 0 && !this.synthetic(path) && !o.fs.exists(path);
+              mem.view().setUint32(out, fds.open(path, oflags, rights, fdflags), true);
+              if (fresh) this.created(path, 438);
+            } catch (err) {
+              if (err.code !== "ENOENT") throw err;
+              const raw = mem.string(p, l);
+              const joined2 = raw.startsWith("/") ? raw : `${fds.dir(dirfd).path}/${raw}`;
+              const resolved2 = this.resolveForDev(joined2, follow2);
+              if (!resolved2) throw err;
+              mem.view().setUint32(out, fds.open(resolved2, oflags, rights, fdflags), true);
+            }
+          },
+          path_filestat_get: (dirfd, lookup2, p, l, out) => {
+            try {
+              this.writeFilestat(out, this.pathFilestat(at(dirfd, p, l), lookup2));
+            } catch (err) {
+              if (err.code !== "ENOENT") throw err;
+              const raw = mem.string(p, l);
+              const joined2 = raw.startsWith("/") ? raw : `${fds.dir(dirfd).path}/${raw}`;
+              const resolved2 = this.resolveForDev(joined2, (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0);
+              if (!resolved2) throw err;
+              this.writeFilestat(out, this.pathFilestat(resolved2, lookup2));
+            }
           },
-          path_filestat_get: (dirfd, lookup2, p, l, out) => void this.writeFilestat(out, this.pathFilestat(at(dirfd, p, l), lookup2)),
           path_filestat_set_times: (dirfd, lookup2, p, l, atim, mtim, flags) => {
             const path = at(dirfd, p, l);
             fds.flushPath(path);
@@ -2937,6 +3009,7 @@ var init_wasi_host = __esm({
           path_remove_directory: (dirfd, p, l) => void o.fs.rmdir(at(dirfd, p, l)),
           path_unlink_file: (dirfd, p, l) => {
             const path = at(dirfd, p, l);
+            if (inDevTree(path)) return void o.fs.unlink(path);
             const st = o.fs.lstat(path);
             if (st.isDirectory) throw new WasiError("EISDIR");
             const linked = linkedOf(st);
@@ -3168,7 +3241,12 @@ var init_wasi_host = __esm({
         const v = this.mem.view();
         v.setUint8(out, filetype);
         v.setUint16(out + 2, flags, true);
-        const rights = seeks ? RIGHTS.ALL : RIGHTS.ALL & ~(RIGHTS.FD_SEEK | RIGHTS.FD_TELL);
+        let rights = seeks ? RIGHTS.ALL : RIGHTS.ALL & ~(RIGHTS.FD_SEEK | RIGHTS.FD_TELL);
+        if (e.type === "kernel") {
+          const access = this.o.kernel.sys.access?.(fd);
+          if (access === "read") rights &= ~RIGHTS.FD_WRITE;
+          else if (access === "write") rights &= ~RIGHTS.FD_READ;
+        }
         v.setBigUint64(out + 8, rights, true);
         v.setBigUint64(out + 16, RIGHTS.ALL, true);
       }
@@ -3234,6 +3312,21 @@ var init_wasi_host = __esm({
       synthetic(path) {
         return deviceOf(path) !== void 0 || path === SEALED_PATH && !!this.o.kernel.sys.openSealed || path === CLIPBOARD_PATH && !!this.o.kernel.sys.openClipboard;
       }
+      resolveForDev(path, follow2 = true) {
+        try {
+          if (!follow2) {
+            const slash = path.lastIndexOf("/");
+            if (slash <= 0) return void 0;
+            const parent = physicalPath(this.o.fs, path.slice(0, slash));
+            const resolved3 = `${parent}/${path.slice(slash + 1)}`;
+            return resolved3 !== path && this.synthetic(resolved3) ? resolved3 : void 0;
+          }
+          const resolved2 = physicalPath(this.o.fs, path);
+          return resolved2 !== path && this.synthetic(resolved2) ? resolved2 : void 0;
+        } catch {
+          return void 0;
+        }
+      }
       pathFilestat(path, lookup2) {
         if (this.synthetic(path)) {
           return this.local({
@@ -3245,7 +3338,19 @@ var init_wasi_host = __esm({
         }
         this.fds.flushPath(path);
         const follow2 = (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0;
-        return filestatOf(path, follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path));
+        try {
+          return filestatOf(path, follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path));
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+          const resolved2 = this.resolveForDev(path, follow2);
+          if (!resolved2) throw err;
+          return this.local({
+            filetype: FILETYPE.CHARACTER_DEVICE,
+            size: 0n,
+            ino: pathInode(resolved2),
+            mtimeNs: 0n
+          });
+        }
       }
       setTimes(path, atim, mtim, flags, follow2 = true) {
         const asked = FSTFLAGS.ATIM | FSTFLAGS.ATIM_NOW | FSTFLAGS.MTIM | FSTFLAGS.MTIM_NOW;
@@ -3508,7 +3613,8 @@ var init_wasix_process = __esm({
           cwd: this.host.cwd,
           ...fds.isShared ? { shared: true } : {},
           setjmps: this.driver.setjmps(),
-          ...this.host.signals ? { signals: this.host.signals.snapshot() } : {}
+          ...this.host.signals ? { signals: this.host.signals.snapshot() } : {},
+          ...this.host.sigmask ? { blocked: this.host.sigmask.inherited() } : {}
         };
         return this.call({
           op: "proc-fork",
@@ -3638,6 +3744,7 @@ function importsContext({
     fs,
     fds,
     syscall: call2,
+    net: network(raw, call2),
     ...processes(host, call2, tid !== MAIN_TID),
     async: {
       submit: (req) => call2({ op: "async-submit", req }),
@@ -3673,6 +3780,30 @@ function importsContext({
     gid: { get: () => live().gid, enumerable: true }
   });
 }
+function loopbackHost(host) {
+  if (host === "localhost") return "127.0.0.1";
+  if (typeof host === "string" && LOOPBACK.test(host)) return host;
+  throw new WasiError("EINVAL");
+}
+function network(raw, call2) {
+  return {
+    connect({ host, port: port3, nonblock = false }) {
+      const to = loopbackHost(host);
+      if (!Number.isInteger(port3) || port3 < 1 || port3 > 65535) throw new WasiError("EINVAL");
+      const fd = call2({ op: "sock-open", domain: "inet" });
+      const addr = { family: "inet", host: to, port: port3 };
+      const r = raw({ op: "sock-connect", fd, addr, ...nonblock ? { nonblock: true } : {} });
+      if (r.ok || nonblock && r.errno === "EINPROGRESS") return fd;
+      raw({ op: "fd-close", fd });
+      throw new WasiError(r.errno);
+    },
+    ready(fd) {
+      const sel = call2({ op: "fd-select", read: [], write: [fd], timeoutMs: 0 });
+      if (!sel.write.includes(fd)) return E.INPROGRESS;
+      return call2({ op: "sock-getopt", fd, level: SOL_SOCKET, name: SO_ERROR });
+    }
+  };
+}
 function processes(host, call2, inThread) {
   const close = (fd) => void call2({ op: "fd-close", fd });
   const slot2 = (n, how, mine, theirs) => {
@@ -3730,7 +3861,7 @@ function processes(host, call2, inThread) {
     }
   };
 }
-var UID, STDIO;
+var UID, LOOPBACK, SOL_SOCKET, SO_ERROR, STDIO;
 var init_wasi_imports = __esm({
   "src/process/wasi/wasi-imports.ts"() {
     "use strict";
@@ -3739,6 +3870,9 @@ var init_wasi_imports = __esm({
     init_wasi_threads();
     init_wasix_process();
     UID = 1e3;
+    LOOPBACK = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+    SOL_SOCKET = 1;
+    SO_ERROR = 4;
     STDIO = ["stdin", "stdout", "stderr"];
   }
 });
@@ -3884,12 +4018,19 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.91.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.93.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
 
 // src/process/js/js-kernel.ts
+function umaskRequest(mask) {
+  if (mask === void 0) return { op: "proc-umask" };
+  if (!Number.isInteger(mask) || mask < 0 || mask > 511) {
+    throw new JsCallError("EINVAL", "umask");
+  }
+  return { op: "proc-umask", mask };
+}
 function modeOf(mode) {
   if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
     throw new JsCallError("EINVAL", "chmod");
@@ -4114,6 +4255,8 @@ var init_js_kernel = __esm({
 
 // src/process/js/js-children.ts
 function exitedOf(status2) {
+  if ((status2 & 255) === 127)
+    return { status: 128 + (status2 >> 8 & 255), signal: status2 >> 8 & 255, stopped: true };
   const signal = status2 & 127;
   return signal ? { status: 128 + signal, signal } : { status: status2 >> 8 & 255 };
 }
@@ -4150,8 +4293,10 @@ function writable(io, fd) {
   });
 }
 function childOps(kernel, io, defaults, sync) {
-  const wait2 = async (pid) => {
-    const r = await kernel.blocking({ op: "proc-wait", pid, nohang: false });
+  const wait2 = async (pid, options = {}) => {
+    if (typeof options !== "object" || options === null) throw new JsCallError("EINVAL", "wait");
+    const untraced = options.untraced === true ? { untraced: true } : {};
+    const r = await kernel.blocking({ op: "proc-wait", pid, nohang: false, ...untraced });
     const [, status2] = r.ok && r.kind === "json" ? r.json : [0, 0];
     return exitedOf(status2);
   };
@@ -4165,7 +4310,7 @@ function childOps(kernel, io, defaults, sync) {
       ...stdin !== void 0 ? { stdin: writable(io, stdin) } : {},
       ...stdout !== void 0 ? { stdout: readable(io, stdout) } : {},
       ...stderr !== void 0 ? { stderr: readable(io, stderr) } : {},
-      wait: () => wait2(pid),
+      wait: (options) => wait2(pid, options),
       kill: (signal) => kill(pid, signal)
     };
   };
@@ -4371,7 +4516,8 @@ function openRequest(abs, o) {
     flags: flagsOf(o),
     position: 0,
     ...isExclusive(o) ? { exclusive: true } : o.create ? { create: true } : { existing: true },
-    ...o.truncate ? { truncate: true } : {}
+    ...o.truncate ? { truncate: true } : {},
+    ...o.create || isExclusive(o) ? { mode: o.mode === void 0 ? 438 : modeOf(o.mode) } : {}
   };
 }
 function index2(n, what) {
@@ -4430,6 +4576,7 @@ function* lookup(abs) {
     const names = yield { op: "fd-tty-names" };
     if (names.includes(abs)) return { kind: "terminal", name: abs };
   }
+  if (name2 === "pts") return { kind: "dir", mode: DIR | 365 };
   const pts = /^pts\/(\d+)$/.exec(name2)?.[1];
   if (pts !== void 0) {
     const open = yield { op: "pty-list" };
@@ -4461,7 +4608,8 @@ function* fdStat(fd, path) {
   if (info.kind === "file") {
     const file = yield { op: "fd-vfs-stat", fd };
     if (file.orphan) return { ...nodeStat(33152, file.size), isFile: true };
-    return yield* pathStat(file.path);
+    const st = yield* pathStat(file.path);
+    return { ...st, size: file.size };
   }
   if (info.terminal) return yield* terminalStat(info.terminal);
   if (CHAR_KINDS.has(info.kind)) return nodeStat(CHAR | 438);
@@ -4514,16 +4662,26 @@ function* devReadlink(abs) {
   if (node.kind === "fd") return yield* fdTarget(node.fd, abs);
   throw new JsCallError("EINVAL", abs);
 }
+function* devResolveTarget(abs) {
+  const node = yield* lookup(abs);
+  if (node.kind === "fd") return yield* fdTarget(node.fd, abs);
+  if (node.kind === "link" && node.fd !== void 0) return yield* fdTarget(node.fd, abs);
+  return void 0;
+}
 function* devReaddir(abs) {
   if (abs === "/dev/fd") {
     const fds = yield { op: "fd-list" };
     return fds.map(({ fd }) => String(fd));
   }
+  if (abs === "/dev/pts") {
+    const open = yield { op: "pty-list" };
+    return open.map(String).sort();
+  }
   const node = yield* lookup(abs);
   if (node.kind !== "dir") throw new JsCallError("ENOTDIR", abs);
   const names = yield { op: "fd-tty-names" };
   const ttys = names.filter((n) => /^\/dev\/tty\d+$/.test(n)).map((n) => n.slice(5));
-  return [...DEVICES, "clipboard", "sealed", "tty", "fd", ...STDIO3, ...ttys].sort();
+  return [...DEVICES, "clipboard", "sealed", "tty", "fd", "pts", ...STDIO3, ...ttys].sort();
 }
 function* aliasOf(fd, abs, o) {
   const info = yield* fdInfo(fd, abs);
@@ -4532,6 +4690,9 @@ function* aliasOf(fd, abs, o) {
     const at = yield { op: "fd-vfs-stat", fd };
     if (!at.orphan)
       return { fd: yield openRequest(at.path, { ...o, create: false }), file };
+    const wantWrite = o.write === true || o.append === true || o.truncate === true;
+    if (wantWrite && info.access === "read") throw new JsCallError("EBADF", abs);
+    if (!wantWrite && info.access === "write") throw new JsCallError("EBADF", abs);
   }
   const copy2 = yield { op: "fd-dup", fd, min: 3 };
   if (file && o.truncate) {
@@ -4883,11 +5044,18 @@ function plain(status2, text) {
 function local2(url) {
   return isKernelLoopbackHost(new URL(url).hostname);
 }
+function badPort(url) {
+  const port3 = url.port ? Number(url.port) : 0;
+  return port3 !== 0 && BAD_PORTS.has(port3);
+}
 function rewrite(hop, status2, location) {
   const next2 = new URL(location, hop.url);
   if (next2.protocol !== "http:" && next2.protocol !== "https:") {
     throw failed(new JsCallError("EPROTONOSUPPORT", next2.protocol));
   }
+  if (badPort(next2)) {
+    throw failed(new JsCallError("EACCES", `bad port: ${next2.href}`));
+  }
   if (local2(next2.href) && !local2(hop.url)) {
     const from = new URL(hop.url).origin;
     throw failed(
@@ -5173,6 +5341,9 @@ function fetchOp(kernel) {
     if (protocol !== "http:" && protocol !== "https:") {
       throw failed(new JsCallError("EPROTONOSUPPORT", protocol));
     }
+    if (badPort(new URL(request.url))) {
+      throw failed(new JsCallError("EACCES", `bad port: ${request.url}`));
+    }
     let known = await traitsAt(request.url);
     if (!known.manualRedirects && request.redirect !== "follow") {
       throw failed(new JsCallError("ENOTSUP", `redirect: ${request.redirect}`));
@@ -5203,7 +5374,7 @@ function fetchOp(kernel) {
     }
   };
 }
-var CHUNK2, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTIALS, OVER, TOKEN, QUOTABLE, SPACE, BASE64, SLICE;
+var CHUNK2, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTIALS, BAD_PORTS, OVER, TOKEN, QUOTABLE, SPACE, BASE64, SLICE;
 var init_js_fetch = __esm({
   "src/process/js/js-fetch.ts"() {
     "use strict";
@@ -5222,6 +5393,89 @@ var init_js_fetch = __esm({
     ]);
     DECODED = /* @__PURE__ */ new Set(["gzip", "x-gzip", "deflate"]);
     CREDENTIALS = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2"]);
+    BAD_PORTS = /* @__PURE__ */ new Set([
+      1,
+      7,
+      9,
+      11,
+      13,
+      15,
+      17,
+      19,
+      20,
+      21,
+      22,
+      23,
+      25,
+      37,
+      42,
+      43,
+      53,
+      69,
+      77,
+      79,
+      87,
+      95,
+      101,
+      102,
+      103,
+      104,
+      109,
+      110,
+      111,
+      113,
+      115,
+      117,
+      119,
+      123,
+      135,
+      137,
+      139,
+      143,
+      161,
+      179,
+      389,
+      427,
+      465,
+      512,
+      513,
+      514,
+      515,
+      526,
+      530,
+      531,
+      532,
+      540,
+      548,
+      554,
+      556,
+      563,
+      587,
+      601,
+      636,
+      989,
+      990,
+      993,
+      995,
+      1719,
+      1720,
+      1723,
+      2049,
+      3659,
+      4045,
+      4190,
+      5060,
+      5061,
+      6e3,
+      6566,
+      6665,
+      6666,
+      6667,
+      6668,
+      6669,
+      6697,
+      10080
+    ]);
     OVER = /* @__PURE__ */ Symbol("over");
     TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
     QUOTABLE = /^[\t\x20-\x7e\x80-\xff]*$/;
@@ -5348,8 +5602,8 @@ function netOps(kernel, io) {
         const failed5 = await kernel.json({
           op: "sock-getopt",
           fd,
-          level: SOL_SOCKET,
-          name: SO_ERROR
+          level: SOL_SOCKET2,
+          name: SO_ERROR2
         });
         if (failed5 !== 0) throw new JsCallError(errnoName(failed5), "connect");
         return connection(fd);
@@ -5357,7 +5611,7 @@ function netOps(kernel, io) {
     }
   };
 }
-var SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET, SO_ERROR;
+var SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2;
 var init_js_net = __esm({
   "src/process/js/js-net.ts"() {
     "use strict";
@@ -5367,8 +5621,47 @@ var init_js_net = __esm({
     SHUT_WR = 1;
     IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
     NEVER = new AbortController().signal;
-    SOL_SOCKET = 1;
-    SO_ERROR = 4;
+    SOL_SOCKET2 = 1;
+    SO_ERROR2 = 4;
+  }
+});
+
+// src/fs/owners.ts
+function inGroup(cred, gid) {
+  return cred.egid === gid || cred.groups.includes(gid);
+}
+var ROOT_OWNER;
+var init_owners = __esm({
+  "src/fs/owners.ts"() {
+    "use strict";
+    init_types();
+    ROOT_OWNER = Object.freeze({ uid: 0, gid: 0 });
+  }
+});
+
+// src/fs/walk.ts
+var init_walk = __esm({
+  "src/fs/walk.ts"() {
+    "use strict";
+    init_types();
+  }
+});
+
+// src/fs/access.ts
+function permits(cred, perm, want, directory = true) {
+  const mode = perm.mode ?? (directory ? 493 : 420);
+  if (cred.euid === 0) return (want & X_OK) === 0 || directory || (mode & 73) !== 0;
+  const shift = cred.euid === perm.uid ? 6 : inGroup(cred, perm.gid) ? 3 : 0;
+  return (mode >> shift & want) === want;
+}
+var X_OK;
+var init_access = __esm({
+  "src/fs/access.ts"() {
+    "use strict";
+    init_owners();
+    init_types();
+    init_walk();
+    X_OK = 1;
   }
 });
 
@@ -5580,12 +5873,21 @@ function createSyncFsSabBridge(transport, opts = {}) {
     lutimes: (path, atimeMs, mtimeMs, now) => {
       run({ op: "lutimes", path, atimeMs, mtimeMs, ...now ? { now } : {} }, path);
     },
-    create: (path, mode) => {
-      run({ op: "create", path, ...mode !== void 0 ? { mode } : {} }, path);
+    create: (path, mode, opening2) => {
+      const flags = { ...mode !== void 0 ? { mode } : {}, ...opening2 ? { opening: opening2 } : {} };
+      run({ op: "create", path, ...flags }, path);
     },
-    chown: (path, uid, gid, follow2) => {
+    chown: (path, uid, gid, follow2, handle) => {
       const ids = { ...uid !== void 0 ? { uid } : {}, ...gid !== void 0 ? { gid } : {} };
-      changing({ op: follow2 ? "chown" : "lchown", path, ...ids }, path);
+      changing(
+        {
+          op: follow2 ? "chown" : "lchown",
+          path,
+          ...ids,
+          ...handle !== void 0 ? { handle } : {}
+        },
+        path
+      );
     },
     ...opts.owners ? { owners: true } : {},
     ...opts.links ? { links: true } : {},
@@ -5646,6 +5948,7 @@ function toMs(v) {
   return v instanceof Date ? v.getTime() : v;
 }
 function wantOf2(flags) {
+  if (flags & O_PATH) return 0;
   const mode = flags & O_ACCMODE;
   const read2 = mode === 1 ? 0 : HOLD_READ;
   const write2 = mode !== 0 || (flags & O_TRUNC) !== 0 ? HOLD_WRITE : 0;
@@ -5661,15 +5964,36 @@ function refusal(err) {
 function cachedStat(s, dir) {
   return s.stat !== void 0 && (!dir || s.statAt === syncCallCount());
 }
+function searchParents(Fs, node, bridge, call2) {
+  const cred = Fs.sliccCred;
+  if (!cred) return;
+  let cur = node.parent;
+  while (cur) {
+    const st = cur.live.stat;
+    if (st && st.uid !== void 0 && st.mode !== void 0) {
+      const perm = { uid: st.uid, gid: st.gid ?? 0, mode: st.mode & 4095 };
+      if (!permits(cred, perm, X_OK, true)) {
+        call2(() => bridge.access?.(liveNodePath(cur), X_OK, "eaccess"));
+        cur.live.stat = void 0;
+        return;
+      }
+    } else {
+      call2(() => bridge.access?.(liveNodePath(cur), X_OK, "eaccess"));
+      return;
+    }
+    if (cur === cur.parent) break;
+    cur = cur.parent;
+  }
+}
 function linkedStates(bridgeOf) {
   const opens = /* @__PURE__ */ new Map();
   const byId = /* @__PURE__ */ new Map();
-  const idOf3 = (st) => st?.ino === void 0 || (st.nlink ?? 1) < 2 ? void 0 : `${st.dev}:${st.ino}`;
+  const idOf4 = (st) => st?.ino === void 0 || (st.nlink ?? 1) < 2 ? void 0 : `${st.dev}:${st.ino}`;
   function know(s, id) {
     s.id = id;
     if (!byId.has(id)) byId.set(id, s);
   }
-  function opening(node, on) {
+  function opening2(node, on) {
     const s = node.live;
     if (!on) {
       opens.delete(s);
@@ -5678,14 +6002,14 @@ function linkedStates(bridgeOf) {
       return;
     }
     opens.set(s, node);
-    const id = idOf3(s.stat);
+    const id = idOf4(s.stat);
     if (id !== void 0) know(s, id);
   }
   function sharedWith(node) {
     const st = node.live.stat;
     if (st?.ino === void 0) return void 0;
     const id = `${st.dev}:${st.ino}`;
-    if (!byId.has(id) && idOf3(st) !== void 0) {
+    if (!byId.has(id) && idOf4(st) !== void 0) {
       for (const [s2, other] of opens) {
         if (s2.id !== void 0 || s2.orphan) continue;
         let st2;
@@ -5693,7 +6017,7 @@ function linkedStates(bridgeOf) {
           st2 = bridgeOf(other).lstat(liveNodePath(other));
         } catch {
         }
-        const known = idOf3(st2);
+        const known = idOf4(st2);
         if (known !== void 0) know(s2, known);
       }
     }
@@ -5701,7 +6025,7 @@ function linkedStates(bridgeOf) {
     return s && s !== node.live && !stale(s) ? s : void 0;
   }
   const holder = (node) => opens.get(node.live) ?? node;
-  return { opening, sharedWith, know, idOf: idOf3, holder };
+  return { opening: opening2, sharedWith, know, idOf: idOf4, holder };
 }
 function createHelpers(Fs, ops) {
   const bridgeOf = (node) => node.mount.opts.bridge;
@@ -5923,7 +6247,9 @@ function createNodeOps(h) {
       const owned = bridgeOf(node).owners === true;
       if (owned && Fs.isLink(node.mode) && statOf(node).uid === void 0)
         node.live.stat = void 0;
+      const cached = owned && cachedStat(node.live, Fs.isDir(node.mode));
       const st = statOf(node);
+      if (cached) searchParents(Fs, node, bridgeOf(node), call2);
       const s = node.live;
       const size = Fs.isDir(node.mode) ? 4096 : s.ranged?.size() ?? (s.loaded ? s.len : st.size);
       const mtime = new Date(st.mtimeMs ?? 0);
@@ -5986,7 +6312,7 @@ function createNodeOps(h) {
         if (masked !== DEFAULT_DIR_PERM) metadataCall(() => bridge.chmod(path, masked));
       } else if (Fs.isFile(mode)) {
         call2(
-          () => bridge.create ? bridge.create(path, perm) : bridge.writeFile(path, new Uint8Array(0))
+          () => bridge.create ? bridge.create(path, perm, opening.get(h.Fs) > 0) : bridge.writeFile(path, new Uint8Array(0))
         );
       } else {
         throw new Fs.ErrnoError(wasiErrno("EPERM"));
@@ -6232,10 +6558,24 @@ function createStreamOps(h) {
     }
   };
 }
+function countOpens(Fs) {
+  const { open } = Fs;
+  if (typeof open !== "function" || opening.has(Fs)) return;
+  opening.set(Fs, 0);
+  Fs.open = function(...args) {
+    opening.set(Fs, (opening.get(Fs) ?? 0) + 1);
+    try {
+      return open.apply(this, args);
+    } finally {
+      opening.set(Fs, (opening.get(Fs) ?? 1) - 1);
+    }
+  };
+}
 function createLiveVfsPlugin(Fs) {
   const mounts = /* @__PURE__ */ new Set();
   const ops = {};
   const h = createHelpers(Fs, ops);
+  countOpens(Fs);
   const nodeOps = createNodeOps(h);
   const streamOps = createStreamOps(h);
   ops.node = nodeOps;
@@ -6368,12 +6708,12 @@ function liveRoot(Fs, bridge) {
   };
 }
 function crosses(Fs, from, to) {
-  const parentOf = (path) => Fs.lookupPath?.(path, { parent: true }).node;
+  const parentOf2 = (path) => Fs.lookupPath?.(path, { parent: true }).node;
   const name2 = from.replace(/\/+$/, "").split("/").pop() ?? "";
   try {
-    const fromDir = parentOf(from);
+    const fromDir = parentOf2(from);
     const node = fromDir && Fs.lookupNode?.(fromDir, name2);
-    const dir = parentOf(to);
+    const dir = parentOf2(to);
     return !!node && !!dir && !!node.live !== !!dir.live;
   } catch {
     return false;
@@ -6437,6 +6777,25 @@ function guardRenames(Fs) {
 function idOf2(value2) {
   return value2 === -1 || value2 === 4294967295 ? void 0 : value2 >>> 0;
 }
+function chownHeld(Fs, node, s, uid, gid) {
+  const bridge = node.mount.opts.bridge;
+  const handle = s.handle;
+  try {
+    bridge.chown?.(liveNodePath(node), idOf2(uid), idOf2(gid), false, handle);
+  } catch (err) {
+    throw toErrno(Fs, err);
+  }
+  if (node.parent?.live) node.parent.live.listed = void 0;
+  if (!s.orphan) {
+    s.stat = void 0;
+    return;
+  }
+  try {
+    const st = bridge.keptStat?.(handle);
+    if (st && s.stat) s.stat = { ...s.stat, uid: st.uid, gid: st.gid, mode: st.mode };
+  } catch {
+  }
+}
 function useLiveChown(Fs) {
   const chown = Fs.chown?.bind(Fs);
   if (!chown) return;
@@ -6455,8 +6814,10 @@ function useLiveChown(Fs) {
   if (!Fs.fchown || !getStreamChecked) return;
   Fs.fchown = (fd, uid, gid) => {
     const stream = getStreamChecked.call(Fs, fd);
-    const live = stream.node.live !== void 0;
-    const target = live || stream.path === void 0 ? stream.node : stream.path;
+    const node = stream.node;
+    const s = node.live;
+    if (s?.handle !== void 0 && (!s.orphan || s.kept)) return chownHeld(Fs, node, s, uid, gid);
+    const target = s !== void 0 || stream.path === void 0 ? stream.node : stream.path;
     Fs.chown(target, uid, gid);
   };
 }
@@ -6517,10 +6878,11 @@ function readingLinks(Fs) {
     }
   };
 }
-var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale;
+var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale, opening;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
     "use strict";
+    init_access();
     init_ranged();
     init_types();
     init_wasi_errno();
@@ -6539,6 +6901,7 @@ var init_live_vfs_fs = __esm({
     O_TRUNC = 512;
     O_PATH = 2097152;
     stale = (s) => !!s.orphan && !s.kept;
+    opening = /* @__PURE__ */ new WeakMap();
   }
 });
 
@@ -6977,14 +7340,17 @@ function wasmMemory(instance, imports) {
   }
   return void 0;
 }
-function fdOfPath(path, cwd) {
+function absoluteOf(path, cwd) {
   const parts = [];
   for (const part of `${path.startsWith("/") ? "" : cwd}/${path}`.split("/")) {
     if (part === "" || part === ".") continue;
     if (part === "..") parts.pop();
     else parts.push(part);
   }
-  const abs = `/${parts.join("/")}`;
+  return `/${parts.join("/")}`;
+}
+function fdOfPath(path, cwd) {
+  const abs = absoluteOf(path, cwd);
   const std = ["/dev/stdin", "/dev/stdout", "/dev/stderr"].indexOf(abs);
   if (std >= 0) return std;
   const m = /^\/(?:dev|proc\/self)\/fd\/(\d+)$/.exec(abs);
@@ -7056,6 +7422,18 @@ function useZeroDevices(Fs) {
     mkdev.call(Fs, path, CHAR_DEVICE, dev);
   }
 }
+function useDevRemoval(Fs) {
+  const fs = Fs;
+  for (const name2 of ["unlink", "rmdir"]) {
+    const remove = fs[name2];
+    if (typeof remove !== "function") continue;
+    fs[name2] = (path) => {
+      const refused2 = devRemoval(absoluteOf(path, Fs.cwd()), fs.sliccCred);
+      if (refused2) throw new Fs.ErrnoError(wasiErrno(refused2));
+      remove.call(Fs, path);
+    };
+  }
+}
 function linkStdio(Fs) {
   const { unlink, symlink } = Fs;
   if (!unlink || !symlink) return;
@@ -7271,6 +7649,7 @@ var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC,
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
+    init_dev_removal();
     init_loopback_names();
     init_live_vfs_fs();
     init_process_pty();
@@ -7949,7 +8328,7 @@ function procfsBridge(fs, tree) {
   }
   const { chown } = fs;
   if (chown) {
-    over.chown = (p, uid, gid, follow2) => readOnly2([[p, follow2 === true]], () => chown.call(fs, p, uid, gid, follow2));
+    over.chown = (p, ...rest2) => readOnly2([[p, rest2[2] === true]], () => chown.call(fs, p, ...rest2));
   }
   return new Proxy(fs, {
     get: (target, key, receiver) => key in over ? over[key] : Reflect.get(target, key, receiver)
@@ -8310,6 +8689,24 @@ function laneOf(lane) {
 }
 function syncOps(kernel, shared) {
   const { infos, handles, resolve } = shared;
+  const tryDevSync = (abs) => {
+    try {
+      const resolved2 = physicalPath(
+        {
+          lstat(p) {
+            return parseSyncFsStat(kernel.json({ op: "lstat", path: p })) ?? {};
+          },
+          readlink(p) {
+            return String(kernel.json({ op: "readlink", path: p }));
+          }
+        },
+        abs
+      );
+      return resolved2 !== abs && inDev(resolved2) ? resolved2 : void 0;
+    } catch {
+      return void 0;
+    }
+  };
   const info = (fd) => {
     const known = infos.get(fd);
     if (known) return known;
@@ -8342,10 +8739,17 @@ function syncOps(kernel, shared) {
   const statOf = (op, path) => {
     const abs = resolve(path);
     if (inDev(abs)) return devSync(kernel, devStat(abs, op === "stat"));
-    kernel.call({ op: "fd-path-flush", path: abs });
-    const s = parseSyncFsStat(kernel.json({ op, path: abs }));
-    if (!s) throw new JsCallError("EIO", op);
-    return s;
+    try {
+      kernel.call({ op: "fd-path-flush", path: abs });
+      const s = parseSyncFsStat(kernel.json({ op, path: abs }));
+      if (!s) throw new JsCallError("EIO", op);
+      return s;
+    } catch (err) {
+      if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+      const devPath = tryDevSync(abs);
+      if (!devPath) throw err;
+      return devSync(kernel, devStat(devPath, op === "stat"));
+    }
   };
   const openDev2 = (abs, options) => {
     const { fd, file, ...access } = devSync(kernel, devOpen(abs, options));
@@ -8365,27 +8769,34 @@ function syncOps(kernel, shared) {
   const open = (path, options = {}) => {
     const abs = resolve(path);
     if (inDev(abs)) return openDev2(abs, options);
-    let existing;
     try {
-      existing = statOf(isExclusive(options) ? "lstat" : "stat", abs);
-    } catch (err) {
-      existing = absent(err);
-    }
-    checkOpen(abs, options, existing);
-    const fd = kernel.json(openRequest(abs, options));
-    try {
-      kernel.call({ op: "fd-vfs-stat", fd });
+      let existing;
+      try {
+        existing = statOf(isExclusive(options) ? "lstat" : "stat", abs);
+      } catch (err) {
+        existing = absent(err);
+      }
+      checkOpen(abs, options, existing);
+      const fd = kernel.json(openRequest(abs, options));
+      try {
+        kernel.call({ op: "fd-vfs-stat", fd });
+      } catch (err) {
+        kernel.raw({ op: "fd-close", fd });
+        throw err;
+      }
+      infos.set(fd, { kind: "file" });
+      const handle = syncFile(kernel, fd, abs, options.append === true, () => {
+        infos.delete(fd);
+        handles.delete(fd);
+      });
+      handles.set(fd, handle.invalidate);
+      return handle.file;
     } catch (err) {
-      kernel.raw({ op: "fd-close", fd });
-      throw err;
+      if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+      const devPath = tryDevSync(abs);
+      if (!devPath) throw err;
+      return openDev2(devPath, options);
     }
-    infos.set(fd, { kind: "file" });
-    const handle = syncFile(kernel, fd, abs, options.append === true, () => {
-      infos.delete(fd);
-      handles.delete(fd);
-    });
-    handles.set(fd, handle.invalidate);
-    return handle.file;
   };
   return {
     read: read2,
@@ -8397,7 +8808,7 @@ function syncOps(kernel, shared) {
       kernel.call({ op: "fd-close", fd });
     },
     open: procOpenSync(open, kernel, { resolve, pid: shared.pid }),
-    fs: procFsSync(syncPathOps(kernel, resolve, statOf, open), kernel, {
+    fs: procFsSync(syncPathOps(kernel, resolve, statOf, open, tryDevSync), kernel, {
       resolve,
       pid: shared.pid
     })
@@ -8467,14 +8878,16 @@ function syncFile(kernel, fd, path, append, forget) {
     }
   };
 }
-function syncPathOps(kernel, resolve, statOf, open) {
+function syncPathOps(kernel, resolve, statOf, open, tryDev) {
   return {
     stat: (path) => statOf("stat", path),
     lstat: (path) => statOf("lstat", path),
     exists(path) {
       const abs = resolve(path);
       if (inDev(abs)) return devSync(kernel, devExists(abs));
-      return kernel.json({ op: "exists", path: abs }) === true;
+      if (kernel.json({ op: "exists", path: abs }) === true) return true;
+      const devPath = tryDev(abs);
+      return devPath ? devSync(kernel, devExists(devPath)) : false;
     },
     readdir(path) {
       const abs = resolve(path);
@@ -8484,7 +8897,8 @@ function syncPathOps(kernel, resolve, statOf, open) {
     mkdir: (path, options) => void kernel.call({
       op: "mkdir",
       path: resolve(path),
-      ...options?.recursive === false ? { exclusive: true } : {}
+      ...options?.recursive === false ? { exclusive: true } : {},
+      mode: options?.mode === void 0 ? 511 : modeOf(options.mode)
     }),
     rm: (path) => void kernel.call({ op: "rm", path: resolve(path) }),
     unlink: (path) => void kernel.call({ op: "unlink", path: resolve(path) }),
@@ -8498,18 +8912,38 @@ function syncPathOps(kernel, resolve, statOf, open) {
       return String(kernel.json({ op: "readlink", path: abs }));
     },
     statfs(path) {
-      const abs = resolve(path);
+      let abs = resolve(path);
+      if (inDev(abs)) {
+        try {
+          const target = devSync(kernel, devResolveTarget(abs));
+          if (target?.startsWith("/")) abs = target;
+        } catch {
+        }
+      }
       statOf("stat", abs);
       return statFsOf(kernel.json({ op: "statfs", path: abs }));
     },
     readFile(path) {
       const abs = resolve(path);
       if (inDev(abs)) return readWholeSync(open(abs));
-      kernel.call({ op: "fd-path-flush", path: abs });
-      return kernel.bytes({ op: "read", path: abs });
-    },
-    writeFile(path, data) {
-      const file = open(path, { write: true, create: true, truncate: true });
+      try {
+        kernel.call({ op: "fd-path-flush", path: abs });
+        return kernel.bytes({ op: "read", path: abs });
+      } catch (err) {
+        if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+        const devPath = tryDev(abs);
+        if (!devPath) throw err;
+        return readWholeSync(open(devPath));
+      }
+    },
+    writeFile(path, data, options) {
+      const mode = options?.mode;
+      const file = open(path, {
+        write: true,
+        create: true,
+        truncate: true,
+        ...mode !== void 0 ? { mode } : {}
+      });
       try {
         file.write(0, typeof data === "string" ? encoder3.encode(data) : data);
       } finally {
@@ -8522,6 +8956,7 @@ var encoder3, noLane, JsSyncKernel;
 var init_js_sync = __esm({
   "src/process/js/js-sync.ts"() {
     "use strict";
+    init_physical_path();
     init_signals();
     init_sync_fs_wire();
     init_sync_sab_bridge();
@@ -8918,6 +9353,55 @@ function readable2(read2) {
     { highWaterMark: 0 }
   );
 }
+async function resolveDevAsync(kernel, abs) {
+  try {
+    const resolved2 = await physicalPathAsync(
+      {
+        async lstat(p) {
+          return parseSyncFsStat(await kernel.json({ op: "lstat", path: p })) ?? {};
+        },
+        async readlink(p) {
+          return String(await kernel.json({ op: "readlink", path: p }));
+        }
+      },
+      abs
+    );
+    return resolved2 !== abs && inDev(resolved2) ? resolved2 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function vfsStat(kernel, abs, op, tryDev) {
+  try {
+    await kernel.call({ op: "fd-path-flush", path: abs });
+    const s = parseSyncFsStat(await kernel.json({ op, path: abs }));
+    if (!s) throw new JsCallError("EIO", op);
+    return s;
+  } catch (err) {
+    if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+    const devPath = await tryDev(abs);
+    if (!devPath) throw err;
+    return devAsync(kernel, devStat(devPath, op === "stat"));
+  }
+}
+async function vfsOpen(kernel, abs, options, statOf, infos, handles) {
+  const existing = await statOf(isExclusive(options) ? "lstat" : "stat", abs).catch(absent);
+  checkOpen(abs, options, existing);
+  const fd = await kernel.json(openRequest(abs, options));
+  try {
+    await kernel.call({ op: "fd-vfs-stat", fd });
+  } catch (err) {
+    await kernel.raw({ op: "fd-close", fd });
+    throw err;
+  }
+  infos.set(fd, { kind: "file" });
+  const handle = fileHandle(kernel, fd, abs, options.append === true, () => {
+    infos.delete(fd);
+    handles.delete(fd);
+  });
+  handles.set(fd, handle.invalidate);
+  return handle.file;
+}
 function createContext(o) {
   const { kernel } = o;
   const infos = /* @__PURE__ */ new Map();
@@ -8925,6 +9409,7 @@ function createContext(o) {
   const pending = /* @__PURE__ */ new Set();
   const random = o.random ?? ((bytes) => void crypto.getRandomValues(bytes));
   const resolve = (path) => resolvePath(o.cwd, path);
+  const tryDev = (abs) => resolveDevAsync(kernel, abs);
   let exiting;
   const exit = (code2 = 0) => {
     exiting ??= code2;
@@ -8967,32 +9452,25 @@ function createContext(o) {
   const statOf = async (op, path) => {
     const abs = resolve(path);
     if (inDev(abs)) return devAsync(kernel, devStat(abs, op === "stat"));
-    await kernel.call({ op: "fd-path-flush", path: abs });
-    const s = parseSyncFsStat(await kernel.json({ op, path: abs }));
-    if (!s) throw new JsCallError("EIO", op);
-    return s;
+    return vfsStat(kernel, abs, op, tryDev);
   };
+  const devIo = { infos, handles, read: read2, write: writeAll };
   const open = async (path, options = {}) => {
     const abs = resolve(path);
-    if (inDev(abs)) return openDev(kernel, abs, options, { infos, handles, read: read2, write: writeAll });
-    const existing = await statOf(isExclusive(options) ? "lstat" : "stat", abs).catch(absent);
-    checkOpen(abs, options, existing);
-    const fd = await kernel.json(openRequest(abs, options));
+    if (inDev(abs)) return openDev(kernel, abs, options, devIo);
     try {
-      await kernel.call({ op: "fd-vfs-stat", fd });
+      return await vfsOpen(kernel, abs, options, statOf, infos, handles);
     } catch (err) {
-      await kernel.raw({ op: "fd-close", fd });
-      throw err;
+      if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+      const devPath = await tryDev(abs);
+      if (!devPath) throw err;
+      return openDev(kernel, devPath, options, devIo);
     }
-    infos.set(fd, { kind: "file" });
-    const handle = fileHandle(kernel, fd, abs, options.append === true, () => {
-      infos.delete(fd);
-      handles.delete(fd);
-    });
-    handles.set(fd, handle.invalidate);
-    return handle.file;
   };
-  const fs = procFsAsync(pathOps(kernel, resolve, statOf, open), kernel, { resolve, pid: o.pid });
+  const fs = procFsAsync(pathOps(kernel, resolve, statOf, open, tryDev), kernel, {
+    resolve,
+    pid: o.pid
+  });
   const lane = o.lane ?? laneOf(void 0);
   if (o.lane && o.lane !== noLane) kernel.syncLane = o.lane;
   const syncKernel = new JsSyncKernel(lane, kernel, unwind);
@@ -9008,6 +9486,7 @@ function createContext(o) {
     },
     kill: killer({ self: o.pid, kernel, syncKernel, lane, writes, modes: terminal.modes }),
     cred: () => syncKernel.json({ op: "proc-cred" }),
+    umask: (mask) => syncKernel.json(umaskRequest(mask)),
     setcred(change) {
       if (typeof change !== "object" || change === null || Array.isArray(change)) {
         throw new JsCallError("EINVAL", "setcred");
@@ -9054,6 +9533,7 @@ function createContext(o) {
     },
     sync,
     fetch: fetchOp(kernel),
+    umask: async (mask) => await kernel.json(umaskRequest(mask)),
     sudo: async (args) => await kernel.json({
       op: "proc-sudo",
       args: [...args],
@@ -9186,14 +9666,16 @@ async function sendSome(kernel, fd, body, signal) {
     await kernel.blocking({ op: "fd-select", read: [], write: [fd], timeoutMs: -1 }, signal);
   }
 }
-function pathOps(kernel, resolve, statOf, open) {
+function pathOps(kernel, resolve, statOf, open, tryDev) {
   return {
     stat: (path) => statOf("stat", path),
     lstat: (path) => statOf("lstat", path),
     async exists(path) {
       const abs = resolve(path);
       if (inDev(abs)) return devAsync(kernel, devExists(abs));
-      return await kernel.json({ op: "exists", path: abs }) === true;
+      if (await kernel.json({ op: "exists", path: abs }) === true) return true;
+      const devPath = await tryDev(abs);
+      return devPath ? devAsync(kernel, devExists(devPath)) : false;
     },
     async readdir(path) {
       const abs = resolve(path);
@@ -9203,7 +9685,8 @@ function pathOps(kernel, resolve, statOf, open) {
     mkdir: async (path, options) => void await kernel.call({
       op: "mkdir",
       path: resolve(path),
-      ...options?.recursive === false ? { exclusive: true } : {}
+      ...options?.recursive === false ? { exclusive: true } : {},
+      mode: options?.mode === void 0 ? 511 : modeOf(options.mode)
     }),
     rm: async (path) => void await kernel.call({ op: "rm", path: resolve(path) }),
     unlink: async (path) => void await kernel.call({ op: "unlink", path: resolve(path) }),
@@ -9217,18 +9700,35 @@ function pathOps(kernel, resolve, statOf, open) {
       return String(await kernel.json({ op: "readlink", path: abs }));
     },
     async statfs(path) {
-      const abs = resolve(path);
+      let abs = resolve(path);
+      if (inDev(abs)) {
+        const target = await devAsync(kernel, devResolveTarget(abs)).catch(() => void 0);
+        if (target?.startsWith("/")) abs = target;
+      }
       await statOf("stat", abs);
       return statFsOf(await kernel.json({ op: "statfs", path: abs }));
     },
     async readFile(path) {
       const abs = resolve(path);
       if (inDev(abs)) return readWhole(await open(abs));
-      await kernel.call({ op: "fd-path-flush", path: abs });
-      return kernel.bytes({ op: "read", path: abs });
-    },
-    async writeFile(path, data) {
-      const file = await open(path, { write: true, create: true, truncate: true });
+      try {
+        await kernel.call({ op: "fd-path-flush", path: abs });
+        return await kernel.bytes({ op: "read", path: abs });
+      } catch (err) {
+        if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+        const devPath = await tryDev(abs);
+        if (!devPath) throw err;
+        return readWhole(await open(devPath));
+      }
+    },
+    async writeFile(path, data, options) {
+      const mode = options?.mode;
+      const file = await open(path, {
+        write: true,
+        create: true,
+        truncate: true,
+        ...mode !== void 0 ? { mode } : {}
+      });
       try {
         await file.write(0, typeof data === "string" ? encoder4.encode(data) : data);
       } finally {
@@ -9241,6 +9741,7 @@ var KERNEL_INFO, JsExit, encoder4;
 var init_js_context = __esm({
   "src/process/js/js-context.ts"() {
     "use strict";
+    init_physical_path();
     init_signals();
     init_sync_fs_wire();
     init_version();
@@ -9411,6 +9912,22 @@ function topLevelDirs(bridge, warn) {
   }
   return dirs;
 }
+function linuxRmdir(Fs) {
+  const raw = Fs;
+  const { mayDelete, lookupNode } = raw;
+  if (!mayDelete || !lookupNode) return;
+  raw.mayDelete = (dir, name2, isdir) => {
+    const code2 = mayDelete.call(raw, dir, name2, isdir);
+    if (code2 !== 10 || !isdir) return code2;
+    try {
+      const node = lookupNode.call(raw, dir, name2);
+      if (node === node.parent) return 10;
+    } catch {
+      return code2;
+    }
+    return 0;
+  };
+}
 function mountVfsIntoEmscripten(Fs, deps) {
   const { bridge, warn } = deps;
   const dirs = topLevelDirs(bridge, warn);
@@ -9418,6 +9935,8 @@ function mountVfsIntoEmscripten(Fs, deps) {
   if (dirs) liveRoot(Fs, bridge);
   if (bridge.owners && Fs.lookupPath) useLiveChown(Fs);
   if (bridge.links && Fs.lookupPath) readingLinks(Fs);
+  linuxRmdir(Fs);
+  if (deps.cred) Fs.sliccCred = deps.cred;
   try {
     Fs.chdir(deps.cwd);
   } catch (err) {
@@ -9440,6 +9959,81 @@ var init_emscripten_vfs_hook = __esm({
   }
 });
 
+// src/process/fd-metadata.ts
+function idOf3(value2) {
+  return value2 === -1 || value2 === 4294967295 ? void 0 : value2 >>> 0;
+}
+function timeOf(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? value2 : null;
+}
+function useKernelFdMetadata(Fs, sys, call2) {
+  const { fdChown, fdChmod, fdUtimes } = sys;
+  const meta = Fs;
+  const kernelFd = (stream) => stream?.sliccKernelFile ? stream.sliccKernelFd : void 0;
+  const find = (match) => {
+    for (const s of Fs.streams) {
+      const kfd = s && match(s) ? kernelFd(s) : void 0;
+      if (kfd !== void 0) return kfd;
+    }
+    return void 0;
+  };
+  const ofPath = (path, follow2) => {
+    if (typeof path !== "string") return find((s) => s.node === path);
+    const fd = follow2 ? fdOfPath(path, Fs.cwd()) : void 0;
+    if (fd !== void 0) return kernelFd(Fs.getStream(fd));
+    return find((s) => s.path === path);
+  };
+  const ofFd = (fd) => kernelFd(Fs.getStream(fd));
+  const chownBy = (kfd, uid, gid) => call2(() => fdChown?.call(sys, kfd, idOf3(uid), idOf3(gid)));
+  if (fdChown && meta.chown) {
+    const chown = meta.chown.bind(Fs);
+    meta.chown = (path, uid, gid, dontFollow) => {
+      const kfd = ofPath(path, !dontFollow);
+      if (kfd === void 0) return chown(path, uid, gid, dontFollow);
+      chownBy(kfd, uid, gid);
+    };
+  }
+  if (fdChown && meta.fchown) {
+    const fchown = meta.fchown.bind(Fs);
+    meta.fchown = (fd, uid, gid) => {
+      const kfd = ofFd(fd);
+      if (kfd === void 0) return fchown(fd, uid, gid);
+      chownBy(kfd, uid, gid);
+    };
+  }
+  if (fdChmod && meta.chmod) {
+    const chmod = meta.chmod.bind(Fs);
+    meta.chmod = (path, mode, dontFollow) => {
+      const kfd = ofPath(path, !dontFollow);
+      if (kfd === void 0) return chmod(path, mode, dontFollow);
+      call2(() => fdChmod.call(sys, kfd, mode & 4095));
+    };
+  }
+  if (fdChmod && meta.fchmod) {
+    const fchmod = meta.fchmod.bind(Fs);
+    meta.fchmod = (fd, mode) => {
+      const kfd = ofFd(fd);
+      if (kfd === void 0) return fchmod(fd, mode);
+      call2(() => fdChmod.call(sys, kfd, mode & 4095));
+    };
+  }
+  if (fdUtimes && meta.utime) {
+    const utime = meta.utime.bind(Fs);
+    meta.utime = (path, atime, mtime) => {
+      const kfd = ofPath(path, true);
+      if (kfd === void 0) return utime(path, atime, mtime);
+      const now = meta.sliccTouch === true;
+      call2(() => fdUtimes.call(sys, kfd, timeOf(atime), timeOf(mtime), now));
+    };
+  }
+}
+var init_fd_metadata = __esm({
+  "src/process/fd-metadata.ts"() {
+    "use strict";
+    init_process_fds();
+  }
+});
+
 // src/process/kernel-streams.ts
 function isPtyPath(path) {
   return PTY_PATH.test(path);
@@ -9467,7 +10061,7 @@ function sealedStat(minor = 250) {
   const now = /* @__PURE__ */ new Date();
   return {
     dev: 22,
-    ino: 1,
+    ino: minor === 251 ? 2 : 1,
     mode: 8630,
     nlink: 1,
     uid: 0,
@@ -9484,10 +10078,18 @@ function sealedStat(minor = 250) {
 function nonblocking(stream) {
   return (stream.flags & O_NONBLOCK2) !== 0 ? { nonblock: true } : void 0;
 }
-var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK2, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, SEALED_PATH2, STRERROR, CLIPBOARD_PATH2, O_CREAT2, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
+function datesOf(real) {
+  const dates = {};
+  for (const [key, value2] of Object.entries(real ?? {}))
+    if (/^[amc]time$/.test(key) && (typeof value2 === "string" || typeof value2 === "number"))
+      dates[key] = new Date(value2);
+  return dates;
+}
+var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK2, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, SEALED_PATH2, STRERROR, CLIPBOARD_PATH2, O_CREAT2, O_EXCL, O_NOCTTY, O_TRUNC2, O_DIRECTORY, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
 var init_kernel_streams = __esm({
   "src/process/kernel-streams.ts"() {
     "use strict";
+    init_fd_metadata();
     init_wasi_errno();
     POLLIN = 1;
     POLLOUT = 4;
@@ -9516,6 +10118,7 @@ var init_kernel_streams = __esm({
     O_EXCL = 128;
     O_NOCTTY = 256;
     O_TRUNC2 = 512;
+    O_DIRECTORY = 65536;
     KILLED_BY_SIGPIPE = 128 + 13;
     ProcessExit = class extends Error {
       status;
@@ -9736,13 +10339,15 @@ var init_kernel_streams = __esm({
         };
       }
       sizeFromKernel(stream, kfd) {
-        const { size } = this.sys;
+        const { size, fdStat: fdStat2 } = this.sys;
         if (!size) return;
         const node = stream.node;
-        this.describe(stream, `${stream.path ?? ""}:${++this.described}`, () => ({
-          ...node.node_ops?.getattr?.(node),
-          size: this.call(() => size.call(this.sys, kfd))
-        }));
+        this.describe(stream, `${stream.path ?? ""}:${++this.described}`, () => {
+          const base = node.node_ops?.getattr?.(node);
+          const live = this.call(() => size.call(this.sys, kfd));
+          const real = fdStat2 && this.call(() => fdStat2.call(this.sys, kfd));
+          return { ...base, ...real, ...datesOf(real), size: live };
+        });
       }
       describe(stream, name2, getattr) {
         if (this.descriptions.size === 0) this.useDescriptions();
@@ -9761,6 +10366,9 @@ var init_kernel_streams = __esm({
           };
         }
       }
+      useKernelFdMetadata() {
+        useKernelFdMetadata(this.Fs, this.sys, this.call.bind(this));
+      }
       useControllingTerminal() {
         if (typeof this.Fs.open !== "function") return;
         this.usePtyPaths();
@@ -9841,10 +10449,17 @@ var init_kernel_streams = __esm({
       openClipboard(open, path, flags, mode) {
         const { openClipboard } = this.sys;
         if (path !== CLIPBOARD_PATH2 || !openClipboard) return void 0;
+        if (flags & O_DIRECTORY) throw new this.Fs.ErrnoError(wasiErrno("ENOTDIR"));
         const kfd = this.call(() => openClipboard.call(this.sys, flags & 3));
-        const stream = this.vessel(open, kfd, { path, flags, mode }, false);
-        this.reportClose(kfd);
-        return stream;
+        try {
+          const stream = this.vessel(open, kfd, { path, flags, mode }, false);
+          this.reportClose(kfd);
+          return stream;
+        } catch (e) {
+          this.sys.clipboardAbort?.(kfd);
+          this.sys.close(kfd);
+          throw e;
+        }
       }
       vessel(open, kfd, at, terminal) {
         let stream;
@@ -10094,7 +10709,8 @@ function kernelEntry2(stream, kernel) {
   }
   const device2 = stream.path === void 0 ? void 0 : NAMED_DEVICES[stream.path];
   const kind = stream.sliccKernelFile ? "file" : stream.tty ? "tty" : device2 ?? "stream";
-  return { fd: stream.fd, kernel, kind, ...cloexec };
+  const access = kind === "tty" ? O_RDWR4 : (stream.flags ?? O_RDWR4) & O_ACCMODE3;
+  return { fd: stream.fd, kernel, kind, flags: access, ...cloexec };
 }
 function describeInherited(Fs, sys, streams, livePath, actions = []) {
   const table = /* @__PURE__ */ new Map();
@@ -10141,12 +10757,13 @@ function place(Fs, stream, fd) {
   return moved;
 }
 function placeholder(Fs, streams, entry) {
-  if (entry.kind === "socket") return streams.socketStream(entry.flags ?? O_RDWR4);
+  const access = entry.flags ?? O_RDWR4;
+  if (entry.kind === "socket") return streams.socketStream(access);
   if (entry.kind === "tty") return Fs.open("/dev/tty", O_RDWR4);
   if (entry.kind === "stream" || entry.kind === "clipboard" || entry.kind === "sealed")
-    return Fs.open("/dev/null", O_RDWR4);
+    return Fs.open("/dev/null", access);
   Fs.mkdirTree(PLACEHOLDER_DIR);
-  return Fs.open(`${PLACEHOLDER_DIR}/${entry.fd}`, O_RDWR4 | O_CREAT3);
+  return Fs.open(`${PLACEHOLDER_DIR}/${entry.fd}`, access | O_CREAT3);
 }
 function asFifo(stream, streams, identity) {
   const inos = streamInos.get(streams) ?? /* @__PURE__ */ new Map();
@@ -10931,6 +11548,20 @@ function kernelSys(transport) {
     size(fd) {
       return json2(call2({ op: "fd-vfs-stat", fd }, `fd-vfs-stat ${fd}`)).size;
     },
+    fdStat(fd) {
+      const r = json2(call2({ op: "fd-vfs-stat", fd, full: true }, `fd-vfs-stat ${fd}`));
+      return r?.stat;
+    },
+    fdChmod(fd, mode) {
+      call2({ op: "fd-chmod", fd, mode }, `fd-chmod ${fd}`);
+    },
+    fdChown(fd, uid, gid) {
+      const ids = { ...uid !== void 0 ? { uid } : {}, ...gid !== void 0 ? { gid } : {} };
+      call2({ op: "fd-chown", fd, ...ids }, `fd-chown ${fd}`);
+    },
+    fdUtimes(fd, atimeMs, mtimeMs, now) {
+      call2({ op: "fd-utimes", fd, atimeMs, mtimeMs, now }, `fd-utimes ${fd}`);
+    },
     ttyNames() {
       return json2(call2({ op: "fd-tty-names" }, "fd-tty-names"));
     },
@@ -10962,6 +11593,9 @@ function kernelSys(transport) {
     openClipboard(flags) {
       return json2(call2({ op: "fd-open-clipboard", flags }, "fd-open-clipboard"));
     },
+    clipboardAbort(fd) {
+      call2({ op: "fd-clipboard-abort", fd }, "fd-clipboard-abort");
+    },
     ptyNumbers() {
       return json2(call2({ op: "pty-list" }, "pty-list"));
     },
@@ -11000,7 +11634,7 @@ function openDevice(Fs, fd, meta) {
   return openAt(Fs, fd, `/dev/${meta.device}`, accessMode(meta.access));
 }
 function openHeld(Fs, fd, meta) {
-  return "dir" in meta ? openAt(Fs, fd, meta.dir, O_RDONLY | O_DIRECTORY) : openDevice(Fs, fd, meta);
+  return "dir" in meta ? openAt(Fs, fd, meta.dir, O_RDONLY | O_DIRECTORY2) : openDevice(Fs, fd, meta);
 }
 function openAt(Fs, fd, path, flags) {
   let stream;
@@ -11112,6 +11746,17 @@ function kernelWrappers(imports, module, deps) {
 function bridgeFlags(init) {
   return { ...init.owners ? { owners: true } : {}, ...init.links ? { links: true } : {} };
 }
+function credSyncTransport(gated, early, cred) {
+  return {
+    call: (req, timeoutMs, label) => {
+      if (!FS_OPS.has(req.op)) early();
+      const r = gated.call(req, timeoutMs, label);
+      if (cred && req.op === "proc-setcred" && r.ok && r.kind === "json")
+        Object.assign(cred, r.json);
+      return r;
+    }
+  };
+}
 async function runWasmProcess(init, port3, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port3, {
@@ -11130,12 +11775,7 @@ async function runWasmProcess(init, port3, deps = {}) {
   const gated = signals.transport();
   let early = () => {
   };
-  const transport = {
-    call: (req, timeoutMs, label) => {
-      if (!FS_OPS.has(req.op)) early();
-      return gated.call(req, timeoutMs, label);
-    }
-  };
+  const transport = credSyncTransport(gated, () => early(), init.cred);
   const sys = kernelSys(transport);
   const encoder5 = new TextEncoder();
   const say = (fd) => (text) => sys.write(fd, encoder5.encode(`${text}
@@ -11218,7 +11858,8 @@ async function runWasmProcess(init, port3, deps = {}) {
   const vfs = mountVfsIntoEmscripten(running.FS, {
     bridge: createSyncFsSabBridge(transport, bridgeFlags(init)),
     cwd: init.cwd,
-    warn: deps.warn ?? say(2)
+    warn: deps.warn ?? say(2),
+    cred: init.owners ? init.cred : void 0
   });
   early = () => signals.quiet(() => vfs.flushDirty());
   const sigpipe = () => running.sliccSigpipe?.() === 1;
@@ -11237,6 +11878,7 @@ async function runWasmProcess(init, port3, deps = {}) {
   atExit = () => streams.exiting();
   useMounts(running.FS, init.env, true);
   useZeroDevices(running.FS);
+  useDevRemoval(running.FS);
   useProcfs(running.FS, sys, init.pid);
   if (init.fork) restoreForkedStreams(running.FS, streams, init.fork.streams ?? []);
   else {
@@ -11246,6 +11888,7 @@ async function runWasmProcess(init, port3, deps = {}) {
   const pipefs = ownValue(running, "PIPEFS");
   if (pipefs) streams.usePipes(pipefs);
   streams.useControllingTerminal();
+  streams.useKernelFdMetadata();
   useDevFd(running.FS);
   useFileMmap(running.FS, {
     sys,
@@ -11257,9 +11900,9 @@ async function runWasmProcess(init, port3, deps = {}) {
     transport,
     Fs: running.FS,
     env: init.env,
+    pid: init.pid,
     beforeSpawn: () => vfs.flush(),
     afterChild: () => vfs.invalidate(),
-    pid: init.pid,
     raise: (sig) => running.sliccRaise?.(sig),
     restartable,
     memory: () => memory,
@@ -11279,6 +11922,9 @@ async function runWasmProcess(init, port3, deps = {}) {
     sigpipe,
     restartable
   });
+  return runWithFlush(running, init, streams, vfs);
+}
+function runWithFlush(running, init, streams, vfs) {
   try {
     return streams.exitStatus(runMain(running, init));
   } finally {
@@ -11343,7 +11989,7 @@ function runMain(running, init) {
     return status2;
   }
 }
-var FS_OPS, O_RDONLY, O_WRONLY6, O_RDWR6, O_ACCMODE4, O_DIRECTORY, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
+var FS_OPS, O_RDONLY, O_WRONLY6, O_RDWR6, O_ACCMODE4, O_DIRECTORY2, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
 var init_process_runtime = __esm({
   "src/process/process-runtime.ts"() {
     "use strict";
@@ -11369,7 +12015,7 @@ var init_process_runtime = __esm({
     O_WRONLY6 = 1;
     O_RDWR6 = 2;
     O_ACCMODE4 = 3;
-    O_DIRECTORY = 65536;
+    O_DIRECTORY2 = 65536;
     accessMode = (access) => access === "read" ? O_RDONLY : access === "write" ? O_WRONLY6 : O_RDWR6;
     PLACED = /* @__PURE__ */ new Set(["stream", "file", "socket", "clipboard", "sealed"]);
     GLUE_TRAILER = [
@@ -11550,7 +12196,7 @@ var init_wasi_sigmask = __esm({
     };
     WasiSigmask = class {
       lo;
-      hi = 0;
+      hi;
       header;
       deliver;
       process;
@@ -11559,9 +12205,10 @@ var init_wasi_sigmask = __esm({
         this.deliver = deliver;
         this.process = process;
         this.lo = libcBits(Atomics.load(header, SAB_I_BLOCKED));
+        this.hi = Atomics.load(header, SAB_I_BLOCKED_HI);
       }
       static unsupported(header) {
-        Atomics.store(header, SAB_I_BLOCKED, 0);
+        storeBlocked(header, [0, 0]);
       }
       set(how, setLo, setHi, old) {
         if (how !== SIG_BLOCK && how !== SIG_UNBLOCK && how !== SIG_SETMASK) return E.INVAL;
@@ -11569,7 +12216,7 @@ var init_wasi_sigmask = __esm({
         this.lo = apply(how, this.lo, setLo | 0) & ~LIBC_UNBLOCKABLE;
         this.hi = apply(how, this.hi, setHi | 0);
         const now = kernelBits(this.lo);
-        Atomics.store(this.header, SAB_I_BLOCKED, now);
+        storeBlocked(this.header, [now, this.hi]);
         if ((Atomics.load(this.header, SAB_I_SIGNALS) & ~now) !== 0) this.deliver();
         return E.SUCCESS;
       }
@@ -11577,7 +12224,7 @@ var init_wasi_sigmask = __esm({
         const old = [this.lo, this.hi];
         this.lo = setLo & ~LIBC_UNBLOCKABLE;
         this.hi = setHi | 0;
-        Atomics.store(this.header, SAB_I_BLOCKED, kernelBits(this.lo));
+        storeBlocked(this.header, [kernelBits(this.lo), this.hi]);
         return old;
       }
       deliverUnblocked() {
@@ -11590,6 +12237,9 @@ var init_wasi_sigmask = __esm({
         this.set(SIG_SETMASK, lo, hi, () => {
         });
       }
+      inherited() {
+        return [kernelBits(this.lo), this.hi];
+      }
       discard(sig) {
         Atomics.and(this.header, SAB_I_SIGNALS, ~sigbit(sig));
         if (this.process) Atomics.and(this.process, SAB_I_SIGNALS, ~sigbit(sig));
@@ -12869,7 +13519,7 @@ function readAddr(view, ptr) {
 function ipv6Host(bytes) {
   const zeros = (n) => bytes.subarray(0, n).every((b) => b === 0);
   if (zeros(16)) return "0.0.0.0";
-  if (zeros(15) && bytes[15] === 1) return LOOPBACK;
+  if (zeros(15) && bytes[15] === 1) return LOOPBACK2;
   if (zeros(10) && bytes[10] === 255 && bytes[11] === 255) return bytes.subarray(12).join(".");
   const groups = [0, 2, 4, 6, 8, 10, 12, 14].map(
     (i) => (bytes[i] << 8 | bytes[i + 1]).toString(16)
@@ -13026,7 +13676,7 @@ function wasixSocketImports(host, preview1) {
     }
   };
 }
-var INET4, INET6, UNIX, STREAM, ADDR_IP_SIZE, LOOPBACK, OPTIONS;
+var INET4, INET6, UNIX, STREAM, ADDR_IP_SIZE, LOOPBACK2, OPTIONS;
 var init_wasix_sockets = __esm({
   "src/process/wasi/wasix-sockets.ts"() {
     "use strict";
@@ -13038,7 +13688,7 @@ var init_wasix_sockets = __esm({
     UNIX = 3;
     STREAM = 1;
     ADDR_IP_SIZE = 18;
-    LOOPBACK = "127.0.0.1";
+    LOOPBACK2 = "127.0.0.1";
     OPTIONS = {
       1: [1, 15],
       2: [1, 2],
@@ -13567,6 +14217,7 @@ __export(wasi_runtime_exports, {
   runWasiProcess: () => runWasiProcess,
   runWasiThread: () => runWasiThread,
   sigmaskOf: () => sigmaskOf,
+  takeThreadDefault: () => takeThreadDefault,
   trapMessage: () => trapMessage,
   unsupportedImport: () => unsupportedImport,
   wireSignals: () => wireSignals
@@ -13610,7 +14261,7 @@ function sigmaskOf(module, sab, gate, threads, process) {
     WasiSigmask.unsupported(header);
     return void 0;
   }
-  if (threads) threads.blocked = () => Atomics.load(header, SAB_I_BLOCKED);
+  if (threads) threads.blocked = () => loadBlocked(header);
   const shared = process && new Int32Array(process, 0, SAB_HEADER_I32);
   return new WasiSigmask(header, () => gate.deliver(), shared);
 }
@@ -14004,7 +14655,7 @@ async function runWasiThread(init, port3) {
     masks: () => null,
     raise: (sig) => signals.raise(sig)
   });
-  const signals = new WasiSignals(takeDefault(call2, init.pid));
+  const signals = new WasiSignals(takeThreadDefault(call2, init.pid));
   const threads = new WasiThreads(port3, thread.memory, threadCap(init.env), thread.tid, thread.ids);
   threads.received = thread.modules;
   const id = identify(transport, init);
@@ -14058,7 +14709,7 @@ async function runWasiThread(init, port3) {
     throw e;
   }
 }
-var TRAPPED, PREVIEW1, WASIX, SLICC, SIGNAL_CALLBACK, takeDefault, SLICC_FS, SLICC_TTY, RESERVED2, UNDELIVERED, DELIVERED, importsSlicc, importsSigactionHook, noErrno, FALLBACK_MAXIMUM_PAGES, LinkSync, DL_GEN, BACKTRACE_FRAMES;
+var TRAPPED, PREVIEW1, WASIX, SLICC, SIGNAL_CALLBACK, takeDefault, takeThreadDefault, SLICC_FS, SLICC_TTY, RESERVED2, UNDELIVERED, DELIVERED, importsSlicc, importsSigactionHook, noErrno, FALLBACK_MAXIMUM_PAGES, LinkSync, DL_GEN, BACKTRACE_FRAMES;
 var init_wasi_runtime = __esm({
   "src/process/wasi/wasi-runtime.ts"() {
     "use strict";
@@ -14093,6 +14744,17 @@ var init_wasi_runtime = __esm({
       call2({ op: "proc-kill", pid, sig });
       if (defaultAction(sig) === "terminate") throw new WasiExit(128 + sig);
     };
+    takeThreadDefault = (call2, pid) => (sig) => {
+      if (defaultAction(sig) !== "terminate") {
+        call2({ op: "proc-kill", pid, sig });
+        return;
+      }
+      try {
+        call2({ op: "proc-kill-self", sig });
+      } catch {
+      }
+      throw new WasiExit(128 + sig);
+    };
     SLICC_FS = "slicc_fs";
     SLICC_TTY = "slicc_tty";
     RESERVED2 = RESERVED_NAMESPACES;
@@ -14238,7 +14900,11 @@ function refuseModules() {
     }
   });
 }
+var locked = /* @__PURE__ */ new WeakSet();
+var nodeProcess = typeof globalThis.process === "object" && globalThis.process !== null ? globalThis.process : void 0;
 function nodeLockdown(scope2 = globalThis) {
+  if (locked.has(scope2)) return;
+  locked.add(scope2);
   zeroedBuffers(Buffer);
   lockdown(scope2);
   hide(scope2, NODE_GLOBALS);
@@ -14304,14 +14970,22 @@ function processEntry(port3, run = runWasmProcess, wasi = loadWasi, js = loadJs,
 }
 
 // src/node-process-worker.ts
+init_wasi_runtime();
 var scope = globalThis;
 scope.require ??= createRequire(import.meta.url);
 scope.__filename ??= new URL(import.meta.url).pathname;
 scope.__dirname ??= new URL(".", import.meta.url).pathname;
 var port2 = parentPort;
 var post = { postMessage: (message2) => port2.postMessage(message2) };
-var onMessage = processEntry(post, void 0, void 0, async () => ({
-  runJsProcess: (init, at) => runJsProcess(init, at, { lockdown: () => nodeLockdown() })
-}));
+var strayScope = nodeProcess ? { process: nodeProcess } : {};
+var onMessage = processEntry(
+  post,
+  void 0,
+  async () => wasi_runtime_exports,
+  async () => ({
+    runJsProcess: (init, at) => runJsProcess(init, at, { lockdown: () => nodeLockdown(), scope: strayScope })
+  }),
+  () => nodeLockdown()
+);
 port2.on("message", onMessage);
 //# sourceMappingURL=node-process-worker.js.map