@ai-ecoverse/slicc-kernel 1.92.0 → 1.93.0

package/dist/process-worker.js

@@ -104,6 +104,13 @@ var init_lockdown = __esm({
 });
 
 // src/realm/sync-sab-wire.ts
+function loadBlocked(header) {
+  return [Atomics.load(header, SAB_I_BLOCKED), Atomics.load(header, SAB_I_BLOCKED_HI)];
+}
+function storeBlocked(header, [low, high]) {
+  Atomics.store(header, SAB_I_BLOCKED_HI, high);
+  Atomics.store(header, SAB_I_BLOCKED, low);
+}
 function loadU53(header, lo, hi) {
   return (Atomics.load(header, lo) >>> 0) + Atomics.load(header, hi) * U32;
 }
@@ -146,7 +153,7 @@ function sabViews(sab) {
     window: new Uint8Array(sab, SAB_HEADER_BYTES)
   };
 }
-var SAB_HEADER_I32, SAB_CLOCK_OFFSET, SAB_CLOCK_I64, SAB_HEADER_BYTES, SAB_I_STATE, SAB_I_SEQ, SAB_I_STATUS, SAB_I_TOTAL, SAB_I_CHUNK, SAB_I_OFFSET, SAB_I_REQ, SAB_I_PUB, SAB_I_SIGNALS, SAB_I_TIMERS, SAB_I_MEMORY, SAB_I_TOTAL_HI, SAB_I_OFFSET_HI, SAB_I_KILLED, SAB_I_ASYNC, SAB_I_STOP, SAB_I_BLOCKED, U32, SAB_STATE_IDLE, SAB_STATE_PENDING, SAB_STATE_READY, SAB_STATUS_BYTES, SAB_STATUS_JSON, SAB_STATUS_VOID, SAB_STATUS_ERRNO, SAB_DEFAULT_WINDOW_BYTES, SAB_MIN_BYTES, SYNC_SAB_REQ_MSG, SYNC_SAB_NEXT_MSG, encoder, decoder;
+var SAB_HEADER_I32, SAB_CLOCK_OFFSET, SAB_CLOCK_I64, SAB_HEADER_BYTES, SAB_I_STATE, SAB_I_SEQ, SAB_I_STATUS, SAB_I_TOTAL, SAB_I_CHUNK, SAB_I_OFFSET, SAB_I_REQ, SAB_I_PUB, SAB_I_SIGNALS, SAB_I_TIMERS, SAB_I_MEMORY, SAB_I_TOTAL_HI, SAB_I_OFFSET_HI, SAB_I_KILLED, SAB_I_ASYNC, SAB_I_STOP, SAB_I_BLOCKED, SAB_I_BLOCKED_HI, anyBlocked, U32, SAB_STATE_IDLE, SAB_STATE_PENDING, SAB_STATE_READY, SAB_STATUS_BYTES, SAB_STATUS_JSON, SAB_STATUS_VOID, SAB_STATUS_ERRNO, SAB_DEFAULT_WINDOW_BYTES, SAB_MIN_BYTES, SYNC_SAB_REQ_MSG, SYNC_SAB_NEXT_MSG, encoder, decoder;
 var init_sync_sab_wire = __esm({
   "src/realm/sync-sab-wire.ts"() {
     "use strict";
@@ -171,6 +178,8 @@ var init_sync_sab_wire = __esm({
     SAB_I_ASYNC = 14;
     SAB_I_STOP = 15;
     SAB_I_BLOCKED = 16;
+    SAB_I_BLOCKED_HI = 17;
+    anyBlocked = (mask) => mask !== void 0 && (mask[0] !== 0 || mask[1] !== 0);
     U32 = 2 ** 32;
     SAB_STATE_IDLE = 0;
     SAB_STATE_PENDING = 1;
@@ -365,6 +374,73 @@ var init_signals = __esm({
   }
 });
 
+// src/fs/types.ts
+function normalizePath(path) {
+  const parts = [];
+  for (const part of path.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") parts.pop();
+    else parts.push(part);
+  }
+  return `/${parts.join("/")}`;
+}
+function inodeOf(path) {
+  let h1 = 3735928559;
+  let h2 = 1103547991;
+  for (let i = 0; i < path.length; i++) {
+    const c = path.charCodeAt(i);
+    h1 = Math.imul(h1 ^ c, 2654435761);
+    h2 = Math.imul(h2 ^ c, 1597334677);
+  }
+  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507) ^ Math.imul(h2 ^ h2 >>> 13, 3266489909);
+  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
+  return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
+}
+var init_types = __esm({
+  "src/fs/types.ts"() {
+    "use strict";
+  }
+});
+
+// src/fs/owners.ts
+function inGroup(cred, gid) {
+  return cred.egid === gid || cred.groups.includes(gid);
+}
+var ROOT_OWNER;
+var init_owners = __esm({
+  "src/fs/owners.ts"() {
+    "use strict";
+    init_types();
+    ROOT_OWNER = Object.freeze({ uid: 0, gid: 0 });
+  }
+});
+
+// src/fs/walk.ts
+var init_walk = __esm({
+  "src/fs/walk.ts"() {
+    "use strict";
+    init_types();
+  }
+});
+
+// src/fs/access.ts
+function permits(cred, perm, want, directory = true) {
+  const mode = perm.mode ?? (directory ? 493 : 420);
+  if (cred.euid === 0) return (want & X_OK) === 0 || directory || (mode & 73) !== 0;
+  const shift = cred.euid === perm.uid ? 6 : inGroup(cred, perm.gid) ? 3 : 0;
+  return (mode >> shift & want) === want;
+}
+var X_OK;
+var init_access = __esm({
+  "src/fs/access.ts"() {
+    "use strict";
+    init_owners();
+    init_types();
+    init_walk();
+    X_OK = 1;
+  }
+});
+
 // src/fs/pages.ts
 var PAGE, READAHEAD, CLEAN_LIMIT, WRITEBACK, RUN, Pages;
 var init_pages = __esm({
@@ -619,34 +695,6 @@ var init_ranged = __esm({
   }
 });
 
-// src/fs/types.ts
-function normalizePath(path) {
-  const parts = [];
-  for (const part of path.split("/")) {
-    if (part === "" || part === ".") continue;
-    if (part === "..") parts.pop();
-    else parts.push(part);
-  }
-  return `/${parts.join("/")}`;
-}
-function inodeOf(path) {
-  let h1 = 3735928559;
-  let h2 = 1103547991;
-  for (let i = 0; i < path.length; i++) {
-    const c = path.charCodeAt(i);
-    h1 = Math.imul(h1 ^ c, 2654435761);
-    h2 = Math.imul(h2 ^ c, 1597334677);
-  }
-  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507) ^ Math.imul(h2 ^ h2 >>> 13, 3266489909);
-  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
-  return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
-}
-var init_types = __esm({
-  "src/fs/types.ts"() {
-    "use strict";
-  }
-});
-
 // src/process/wasi/wasi-abi.ts
 function wasiErrnoOf(code2) {
   if (!code2) return E.IO;
@@ -1071,12 +1119,21 @@ function createSyncFsSabBridge(transport, opts = {}) {
     lutimes: (path, atimeMs, mtimeMs, now) => {
       run({ op: "lutimes", path, atimeMs, mtimeMs, ...now ? { now } : {} }, path);
     },
-    create: (path, mode) => {
-      run({ op: "create", path, ...mode !== void 0 ? { mode } : {} }, path);
+    create: (path, mode, opening2) => {
+      const flags = { ...mode !== void 0 ? { mode } : {}, ...opening2 ? { opening: opening2 } : {} };
+      run({ op: "create", path, ...flags }, path);
     },
-    chown: (path, uid, gid, follow2) => {
+    chown: (path, uid, gid, follow2, handle) => {
       const ids = { ...uid !== void 0 ? { uid } : {}, ...gid !== void 0 ? { gid } : {} };
-      changing({ op: follow2 ? "chown" : "lchown", path, ...ids }, path);
+      changing(
+        {
+          op: follow2 ? "chown" : "lchown",
+          path,
+          ...ids,
+          ...handle !== void 0 ? { handle } : {}
+        },
+        path
+      );
     },
     ...opts.owners ? { owners: true } : {},
     ...opts.links ? { links: true } : {},
@@ -1153,15 +1210,36 @@ function refusal(err) {
 function cachedStat(s, dir) {
   return s.stat !== void 0 && (!dir || s.statAt === syncCallCount());
 }
+function searchParents(Fs, node, bridge, call2) {
+  const cred = Fs.sliccCred;
+  if (!cred) return;
+  let cur = node.parent;
+  while (cur) {
+    const st = cur.live.stat;
+    if (st && st.uid !== void 0 && st.mode !== void 0) {
+      const perm = { uid: st.uid, gid: st.gid ?? 0, mode: st.mode & 4095 };
+      if (!permits(cred, perm, X_OK, true)) {
+        call2(() => bridge.access?.(liveNodePath(cur), X_OK, "eaccess"));
+        cur.live.stat = void 0;
+        return;
+      }
+    } else {
+      call2(() => bridge.access?.(liveNodePath(cur), X_OK, "eaccess"));
+      return;
+    }
+    if (cur === cur.parent) break;
+    cur = cur.parent;
+  }
+}
 function linkedStates(bridgeOf) {
   const opens = /* @__PURE__ */ new Map();
   const byId = /* @__PURE__ */ new Map();
-  const idOf3 = (st) => st?.ino === void 0 || (st.nlink ?? 1) < 2 ? void 0 : `${st.dev}:${st.ino}`;
+  const idOf4 = (st) => st?.ino === void 0 || (st.nlink ?? 1) < 2 ? void 0 : `${st.dev}:${st.ino}`;
   function know(s, id) {
     s.id = id;
     if (!byId.has(id)) byId.set(id, s);
   }
-  function opening(node, on) {
+  function opening2(node, on) {
     const s = node.live;
     if (!on) {
       opens.delete(s);
@@ -1170,14 +1248,14 @@ function linkedStates(bridgeOf) {
       return;
     }
     opens.set(s, node);
-    const id = idOf3(s.stat);
+    const id = idOf4(s.stat);
     if (id !== void 0) know(s, id);
   }
   function sharedWith(node) {
     const st = node.live.stat;
     if (st?.ino === void 0) return void 0;
     const id = `${st.dev}:${st.ino}`;
-    if (!byId.has(id) && idOf3(st) !== void 0) {
+    if (!byId.has(id) && idOf4(st) !== void 0) {
       for (const [s2, other] of opens) {
         if (s2.id !== void 0 || s2.orphan) continue;
         let st2;
@@ -1185,7 +1263,7 @@ function linkedStates(bridgeOf) {
           st2 = bridgeOf(other).lstat(liveNodePath(other));
         } catch {
         }
-        const known = idOf3(st2);
+        const known = idOf4(st2);
         if (known !== void 0) know(s2, known);
       }
     }
@@ -1193,7 +1271,7 @@ function linkedStates(bridgeOf) {
     return s && s !== node.live && !stale(s) ? s : void 0;
   }
   const holder = (node) => opens.get(node.live) ?? node;
-  return { opening, sharedWith, know, idOf: idOf3, holder };
+  return { opening: opening2, sharedWith, know, idOf: idOf4, holder };
 }
 function createHelpers(Fs, ops) {
   const bridgeOf = (node) => node.mount.opts.bridge;
@@ -1415,7 +1493,9 @@ function createNodeOps(h) {
       const owned = bridgeOf(node).owners === true;
       if (owned && Fs.isLink(node.mode) && statOf(node).uid === void 0)
         node.live.stat = void 0;
+      const cached = owned && cachedStat(node.live, Fs.isDir(node.mode));
       const st = statOf(node);
+      if (cached) searchParents(Fs, node, bridgeOf(node), call2);
       const s = node.live;
       const size = Fs.isDir(node.mode) ? 4096 : s.ranged?.size() ?? (s.loaded ? s.len : st.size);
       const mtime = new Date(st.mtimeMs ?? 0);
@@ -1478,7 +1558,7 @@ function createNodeOps(h) {
         if (masked !== DEFAULT_DIR_PERM) metadataCall(() => bridge.chmod(path, masked));
       } else if (Fs.isFile(mode)) {
         call2(
-          () => bridge.create ? bridge.create(path, perm) : bridge.writeFile(path, new Uint8Array(0))
+          () => bridge.create ? bridge.create(path, perm, opening.get(h.Fs) > 0) : bridge.writeFile(path, new Uint8Array(0))
         );
       } else {
         throw new Fs.ErrnoError(wasiErrno("EPERM"));
@@ -1724,10 +1804,24 @@ function createStreamOps(h) {
     }
   };
 }
+function countOpens(Fs) {
+  const { open } = Fs;
+  if (typeof open !== "function" || opening.has(Fs)) return;
+  opening.set(Fs, 0);
+  Fs.open = function(...args) {
+    opening.set(Fs, (opening.get(Fs) ?? 0) + 1);
+    try {
+      return open.apply(this, args);
+    } finally {
+      opening.set(Fs, (opening.get(Fs) ?? 1) - 1);
+    }
+  };
+}
 function createLiveVfsPlugin(Fs) {
   const mounts = /* @__PURE__ */ new Set();
   const ops = {};
   const h = createHelpers(Fs, ops);
+  countOpens(Fs);
   const nodeOps = createNodeOps(h);
   const streamOps = createStreamOps(h);
   ops.node = nodeOps;
@@ -1860,12 +1954,12 @@ function liveRoot(Fs, bridge) {
   };
 }
 function crosses(Fs, from, to) {
-  const parentOf = (path) => Fs.lookupPath?.(path, { parent: true }).node;
+  const parentOf2 = (path) => Fs.lookupPath?.(path, { parent: true }).node;
   const name2 = from.replace(/\/+$/, "").split("/").pop() ?? "";
   try {
-    const fromDir = parentOf(from);
+    const fromDir = parentOf2(from);
     const node = fromDir && Fs.lookupNode?.(fromDir, name2);
-    const dir = parentOf(to);
+    const dir = parentOf2(to);
     return !!node && !!dir && !!node.live !== !!dir.live;
   } catch {
     return false;
@@ -1929,6 +2023,25 @@ function guardRenames(Fs) {
 function idOf(value2) {
   return value2 === -1 || value2 === 4294967295 ? void 0 : value2 >>> 0;
 }
+function chownHeld(Fs, node, s, uid, gid) {
+  const bridge = node.mount.opts.bridge;
+  const handle = s.handle;
+  try {
+    bridge.chown?.(liveNodePath(node), idOf(uid), idOf(gid), false, handle);
+  } catch (err) {
+    throw toErrno(Fs, err);
+  }
+  if (node.parent?.live) node.parent.live.listed = void 0;
+  if (!s.orphan) {
+    s.stat = void 0;
+    return;
+  }
+  try {
+    const st = bridge.keptStat?.(handle);
+    if (st && s.stat) s.stat = { ...s.stat, uid: st.uid, gid: st.gid, mode: st.mode };
+  } catch {
+  }
+}
 function useLiveChown(Fs) {
   const chown = Fs.chown?.bind(Fs);
   if (!chown) return;
@@ -1947,8 +2060,10 @@ function useLiveChown(Fs) {
   if (!Fs.fchown || !getStreamChecked) return;
   Fs.fchown = (fd, uid, gid) => {
     const stream = getStreamChecked.call(Fs, fd);
-    const live = stream.node.live !== void 0;
-    const target = live || stream.path === void 0 ? stream.node : stream.path;
+    const node = stream.node;
+    const s = node.live;
+    if (s?.handle !== void 0 && (!s.orphan || s.kept)) return chownHeld(Fs, node, s, uid, gid);
+    const target = s !== void 0 || stream.path === void 0 ? stream.node : stream.path;
     Fs.chown(target, uid, gid);
   };
 }
@@ -2009,10 +2124,11 @@ function readingLinks(Fs) {
     }
   };
 }
-var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale;
+var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale, opening;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
     "use strict";
+    init_access();
     init_ranged();
     init_types();
     init_wasi_errno();
@@ -2031,6 +2147,7 @@ var init_live_vfs_fs = __esm({
     O_TRUNC = 512;
     O_PATH = 2097152;
     stale = (s) => !!s.orphan && !s.kept;
+    opening = /* @__PURE__ */ new WeakMap();
   }
 });
 
@@ -2054,6 +2171,22 @@ function topLevelDirs(bridge, warn) {
   }
   return dirs;
 }
+function linuxRmdir(Fs) {
+  const raw = Fs;
+  const { mayDelete, lookupNode } = raw;
+  if (!mayDelete || !lookupNode) return;
+  raw.mayDelete = (dir, name2, isdir) => {
+    const code2 = mayDelete.call(raw, dir, name2, isdir);
+    if (code2 !== 10 || !isdir) return code2;
+    try {
+      const node = lookupNode.call(raw, dir, name2);
+      if (node === node.parent) return 10;
+    } catch {
+      return code2;
+    }
+    return 0;
+  };
+}
 function mountVfsIntoEmscripten(Fs, deps) {
   const { bridge, warn } = deps;
   const dirs = topLevelDirs(bridge, warn);
@@ -2061,6 +2194,8 @@ function mountVfsIntoEmscripten(Fs, deps) {
   if (dirs) liveRoot(Fs, bridge);
   if (bridge.owners && Fs.lookupPath) useLiveChown(Fs);
   if (bridge.links && Fs.lookupPath) readingLinks(Fs);
+  linuxRmdir(Fs);
+  if (deps.cred) Fs.sliccCred = deps.cred;
   try {
     Fs.chdir(deps.cwd);
   } catch (err) {
@@ -2083,309 +2218,1231 @@ var init_emscripten_vfs_hook = __esm({
   }
 });
 
-// src/process/kernel-streams.ts
-function isPtyPath(path) {
-  return PTY_PATH.test(path);
+// src/fs/dev-removal.ts
+function inDevTree(path) {
+  return path === "/dev" || path.startsWith("/dev/");
 }
-function ptyStat(path) {
-  const n = PTY_PATH.exec(path)?.[1];
-  const now = /* @__PURE__ */ new Date();
-  return {
-    dev: 22,
-    ino: n === void 0 ? 2 : 3 + Number(n),
-    mode: n === void 0 ? 8630 : 8592,
-    nlink: 1,
-    uid: 1e3,
-    gid: 1e3,
-    rdev: n === void 0 ? 5 << 8 | 2 : 136 << 8 | Number(n),
-    size: 0,
-    blksize: 4096,
-    blocks: 0,
-    atime: now,
-    mtime: now,
-    ctime: now
-  };
+function devRemoval(path, cred) {
+  if (!inDevTree(path)) return void 0;
+  if (cred && cred.euid !== 0) return "EACCES";
+  return path === "/dev" ? "EBUSY" : "EPERM";
 }
-function sealedStat(minor = 250) {
-  const now = /* @__PURE__ */ new Date();
-  return {
-    dev: 22,
-    ino: 1,
-    mode: 8630,
-    nlink: 1,
-    uid: 0,
-    gid: 0,
-    rdev: 10 << 8 | minor,
-    size: 0,
-    blksize: 4096,
-    blocks: 0,
-    atime: now,
-    mtime: now,
-    ctime: now
+var init_dev_removal = __esm({
+  "src/fs/dev-removal.ts"() {
+    "use strict";
+  }
+});
+
+// src/process/process-pty.ts
+function failed(e) {
+  const code2 = e?.code;
+  if (typeof code2 === "string") return -wasiErrno(code2);
+  throw e;
+}
+function ptyIoctl(ioctl, deps) {
+  return (fd, op, varargs) => {
+    const request = op >>> 0;
+    if (request !== TIOCGPTN && request !== TIOCSPTLCK && request !== TIOCSCTTY && request !== TIOCSWINSZ && request !== TIOCPKT) {
+      return ioctl(fd, op, varargs);
+    }
+    const stream = deps.fs()?.getStream(fd);
+    const kfd = stream?.sliccKernelFd;
+    if (kfd === void 0) return ioctl(fd, op, varargs);
+    const heap = deps.heap();
+    if (!heap) return -wasiErrno("EFAULT");
+    const argp = (heap[varargs >> 2] ?? 0) >>> 0;
+    try {
+      return answer(request, kfd, argp, heap, deps.kernel);
+    } catch (e) {
+      return failed(e);
+    }
   };
 }
-function nonblocking(stream) {
-  return (stream.flags & O_NONBLOCK) !== 0 ? { nonblock: true } : void 0;
+function answer(request, kfd, argp, heap, kernel) {
+  switch (request) {
+    case TIOCGPTN:
+      heap[argp >> 2] = kernel.ptyNumber(kfd);
+      return 0;
+    case TIOCSPTLCK:
+      kernel.ptyLock(kfd, (heap[argp >> 2] ?? 0) !== 0);
+      return 0;
+    case TIOCSCTTY:
+      kernel.setControllingTerminal(kfd);
+      return 0;
+    case TIOCPKT:
+      kernel.setPacketMode(kfd, (heap[argp >> 2] ?? 0) !== 0);
+      return 0;
+    default: {
+      const word = heap[argp >> 2] ?? 0;
+      kernel.setWinsize(kfd, word & 65535, word >>> 16 & 65535);
+      return 0;
+    }
+  }
 }
-var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, SEALED_PATH, STRERROR, CLIPBOARD_PATH, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
-var init_kernel_streams = __esm({
-  "src/process/kernel-streams.ts"() {
+var TIOCGPTN, TIOCSPTLCK, TIOCSCTTY, TIOCSWINSZ, TIOCPKT;
+var init_process_pty = __esm({
+  "src/process/process-pty.ts"() {
     "use strict";
     init_wasi_errno();
-    POLLIN = 1;
-    POLLOUT = 4;
-    POLLERR = 8;
-    POLLHUP = 16;
-    POLLRDNORM = 64;
-    POLLWRNORM = 256;
-    TCSETSF = 21508;
-    O_NONBLOCK = 2048;
-    SOCKET_MODE = 49663;
-    PTY_PATH = /^\/dev\/(?:ptmx|pts\/(\d+))$/;
-    TTY_PATH = /^\/dev\/tty\d+$/;
-    TTY_NAME = /^tty\d+$/;
-    SEALED_PATH = "/dev/sealed";
-    STRERROR = {
-      EACCES: "Permission denied",
-      EIO: "I/O error",
-      ENOTSUP: "Not supported",
-      EOPNOTSUPP: "Not supported",
-      EFBIG: "File too large",
-      EILSEQ: "Illegal byte sequence",
-      EINTR: "Interrupted system call"
+    TIOCGPTN = 2147767344;
+    TIOCSPTLCK = 1074025521;
+    TIOCSCTTY = 21518;
+    TIOCSWINSZ = 21524;
+    TIOCPKT = 21536;
+  }
+});
+
+// src/process/process-fds.ts
+function closesOnExec(stream) {
+  return stream.sliccCloexec === true;
+}
+function setCloseOnExec(stream, on) {
+  if (on) stream.sliccCloexec = true;
+  else delete stream.sliccCloexec;
+}
+function trackCloseOnExec(Fs) {
+  if (tracked.has(Fs)) return;
+  tracked.add(Fs);
+  if (typeof Fs.dupStream === "function") {
+    const dupStream = Fs.dupStream.bind(Fs);
+    Fs.dupStream = (stream, fd) => {
+      const copy2 = dupStream(stream, fd);
+      setCloseOnExec(copy2, false);
+      return copy2;
     };
-    CLIPBOARD_PATH = "/dev/clipboard";
-    O_CREAT = 64;
-    O_EXCL = 128;
-    O_NOCTTY = 256;
-    O_TRUNC2 = 512;
-    KILLED_BY_SIGPIPE = 128 + 13;
-    ProcessExit = class extends Error {
-      status;
-      constructor(status2) {
-        super(`exit ${status2}`);
-        this.status = status2;
-      }
+  }
+  if (typeof Fs.open === "function") {
+    const open = Fs.open.bind(Fs);
+    Fs.open = (path, flags, mode) => {
+      const cloexec = typeof flags === "number" && (flags & O_CLOEXEC) !== 0;
+      const stream = open(path, cloexec ? flags & ~O_CLOEXEC : flags, mode);
+      setCloseOnExec(stream, cloexec);
+      return stream;
     };
-    SyscallError = class extends Error {
-      code;
-      constructor(code2) {
-        super(code2);
-        this.code = code2;
+  }
+}
+function marker(deps) {
+  return (fd, on) => {
+    const stream = deps.fs()?.getStream(fd);
+    if (stream) setCloseOnExec(stream, on);
+  };
+}
+function cloexecFcntl(fcntl, deps) {
+  const mark = marker(deps);
+  return (fd, cmd, varargs) => {
+    if (cmd === F_DUPFD_CLOEXEC) {
+      const copy2 = fcntl(fd, F_DUPFD, varargs);
+      if (copy2 >= 0) mark(copy2, true);
+      return copy2;
+    }
+    if (cmd === F_GETFL) {
+      const flags = fcntl(fd, cmd, varargs);
+      return flags < 0 ? flags : flags & ~O_CLOEXEC;
+    }
+    if (cmd !== F_GETFD && cmd !== F_SETFD) return fcntl(fd, cmd, varargs);
+    const stream = deps.fs()?.getStream(fd);
+    if (!stream) return -wasiErrno("EBADF");
+    if (cmd === F_GETFD) return closesOnExec(stream) ? FD_CLOEXEC : 0;
+    const arg = deps.heap()?.[varargs >> 2];
+    if (arg === void 0) return -wasiErrno("EINVAL");
+    setCloseOnExec(stream, (arg & FD_CLOEXEC) !== 0);
+    return 0;
+  };
+}
+function cloexecPipe2(pipe2, deps) {
+  const mark = marker(deps);
+  return (fdPtr, flags) => {
+    const r = pipe2(fdPtr, flags & ~O_CLOEXEC);
+    const heap = deps.heap();
+    if (r === 0 && flags & O_CLOEXEC && heap) {
+      mark(heap[fdPtr >> 2], true);
+      mark(heap[(fdPtr >> 2) + 1], true);
+    }
+    return r;
+  };
+}
+function quietTarget(dup3, deps) {
+  return (fd = -1, newfd = -1, flags = 0, ...rest2) => {
+    const Fs = deps.fs();
+    const target = fd === newfd || flags !== 0 ? void 0 : Fs?.getStream(newfd);
+    if (target && Fs?.getStream(fd)) {
+      try {
+        Fs.close?.(target);
+      } catch {
       }
+    }
+    return dup3(fd, newfd, flags, ...rest2);
+  };
+}
+function cloexecByFlag(syscall, flagArg, deps) {
+  const mark = marker(deps);
+  return (...args) => {
+    const cloexec = ((args[flagArg] ?? 0) & O_CLOEXEC) !== 0;
+    if (cloexec) args[flagArg] = args[flagArg] & ~O_CLOEXEC;
+    const fd = syscall(...args);
+    if (fd >= 0) mark(fd, cloexec);
+    return fd;
+  };
+}
+function wrapperFactories(deps) {
+  const { pty, timer } = deps;
+  return {
+    ...timer ? { setitimer: (f) => kernelTimer(f, timer) } : {},
+    fcntl: (f) => cloexecFcntl(f, deps),
+    pipe2: (f) => cloexecPipe2(f, deps),
+    dup3: (f) => cloexecByFlag(quietTarget(f, deps), 2, deps),
+    socket: (f) => cloexecByFlag(f, 1, deps),
+    accept4: (f) => cloexecByFlag(f, 3, deps),
+    ...pty ? { ioctl: (f) => ptyIoctl(f, { fs: deps.fs, heap: deps.heap, kernel: pty }) } : {}
+  };
+}
+function kernelTimer(setitimer, timer) {
+  return (which, ms) => {
+    if (which !== 0) return setitimer(which, ms);
+    timer.arm(ms ?? 0);
+    return 0;
+  };
+}
+function syscallOf(glue, name2, value2) {
+  const names = Object.keys(IMPORT_NAMES);
+  const own = names.find((key) => glue[key] !== void 0 && glue[key] === value2);
+  if (own) return own;
+  return typeof value2 === "function" ? names.find((key) => glue[key] !== void 0 && IMPORT_NAMES[key] === name2) : void 0;
+}
+function wrapCloexecSyscalls(imports, glue, deps) {
+  if (!glue) return;
+  const factories = wrapperFactories(deps);
+  const seen = /* @__PURE__ */ new Set();
+  for (const namespace of Object.values(imports)) {
+    if (!namespace || typeof namespace !== "object" || seen.has(namespace)) continue;
+    seen.add(namespace);
+    for (const [name2, value2] of Object.entries(namespace)) {
+      const key = syscallOf(glue, name2, value2);
+      const wrap2 = key && factories[key];
+      if (wrap2) namespace[name2] = wrap2(value2);
+    }
+  }
+}
+function pathOpensLinks(Fs) {
+  const fs = Fs;
+  const { mayOpen, isLink } = fs;
+  if (!mayOpen || !isLink) return;
+  fs.mayOpen = (node, flags) => flags & O_PATH2 && isLink.call(fs, node.mode) ? 0 : mayOpen.call(fs, node, flags);
+}
+function importKey(namespace, name2, glue) {
+  const own = glue?.[name2];
+  if (typeof own === "function") {
+    const found = Object.keys(namespace).find((k) => namespace[k] === own);
+    if (found !== void 0) return found;
+  }
+  const literal = LITERALS[name2];
+  return typeof namespace[literal] === "function" ? literal : void 0;
+}
+function wrapImport(imports, name2, glue, wrap2, optional = false) {
+  let wrapped = false;
+  for (const ns of namespaces(imports)) {
+    const key = importKey(ns, name2, glue);
+    if (key === void 0) continue;
+    ns[key] = wrap2(ns[key]);
+    wrapped = true;
+  }
+  if (!wrapped && !optional && typeof glue?.[name2] === "function") {
+    throw new Error(`slicc-kernel cannot find the glue's ${LITERALS[name2]} among its imports`);
+  }
+}
+function kernelUmask(imports, deps) {
+  let umask = deps.initial & 511;
+  const { glue } = deps;
+  wrapImport(imports, "openat", glue, (openat) => (dirfd, path, flags, varargs) => {
+    const memory = deps.memory();
+    if (flags & O_CREAT && varargs && memory) new Int32Array(memory.buffer)[varargs >> 2] &= ~umask;
+    return openat(dirfd, path, flags, varargs);
+  });
+  wrapImport(
+    imports,
+    "mkdirat",
+    glue,
+    (mkdirat) => (dirfd, path, mode) => mkdirat(dirfd, path, mode & ~umask)
+  );
+  wrapImport(
+    imports,
+    "mknodat",
+    glue,
+    (mknodat) => (dirfd, path, mode, dev) => mknodat(dirfd, path, mode & ~umask, dev)
+  );
+  wrapImport(imports, "umask", glue, (own) => {
+    own(umask);
+    return (mask) => {
+      const old = umask;
+      umask = mask & 511;
+      own(umask);
+      deps.set(umask);
+      return old;
     };
-    KernelStreams = class {
-      refs = /* @__PURE__ */ new Map();
-      socketRoot;
-      sockets = 0;
-      descriptions = /* @__PURE__ */ new Map();
-      described = 0;
-      Fs;
-      sys;
-      options;
-      constructor(Fs, sys, options = {}) {
-        this.Fs = Fs;
-        this.sys = sys;
-        this.options = options;
-      }
-      attach(stream, kfd, terminal) {
-        this.refs.set(kfd, (this.refs.get(kfd) ?? 0) + 1);
-        stream.sliccKernelFd = kfd;
-        stream.stream_ops = this.ops(kfd, stream.stream_ops);
-        if (terminal ?? this.sys.isatty?.(kfd) ?? false) stream.tty = this.ttyOps(kfd);
-        else delete stream.tty;
-      }
-      attachSocket(stream, kfd) {
-        this.attach(stream, kfd, false);
-        stream.sliccKernelSocket = true;
-      }
-      socketStream(flags) {
-        const fs = this.Fs;
-        if (!fs.mount || !fs.createNode || !fs.createStream) {
-          const stream = this.Fs.open("/dev/null", 2);
-          stream.flags = flags;
-          return stream;
-        }
-        const createNode = fs.createNode;
-        this.socketRoot ??= fs.mount({ mount: () => createNode(null, "/", 16895, 0) }, {}, null);
-        const ino = ++this.sockets;
-        const node = fs.createNode(this.socketRoot, `socket:${ino}`, SOCKET_MODE, 0);
-        const now = /* @__PURE__ */ new Date();
-        const stat = { dev: 0, ino, mode: SOCKET_MODE, nlink: 1, uid: 0, gid: 0, rdev: 0, size: 0 };
-        const times = { atime: now, mtime: now, ctime: now, blksize: 4096, blocks: 0 };
-        node.node_ops = { getattr: () => ({ ...stat, ...times }) };
-        return fs.createStream({ node, flags, seekable: false, position: 0, stream_ops: {} });
+  });
+}
+function touching(times, memory) {
+  if (times === 0) return true;
+  if (!memory) return false;
+  const heap = new Int32Array(memory.buffer);
+  const nsec = [heap[times + 8 >> 2], heap[times + 24 >> 2]];
+  return nsec.every((n) => n === UTIME_NOW || n === UTIME_OMIT);
+}
+function touch(Fs, on, run) {
+  if (!Fs || !on) return run();
+  Fs.sliccTouch = true;
+  try {
+    return run();
+  } finally {
+    Fs.sliccTouch = void 0;
+  }
+}
+function noFollowUtimes(imports, fs, glue, memory = () => void 0) {
+  wrapImport(
+    imports,
+    "utimensat",
+    { utimensat: glue },
+    (utimensat) => (dirfd, path, times, flags) => {
+      const Fs = fs();
+      const on = touching(times, memory());
+      const { utime, lookupPath, ErrnoError } = Fs ?? {};
+      if (!Fs || !(flags & AT_SYMLINK_NOFOLLOW) || !utime || !lookupPath || !ErrnoError) {
+        return touch(Fs, on, () => utimensat(dirfd, path, times, flags));
       }
-      nameTerminal(stream) {
-        const kfd = stream.sliccKernelFd;
-        if (!stream.tty || kfd === void 0) return;
-        const name2 = this.sys.ttyName?.(kfd);
-        if (name2) this.nameStream(stream, name2);
+      Fs.utime = (at, atime, mtime) => {
+        const { node } = lookupPath.call(Fs, at, { follow: false });
+        if (!node.node_ops.setattr) throw new ErrnoError(EMSCRIPTEN_EPERM);
+        node.node_ops.setattr(node, { atime, mtime });
+      };
+      try {
+        return touch(Fs, on, () => utimensat(dirfd, path, times, flags));
+      } finally {
+        Fs.utime = utime;
       }
-      nameStream(stream, name2) {
-        stream.path = name2;
-        this.ttyNode(name2);
-        if (typeof this.Fs.stat !== "function") return;
-        stream.stream_ops = { ...stream.stream_ops, getattr: () => this.Fs.stat?.(name2) ?? {} };
+    }
+  );
+}
+function errnoOf(err) {
+  const { errno: errno2, code: code2 } = err ?? {};
+  if (typeof errno2 === "number") return errno2;
+  if (typeof code2 === "string") return wasiErrno(code2);
+  throw err;
+}
+function persistsItself(stream) {
+  const type = stream.node.mount?.type;
+  return typeof type?.syncfs === "function";
+}
+function namespaces(imports) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const namespace of Object.values(imports)) {
+    if (namespace && typeof namespace === "object") seen.add(namespace);
+  }
+  return [...seen];
+}
+function keyOf(namespace, name2, glue) {
+  const own = glue?.[name2];
+  const found = typeof own === "function" ? Object.keys(namespace).find((k) => namespace[k] === own) : void 0;
+  return found ?? (typeof namespace[name2] === "function" ? name2 : void 0);
+}
+function syncFsync(imports, fs, glue) {
+  for (const namespace of namespaces(imports)) {
+    const key = keyOf(namespace, "fd_sync", glue);
+    const original = key === void 0 ? void 0 : namespace[key];
+    if (key === void 0 || !original?.isAsync) continue;
+    namespace[key] = (fd) => {
+      const stream = fs()?.getStream(fd);
+      if (!stream) return EBADF;
+      if (persistsItself(stream)) return original(fd);
+      try {
+        const result = stream.stream_ops.fsync?.(stream);
+        return typeof result === "number" ? result : 0;
+      } catch (err) {
+        return errnoOf(err);
       }
-      nameDevice(stream, kind) {
-        this.nameStream(stream, kind === "sealed" ? SEALED_PATH : CLIPBOARD_PATH);
+    };
+  }
+}
+function offsetOf(rest2) {
+  const at = rest2.length >= 3 ? Number(rest2[1]) * 2 ** 32 + (Number(rest2[0]) >>> 0) : Number(BigInt.asIntN(64, BigInt(rest2[0])));
+  return at >= 0 && Number.isSafeInteger(at) ? at : void 0;
+}
+function readInto(sys, kfd, target, at) {
+  let done = 0;
+  while (done < target.length) {
+    const got = sys.pread?.(kfd, target.length - done, at + done) ?? new Uint8Array(0);
+    if (got.length === 0) break;
+    target.set(got, done);
+    done += got.length;
+  }
+  return done;
+}
+function positioned(original, write2, deps) {
+  return (fd, iov, iovcnt, ...rest2) => {
+    const stream = deps.fs()?.getStream(Number(fd));
+    const memory = deps.memory();
+    const kfd = stream?.sliccKernelFile ? stream.sliccKernelFd : void 0;
+    if (kfd === void 0 || !memory || !(write2 ? deps.sys.pwrite : deps.sys.pread)) {
+      return original(fd, iov, iovcnt, ...rest2);
+    }
+    const at = offsetOf(rest2);
+    if (at === void 0) return wasiErrno("EINVAL");
+    const view = new DataView(memory.buffer);
+    let done = 0;
+    try {
+      for (let i = 0; i < Number(iovcnt); i++) {
+        const ptr = view.getUint32(Number(iov) + i * 8, true);
+        const len = view.getUint32(Number(iov) + i * 8 + 4, true);
+        const part = new Uint8Array(memory.buffer, ptr, len);
+        const moved = write2 ? deps.sys.pwrite?.(kfd, part.slice(), at + done) ?? 0 : readInto(deps.sys, kfd, part, at + done);
+        done += moved;
+        if (moved < len) break;
       }
-      listSealed() {
-        const fs = this.Fs;
-        const { analyzePath, mkdev, makedev, registerDevice } = fs;
-        if (!analyzePath || !mkdev || !makedev) return;
-        const nodes = [
-          [SEALED_PATH, 250, this.sys.openSealed],
-          [CLIPBOARD_PATH, 251, this.sys.openClipboard]
-        ];
-        for (const [path, minor, opener] of nodes) {
-          if (!opener) continue;
-          const dev = makedev.call(fs, 10, minor);
-          registerDevice?.call(fs, dev, {
-            open: (stream) => this.openNode(stream, path, opener)
-          });
-          if (analyzePath.call(fs, path).exists) continue;
-          try {
-            const node = mkdev.call(fs, path, dev);
-            if (typeof node === "object" && node !== null) {
-              const made = node;
-              made.node_ops = { ...made.node_ops, getattr: () => sealedStat(minor) };
-            }
-          } catch {
-          }
-        }
+    } catch (err) {
+      return errnoOf(err);
+    }
+    view.setUint32(Number(rest2[rest2.length - 1]), done, true);
+    return 0;
+  };
+}
+function positionalIo(imports, deps) {
+  for (const namespace of namespaces(imports)) {
+    for (const [name2, write2] of [
+      ["fd_pread", false],
+      ["fd_pwrite", true]
+    ]) {
+      const key = keyOf(namespace, name2, deps.glue);
+      if (key !== void 0) {
+        namespace[key] = positioned(namespace[key], write2, deps);
       }
-      openNode(stream, path, opener) {
-        let kfd;
-        try {
-          kfd = this.call(() => opener.call(this.sys, stream.flags & 3));
-        } catch (e) {
-          this.Fs.closeStream(stream.fd);
-          throw e;
+    }
+  }
+}
+function staging(Fs, length) {
+  try {
+    return new Uint8Array(length);
+  } catch {
+    throw new Fs.ErrnoError(wasiErrno("ENOMEM"));
+  }
+}
+function useFileMmap(Fs, deps) {
+  const fs = Fs;
+  const mmap = fs.mmap;
+  if (typeof mmap !== "function") return;
+  fs.mmap = (stream, length, position, prot, flags) => {
+    const memalign = deps.memalign();
+    const memory = deps.memory();
+    const shared = (flags & MAP_TYPE) !== MAP_PRIVATE && (prot & PROT_WRITE) !== 0;
+    const kfd = stream.sliccKernelFile ? stream.sliccKernelFd : void 0;
+    if (shared && kfd !== void 0) throw new Fs.ErrnoError(wasiErrno("ENODEV"));
+    if (stream.stream_ops.mmap && kfd === void 0 || !memalign || !memory || length <= 0 || shared || (stream.flags & O_ACCMODE2) === O_WRONLY || !Fs.isFile(stream.node.mode)) {
+      return mmap.call(fs, stream, length, position, prot, flags);
+    }
+    const data = staging(Fs, length);
+    let done = 0;
+    try {
+      if (kfd !== void 0) done = readInto(deps.sys, kfd, data, position);
+      else {
+        for (let got = 1; done < length && got > 0; done += got) {
+          got = Fs.read(stream, data, done, length - done, position + done);
         }
-        this.attach(stream, kfd, false);
-        this.nameStream(stream, path);
-        if (path === CLIPBOARD_PATH) this.reportClose(kfd);
       }
-      reporting = /* @__PURE__ */ new Set();
-      reportClose(kfd) {
-        this.reporting.add(kfd);
+    } catch (err) {
+      throw new Fs.ErrnoError(errnoOf(err));
+    }
+    const size = Math.ceil(length / MAP_ALIGN) * MAP_ALIGN;
+    const ptr = memalign(MAP_ALIGN, size);
+    if (!ptr) throw new Fs.ErrnoError(wasiErrno("ENOMEM"));
+    const target = new Uint8Array(memory.buffer, ptr, size);
+    target.fill(0);
+    target.set(data.subarray(0, done));
+    return { ptr, allocated: true };
+  };
+}
+function wasmMemory(instance, imports) {
+  const isMemory = (v) => v instanceof WebAssembly.Memory;
+  const exported = Object.values(instance.exports).find(isMemory);
+  if (exported) return exported;
+  for (const namespace of Object.values(imports)) {
+    const found = Object.values(namespace ?? {}).find(isMemory);
+    if (found) return found;
+  }
+  return void 0;
+}
+function absoluteOf(path, cwd) {
+  const parts = [];
+  for (const part of `${path.startsWith("/") ? "" : cwd}/${path}`.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") parts.pop();
+    else parts.push(part);
+  }
+  return `/${parts.join("/")}`;
+}
+function fdOfPath(path, cwd) {
+  const abs = absoluteOf(path, cwd);
+  const std = ["/dev/stdin", "/dev/stdout", "/dev/stderr"].indexOf(abs);
+  if (std >= 0) return std;
+  const m = /^\/(?:dev|proc\/self)\/fd\/(\d+)$/.exec(abs);
+  return m ? Number(m[1]) : void 0;
+}
+function syntheticAttr(mode, ino) {
+  const now = /* @__PURE__ */ new Date();
+  return {
+    dev: 1,
+    ino,
+    mode,
+    nlink: 1,
+    uid: 0,
+    gid: 0,
+    rdev: 0,
+    size: 0,
+    atime: now,
+    mtime: now,
+    ctime: now,
+    blksize: 4096,
+    blocks: 0
+  };
+}
+function describeFdDir(Fs) {
+  let dir;
+  try {
+    dir = Fs.lookupPath?.("/proc/self/fd", { follow: true })?.node;
+  } catch {
+    return;
+  }
+  const ops = dir?.node_ops;
+  const lookup2 = ops?.lookup;
+  if (!dir || !lookup2 || ops.getattr) return;
+  dir.node_ops = {
+    ...ops,
+    getattr: () => syntheticAttr(DIR_MODE, 1),
+    lookup: (parent, name2) => {
+      const entry = lookup2(parent, name2);
+      entry.node_ops = {
+        ...entry.node_ops,
+        getattr: () => syntheticAttr(LINK_MODE, entry.id ?? 0)
+      };
+      return entry;
+    }
+  };
+}
+function useZeroDevices(Fs) {
+  const { analyzePath, registerDevice, mkdev, makedev } = Fs;
+  if (!analyzePath || !registerDevice || !mkdev || !makedev) return;
+  const zeros = (_s, buffer, offset, length) => {
+    buffer.fill(0, offset, offset + length);
+    return length;
+  };
+  const devices = [
+    ["/dev/zero", 5, (_s, _b, _o, length) => length],
+    [
+      "/dev/full",
+      7,
+      (_s, _b, _o, length) => {
+        if (length > 0) throw new Fs.ErrnoError(wasiErrno("ENOSPC"));
+        return 0;
       }
-      quitting = false;
-      atExit = false;
-      failedAtExit = false;
-      committed = /* @__PURE__ */ new Set();
-      exiting() {
-        this.atExit = true;
-        return () => {
-          this.atExit = false;
-        };
-      }
-      commitStdout() {
-        const kfd = this.Fs.getStream(1)?.sliccKernelFd;
-        if (kfd === void 0 || !this.reporting.delete(kfd)) return;
-        this.committed.add(kfd);
-        try {
-          this.sys.close(kfd);
-        } catch (e) {
-          if (e instanceof SyscallError) this.stdoutFailed(e.code);
-        }
-      }
-      exitStatus(status2) {
-        return this.failedAtExit && status2 === 0 ? 1 : status2;
-      }
-      reportedClose(stream, kfd) {
-        try {
-          this.sys.close(kfd);
-        } catch (e) {
-          if (this.quitting && stream.fd === 1 && e instanceof SyscallError) this.stdoutFailed(e.code);
-          this.call(() => {
-            throw e;
-          });
-        }
-      }
-      stdoutFailed(code2) {
-        this.failedAtExit = true;
-        const stderr = this.Fs.getStream(2)?.sliccKernelFd;
-        if (stderr === void 0) return;
-        const line = `${this.options.program ?? "program"}: write error: ${STRERROR[code2] ?? code2}
+    ]
+  ];
+  for (const [path, minor, write2] of devices) {
+    if (analyzePath.call(Fs, path).exists) continue;
+    const dev = makedev.call(Fs, 1, minor);
+    registerDevice.call(Fs, dev, { read: zeros, write: write2, llseek: () => 0 });
+    mkdev.call(Fs, path, CHAR_DEVICE, dev);
+  }
+}
+function useDevRemoval(Fs) {
+  const fs = Fs;
+  for (const name2 of ["unlink", "rmdir"]) {
+    const remove = fs[name2];
+    if (typeof remove !== "function") continue;
+    fs[name2] = (path) => {
+      const refused = devRemoval(absoluteOf(path, Fs.cwd()), fs.sliccCred);
+      if (refused) throw new Fs.ErrnoError(wasiErrno(refused));
+      remove.call(Fs, path);
+    };
+  }
+}
+function linkStdio(Fs) {
+  const { unlink, symlink } = Fs;
+  if (!unlink || !symlink) return;
+  for (const [fd, name2] of ["stdin", "stdout", "stderr"].entries()) {
+    try {
+      unlink.call(Fs, `/dev/${name2}`);
+    } catch {
+    }
+    try {
+      symlink.call(Fs, `/proc/self/fd/${fd}`, `/dev/${name2}`);
+    } catch {
+    }
+  }
+}
+function useDevFd(Fs) {
+  if (typeof Fs.open !== "function") return;
+  try {
+    Fs.symlink?.("/proc/self/fd", "/dev/fd");
+  } catch {
+  }
+  linkStdio(Fs);
+  describeFdDir(Fs);
+  const fdOf = (path) => typeof path === "string" ? fdOfPath(path, Fs.cwd()) : void 0;
+  const target = (fd) => {
+    const stream = Fs.getStream(fd);
+    if (!stream) throw new Fs.ErrnoError(wasiErrno("EBADF"));
+    return stream;
+  };
+  const open = Fs.open.bind(Fs);
+  Fs.open = (path, flags, mode) => {
+    const fd = fdOf(path);
+    if (fd === void 0) return open(path, flags, mode);
+    const copy2 = Fs.dupStream(target(fd), -1);
+    setCloseOnExec(copy2, typeof flags === "number" && (flags & O_CLOEXEC) !== 0);
+    return copy2;
+  };
+  const { stat, fstat } = Fs;
+  if (typeof stat !== "function" || typeof fstat !== "function") return;
+  Fs.stat = (path, dontFollow) => {
+    const fd = dontFollow ? void 0 : fdOf(path);
+    if (fd === void 0) return stat.call(Fs, path, dontFollow);
+    target(fd);
+    return fstat.call(Fs, fd);
+  };
+}
+function pinRootKind() {
+  pinnedRoot = rootKind();
+}
+function mountTable(mounts = []) {
+  const root = pinnedRoot ?? rootKind();
+  const lines = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
+  for (const m of mounts) {
+    const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
+    if (m.state !== "ok") options.push(m.state);
+    const access = options.includes("ro") ? [] : ["rw"];
+    lines.push(
+      `${field(m.source)} ${field(m.target)} ${m.type} ${[...access, ...options].join(",")} 0 0`
+    );
+  }
+  return `${lines.join("\n")}
 `;
-        try {
-          this.sys.write(stderr, new TextEncoder().encode(line));
-        } catch {
-        }
+}
+function accounts(env = {}) {
+  const user = env.USER ?? "web_user";
+  const name2 = NAME.test(user) && user !== "root" ? user : "user";
+  const home = env.HOME || "/home";
+  return {
+    passwd: `root:x:0:0:root:/root:/bin/sh
+${name2}:x:1000:1000:${name2}:${home}:/bin/bash
+`,
+    group: `root:x:0:
+${name2}:x:1000:
+`
+  };
+}
+function useMounts(Fs, env = {}, live = false) {
+  const { writeFile, mkdirTree } = Fs;
+  if (typeof Fs.open !== "function" || typeof writeFile !== "function") return;
+  const { passwd, group } = accounts(env);
+  const backing = { "/etc/mtab": "/proc/mounts" };
+  try {
+    if (!live) writeFile.call(Fs, "/proc/mounts", mountTable());
+  } catch {
+    return;
+  }
+  try {
+    mkdirTree.call(Fs, "/dev/.etc");
+    writeFile.call(Fs, "/dev/.etc/passwd", passwd);
+    writeFile.call(Fs, "/dev/.etc/group", group);
+    writeFile.call(Fs, "/dev/.etc/hosts", hostsFile(hostnameOf(env)));
+    writeFile.call(Fs, "/dev/.etc/hostname", `${hostnameOf(env)}
+`);
+    backing["/etc/passwd"] = "/dev/.etc/passwd";
+    backing["/etc/group"] = "/dev/.etc/group";
+    backing["/etc/hosts"] = "/dev/.etc/hosts";
+    backing["/etc/hostname"] = "/dev/.etc/hostname";
+  } catch {
+  }
+  const open = Fs.open.bind(Fs);
+  Fs.open = (path, flags, mode) => {
+    const instead = backing[path];
+    if (!instead || (flags & (O_ACCMODE2 | O_CREAT)) !== 0) return open(path, flags, mode);
+    try {
+      return open(path, flags, mode);
+    } catch (e) {
+      if (e?.errno !== wasiErrno("ENOENT")) throw e;
+      return open(instead, flags, mode);
+    }
+  };
+}
+function cString(memory, at) {
+  const bytes = new Uint8Array(memory.buffer, at);
+  return new TextDecoder().decode(bytes.subarray(0, bytes.indexOf(0)));
+}
+function baseOf(Fs, dirfd) {
+  return dirfd === AT_FDCWD ? Fs.cwd?.() ?? "/" : Fs.getStream?.(dirfd)?.path ?? "/";
+}
+function readonlyRefusal(Fs, memory, call2) {
+  if (!(call2.amode & W_ACCESS)) return 0;
+  try {
+    const name2 = cString(memory, call2.path);
+    const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
+    const follow2 = (call2.flags & AT_SYMLINK_NOFOLLOW) === 0;
+    const { node } = Fs.lookupPath.call(Fs, abs, {
+      follow: follow2
+    });
+    const bridge = node.live ? node.mount.opts.bridge : void 0;
+    const stats = bridge;
+    const stat = follow2 ? stats?.stat : stats?.lstat;
+    return stat?.call(stats, liveNodePath(node)).readonly ? -wasiErrno("EROFS") : 0;
+  } catch {
+    return 0;
+  }
+}
+function kernelChecks(Fs, memory, call2) {
+  const name2 = cString(memory, call2.path);
+  const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
+  const lookupPath = Fs.lookupPath;
+  const { node } = lookupPath.call(Fs, abs, { follow: (call2.flags & AT_SYMLINK_NOFOLLOW) === 0 });
+  const bridge = node.live ? node.mount.opts.bridge : void 0;
+  if (!bridge?.owners || !bridge.access) return 0;
+  const kind = call2.flags & AT_EACCESS ? "eaccess" : "access";
+  bridge.access(liveNodePath(node), call2.amode, kind, (call2.flags & AT_SYMLINK_NOFOLLOW) !== 0);
+  return 0;
+}
+function kernelAccess(imports, fs, memory, glue) {
+  wrapImport(imports, "faccessat", glue, (own) => (dirfd, path, amode, flags) => {
+    const Fs = fs();
+    const heap = memory();
+    const call2 = { dirfd, path, amode: amode & 7, flags };
+    const refused = Fs?.lookupPath && heap ? readonlyRefusal(Fs, heap, call2) : 0;
+    if (refused !== 0) return refused;
+    const rc = own(dirfd, path, amode, flags);
+    if (rc !== 0 || !Fs?.lookupPath || !heap) return rc;
+    try {
+      return kernelChecks(Fs, heap, { dirfd, path, amode: amode & 7, flags });
+    } catch (err) {
+      return -errnoOf(err);
+    }
+  });
+}
+function kernelLink(imports, fs, memory, glue) {
+  wrapImport(
+    imports,
+    "linkat",
+    glue,
+    (own) => (olddirfd, oldpath, newdirfd, newpath, flags) => {
+      const Fs = fs();
+      const heap = memory();
+      if (!Fs?.lookupPath || !heap) return own(olddirfd, oldpath, newdirfd, newpath, flags);
+      const at = (dirfd, ptr) => {
+        const name2 = cString(heap, ptr);
+        return name2.startsWith("/") ? name2 : `${baseOf(Fs, dirfd)}/${name2}`;
+      };
+      try {
+        const from = at(olddirfd, oldpath);
+        const to = at(newdirfd, newpath);
+        const follow2 = (flags & AT_SYMLINK_FOLLOW) !== 0;
+        if (linkLive(Fs, from, to, follow2)) return 0;
+      } catch (err) {
+        return -errnoOf(err);
       }
-      creatingTerminal = false;
-      useTerminalNodes() {
-        const fs = this.Fs;
-        const { lookupNode, readdir, getPath, mkdev, makedev } = fs;
-        const ttyNames = this.sys.ttyNames?.bind(this.sys);
-        if (!lookupNode || !readdir || !getPath || !mkdev || !makedev || !ttyNames) return;
-        fs.lookupNode = (parent, name2) => {
-          try {
-            return lookupNode.call(fs, parent, name2);
-          } catch (e) {
-            const path = `/dev/${name2}`;
-            if (this.creatingTerminal || !TTY_NAME.test(name2) || getPath.call(fs, parent) !== "/dev")
-              throw e;
-            if (!ttyNames().includes(path)) throw e;
-            this.creatingTerminal = true;
-            try {
-              mkdev.call(fs, path, makedev.call(fs, 6, 0));
-            } finally {
-              this.creatingTerminal = false;
-            }
-            return lookupNode.call(fs, parent, name2);
-          }
-        };
-        fs.readdir = (path) => {
-          const names = readdir.call(fs, path);
-          if (path.replace(/\/+$/, "") !== "/dev") return names;
-          const missing2 = ttyNames().map((tty) => tty.slice("/dev/".length)).filter((name2) => TTY_NAME.test(name2) && !names.includes(name2));
-          return [...names, ...missing2];
-        };
-      }
-      ttyNode(name2) {
-        const { analyzePath, mkdev, makedev } = this.Fs;
-        if (!TTY_PATH.test(name2) || !analyzePath || !mkdev || !makedev) return;
-        if (!analyzePath.call(this.Fs, name2).exists)
-          mkdev.call(this.Fs, name2, makedev.call(this.Fs, 6, 0));
+      return own(olddirfd, oldpath, newdirfd, newpath, flags);
+    },
+    true
+  );
+}
+function kernelChdir(Fs) {
+  const { chdir, lookupPath, ErrnoError } = Fs;
+  if (!chdir || !lookupPath || !ErrnoError) return;
+  Fs.chdir = (path) => {
+    const { node } = lookupPath.call(Fs, path, { follow: true });
+    const directory = Fs.isDir?.(node.mode) === true;
+    const bridge = node.live && directory ? node.mount.opts.bridge : void 0;
+    try {
+      bridge?.access?.(liveNodePath(node), X_ACCESS, "eaccess", false);
+    } catch (err) {
+      throw new ErrnoError(errnoOf(err));
+    }
+    chdir.call(Fs, path);
+  };
+}
+function linuxDevices(Fs) {
+  Fs.ignorePermissions = true;
+  kernelChdir(Fs);
+  const { chmod } = Fs;
+  if (!chmod) return;
+  for (const [path, mode] of DEVICE_MODES) {
+    try {
+      chmod.call(Fs, path, mode);
+    } catch {
+    }
+  }
+}
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, X_ACCESS, AT_SYMLINK_FOLLOW, DEVICE_MODES;
+var init_process_fds = __esm({
+  "src/process/process-fds.ts"() {
+    "use strict";
+    init_dev_removal();
+    init_loopback_names();
+    init_live_vfs_fs();
+    init_process_pty();
+    init_wasi_errno();
+    O_CLOEXEC = 524288;
+    FD_CLOEXEC = 1;
+    F_DUPFD = 0;
+    F_GETFD = 1;
+    F_SETFD = 2;
+    F_GETFL = 3;
+    F_DUPFD_CLOEXEC = 1030;
+    tracked = /* @__PURE__ */ new WeakSet();
+    IMPORT_NAMES = {
+      fcntl: "__syscall_fcntl64",
+      pipe2: "__syscall_pipe2",
+      dup3: "__syscall_dup3",
+      socket: "__syscall_socket",
+      accept4: "__syscall_accept4",
+      ioctl: "__syscall_ioctl",
+      setitimer: "_setitimer_js"
+    };
+    EBADF = 8;
+    AT_SYMLINK_NOFOLLOW = 256;
+    EMSCRIPTEN_EPERM = 63;
+    O_PATH2 = 2097152;
+    LITERALS = {
+      openat: "__syscall_openat",
+      mkdirat: "__syscall_mkdirat",
+      mknodat: "__syscall_mknodat",
+      umask: "__syscall_umask",
+      faccessat: "__syscall_faccessat",
+      linkat: "__syscall_linkat",
+      utimensat: "__syscall_utimensat",
+      getppid: "slicc_getppid_js",
+      resizeHeap: "emscripten_resize_heap",
+      fdWrite: "fd_write",
+      fdRead: "fd_read",
+      sleepMs: "slicc_sleep_ms"
+    };
+    UTIME_NOW = 1073741823;
+    UTIME_OMIT = 1073741822;
+    PROT_WRITE = 2;
+    MAP_PRIVATE = 2;
+    MAP_TYPE = 15;
+    O_WRONLY = 1;
+    MAP_ALIGN = 65536;
+    DIR_MODE = 16749;
+    LINK_MODE = 41408;
+    CHAR_DEVICE = 8630;
+    O_ACCMODE2 = 3;
+    O_CREAT = 64;
+    field = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
+    rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
+    NAME = /^[a-z_][a-z0-9_-]*$/i;
+    AT_FDCWD = -100;
+    AT_EACCESS = 512;
+    W_ACCESS = 2;
+    X_ACCESS = 1;
+    AT_SYMLINK_FOLLOW = 1024;
+    DEVICE_MODES = [
+      ["/", 493],
+      ["/dev", 493],
+      ["/dev/null", 438],
+      ["/dev/zero", 438],
+      ["/dev/full", 438],
+      ["/dev/random", 438],
+      ["/dev/urandom", 438],
+      ["/dev/tty", 438],
+      ["/dev/shm", 1023]
+    ];
+  }
+});
+
+// src/process/fd-metadata.ts
+function idOf2(value2) {
+  return value2 === -1 || value2 === 4294967295 ? void 0 : value2 >>> 0;
+}
+function timeOf(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? value2 : null;
+}
+function useKernelFdMetadata(Fs, sys, call2) {
+  const { fdChown, fdChmod, fdUtimes } = sys;
+  const meta = Fs;
+  const kernelFd = (stream) => stream?.sliccKernelFile ? stream.sliccKernelFd : void 0;
+  const find = (match) => {
+    for (const s of Fs.streams) {
+      const kfd = s && match(s) ? kernelFd(s) : void 0;
+      if (kfd !== void 0) return kfd;
+    }
+    return void 0;
+  };
+  const ofPath = (path, follow2) => {
+    if (typeof path !== "string") return find((s) => s.node === path);
+    const fd = follow2 ? fdOfPath(path, Fs.cwd()) : void 0;
+    if (fd !== void 0) return kernelFd(Fs.getStream(fd));
+    return find((s) => s.path === path);
+  };
+  const ofFd = (fd) => kernelFd(Fs.getStream(fd));
+  const chownBy = (kfd, uid, gid) => call2(() => fdChown?.call(sys, kfd, idOf2(uid), idOf2(gid)));
+  if (fdChown && meta.chown) {
+    const chown = meta.chown.bind(Fs);
+    meta.chown = (path, uid, gid, dontFollow) => {
+      const kfd = ofPath(path, !dontFollow);
+      if (kfd === void 0) return chown(path, uid, gid, dontFollow);
+      chownBy(kfd, uid, gid);
+    };
+  }
+  if (fdChown && meta.fchown) {
+    const fchown = meta.fchown.bind(Fs);
+    meta.fchown = (fd, uid, gid) => {
+      const kfd = ofFd(fd);
+      if (kfd === void 0) return fchown(fd, uid, gid);
+      chownBy(kfd, uid, gid);
+    };
+  }
+  if (fdChmod && meta.chmod) {
+    const chmod = meta.chmod.bind(Fs);
+    meta.chmod = (path, mode, dontFollow) => {
+      const kfd = ofPath(path, !dontFollow);
+      if (kfd === void 0) return chmod(path, mode, dontFollow);
+      call2(() => fdChmod.call(sys, kfd, mode & 4095));
+    };
+  }
+  if (fdChmod && meta.fchmod) {
+    const fchmod = meta.fchmod.bind(Fs);
+    meta.fchmod = (fd, mode) => {
+      const kfd = ofFd(fd);
+      if (kfd === void 0) return fchmod(fd, mode);
+      call2(() => fdChmod.call(sys, kfd, mode & 4095));
+    };
+  }
+  if (fdUtimes && meta.utime) {
+    const utime = meta.utime.bind(Fs);
+    meta.utime = (path, atime, mtime) => {
+      const kfd = ofPath(path, true);
+      if (kfd === void 0) return utime(path, atime, mtime);
+      const now = meta.sliccTouch === true;
+      call2(() => fdUtimes.call(sys, kfd, timeOf(atime), timeOf(mtime), now));
+    };
+  }
+}
+var init_fd_metadata = __esm({
+  "src/process/fd-metadata.ts"() {
+    "use strict";
+    init_process_fds();
+  }
+});
+
+// src/process/kernel-streams.ts
+function isPtyPath(path) {
+  return PTY_PATH.test(path);
+}
+function ptyStat(path) {
+  const n = PTY_PATH.exec(path)?.[1];
+  const now = /* @__PURE__ */ new Date();
+  return {
+    dev: 22,
+    ino: n === void 0 ? 2 : 3 + Number(n),
+    mode: n === void 0 ? 8630 : 8592,
+    nlink: 1,
+    uid: 1e3,
+    gid: 1e3,
+    rdev: n === void 0 ? 5 << 8 | 2 : 136 << 8 | Number(n),
+    size: 0,
+    blksize: 4096,
+    blocks: 0,
+    atime: now,
+    mtime: now,
+    ctime: now
+  };
+}
+function sealedStat(minor = 250) {
+  const now = /* @__PURE__ */ new Date();
+  return {
+    dev: 22,
+    ino: minor === 251 ? 2 : 1,
+    mode: 8630,
+    nlink: 1,
+    uid: 0,
+    gid: 0,
+    rdev: 10 << 8 | minor,
+    size: 0,
+    blksize: 4096,
+    blocks: 0,
+    atime: now,
+    mtime: now,
+    ctime: now
+  };
+}
+function nonblocking(stream) {
+  return (stream.flags & O_NONBLOCK) !== 0 ? { nonblock: true } : void 0;
+}
+function datesOf(real) {
+  const dates = {};
+  for (const [key, value2] of Object.entries(real ?? {}))
+    if (/^[amc]time$/.test(key) && (typeof value2 === "string" || typeof value2 === "number"))
+      dates[key] = new Date(value2);
+  return dates;
+}
+var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, SEALED_PATH, STRERROR, CLIPBOARD_PATH, O_CREAT2, O_EXCL, O_NOCTTY, O_TRUNC2, O_DIRECTORY, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
+var init_kernel_streams = __esm({
+  "src/process/kernel-streams.ts"() {
+    "use strict";
+    init_fd_metadata();
+    init_wasi_errno();
+    POLLIN = 1;
+    POLLOUT = 4;
+    POLLERR = 8;
+    POLLHUP = 16;
+    POLLRDNORM = 64;
+    POLLWRNORM = 256;
+    TCSETSF = 21508;
+    O_NONBLOCK = 2048;
+    SOCKET_MODE = 49663;
+    PTY_PATH = /^\/dev\/(?:ptmx|pts\/(\d+))$/;
+    TTY_PATH = /^\/dev\/tty\d+$/;
+    TTY_NAME = /^tty\d+$/;
+    SEALED_PATH = "/dev/sealed";
+    STRERROR = {
+      EACCES: "Permission denied",
+      EIO: "I/O error",
+      ENOTSUP: "Not supported",
+      EOPNOTSUPP: "Not supported",
+      EFBIG: "File too large",
+      EILSEQ: "Illegal byte sequence",
+      EINTR: "Interrupted system call"
+    };
+    CLIPBOARD_PATH = "/dev/clipboard";
+    O_CREAT2 = 64;
+    O_EXCL = 128;
+    O_NOCTTY = 256;
+    O_TRUNC2 = 512;
+    O_DIRECTORY = 65536;
+    KILLED_BY_SIGPIPE = 128 + 13;
+    ProcessExit = class extends Error {
+      status;
+      constructor(status2) {
+        super(`exit ${status2}`);
+        this.status = status2;
       }
-      ttyOps(kfd) {
-        return {
-          ops: {
-            ioctl_tcgets: () => this.call(() => this.sys.tcgets?.(kfd)),
-            ioctl_tcsets: (_tty, op, termios) => this.call(() => {
-              this.sys.tcsets?.(kfd, termios, op === TCSETSF);
-              return 0;
-            }),
-            ioctl_tiocgwinsz: () => this.call(() => this.sys.winsize?.(kfd) ?? [24, 80]),
-            fsync: () => {
-            }
-          }
-        };
+    };
+    SyscallError = class extends Error {
+      code;
+      constructor(code2) {
+        super(code2);
+        this.code = code2;
       }
-      attachFile(stream, kfd) {
-        this.attach(stream, kfd, false);
-        stream.sliccKernelFile = true;
-        stream.stream_ops = {
-          ...stream.stream_ops,
-          llseek: (_s, offset, whence) => this.call(() => this.sys.seek(kfd, offset, whence)),
-          fsync: () => this.call(() => {
-            this.sys.flush(kfd);
-            return 0;
-          })
-        };
+    };
+    KernelStreams = class {
+      refs = /* @__PURE__ */ new Map();
+      socketRoot;
+      sockets = 0;
+      descriptions = /* @__PURE__ */ new Map();
+      described = 0;
+      Fs;
+      sys;
+      options;
+      constructor(Fs, sys, options = {}) {
+        this.Fs = Fs;
+        this.sys = sys;
+        this.options = options;
+      }
+      attach(stream, kfd, terminal) {
+        this.refs.set(kfd, (this.refs.get(kfd) ?? 0) + 1);
+        stream.sliccKernelFd = kfd;
+        stream.stream_ops = this.ops(kfd, stream.stream_ops);
+        if (terminal ?? this.sys.isatty?.(kfd) ?? false) stream.tty = this.ttyOps(kfd);
+        else delete stream.tty;
+      }
+      attachSocket(stream, kfd) {
+        this.attach(stream, kfd, false);
+        stream.sliccKernelSocket = true;
+      }
+      socketStream(flags) {
+        const fs = this.Fs;
+        if (!fs.mount || !fs.createNode || !fs.createStream) {
+          const stream = this.Fs.open("/dev/null", 2);
+          stream.flags = flags;
+          return stream;
+        }
+        const createNode = fs.createNode;
+        this.socketRoot ??= fs.mount({ mount: () => createNode(null, "/", 16895, 0) }, {}, null);
+        const ino = ++this.sockets;
+        const node = fs.createNode(this.socketRoot, `socket:${ino}`, SOCKET_MODE, 0);
+        const now = /* @__PURE__ */ new Date();
+        const stat = { dev: 0, ino, mode: SOCKET_MODE, nlink: 1, uid: 0, gid: 0, rdev: 0, size: 0 };
+        const times = { atime: now, mtime: now, ctime: now, blksize: 4096, blocks: 0 };
+        node.node_ops = { getattr: () => ({ ...stat, ...times }) };
+        return fs.createStream({ node, flags, seekable: false, position: 0, stream_ops: {} });
+      }
+      nameTerminal(stream) {
+        const kfd = stream.sliccKernelFd;
+        if (!stream.tty || kfd === void 0) return;
+        const name2 = this.sys.ttyName?.(kfd);
+        if (name2) this.nameStream(stream, name2);
+      }
+      nameStream(stream, name2) {
+        stream.path = name2;
+        this.ttyNode(name2);
+        if (typeof this.Fs.stat !== "function") return;
+        stream.stream_ops = { ...stream.stream_ops, getattr: () => this.Fs.stat?.(name2) ?? {} };
+      }
+      nameDevice(stream, kind) {
+        this.nameStream(stream, kind === "sealed" ? SEALED_PATH : CLIPBOARD_PATH);
+      }
+      listSealed() {
+        const fs = this.Fs;
+        const { analyzePath, mkdev, makedev, registerDevice } = fs;
+        if (!analyzePath || !mkdev || !makedev) return;
+        const nodes = [
+          [SEALED_PATH, 250, this.sys.openSealed],
+          [CLIPBOARD_PATH, 251, this.sys.openClipboard]
+        ];
+        for (const [path, minor, opener] of nodes) {
+          if (!opener) continue;
+          const dev = makedev.call(fs, 10, minor);
+          registerDevice?.call(fs, dev, {
+            open: (stream) => this.openNode(stream, path, opener)
+          });
+          if (analyzePath.call(fs, path).exists) continue;
+          try {
+            const node = mkdev.call(fs, path, dev);
+            if (typeof node === "object" && node !== null) {
+              const made = node;
+              made.node_ops = { ...made.node_ops, getattr: () => sealedStat(minor) };
+            }
+          } catch {
+          }
+        }
+      }
+      openNode(stream, path, opener) {
+        let kfd;
+        try {
+          kfd = this.call(() => opener.call(this.sys, stream.flags & 3));
+        } catch (e) {
+          this.Fs.closeStream(stream.fd);
+          throw e;
+        }
+        this.attach(stream, kfd, false);
+        this.nameStream(stream, path);
+        if (path === CLIPBOARD_PATH) this.reportClose(kfd);
+      }
+      reporting = /* @__PURE__ */ new Set();
+      reportClose(kfd) {
+        this.reporting.add(kfd);
+      }
+      quitting = false;
+      atExit = false;
+      failedAtExit = false;
+      committed = /* @__PURE__ */ new Set();
+      exiting() {
+        this.atExit = true;
+        return () => {
+          this.atExit = false;
+        };
+      }
+      commitStdout() {
+        const kfd = this.Fs.getStream(1)?.sliccKernelFd;
+        if (kfd === void 0 || !this.reporting.delete(kfd)) return;
+        this.committed.add(kfd);
+        try {
+          this.sys.close(kfd);
+        } catch (e) {
+          if (e instanceof SyscallError) this.stdoutFailed(e.code);
+        }
+      }
+      exitStatus(status2) {
+        return this.failedAtExit && status2 === 0 ? 1 : status2;
+      }
+      reportedClose(stream, kfd) {
+        try {
+          this.sys.close(kfd);
+        } catch (e) {
+          if (this.quitting && stream.fd === 1 && e instanceof SyscallError) this.stdoutFailed(e.code);
+          this.call(() => {
+            throw e;
+          });
+        }
+      }
+      stdoutFailed(code2) {
+        this.failedAtExit = true;
+        const stderr = this.Fs.getStream(2)?.sliccKernelFd;
+        if (stderr === void 0) return;
+        const line = `${this.options.program ?? "program"}: write error: ${STRERROR[code2] ?? code2}
+`;
+        try {
+          this.sys.write(stderr, new TextEncoder().encode(line));
+        } catch {
+        }
+      }
+      creatingTerminal = false;
+      useTerminalNodes() {
+        const fs = this.Fs;
+        const { lookupNode, readdir, getPath, mkdev, makedev } = fs;
+        const ttyNames = this.sys.ttyNames?.bind(this.sys);
+        if (!lookupNode || !readdir || !getPath || !mkdev || !makedev || !ttyNames) return;
+        fs.lookupNode = (parent, name2) => {
+          try {
+            return lookupNode.call(fs, parent, name2);
+          } catch (e) {
+            const path = `/dev/${name2}`;
+            if (this.creatingTerminal || !TTY_NAME.test(name2) || getPath.call(fs, parent) !== "/dev")
+              throw e;
+            if (!ttyNames().includes(path)) throw e;
+            this.creatingTerminal = true;
+            try {
+              mkdev.call(fs, path, makedev.call(fs, 6, 0));
+            } finally {
+              this.creatingTerminal = false;
+            }
+            return lookupNode.call(fs, parent, name2);
+          }
+        };
+        fs.readdir = (path) => {
+          const names = readdir.call(fs, path);
+          if (path.replace(/\/+$/, "") !== "/dev") return names;
+          const missing2 = ttyNames().map((tty) => tty.slice("/dev/".length)).filter((name2) => TTY_NAME.test(name2) && !names.includes(name2));
+          return [...names, ...missing2];
+        };
+      }
+      ttyNode(name2) {
+        const { analyzePath, mkdev, makedev } = this.Fs;
+        if (!TTY_PATH.test(name2) || !analyzePath || !mkdev || !makedev) return;
+        if (!analyzePath.call(this.Fs, name2).exists)
+          mkdev.call(this.Fs, name2, makedev.call(this.Fs, 6, 0));
+      }
+      ttyOps(kfd) {
+        return {
+          ops: {
+            ioctl_tcgets: () => this.call(() => this.sys.tcgets?.(kfd)),
+            ioctl_tcsets: (_tty, op, termios) => this.call(() => {
+              this.sys.tcsets?.(kfd, termios, op === TCSETSF);
+              return 0;
+            }),
+            ioctl_tiocgwinsz: () => this.call(() => this.sys.winsize?.(kfd) ?? [24, 80]),
+            fsync: () => {
+            }
+          }
+        };
+      }
+      attachFile(stream, kfd) {
+        this.attach(stream, kfd, false);
+        stream.sliccKernelFile = true;
+        stream.stream_ops = {
+          ...stream.stream_ops,
+          llseek: (_s, offset, whence) => this.call(() => this.sys.seek(kfd, offset, whence)),
+          fsync: () => this.call(() => {
+            this.sys.flush(kfd);
+            return 0;
+          })
+        };
       }
       sizeFromKernel(stream, kfd) {
-        const { size } = this.sys;
+        const { size, fdStat: fdStat2 } = this.sys;
         if (!size) return;
         const node = stream.node;
-        this.describe(stream, `${stream.path ?? ""}:${++this.described}`, () => ({
-          ...node.node_ops?.getattr?.(node),
-          size: this.call(() => size.call(this.sys, kfd))
-        }));
+        this.describe(stream, `${stream.path ?? ""}:${++this.described}`, () => {
+          const base = node.node_ops?.getattr?.(node);
+          const live = this.call(() => size.call(this.sys, kfd));
+          const real = fdStat2 && this.call(() => fdStat2.call(this.sys, kfd));
+          return { ...base, ...real, ...datesOf(real), size: live };
+        });
       }
       describe(stream, name2, getattr) {
         if (this.descriptions.size === 0) this.useDescriptions();
@@ -2404,6 +3461,9 @@ var init_kernel_streams = __esm({
           };
         }
       }
+      useKernelFdMetadata() {
+        useKernelFdMetadata(this.Fs, this.sys, this.call.bind(this));
+      }
       useControllingTerminal() {
         if (typeof this.Fs.open !== "function") return;
         this.usePtyPaths();
@@ -2457,7 +3517,7 @@ var init_kernel_streams = __esm({
         }
       }
       refuseExclusiveLink(path, flags) {
-        if ((flags & (O_CREAT | O_EXCL)) !== (O_CREAT | O_EXCL)) return;
+        if ((flags & (O_CREAT2 | O_EXCL)) !== (O_CREAT2 | O_EXCL)) return;
         let mode = 0;
         try {
           mode = this.Fs.stat?.(path, true)?.mode ?? 0;
@@ -2484,15 +3544,22 @@ var init_kernel_streams = __esm({
       openClipboard(open, path, flags, mode) {
         const { openClipboard } = this.sys;
         if (path !== CLIPBOARD_PATH || !openClipboard) return void 0;
+        if (flags & O_DIRECTORY) throw new this.Fs.ErrnoError(wasiErrno("ENOTDIR"));
         const kfd = this.call(() => openClipboard.call(this.sys, flags & 3));
-        const stream = this.vessel(open, kfd, { path, flags, mode }, false);
-        this.reportClose(kfd);
-        return stream;
+        try {
+          const stream = this.vessel(open, kfd, { path, flags, mode }, false);
+          this.reportClose(kfd);
+          return stream;
+        } catch (e) {
+          this.sys.clipboardAbort?.(kfd);
+          this.sys.close(kfd);
+          throw e;
+        }
       }
       vessel(open, kfd, at, terminal) {
         let stream;
         try {
-          stream = open("/dev/null", at.flags & ~(O_CREAT | O_EXCL | O_TRUNC2), at.mode);
+          stream = open("/dev/null", at.flags & ~(O_CREAT2 | O_EXCL | O_TRUNC2), at.mode);
         } catch (e) {
           this.sys.close(kfd);
           throw e;
@@ -2620,869 +3687,64 @@ var init_kernel_streams = __esm({
         return {
           ...base,
           llseek: () => this.call(() => {
-            throw new SyscallError("ESPIPE");
-          }),
-          read: (s, buffer, offset, length) => this.call(() => {
-            const bytes = this.restarting(() => this.sys.read(kfd, length, nonblocking(s)));
-            buffer.set(bytes, offset);
-            return bytes.length;
-          }),
-          write: (s, buffer, offset, length) => {
-            try {
-              const bytes = buffer.slice(offset, offset + length);
-              return this.restarting(() => this.sys.write(kfd, bytes, nonblocking(s)));
-            } catch (e) {
-              if (e instanceof SyscallError && e.code === "EPIPE" && !this.options.sigpipe?.()) {
-                throw new ProcessExit(KILLED_BY_SIGPIPE);
-              }
-              return this.call(() => {
-                throw e;
-              });
-            }
-          },
-          fsync: () => 0,
-          poll: () => {
-            const state = this.call(() => this.sys.poll(kfd));
-            let mask = 0;
-            if (state.readable) mask |= POLLIN | POLLRDNORM;
-            if (state.writable) mask |= POLLOUT | POLLWRNORM;
-            if (state.hangup) mask |= state.readable ? POLLHUP : POLLERR;
-            return mask;
-          },
-          dup: (stream) => {
-            base.dup?.(stream);
-            this.refs.set(kfd, (this.refs.get(kfd) ?? 0) + 1);
-          },
-          close: (stream) => {
-            if (this.atExit && stream.fd === 2 && this.reporting.size > 0) this.commitStdout();
-            try {
-              base.close?.(stream);
-            } catch {
-            }
-            const left = (this.refs.get(kfd) ?? 1) - 1;
-            if (left > 0) {
-              this.refs.set(kfd, left);
-              return;
-            }
-            this.refs.delete(kfd);
-            if (this.committed.size > 0 && this.committed.delete(kfd)) return;
-            if (this.reporting.size > 0 && this.reporting.delete(kfd)) {
-              this.reportedClose(stream, kfd);
-              return;
-            }
-            try {
-              this.sys.close(kfd);
-            } catch {
-            }
-          }
-        };
-      }
-    };
-  }
-});
-
-// src/process/process-pty.ts
-function failed(e) {
-  const code2 = e?.code;
-  if (typeof code2 === "string") return -wasiErrno(code2);
-  throw e;
-}
-function ptyIoctl(ioctl, deps) {
-  return (fd, op, varargs) => {
-    const request = op >>> 0;
-    if (request !== TIOCGPTN && request !== TIOCSPTLCK && request !== TIOCSCTTY && request !== TIOCSWINSZ && request !== TIOCPKT) {
-      return ioctl(fd, op, varargs);
-    }
-    const stream = deps.fs()?.getStream(fd);
-    const kfd = stream?.sliccKernelFd;
-    if (kfd === void 0) return ioctl(fd, op, varargs);
-    const heap = deps.heap();
-    if (!heap) return -wasiErrno("EFAULT");
-    const argp = (heap[varargs >> 2] ?? 0) >>> 0;
-    try {
-      return answer(request, kfd, argp, heap, deps.kernel);
-    } catch (e) {
-      return failed(e);
-    }
-  };
-}
-function answer(request, kfd, argp, heap, kernel) {
-  switch (request) {
-    case TIOCGPTN:
-      heap[argp >> 2] = kernel.ptyNumber(kfd);
-      return 0;
-    case TIOCSPTLCK:
-      kernel.ptyLock(kfd, (heap[argp >> 2] ?? 0) !== 0);
-      return 0;
-    case TIOCSCTTY:
-      kernel.setControllingTerminal(kfd);
-      return 0;
-    case TIOCPKT:
-      kernel.setPacketMode(kfd, (heap[argp >> 2] ?? 0) !== 0);
-      return 0;
-    default: {
-      const word = heap[argp >> 2] ?? 0;
-      kernel.setWinsize(kfd, word & 65535, word >>> 16 & 65535);
-      return 0;
-    }
-  }
-}
-var TIOCGPTN, TIOCSPTLCK, TIOCSCTTY, TIOCSWINSZ, TIOCPKT;
-var init_process_pty = __esm({
-  "src/process/process-pty.ts"() {
-    "use strict";
-    init_wasi_errno();
-    TIOCGPTN = 2147767344;
-    TIOCSPTLCK = 1074025521;
-    TIOCSCTTY = 21518;
-    TIOCSWINSZ = 21524;
-    TIOCPKT = 21536;
-  }
-});
-
-// src/process/process-fds.ts
-function closesOnExec(stream) {
-  return stream.sliccCloexec === true;
-}
-function setCloseOnExec(stream, on) {
-  if (on) stream.sliccCloexec = true;
-  else delete stream.sliccCloexec;
-}
-function trackCloseOnExec(Fs) {
-  if (tracked.has(Fs)) return;
-  tracked.add(Fs);
-  if (typeof Fs.dupStream === "function") {
-    const dupStream = Fs.dupStream.bind(Fs);
-    Fs.dupStream = (stream, fd) => {
-      const copy2 = dupStream(stream, fd);
-      setCloseOnExec(copy2, false);
-      return copy2;
-    };
-  }
-  if (typeof Fs.open === "function") {
-    const open = Fs.open.bind(Fs);
-    Fs.open = (path, flags, mode) => {
-      const cloexec = typeof flags === "number" && (flags & O_CLOEXEC) !== 0;
-      const stream = open(path, cloexec ? flags & ~O_CLOEXEC : flags, mode);
-      setCloseOnExec(stream, cloexec);
-      return stream;
-    };
-  }
-}
-function marker(deps) {
-  return (fd, on) => {
-    const stream = deps.fs()?.getStream(fd);
-    if (stream) setCloseOnExec(stream, on);
-  };
-}
-function cloexecFcntl(fcntl, deps) {
-  const mark = marker(deps);
-  return (fd, cmd, varargs) => {
-    if (cmd === F_DUPFD_CLOEXEC) {
-      const copy2 = fcntl(fd, F_DUPFD, varargs);
-      if (copy2 >= 0) mark(copy2, true);
-      return copy2;
-    }
-    if (cmd === F_GETFL) {
-      const flags = fcntl(fd, cmd, varargs);
-      return flags < 0 ? flags : flags & ~O_CLOEXEC;
-    }
-    if (cmd !== F_GETFD && cmd !== F_SETFD) return fcntl(fd, cmd, varargs);
-    const stream = deps.fs()?.getStream(fd);
-    if (!stream) return -wasiErrno("EBADF");
-    if (cmd === F_GETFD) return closesOnExec(stream) ? FD_CLOEXEC : 0;
-    const arg = deps.heap()?.[varargs >> 2];
-    if (arg === void 0) return -wasiErrno("EINVAL");
-    setCloseOnExec(stream, (arg & FD_CLOEXEC) !== 0);
-    return 0;
-  };
-}
-function cloexecPipe2(pipe2, deps) {
-  const mark = marker(deps);
-  return (fdPtr, flags) => {
-    const r = pipe2(fdPtr, flags & ~O_CLOEXEC);
-    const heap = deps.heap();
-    if (r === 0 && flags & O_CLOEXEC && heap) {
-      mark(heap[fdPtr >> 2], true);
-      mark(heap[(fdPtr >> 2) + 1], true);
-    }
-    return r;
-  };
-}
-function quietTarget(dup3, deps) {
-  return (fd = -1, newfd = -1, flags = 0, ...rest2) => {
-    const Fs = deps.fs();
-    const target = fd === newfd || flags !== 0 ? void 0 : Fs?.getStream(newfd);
-    if (target && Fs?.getStream(fd)) {
-      try {
-        Fs.close?.(target);
-      } catch {
-      }
-    }
-    return dup3(fd, newfd, flags, ...rest2);
-  };
-}
-function cloexecByFlag(syscall, flagArg, deps) {
-  const mark = marker(deps);
-  return (...args) => {
-    const cloexec = ((args[flagArg] ?? 0) & O_CLOEXEC) !== 0;
-    if (cloexec) args[flagArg] = args[flagArg] & ~O_CLOEXEC;
-    const fd = syscall(...args);
-    if (fd >= 0) mark(fd, cloexec);
-    return fd;
-  };
-}
-function wrapperFactories(deps) {
-  const { pty, timer } = deps;
-  return {
-    ...timer ? { setitimer: (f) => kernelTimer(f, timer) } : {},
-    fcntl: (f) => cloexecFcntl(f, deps),
-    pipe2: (f) => cloexecPipe2(f, deps),
-    dup3: (f) => cloexecByFlag(quietTarget(f, deps), 2, deps),
-    socket: (f) => cloexecByFlag(f, 1, deps),
-    accept4: (f) => cloexecByFlag(f, 3, deps),
-    ...pty ? { ioctl: (f) => ptyIoctl(f, { fs: deps.fs, heap: deps.heap, kernel: pty }) } : {}
-  };
-}
-function kernelTimer(setitimer, timer) {
-  return (which, ms) => {
-    if (which !== 0) return setitimer(which, ms);
-    timer.arm(ms ?? 0);
-    return 0;
-  };
-}
-function syscallOf(glue, name2, value2) {
-  const names = Object.keys(IMPORT_NAMES);
-  const own = names.find((key) => glue[key] !== void 0 && glue[key] === value2);
-  if (own) return own;
-  return typeof value2 === "function" ? names.find((key) => glue[key] !== void 0 && IMPORT_NAMES[key] === name2) : void 0;
-}
-function wrapCloexecSyscalls(imports, glue, deps) {
-  if (!glue) return;
-  const factories = wrapperFactories(deps);
-  const seen = /* @__PURE__ */ new Set();
-  for (const namespace of Object.values(imports)) {
-    if (!namespace || typeof namespace !== "object" || seen.has(namespace)) continue;
-    seen.add(namespace);
-    for (const [name2, value2] of Object.entries(namespace)) {
-      const key = syscallOf(glue, name2, value2);
-      const wrap2 = key && factories[key];
-      if (wrap2) namespace[name2] = wrap2(value2);
-    }
-  }
-}
-function pathOpensLinks(Fs) {
-  const fs = Fs;
-  const { mayOpen, isLink } = fs;
-  if (!mayOpen || !isLink) return;
-  fs.mayOpen = (node, flags) => flags & O_PATH2 && isLink.call(fs, node.mode) ? 0 : mayOpen.call(fs, node, flags);
-}
-function importKey(namespace, name2, glue) {
-  const own = glue?.[name2];
-  if (typeof own === "function") {
-    const found = Object.keys(namespace).find((k) => namespace[k] === own);
-    if (found !== void 0) return found;
-  }
-  const literal = LITERALS[name2];
-  return typeof namespace[literal] === "function" ? literal : void 0;
-}
-function wrapImport(imports, name2, glue, wrap2, optional = false) {
-  let wrapped = false;
-  for (const ns of namespaces(imports)) {
-    const key = importKey(ns, name2, glue);
-    if (key === void 0) continue;
-    ns[key] = wrap2(ns[key]);
-    wrapped = true;
-  }
-  if (!wrapped && !optional && typeof glue?.[name2] === "function") {
-    throw new Error(`slicc-kernel cannot find the glue's ${LITERALS[name2]} among its imports`);
-  }
-}
-function kernelUmask(imports, deps) {
-  let umask = deps.initial & 511;
-  const { glue } = deps;
-  wrapImport(imports, "openat", glue, (openat) => (dirfd, path, flags, varargs) => {
-    const memory = deps.memory();
-    if (flags & O_CREAT2 && varargs && memory) new Int32Array(memory.buffer)[varargs >> 2] &= ~umask;
-    return openat(dirfd, path, flags, varargs);
-  });
-  wrapImport(
-    imports,
-    "mkdirat",
-    glue,
-    (mkdirat) => (dirfd, path, mode) => mkdirat(dirfd, path, mode & ~umask)
-  );
-  wrapImport(
-    imports,
-    "mknodat",
-    glue,
-    (mknodat) => (dirfd, path, mode, dev) => mknodat(dirfd, path, mode & ~umask, dev)
-  );
-  wrapImport(imports, "umask", glue, (own) => {
-    own(umask);
-    return (mask) => {
-      const old = umask;
-      umask = mask & 511;
-      own(umask);
-      deps.set(umask);
-      return old;
-    };
-  });
-}
-function touching(times, memory) {
-  if (times === 0) return true;
-  if (!memory) return false;
-  const heap = new Int32Array(memory.buffer);
-  const nsec = [heap[times + 8 >> 2], heap[times + 24 >> 2]];
-  return nsec.every((n) => n === UTIME_NOW || n === UTIME_OMIT);
-}
-function touch(Fs, on, run) {
-  if (!Fs || !on) return run();
-  Fs.sliccTouch = true;
-  try {
-    return run();
-  } finally {
-    Fs.sliccTouch = void 0;
-  }
-}
-function noFollowUtimes(imports, fs, glue, memory = () => void 0) {
-  wrapImport(
-    imports,
-    "utimensat",
-    { utimensat: glue },
-    (utimensat) => (dirfd, path, times, flags) => {
-      const Fs = fs();
-      const on = touching(times, memory());
-      const { utime, lookupPath, ErrnoError } = Fs ?? {};
-      if (!Fs || !(flags & AT_SYMLINK_NOFOLLOW) || !utime || !lookupPath || !ErrnoError) {
-        return touch(Fs, on, () => utimensat(dirfd, path, times, flags));
-      }
-      Fs.utime = (at, atime, mtime) => {
-        const { node } = lookupPath.call(Fs, at, { follow: false });
-        if (!node.node_ops.setattr) throw new ErrnoError(EMSCRIPTEN_EPERM);
-        node.node_ops.setattr(node, { atime, mtime });
-      };
-      try {
-        return touch(Fs, on, () => utimensat(dirfd, path, times, flags));
-      } finally {
-        Fs.utime = utime;
-      }
-    }
-  );
-}
-function errnoOf(err) {
-  const { errno: errno2, code: code2 } = err ?? {};
-  if (typeof errno2 === "number") return errno2;
-  if (typeof code2 === "string") return wasiErrno(code2);
-  throw err;
-}
-function persistsItself(stream) {
-  const type = stream.node.mount?.type;
-  return typeof type?.syncfs === "function";
-}
-function namespaces(imports) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const namespace of Object.values(imports)) {
-    if (namespace && typeof namespace === "object") seen.add(namespace);
-  }
-  return [...seen];
-}
-function keyOf(namespace, name2, glue) {
-  const own = glue?.[name2];
-  const found = typeof own === "function" ? Object.keys(namespace).find((k) => namespace[k] === own) : void 0;
-  return found ?? (typeof namespace[name2] === "function" ? name2 : void 0);
-}
-function syncFsync(imports, fs, glue) {
-  for (const namespace of namespaces(imports)) {
-    const key = keyOf(namespace, "fd_sync", glue);
-    const original = key === void 0 ? void 0 : namespace[key];
-    if (key === void 0 || !original?.isAsync) continue;
-    namespace[key] = (fd) => {
-      const stream = fs()?.getStream(fd);
-      if (!stream) return EBADF;
-      if (persistsItself(stream)) return original(fd);
-      try {
-        const result = stream.stream_ops.fsync?.(stream);
-        return typeof result === "number" ? result : 0;
-      } catch (err) {
-        return errnoOf(err);
-      }
-    };
-  }
-}
-function offsetOf(rest2) {
-  const at = rest2.length >= 3 ? Number(rest2[1]) * 2 ** 32 + (Number(rest2[0]) >>> 0) : Number(BigInt.asIntN(64, BigInt(rest2[0])));
-  return at >= 0 && Number.isSafeInteger(at) ? at : void 0;
-}
-function readInto(sys, kfd, target, at) {
-  let done = 0;
-  while (done < target.length) {
-    const got = sys.pread?.(kfd, target.length - done, at + done) ?? new Uint8Array(0);
-    if (got.length === 0) break;
-    target.set(got, done);
-    done += got.length;
-  }
-  return done;
-}
-function positioned(original, write2, deps) {
-  return (fd, iov, iovcnt, ...rest2) => {
-    const stream = deps.fs()?.getStream(Number(fd));
-    const memory = deps.memory();
-    const kfd = stream?.sliccKernelFile ? stream.sliccKernelFd : void 0;
-    if (kfd === void 0 || !memory || !(write2 ? deps.sys.pwrite : deps.sys.pread)) {
-      return original(fd, iov, iovcnt, ...rest2);
-    }
-    const at = offsetOf(rest2);
-    if (at === void 0) return wasiErrno("EINVAL");
-    const view = new DataView(memory.buffer);
-    let done = 0;
-    try {
-      for (let i = 0; i < Number(iovcnt); i++) {
-        const ptr = view.getUint32(Number(iov) + i * 8, true);
-        const len = view.getUint32(Number(iov) + i * 8 + 4, true);
-        const part = new Uint8Array(memory.buffer, ptr, len);
-        const moved = write2 ? deps.sys.pwrite?.(kfd, part.slice(), at + done) ?? 0 : readInto(deps.sys, kfd, part, at + done);
-        done += moved;
-        if (moved < len) break;
-      }
-    } catch (err) {
-      return errnoOf(err);
-    }
-    view.setUint32(Number(rest2[rest2.length - 1]), done, true);
-    return 0;
-  };
-}
-function positionalIo(imports, deps) {
-  for (const namespace of namespaces(imports)) {
-    for (const [name2, write2] of [
-      ["fd_pread", false],
-      ["fd_pwrite", true]
-    ]) {
-      const key = keyOf(namespace, name2, deps.glue);
-      if (key !== void 0) {
-        namespace[key] = positioned(namespace[key], write2, deps);
-      }
-    }
-  }
-}
-function staging(Fs, length) {
-  try {
-    return new Uint8Array(length);
-  } catch {
-    throw new Fs.ErrnoError(wasiErrno("ENOMEM"));
-  }
-}
-function useFileMmap(Fs, deps) {
-  const fs = Fs;
-  const mmap = fs.mmap;
-  if (typeof mmap !== "function") return;
-  fs.mmap = (stream, length, position, prot, flags) => {
-    const memalign = deps.memalign();
-    const memory = deps.memory();
-    const shared = (flags & MAP_TYPE) !== MAP_PRIVATE && (prot & PROT_WRITE) !== 0;
-    const kfd = stream.sliccKernelFile ? stream.sliccKernelFd : void 0;
-    if (shared && kfd !== void 0) throw new Fs.ErrnoError(wasiErrno("ENODEV"));
-    if (stream.stream_ops.mmap && kfd === void 0 || !memalign || !memory || length <= 0 || shared || (stream.flags & O_ACCMODE2) === O_WRONLY || !Fs.isFile(stream.node.mode)) {
-      return mmap.call(fs, stream, length, position, prot, flags);
-    }
-    const data = staging(Fs, length);
-    let done = 0;
-    try {
-      if (kfd !== void 0) done = readInto(deps.sys, kfd, data, position);
-      else {
-        for (let got = 1; done < length && got > 0; done += got) {
-          got = Fs.read(stream, data, done, length - done, position + done);
-        }
-      }
-    } catch (err) {
-      throw new Fs.ErrnoError(errnoOf(err));
-    }
-    const size = Math.ceil(length / MAP_ALIGN) * MAP_ALIGN;
-    const ptr = memalign(MAP_ALIGN, size);
-    if (!ptr) throw new Fs.ErrnoError(wasiErrno("ENOMEM"));
-    const target = new Uint8Array(memory.buffer, ptr, size);
-    target.fill(0);
-    target.set(data.subarray(0, done));
-    return { ptr, allocated: true };
-  };
-}
-function wasmMemory(instance, imports) {
-  const isMemory = (v) => v instanceof WebAssembly.Memory;
-  const exported = Object.values(instance.exports).find(isMemory);
-  if (exported) return exported;
-  for (const namespace of Object.values(imports)) {
-    const found = Object.values(namespace ?? {}).find(isMemory);
-    if (found) return found;
-  }
-  return void 0;
-}
-function fdOfPath(path, cwd) {
-  const parts = [];
-  for (const part of `${path.startsWith("/") ? "" : cwd}/${path}`.split("/")) {
-    if (part === "" || part === ".") continue;
-    if (part === "..") parts.pop();
-    else parts.push(part);
-  }
-  const abs = `/${parts.join("/")}`;
-  const std = ["/dev/stdin", "/dev/stdout", "/dev/stderr"].indexOf(abs);
-  if (std >= 0) return std;
-  const m = /^\/(?:dev|proc\/self)\/fd\/(\d+)$/.exec(abs);
-  return m ? Number(m[1]) : void 0;
-}
-function syntheticAttr(mode, ino) {
-  const now = /* @__PURE__ */ new Date();
-  return {
-    dev: 1,
-    ino,
-    mode,
-    nlink: 1,
-    uid: 0,
-    gid: 0,
-    rdev: 0,
-    size: 0,
-    atime: now,
-    mtime: now,
-    ctime: now,
-    blksize: 4096,
-    blocks: 0
-  };
-}
-function describeFdDir(Fs) {
-  let dir;
-  try {
-    dir = Fs.lookupPath?.("/proc/self/fd", { follow: true })?.node;
-  } catch {
-    return;
-  }
-  const ops = dir?.node_ops;
-  const lookup2 = ops?.lookup;
-  if (!dir || !lookup2 || ops.getattr) return;
-  dir.node_ops = {
-    ...ops,
-    getattr: () => syntheticAttr(DIR_MODE, 1),
-    lookup: (parent, name2) => {
-      const entry = lookup2(parent, name2);
-      entry.node_ops = {
-        ...entry.node_ops,
-        getattr: () => syntheticAttr(LINK_MODE, entry.id ?? 0)
-      };
-      return entry;
-    }
-  };
-}
-function useZeroDevices(Fs) {
-  const { analyzePath, registerDevice, mkdev, makedev } = Fs;
-  if (!analyzePath || !registerDevice || !mkdev || !makedev) return;
-  const zeros = (_s, buffer, offset, length) => {
-    buffer.fill(0, offset, offset + length);
-    return length;
-  };
-  const devices = [
-    ["/dev/zero", 5, (_s, _b, _o, length) => length],
-    [
-      "/dev/full",
-      7,
-      (_s, _b, _o, length) => {
-        if (length > 0) throw new Fs.ErrnoError(wasiErrno("ENOSPC"));
-        return 0;
-      }
-    ]
-  ];
-  for (const [path, minor, write2] of devices) {
-    if (analyzePath.call(Fs, path).exists) continue;
-    const dev = makedev.call(Fs, 1, minor);
-    registerDevice.call(Fs, dev, { read: zeros, write: write2, llseek: () => 0 });
-    mkdev.call(Fs, path, CHAR_DEVICE, dev);
-  }
-}
-function linkStdio(Fs) {
-  const { unlink, symlink } = Fs;
-  if (!unlink || !symlink) return;
-  for (const [fd, name2] of ["stdin", "stdout", "stderr"].entries()) {
-    try {
-      unlink.call(Fs, `/dev/${name2}`);
-    } catch {
-    }
-    try {
-      symlink.call(Fs, `/proc/self/fd/${fd}`, `/dev/${name2}`);
-    } catch {
-    }
-  }
-}
-function useDevFd(Fs) {
-  if (typeof Fs.open !== "function") return;
-  try {
-    Fs.symlink?.("/proc/self/fd", "/dev/fd");
-  } catch {
-  }
-  linkStdio(Fs);
-  describeFdDir(Fs);
-  const fdOf = (path) => typeof path === "string" ? fdOfPath(path, Fs.cwd()) : void 0;
-  const target = (fd) => {
-    const stream = Fs.getStream(fd);
-    if (!stream) throw new Fs.ErrnoError(wasiErrno("EBADF"));
-    return stream;
-  };
-  const open = Fs.open.bind(Fs);
-  Fs.open = (path, flags, mode) => {
-    const fd = fdOf(path);
-    if (fd === void 0) return open(path, flags, mode);
-    const copy2 = Fs.dupStream(target(fd), -1);
-    setCloseOnExec(copy2, typeof flags === "number" && (flags & O_CLOEXEC) !== 0);
-    return copy2;
-  };
-  const { stat, fstat } = Fs;
-  if (typeof stat !== "function" || typeof fstat !== "function") return;
-  Fs.stat = (path, dontFollow) => {
-    const fd = dontFollow ? void 0 : fdOf(path);
-    if (fd === void 0) return stat.call(Fs, path, dontFollow);
-    target(fd);
-    return fstat.call(Fs, fd);
-  };
-}
-function pinRootKind() {
-  pinnedRoot = rootKind();
-}
-function mountTable(mounts = []) {
-  const root = pinnedRoot ?? rootKind();
-  const lines = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
-  for (const m of mounts) {
-    const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
-    if (m.state !== "ok") options.push(m.state);
-    const access = options.includes("ro") ? [] : ["rw"];
-    lines.push(
-      `${field(m.source)} ${field(m.target)} ${m.type} ${[...access, ...options].join(",")} 0 0`
-    );
-  }
-  return `${lines.join("\n")}
-`;
-}
-function accounts(env = {}) {
-  const user = env.USER ?? "web_user";
-  const name2 = NAME.test(user) && user !== "root" ? user : "user";
-  const home = env.HOME || "/home";
-  return {
-    passwd: `root:x:0:0:root:/root:/bin/sh
-${name2}:x:1000:1000:${name2}:${home}:/bin/bash
-`,
-    group: `root:x:0:
-${name2}:x:1000:
-`
-  };
-}
-function useMounts(Fs, env = {}, live = false) {
-  const { writeFile, mkdirTree } = Fs;
-  if (typeof Fs.open !== "function" || typeof writeFile !== "function") return;
-  const { passwd, group } = accounts(env);
-  const backing = { "/etc/mtab": "/proc/mounts" };
-  try {
-    if (!live) writeFile.call(Fs, "/proc/mounts", mountTable());
-  } catch {
-    return;
-  }
-  try {
-    mkdirTree.call(Fs, "/dev/.etc");
-    writeFile.call(Fs, "/dev/.etc/passwd", passwd);
-    writeFile.call(Fs, "/dev/.etc/group", group);
-    writeFile.call(Fs, "/dev/.etc/hosts", hostsFile(hostnameOf(env)));
-    writeFile.call(Fs, "/dev/.etc/hostname", `${hostnameOf(env)}
-`);
-    backing["/etc/passwd"] = "/dev/.etc/passwd";
-    backing["/etc/group"] = "/dev/.etc/group";
-    backing["/etc/hosts"] = "/dev/.etc/hosts";
-    backing["/etc/hostname"] = "/dev/.etc/hostname";
-  } catch {
-  }
-  const open = Fs.open.bind(Fs);
-  Fs.open = (path, flags, mode) => {
-    const instead = backing[path];
-    if (!instead || (flags & (O_ACCMODE2 | O_CREAT2)) !== 0) return open(path, flags, mode);
-    try {
-      return open(path, flags, mode);
-    } catch (e) {
-      if (e?.errno !== wasiErrno("ENOENT")) throw e;
-      return open(instead, flags, mode);
-    }
-  };
-}
-function cString(memory, at) {
-  const bytes = new Uint8Array(memory.buffer, at);
-  return new TextDecoder().decode(bytes.subarray(0, bytes.indexOf(0)));
-}
-function baseOf(Fs, dirfd) {
-  return dirfd === AT_FDCWD ? Fs.cwd?.() ?? "/" : Fs.getStream?.(dirfd)?.path ?? "/";
-}
-function readonlyRefusal(Fs, memory, call2) {
-  if (!(call2.amode & W_ACCESS)) return 0;
-  try {
-    const name2 = cString(memory, call2.path);
-    const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
-    const follow2 = (call2.flags & AT_SYMLINK_NOFOLLOW) === 0;
-    const { node } = Fs.lookupPath.call(Fs, abs, {
-      follow: follow2
-    });
-    const bridge = node.live ? node.mount.opts.bridge : void 0;
-    const stats = bridge;
-    const stat = follow2 ? stats?.stat : stats?.lstat;
-    return stat?.call(stats, liveNodePath(node)).readonly ? -wasiErrno("EROFS") : 0;
-  } catch {
-    return 0;
-  }
-}
-function kernelChecks(Fs, memory, call2) {
-  const name2 = cString(memory, call2.path);
-  const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
-  const lookupPath = Fs.lookupPath;
-  const { node } = lookupPath.call(Fs, abs, { follow: (call2.flags & AT_SYMLINK_NOFOLLOW) === 0 });
-  const bridge = node.live ? node.mount.opts.bridge : void 0;
-  if (!bridge?.owners || !bridge.access) return 0;
-  const kind = call2.flags & AT_EACCESS ? "eaccess" : "access";
-  bridge.access(liveNodePath(node), call2.amode, kind, (call2.flags & AT_SYMLINK_NOFOLLOW) !== 0);
-  return 0;
-}
-function kernelAccess(imports, fs, memory, glue) {
-  wrapImport(imports, "faccessat", glue, (own) => (dirfd, path, amode, flags) => {
-    const Fs = fs();
-    const heap = memory();
-    const call2 = { dirfd, path, amode: amode & 7, flags };
-    const refused = Fs?.lookupPath && heap ? readonlyRefusal(Fs, heap, call2) : 0;
-    if (refused !== 0) return refused;
-    const rc = own(dirfd, path, amode, flags);
-    if (rc !== 0 || !Fs?.lookupPath || !heap) return rc;
-    try {
-      return kernelChecks(Fs, heap, { dirfd, path, amode: amode & 7, flags });
-    } catch (err) {
-      return -errnoOf(err);
-    }
-  });
-}
-function kernelLink(imports, fs, memory, glue) {
-  wrapImport(
-    imports,
-    "linkat",
-    glue,
-    (own) => (olddirfd, oldpath, newdirfd, newpath, flags) => {
-      const Fs = fs();
-      const heap = memory();
-      if (!Fs?.lookupPath || !heap) return own(olddirfd, oldpath, newdirfd, newpath, flags);
-      const at = (dirfd, ptr) => {
-        const name2 = cString(heap, ptr);
-        return name2.startsWith("/") ? name2 : `${baseOf(Fs, dirfd)}/${name2}`;
-      };
-      try {
-        const from = at(olddirfd, oldpath);
-        const to = at(newdirfd, newpath);
-        const follow2 = (flags & AT_SYMLINK_FOLLOW) !== 0;
-        if (linkLive(Fs, from, to, follow2)) return 0;
-      } catch (err) {
-        return -errnoOf(err);
-      }
-      return own(olddirfd, oldpath, newdirfd, newpath, flags);
-    },
-    true
-  );
-}
-function kernelChdir(Fs) {
-  const { chdir, lookupPath, ErrnoError } = Fs;
-  if (!chdir || !lookupPath || !ErrnoError) return;
-  Fs.chdir = (path) => {
-    const { node } = lookupPath.call(Fs, path, { follow: true });
-    const directory = Fs.isDir?.(node.mode) === true;
-    const bridge = node.live && directory ? node.mount.opts.bridge : void 0;
-    try {
-      bridge?.access?.(liveNodePath(node), X_ACCESS, "eaccess", false);
-    } catch (err) {
-      throw new ErrnoError(errnoOf(err));
-    }
-    chdir.call(Fs, path);
-  };
-}
-function linuxDevices(Fs) {
-  Fs.ignorePermissions = true;
-  kernelChdir(Fs);
-  const { chmod } = Fs;
-  if (!chmod) return;
-  for (const [path, mode] of DEVICE_MODES) {
-    try {
-      chmod.call(Fs, path, mode);
-    } catch {
-    }
-  }
-}
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, X_ACCESS, AT_SYMLINK_FOLLOW, DEVICE_MODES;
-var init_process_fds = __esm({
-  "src/process/process-fds.ts"() {
-    "use strict";
-    init_loopback_names();
-    init_live_vfs_fs();
-    init_process_pty();
-    init_wasi_errno();
-    O_CLOEXEC = 524288;
-    FD_CLOEXEC = 1;
-    F_DUPFD = 0;
-    F_GETFD = 1;
-    F_SETFD = 2;
-    F_GETFL = 3;
-    F_DUPFD_CLOEXEC = 1030;
-    tracked = /* @__PURE__ */ new WeakSet();
-    IMPORT_NAMES = {
-      fcntl: "__syscall_fcntl64",
-      pipe2: "__syscall_pipe2",
-      dup3: "__syscall_dup3",
-      socket: "__syscall_socket",
-      accept4: "__syscall_accept4",
-      ioctl: "__syscall_ioctl",
-      setitimer: "_setitimer_js"
-    };
-    EBADF = 8;
-    AT_SYMLINK_NOFOLLOW = 256;
-    EMSCRIPTEN_EPERM = 63;
-    O_PATH2 = 2097152;
-    LITERALS = {
-      openat: "__syscall_openat",
-      mkdirat: "__syscall_mkdirat",
-      mknodat: "__syscall_mknodat",
-      umask: "__syscall_umask",
-      faccessat: "__syscall_faccessat",
-      linkat: "__syscall_linkat",
-      utimensat: "__syscall_utimensat",
-      getppid: "slicc_getppid_js",
-      resizeHeap: "emscripten_resize_heap",
-      fdWrite: "fd_write",
-      fdRead: "fd_read",
-      sleepMs: "slicc_sleep_ms"
+            throw new SyscallError("ESPIPE");
+          }),
+          read: (s, buffer, offset, length) => this.call(() => {
+            const bytes = this.restarting(() => this.sys.read(kfd, length, nonblocking(s)));
+            buffer.set(bytes, offset);
+            return bytes.length;
+          }),
+          write: (s, buffer, offset, length) => {
+            try {
+              const bytes = buffer.slice(offset, offset + length);
+              return this.restarting(() => this.sys.write(kfd, bytes, nonblocking(s)));
+            } catch (e) {
+              if (e instanceof SyscallError && e.code === "EPIPE" && !this.options.sigpipe?.()) {
+                throw new ProcessExit(KILLED_BY_SIGPIPE);
+              }
+              return this.call(() => {
+                throw e;
+              });
+            }
+          },
+          fsync: () => 0,
+          poll: () => {
+            const state = this.call(() => this.sys.poll(kfd));
+            let mask = 0;
+            if (state.readable) mask |= POLLIN | POLLRDNORM;
+            if (state.writable) mask |= POLLOUT | POLLWRNORM;
+            if (state.hangup) mask |= state.readable ? POLLHUP : POLLERR;
+            return mask;
+          },
+          dup: (stream) => {
+            base.dup?.(stream);
+            this.refs.set(kfd, (this.refs.get(kfd) ?? 0) + 1);
+          },
+          close: (stream) => {
+            if (this.atExit && stream.fd === 2 && this.reporting.size > 0) this.commitStdout();
+            try {
+              base.close?.(stream);
+            } catch {
+            }
+            const left = (this.refs.get(kfd) ?? 1) - 1;
+            if (left > 0) {
+              this.refs.set(kfd, left);
+              return;
+            }
+            this.refs.delete(kfd);
+            if (this.committed.size > 0 && this.committed.delete(kfd)) return;
+            if (this.reporting.size > 0 && this.reporting.delete(kfd)) {
+              this.reportedClose(stream, kfd);
+              return;
+            }
+            try {
+              this.sys.close(kfd);
+            } catch {
+            }
+          }
+        };
+      }
     };
-    UTIME_NOW = 1073741823;
-    UTIME_OMIT = 1073741822;
-    PROT_WRITE = 2;
-    MAP_PRIVATE = 2;
-    MAP_TYPE = 15;
-    O_WRONLY = 1;
-    MAP_ALIGN = 65536;
-    DIR_MODE = 16749;
-    LINK_MODE = 41408;
-    CHAR_DEVICE = 8630;
-    O_ACCMODE2 = 3;
-    O_CREAT2 = 64;
-    field = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
-    rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
-    NAME = /^[a-z_][a-z0-9_-]*$/i;
-    AT_FDCWD = -100;
-    AT_EACCESS = 512;
-    W_ACCESS = 2;
-    X_ACCESS = 1;
-    AT_SYMLINK_FOLLOW = 1024;
-    DEVICE_MODES = [
-      ["/", 493],
-      ["/dev", 493],
-      ["/dev/null", 438],
-      ["/dev/zero", 438],
-      ["/dev/full", 438],
-      ["/dev/random", 438],
-      ["/dev/urandom", 438],
-      ["/dev/tty", 438],
-      ["/dev/shm", 1023]
-    ];
   }
 });
 
@@ -3542,7 +3804,8 @@ function kernelEntry(stream, kernel) {
   }
   const device2 = stream.path === void 0 ? void 0 : NAMED_DEVICES[stream.path];
   const kind = stream.sliccKernelFile ? "file" : stream.tty ? "tty" : device2 ?? "stream";
-  return { fd: stream.fd, kernel, kind, ...cloexec };
+  const access = kind === "tty" ? O_RDWR : (stream.flags ?? O_RDWR) & O_ACCMODE3;
+  return { fd: stream.fd, kernel, kind, flags: access, ...cloexec };
 }
 function describeInherited(Fs, sys, streams, livePath, actions = []) {
   const table = /* @__PURE__ */ new Map();
@@ -3589,12 +3852,13 @@ function place(Fs, stream, fd) {
   return moved;
 }
 function placeholder(Fs, streams, entry) {
-  if (entry.kind === "socket") return streams.socketStream(entry.flags ?? O_RDWR);
+  const access = entry.flags ?? O_RDWR;
+  if (entry.kind === "socket") return streams.socketStream(access);
   if (entry.kind === "tty") return Fs.open("/dev/tty", O_RDWR);
   if (entry.kind === "stream" || entry.kind === "clipboard" || entry.kind === "sealed")
-    return Fs.open("/dev/null", O_RDWR);
+    return Fs.open("/dev/null", access);
   Fs.mkdirTree(PLACEHOLDER_DIR);
-  return Fs.open(`${PLACEHOLDER_DIR}/${entry.fd}`, O_RDWR | O_CREAT3);
+  return Fs.open(`${PLACEHOLDER_DIR}/${entry.fd}`, access | O_CREAT3);
 }
 function asFifo(stream, streams, identity) {
   const inos = streamInos.get(streams) ?? /* @__PURE__ */ new Map();
@@ -4295,7 +4559,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.92.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.93.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -4796,6 +5060,20 @@ function kernelSys(transport) {
     size(fd) {
       return json2(call2({ op: "fd-vfs-stat", fd }, `fd-vfs-stat ${fd}`)).size;
     },
+    fdStat(fd) {
+      const r = json2(call2({ op: "fd-vfs-stat", fd, full: true }, `fd-vfs-stat ${fd}`));
+      return r?.stat;
+    },
+    fdChmod(fd, mode) {
+      call2({ op: "fd-chmod", fd, mode }, `fd-chmod ${fd}`);
+    },
+    fdChown(fd, uid, gid) {
+      const ids = { ...uid !== void 0 ? { uid } : {}, ...gid !== void 0 ? { gid } : {} };
+      call2({ op: "fd-chown", fd, ...ids }, `fd-chown ${fd}`);
+    },
+    fdUtimes(fd, atimeMs, mtimeMs, now) {
+      call2({ op: "fd-utimes", fd, atimeMs, mtimeMs, now }, `fd-utimes ${fd}`);
+    },
     ttyNames() {
       return json2(call2({ op: "fd-tty-names" }, "fd-tty-names"));
     },
@@ -4827,6 +5105,9 @@ function kernelSys(transport) {
     openClipboard(flags) {
       return json2(call2({ op: "fd-open-clipboard", flags }, "fd-open-clipboard"));
     },
+    clipboardAbort(fd) {
+      call2({ op: "fd-clipboard-abort", fd }, "fd-clipboard-abort");
+    },
     ptyNumbers() {
       return json2(call2({ op: "pty-list" }, "pty-list"));
     },
@@ -4865,7 +5146,7 @@ function openDevice(Fs, fd, meta) {
   return openAt(Fs, fd, `/dev/${meta.device}`, accessMode(meta.access));
 }
 function openHeld(Fs, fd, meta) {
-  return "dir" in meta ? openAt(Fs, fd, meta.dir, O_RDONLY | O_DIRECTORY) : openDevice(Fs, fd, meta);
+  return "dir" in meta ? openAt(Fs, fd, meta.dir, O_RDONLY | O_DIRECTORY2) : openDevice(Fs, fd, meta);
 }
 function openAt(Fs, fd, path, flags) {
   let stream;
@@ -4977,6 +5258,17 @@ function kernelWrappers(imports, module, deps) {
 function bridgeFlags(init) {
   return { ...init.owners ? { owners: true } : {}, ...init.links ? { links: true } : {} };
 }
+function credSyncTransport(gated, early, cred) {
+  return {
+    call: (req, timeoutMs, label) => {
+      if (!FS_OPS.has(req.op)) early();
+      const r = gated.call(req, timeoutMs, label);
+      if (cred && req.op === "proc-setcred" && r.ok && r.kind === "json")
+        Object.assign(cred, r.json);
+      return r;
+    }
+  };
+}
 async function runWasmProcess(init, port2, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port2, {
@@ -4995,12 +5287,7 @@ async function runWasmProcess(init, port2, deps = {}) {
   const gated = signals.transport();
   let early = () => {
   };
-  const transport = {
-    call: (req, timeoutMs, label) => {
-      if (!FS_OPS.has(req.op)) early();
-      return gated.call(req, timeoutMs, label);
-    }
-  };
+  const transport = credSyncTransport(gated, () => early(), init.cred);
   const sys = kernelSys(transport);
   const encoder5 = new TextEncoder();
   const say = (fd) => (text) => sys.write(fd, encoder5.encode(`${text}
@@ -5083,7 +5370,8 @@ async function runWasmProcess(init, port2, deps = {}) {
   const vfs = mountVfsIntoEmscripten(running.FS, {
     bridge: createSyncFsSabBridge(transport, bridgeFlags(init)),
     cwd: init.cwd,
-    warn: deps.warn ?? say(2)
+    warn: deps.warn ?? say(2),
+    cred: init.owners ? init.cred : void 0
   });
   early = () => signals.quiet(() => vfs.flushDirty());
   const sigpipe = () => running.sliccSigpipe?.() === 1;
@@ -5102,6 +5390,7 @@ async function runWasmProcess(init, port2, deps = {}) {
   atExit = () => streams.exiting();
   useMounts(running.FS, init.env, true);
   useZeroDevices(running.FS);
+  useDevRemoval(running.FS);
   useProcfs(running.FS, sys, init.pid);
   if (init.fork) restoreForkedStreams(running.FS, streams, init.fork.streams ?? []);
   else {
@@ -5111,6 +5400,7 @@ async function runWasmProcess(init, port2, deps = {}) {
   const pipefs = ownValue(running, "PIPEFS");
   if (pipefs) streams.usePipes(pipefs);
   streams.useControllingTerminal();
+  streams.useKernelFdMetadata();
   useDevFd(running.FS);
   useFileMmap(running.FS, {
     sys,
@@ -5122,9 +5412,9 @@ async function runWasmProcess(init, port2, deps = {}) {
     transport,
     Fs: running.FS,
     env: init.env,
+    pid: init.pid,
     beforeSpawn: () => vfs.flush(),
     afterChild: () => vfs.invalidate(),
-    pid: init.pid,
     raise: (sig) => running.sliccRaise?.(sig),
     restartable,
     memory: () => memory,
@@ -5144,6 +5434,9 @@ async function runWasmProcess(init, port2, deps = {}) {
     sigpipe,
     restartable
   });
+  return runWithFlush(running, init, streams, vfs);
+}
+function runWithFlush(running, init, streams, vfs) {
   try {
     return streams.exitStatus(runMain(running, init));
   } finally {
@@ -5208,7 +5501,7 @@ function runMain(running, init) {
     return status2;
   }
 }
-var FS_OPS, O_RDONLY, O_WRONLY3, O_RDWR3, O_ACCMODE4, O_DIRECTORY, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
+var FS_OPS, O_RDONLY, O_WRONLY3, O_RDWR3, O_ACCMODE4, O_DIRECTORY2, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
 var init_process_runtime = __esm({
   "src/process/process-runtime.ts"() {
     "use strict";
@@ -5234,7 +5527,7 @@ var init_process_runtime = __esm({
     O_WRONLY3 = 1;
     O_RDWR3 = 2;
     O_ACCMODE4 = 3;
-    O_DIRECTORY = 65536;
+    O_DIRECTORY2 = 65536;
     accessMode = (access) => access === "read" ? O_RDONLY : access === "write" ? O_WRONLY3 : O_RDWR3;
     PLACED = /* @__PURE__ */ new Set(["stream", "file", "socket", "clipboard", "sealed"]);
     GLUE_TRAILER = [
@@ -5360,6 +5653,21 @@ function physicalPath(fs, path) {
   }
   return `/${walk.done.join("/")}`;
 }
+async function physicalPathAsync(fs, path) {
+  const walk = start(path);
+  for (let part = next(walk); part !== void 0; part = next(walk)) {
+    const at = `/${[...walk.done, part].join("/")}`;
+    let target;
+    try {
+      target = (await fs.lstat(at)).isSymbolicLink ? await fs.readlink(at) : void 0;
+    } catch {
+      return rest(walk, part);
+    }
+    if (target === void 0) walk.done.push(part);
+    else if (!follow(walk, target)) return lexical(path);
+  }
+  return `/${walk.done.join("/")}`;
+}
 var MAX_HOPS;
 var init_physical_path = __esm({
   "src/fs/physical-path.ts"() {
@@ -5584,9 +5892,11 @@ function cachingBridge(bridge, now = () => performance.now(), shared) {
     ...bridge.kept ? { kept: bridge.kept.bind(bridge) } : {},
     ...bridge.keptStat ? { keptStat: bridge.keptStat.bind(bridge) } : {},
     ...bridge.pinned ? { pinned: (handle) => pinnedIo2(bridge, handle, rewriting) } : {},
-    ...bridge.create ? { create: (p) => mutating(() => bridge.create?.(p), ...entry(p)) } : {},
+    ...bridge.create ? {
+      create: (p, mode, opening2) => mutating(() => bridge.create?.(p, mode, opening2), ...entry(p))
+    } : {},
     ...chown ? {
-      chown: (p, uid, gid, follow2) => rewriting(p, () => chown.call(bridge, p, uid, gid, follow2))
+      chown: (p, ...rest2) => rewriting(p, () => chown.call(bridge, p, ...rest2))
     } : {},
     ...bridge.pread && bridge.pwrite && bridge.truncate ? {
       pread: bridge.pread.bind(bridge),
@@ -6356,6 +6666,7 @@ var init_wasi_fds = __esm({
         const { buffer } = e.file;
         try {
           buffer.flush();
+          this.reported.delete(buffer);
         } catch (err) {
           this.reported.add(buffer);
           this.drop(buffer);
@@ -6421,6 +6732,7 @@ var init_wasi_fds = __esm({
         for (const buffer of this.buffers.values()) {
           try {
             buffer.flush();
+            this.reported.delete(buffer);
           } catch (err) {
             if (!this.reported.has(buffer)) throw err;
           }
@@ -6643,7 +6955,7 @@ var init_wasi_fds = __esm({
           return true;
         }
         try {
-          this.fs.create(path);
+          this.fs.create(path, void 0, true);
           return true;
         } catch (err) {
           if (oflags & OFLAGS.EXCL || err.code !== "EEXIST") throw err;
@@ -6957,7 +7269,7 @@ var init_wasi_termios = __esm({
 });
 
 // src/process/wasi/wasi-host.ts
-function idOf2(value2) {
+function idOf3(value2) {
   return value2 >>> 0 === 4294967295 ? void 0 : value2 >>> 0;
 }
 function linkedOf(st) {
@@ -7034,6 +7346,7 @@ var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE,
 var init_wasi_host = __esm({
   "src/process/wasi/wasi-host.ts"() {
     "use strict";
+    init_dev_removal();
     init_physical_path();
     init_cpu_clock();
     init_cred();
@@ -7131,10 +7444,10 @@ var init_wasi_host = __esm({
           return path;
         };
         const modeOf2 = (st) => (st.mode ?? 0) & 4095;
-        const chown = (path, uid, gid, follow2) => {
+        const chown = (path, uid, gid, follow2, handle) => {
           const { chown: own } = this.o.fs;
           if (!own) throw new WasiError("ENOSYS");
-          own.call(this.o.fs, path, idOf2(uid), idOf2(gid), follow2);
+          own.call(this.o.fs, path, idOf3(uid), idOf3(gid), follow2, handle);
         };
         const caller = () => {
           const cred = this.o.kernel.call({ op: "proc-cred" });
@@ -7165,7 +7478,11 @@ var init_wasi_host = __esm({
           return follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path);
         };
         return wrap({
-          fd_chown: (fd, uid, gid) => void chown(pathOf(fd), uid, gid, true),
+          fd_chown: (fd, uid, gid) => {
+            const e = fds.get(fd);
+            const handle = e.type === "file" ? e.file.buffer.handle : void 0;
+            void chown(pathOf(fd), uid, gid, true, handle);
+          },
           path_chown: (dirfd, p, l, uid, gid, flags) => void chown(at(dirfd, p, l), uid, gid, (flags & AT_SYMLINK_NOFOLLOW2) === 0),
           fd_owner: (fd, out) => {
             if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
@@ -7177,14 +7494,14 @@ var init_wasi_host = __esm({
             owner(fdOwned(fd), out);
           },
           path_filestat_owner: (dirfd, lookup2, p, l, statOut, out) => {
-            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             const path = at(dirfd, p, l);
+            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             this.writeFilestat(statOut, this.pathFilestat(path, lookup2));
             owner(pathOwned(path, (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0), out);
           },
           path_owner: (dirfd, p, l, flags, out) => {
-            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             const path = at(dirfd, p, l);
+            if (!this.o.fs.owners) throw new WasiError("ENOTSUP");
             owner(pathOwned(path, (flags & AT_SYMLINK_NOFOLLOW2) === 0), out);
           },
           path_access: (dirfd, p, l, amode, flags) => {
@@ -7441,14 +7758,35 @@ var init_wasi_host = __esm({
         const { mem, fds, o } = this;
         const at = (dirfd, p, l) => fds.resolve(dirfd, mem.string(p, l));
         return {
-          path_open: (dirfd, _lookup, p, l, oflags, rights, _inheriting, fdflags, out) => {
-            const path = at(dirfd, p, l);
-            if (deviceOf(path)) this.interrupted?.();
-            const fresh = (oflags & OFLAGS.CREAT) !== 0 && !this.synthetic(path) && !o.fs.exists(path);
-            mem.view().setUint32(out, fds.open(path, oflags, rights, fdflags), true);
-            if (fresh) this.created(path, 438);
+          path_open: (dirfd, lookup2, p, l, oflags, rights, _inheriting, fdflags, out) => {
+            const follow2 = (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0;
+            try {
+              const path = at(dirfd, p, l);
+              if (deviceOf(path)) this.interrupted?.();
+              const fresh = (oflags & OFLAGS.CREAT) !== 0 && !this.synthetic(path) && !o.fs.exists(path);
+              mem.view().setUint32(out, fds.open(path, oflags, rights, fdflags), true);
+              if (fresh) this.created(path, 438);
+            } catch (err) {
+              if (err.code !== "ENOENT") throw err;
+              const raw = mem.string(p, l);
+              const joined2 = raw.startsWith("/") ? raw : `${fds.dir(dirfd).path}/${raw}`;
+              const resolved2 = this.resolveForDev(joined2, follow2);
+              if (!resolved2) throw err;
+              mem.view().setUint32(out, fds.open(resolved2, oflags, rights, fdflags), true);
+            }
+          },
+          path_filestat_get: (dirfd, lookup2, p, l, out) => {
+            try {
+              this.writeFilestat(out, this.pathFilestat(at(dirfd, p, l), lookup2));
+            } catch (err) {
+              if (err.code !== "ENOENT") throw err;
+              const raw = mem.string(p, l);
+              const joined2 = raw.startsWith("/") ? raw : `${fds.dir(dirfd).path}/${raw}`;
+              const resolved2 = this.resolveForDev(joined2, (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0);
+              if (!resolved2) throw err;
+              this.writeFilestat(out, this.pathFilestat(resolved2, lookup2));
+            }
           },
-          path_filestat_get: (dirfd, lookup2, p, l, out) => void this.writeFilestat(out, this.pathFilestat(at(dirfd, p, l), lookup2)),
           path_filestat_set_times: (dirfd, lookup2, p, l, atim, mtim, flags) => {
             const path = at(dirfd, p, l);
             fds.flushPath(path);
@@ -7463,6 +7801,7 @@ var init_wasi_host = __esm({
           path_remove_directory: (dirfd, p, l) => void o.fs.rmdir(at(dirfd, p, l)),
           path_unlink_file: (dirfd, p, l) => {
             const path = at(dirfd, p, l);
+            if (inDevTree(path)) return void o.fs.unlink(path);
             const st = o.fs.lstat(path);
             if (st.isDirectory) throw new WasiError("EISDIR");
             const linked = linkedOf(st);
@@ -7694,7 +8033,12 @@ var init_wasi_host = __esm({
         const v = this.mem.view();
         v.setUint8(out, filetype);
         v.setUint16(out + 2, flags, true);
-        const rights = seeks ? RIGHTS.ALL : RIGHTS.ALL & ~(RIGHTS.FD_SEEK | RIGHTS.FD_TELL);
+        let rights = seeks ? RIGHTS.ALL : RIGHTS.ALL & ~(RIGHTS.FD_SEEK | RIGHTS.FD_TELL);
+        if (e.type === "kernel") {
+          const access = this.o.kernel.sys.access?.(fd);
+          if (access === "read") rights &= ~RIGHTS.FD_WRITE;
+          else if (access === "write") rights &= ~RIGHTS.FD_READ;
+        }
         v.setBigUint64(out + 8, rights, true);
         v.setBigUint64(out + 16, RIGHTS.ALL, true);
       }
@@ -7760,6 +8104,21 @@ var init_wasi_host = __esm({
       synthetic(path) {
         return deviceOf(path) !== void 0 || path === SEALED_PATH2 && !!this.o.kernel.sys.openSealed || path === CLIPBOARD_PATH2 && !!this.o.kernel.sys.openClipboard;
       }
+      resolveForDev(path, follow2 = true) {
+        try {
+          if (!follow2) {
+            const slash = path.lastIndexOf("/");
+            if (slash <= 0) return void 0;
+            const parent = physicalPath(this.o.fs, path.slice(0, slash));
+            const resolved3 = `${parent}/${path.slice(slash + 1)}`;
+            return resolved3 !== path && this.synthetic(resolved3) ? resolved3 : void 0;
+          }
+          const resolved2 = physicalPath(this.o.fs, path);
+          return resolved2 !== path && this.synthetic(resolved2) ? resolved2 : void 0;
+        } catch {
+          return void 0;
+        }
+      }
       pathFilestat(path, lookup2) {
         if (this.synthetic(path)) {
           return this.local({
@@ -7771,7 +8130,19 @@ var init_wasi_host = __esm({
         }
         this.fds.flushPath(path);
         const follow2 = (lookup2 & LOOKUP_SYMLINK_FOLLOW) !== 0;
-        return filestatOf(path, follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path));
+        try {
+          return filestatOf(path, follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path));
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+          const resolved2 = this.resolveForDev(path, follow2);
+          if (!resolved2) throw err;
+          return this.local({
+            filetype: FILETYPE.CHARACTER_DEVICE,
+            size: 0n,
+            ino: pathInode(resolved2),
+            mtimeNs: 0n
+          });
+        }
       }
       setTimes(path, atim, mtim, flags, follow2 = true) {
         const asked = FSTFLAGS.ATIM | FSTFLAGS.ATIM_NOW | FSTFLAGS.MTIM | FSTFLAGS.MTIM_NOW;
@@ -7843,6 +8214,7 @@ var init_wasi_threads = __esm({
   "src/process/wasi/wasi-threads.ts"() {
     "use strict";
     init_protocol();
+    init_sync_sab_wire();
     init_wasi_files();
     LAST_TID = 0;
     RUNNING = 1;
@@ -7878,7 +8250,7 @@ var init_wasi_threads = __esm({
         this.beforeSpawn?.();
         const tid = Atomics.add(this.ids, LAST_TID, 1) + 1;
         const modules = this.modules?.();
-        const blocked = this.blocked?.() ?? 0;
+        const blocked = this.blocked?.();
         this.port.postMessage({
           type: WASM_THREAD_SPAWN,
           thread: {
@@ -7887,7 +8259,7 @@ var init_wasi_threads = __esm({
             memory: this.memory,
             ids: this.ids.buffer,
             ...modules ? { modules } : {},
-            ...blocked ? { blocked } : {}
+            ...anyBlocked(blocked) ? { blocked } : {}
           }
         });
         return tid;
@@ -8108,7 +8480,8 @@ var init_wasix_process = __esm({
           cwd: this.host.cwd,
           ...fds.isShared ? { shared: true } : {},
           setjmps: this.driver.setjmps(),
-          ...this.host.signals ? { signals: this.host.signals.snapshot() } : {}
+          ...this.host.signals ? { signals: this.host.signals.snapshot() } : {},
+          ...this.host.sigmask ? { blocked: this.host.sigmask.inherited() } : {}
         };
         return this.call({
           op: "proc-fork",
@@ -8614,7 +8987,7 @@ function procfsBridge(fs, tree) {
   }
   const { chown } = fs;
   if (chown) {
-    over.chown = (p, uid, gid, follow2) => readOnly2([[p, follow2 === true]], () => chown.call(fs, p, uid, gid, follow2));
+    over.chown = (p, ...rest2) => readOnly2([[p, rest2[2] === true]], () => chown.call(fs, p, ...rest2));
   }
   return new Proxy(fs, {
     get: (target, key, receiver) => key in over ? over[key] : Reflect.get(target, key, receiver)
@@ -8772,7 +9145,7 @@ var init_wasi_sigmask = __esm({
     };
     WasiSigmask = class {
       lo;
-      hi = 0;
+      hi;
       header;
       deliver;
       process;
@@ -8781,9 +9154,10 @@ var init_wasi_sigmask = __esm({
         this.deliver = deliver;
         this.process = process;
         this.lo = libcBits(Atomics.load(header, SAB_I_BLOCKED));
+        this.hi = Atomics.load(header, SAB_I_BLOCKED_HI);
       }
       static unsupported(header) {
-        Atomics.store(header, SAB_I_BLOCKED, 0);
+        storeBlocked(header, [0, 0]);
       }
       set(how, setLo, setHi, old) {
         if (how !== SIG_BLOCK && how !== SIG_UNBLOCK && how !== SIG_SETMASK) return E.INVAL;
@@ -8791,7 +9165,7 @@ var init_wasi_sigmask = __esm({
         this.lo = apply(how, this.lo, setLo | 0) & ~LIBC_UNBLOCKABLE;
         this.hi = apply(how, this.hi, setHi | 0);
         const now = kernelBits(this.lo);
-        Atomics.store(this.header, SAB_I_BLOCKED, now);
+        storeBlocked(this.header, [now, this.hi]);
         if ((Atomics.load(this.header, SAB_I_SIGNALS) & ~now) !== 0) this.deliver();
         return E.SUCCESS;
       }
@@ -8799,7 +9173,7 @@ var init_wasi_sigmask = __esm({
         const old = [this.lo, this.hi];
         this.lo = setLo & ~LIBC_UNBLOCKABLE;
         this.hi = setHi | 0;
-        Atomics.store(this.header, SAB_I_BLOCKED, kernelBits(this.lo));
+        storeBlocked(this.header, [kernelBits(this.lo), this.hi]);
         return old;
       }
       deliverUnblocked() {
@@ -8812,6 +9186,9 @@ var init_wasi_sigmask = __esm({
         this.set(SIG_SETMASK, lo, hi, () => {
         });
       }
+      inherited() {
+        return [kernelBits(this.lo), this.hi];
+      }
       discard(sig) {
         Atomics.and(this.header, SAB_I_SIGNALS, ~sigbit(sig));
         if (this.process) Atomics.and(this.process, SAB_I_SIGNALS, ~sigbit(sig));
@@ -10789,6 +11166,7 @@ __export(wasi_runtime_exports, {
   runWasiProcess: () => runWasiProcess,
   runWasiThread: () => runWasiThread,
   sigmaskOf: () => sigmaskOf,
+  takeThreadDefault: () => takeThreadDefault,
   trapMessage: () => trapMessage,
   unsupportedImport: () => unsupportedImport,
   wireSignals: () => wireSignals
@@ -10832,7 +11210,7 @@ function sigmaskOf(module, sab, gate, threads, process) {
     WasiSigmask.unsupported(header);
     return void 0;
   }
-  if (threads) threads.blocked = () => Atomics.load(header, SAB_I_BLOCKED);
+  if (threads) threads.blocked = () => loadBlocked(header);
   const shared = process && new Int32Array(process, 0, SAB_HEADER_I32);
   return new WasiSigmask(header, () => gate.deliver(), shared);
 }
@@ -11226,7 +11604,7 @@ async function runWasiThread(init, port2) {
     masks: () => null,
     raise: (sig) => signals.raise(sig)
   });
-  const signals = new WasiSignals(takeDefault(call2, init.pid));
+  const signals = new WasiSignals(takeThreadDefault(call2, init.pid));
   const threads = new WasiThreads(port2, thread.memory, threadCap(init.env), thread.tid, thread.ids);
   threads.received = thread.modules;
   const id = identify(transport, init);
@@ -11280,7 +11658,7 @@ async function runWasiThread(init, port2) {
     throw e;
   }
 }
-var TRAPPED, PREVIEW1, WASIX, SLICC, SIGNAL_CALLBACK, takeDefault, SLICC_FS, SLICC_TTY, RESERVED2, UNDELIVERED, DELIVERED, importsSlicc, importsSigactionHook, noErrno, FALLBACK_MAXIMUM_PAGES, LinkSync, DL_GEN, BACKTRACE_FRAMES;
+var TRAPPED, PREVIEW1, WASIX, SLICC, SIGNAL_CALLBACK, takeDefault, takeThreadDefault, SLICC_FS, SLICC_TTY, RESERVED2, UNDELIVERED, DELIVERED, importsSlicc, importsSigactionHook, noErrno, FALLBACK_MAXIMUM_PAGES, LinkSync, DL_GEN, BACKTRACE_FRAMES;
 var init_wasi_runtime = __esm({
   "src/process/wasi/wasi-runtime.ts"() {
     "use strict";
@@ -11315,6 +11693,17 @@ var init_wasi_runtime = __esm({
       call2({ op: "proc-kill", pid, sig });
       if (defaultAction(sig) === "terminate") throw new WasiExit(128 + sig);
     };
+    takeThreadDefault = (call2, pid) => (sig) => {
+      if (defaultAction(sig) !== "terminate") {
+        call2({ op: "proc-kill", pid, sig });
+        return;
+      }
+      try {
+        call2({ op: "proc-kill-self", sig });
+      } catch {
+      }
+      throw new WasiExit(128 + sig);
+    };
     SLICC_FS = "slicc_fs";
     SLICC_TTY = "slicc_tty";
     RESERVED2 = RESERVED_NAMESPACES;
@@ -11715,6 +12104,8 @@ var init_js_kernel = __esm({
 
 // src/process/js/js-children.ts
 function exitedOf(status2) {
+  if ((status2 & 255) === 127)
+    return { status: 128 + (status2 >> 8 & 255), signal: status2 >> 8 & 255, stopped: true };
   const signal = status2 & 127;
   return signal ? { status: 128 + signal, signal } : { status: status2 >> 8 & 255 };
 }
@@ -11751,8 +12142,10 @@ function writable(io, fd) {
   });
 }
 function childOps(kernel, io, defaults, sync) {
-  const wait2 = async (pid) => {
-    const r = await kernel.blocking({ op: "proc-wait", pid, nohang: false });
+  const wait2 = async (pid, options = {}) => {
+    if (typeof options !== "object" || options === null) throw new JsCallError("EINVAL", "wait");
+    const untraced = options.untraced === true ? { untraced: true } : {};
+    const r = await kernel.blocking({ op: "proc-wait", pid, nohang: false, ...untraced });
     const [, status2] = r.ok && r.kind === "json" ? r.json : [0, 0];
     return exitedOf(status2);
   };
@@ -11766,7 +12159,7 @@ function childOps(kernel, io, defaults, sync) {
       ...stdin !== void 0 ? { stdin: writable(io, stdin) } : {},
       ...stdout !== void 0 ? { stdout: readable(io, stdout) } : {},
       ...stderr !== void 0 ? { stderr: readable(io, stderr) } : {},
-      wait: () => wait2(pid),
+      wait: (options) => wait2(pid, options),
       kill: (signal) => kill(pid, signal)
     };
   };
@@ -12032,6 +12425,7 @@ function* lookup(abs) {
     const names = yield { op: "fd-tty-names" };
     if (names.includes(abs)) return { kind: "terminal", name: abs };
   }
+  if (name2 === "pts") return { kind: "dir", mode: DIR | 365 };
   const pts = /^pts\/(\d+)$/.exec(name2)?.[1];
   if (pts !== void 0) {
     const open = yield { op: "pty-list" };
@@ -12063,7 +12457,8 @@ function* fdStat(fd, path) {
   if (info.kind === "file") {
     const file = yield { op: "fd-vfs-stat", fd };
     if (file.orphan) return { ...nodeStat(33152, file.size), isFile: true };
-    return yield* pathStat(file.path);
+    const st = yield* pathStat(file.path);
+    return { ...st, size: file.size };
   }
   if (info.terminal) return yield* terminalStat(info.terminal);
   if (CHAR_KINDS.has(info.kind)) return nodeStat(CHAR | 438);
@@ -12116,16 +12511,26 @@ function* devReadlink(abs) {
   if (node.kind === "fd") return yield* fdTarget(node.fd, abs);
   throw new JsCallError("EINVAL", abs);
 }
+function* devResolveTarget(abs) {
+  const node = yield* lookup(abs);
+  if (node.kind === "fd") return yield* fdTarget(node.fd, abs);
+  if (node.kind === "link" && node.fd !== void 0) return yield* fdTarget(node.fd, abs);
+  return void 0;
+}
 function* devReaddir(abs) {
   if (abs === "/dev/fd") {
     const fds = yield { op: "fd-list" };
     return fds.map(({ fd }) => String(fd));
   }
+  if (abs === "/dev/pts") {
+    const open = yield { op: "pty-list" };
+    return open.map(String).sort();
+  }
   const node = yield* lookup(abs);
   if (node.kind !== "dir") throw new JsCallError("ENOTDIR", abs);
   const names = yield { op: "fd-tty-names" };
   const ttys = names.filter((n) => /^\/dev\/tty\d+$/.test(n)).map((n) => n.slice(5));
-  return [...DEVICES2, "clipboard", "sealed", "tty", "fd", ...STDIO3, ...ttys].sort();
+  return [...DEVICES2, "clipboard", "sealed", "tty", "fd", "pts", ...STDIO3, ...ttys].sort();
 }
 function* aliasOf(fd, abs, o) {
   const info = yield* fdInfo(fd, abs);
@@ -12134,6 +12539,9 @@ function* aliasOf(fd, abs, o) {
     const at = yield { op: "fd-vfs-stat", fd };
     if (!at.orphan)
       return { fd: yield openRequest(at.path, { ...o, create: false }), file };
+    const wantWrite = o.write === true || o.append === true || o.truncate === true;
+    if (wantWrite && info.access === "read") throw new JsCallError("EBADF", abs);
+    if (!wantWrite && info.access === "write") throw new JsCallError("EBADF", abs);
   }
   const copy2 = yield { op: "fd-dup", fd, min: 3 };
   if (file && o.truncate) {
@@ -12439,11 +12847,18 @@ function plain(status2, text) {
 function local2(url) {
   return isKernelLoopbackHost(new URL(url).hostname);
 }
+function badPort(url) {
+  const port2 = url.port ? Number(url.port) : 0;
+  return port2 !== 0 && BAD_PORTS.has(port2);
+}
 function rewrite(hop, status2, location) {
   const next2 = new URL(location, hop.url);
   if (next2.protocol !== "http:" && next2.protocol !== "https:") {
     throw failed3(new JsCallError("EPROTONOSUPPORT", next2.protocol));
   }
+  if (badPort(next2)) {
+    throw failed3(new JsCallError("EACCES", `bad port: ${next2.href}`));
+  }
   if (local2(next2.href) && !local2(hop.url)) {
     const from = new URL(hop.url).origin;
     throw failed3(
@@ -12729,6 +13144,9 @@ function fetchOp(kernel) {
     if (protocol !== "http:" && protocol !== "https:") {
       throw failed3(new JsCallError("EPROTONOSUPPORT", protocol));
     }
+    if (badPort(new URL(request.url))) {
+      throw failed3(new JsCallError("EACCES", `bad port: ${request.url}`));
+    }
     let known = await traitsAt(request.url);
     if (!known.manualRedirects && request.redirect !== "follow") {
       throw failed3(new JsCallError("ENOTSUP", `redirect: ${request.redirect}`));
@@ -12759,7 +13177,7 @@ function fetchOp(kernel) {
     }
   };
 }
-var CHUNK2, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTIALS, OVER, TOKEN, QUOTABLE, SPACE, BASE64, SLICE;
+var CHUNK2, MAX_REDIRECTS, NULL_BODY, REDIRECTS, BODY_HEADERS, DECODED, CREDENTIALS, BAD_PORTS, OVER, TOKEN, QUOTABLE, SPACE, BASE64, SLICE;
 var init_js_fetch = __esm({
   "src/process/js/js-fetch.ts"() {
     "use strict";
@@ -12778,6 +13196,89 @@ var init_js_fetch = __esm({
     ]);
     DECODED = /* @__PURE__ */ new Set(["gzip", "x-gzip", "deflate"]);
     CREDENTIALS = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2"]);
+    BAD_PORTS = /* @__PURE__ */ new Set([
+      1,
+      7,
+      9,
+      11,
+      13,
+      15,
+      17,
+      19,
+      20,
+      21,
+      22,
+      23,
+      25,
+      37,
+      42,
+      43,
+      53,
+      69,
+      77,
+      79,
+      87,
+      95,
+      101,
+      102,
+      103,
+      104,
+      109,
+      110,
+      111,
+      113,
+      115,
+      117,
+      119,
+      123,
+      135,
+      137,
+      139,
+      143,
+      161,
+      179,
+      389,
+      427,
+      465,
+      512,
+      513,
+      514,
+      515,
+      526,
+      530,
+      531,
+      532,
+      540,
+      548,
+      554,
+      556,
+      563,
+      587,
+      601,
+      636,
+      989,
+      990,
+      993,
+      995,
+      1719,
+      1720,
+      1723,
+      2049,
+      3659,
+      4045,
+      4190,
+      5060,
+      5061,
+      6e3,
+      6566,
+      6665,
+      6666,
+      6667,
+      6668,
+      6669,
+      6697,
+      10080
+    ]);
     OVER = /* @__PURE__ */ Symbol("over");
     TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
     QUOTABLE = /^[\t\x20-\x7e\x80-\xff]*$/;
@@ -13153,6 +13654,24 @@ function laneOf(lane) {
 }
 function syncOps(kernel, shared) {
   const { infos, handles, resolve } = shared;
+  const tryDevSync = (abs) => {
+    try {
+      const resolved2 = physicalPath(
+        {
+          lstat(p) {
+            return parseSyncFsStat(kernel.json({ op: "lstat", path: p })) ?? {};
+          },
+          readlink(p) {
+            return String(kernel.json({ op: "readlink", path: p }));
+          }
+        },
+        abs
+      );
+      return resolved2 !== abs && inDev(resolved2) ? resolved2 : void 0;
+    } catch {
+      return void 0;
+    }
+  };
   const info = (fd) => {
     const known = infos.get(fd);
     if (known) return known;
@@ -13185,10 +13704,17 @@ function syncOps(kernel, shared) {
   const statOf = (op, path) => {
     const abs = resolve(path);
     if (inDev(abs)) return devSync(kernel, devStat(abs, op === "stat"));
-    kernel.call({ op: "fd-path-flush", path: abs });
-    const s = parseSyncFsStat(kernel.json({ op, path: abs }));
-    if (!s) throw new JsCallError("EIO", op);
-    return s;
+    try {
+      kernel.call({ op: "fd-path-flush", path: abs });
+      const s = parseSyncFsStat(kernel.json({ op, path: abs }));
+      if (!s) throw new JsCallError("EIO", op);
+      return s;
+    } catch (err) {
+      if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+      const devPath = tryDevSync(abs);
+      if (!devPath) throw err;
+      return devSync(kernel, devStat(devPath, op === "stat"));
+    }
   };
   const openDev2 = (abs, options) => {
     const { fd, file, ...access } = devSync(kernel, devOpen(abs, options));
@@ -13208,27 +13734,34 @@ function syncOps(kernel, shared) {
   const open = (path, options = {}) => {
     const abs = resolve(path);
     if (inDev(abs)) return openDev2(abs, options);
-    let existing;
-    try {
-      existing = statOf(isExclusive(options) ? "lstat" : "stat", abs);
-    } catch (err) {
-      existing = absent(err);
-    }
-    checkOpen(abs, options, existing);
-    const fd = kernel.json(openRequest(abs, options));
     try {
-      kernel.call({ op: "fd-vfs-stat", fd });
+      let existing;
+      try {
+        existing = statOf(isExclusive(options) ? "lstat" : "stat", abs);
+      } catch (err) {
+        existing = absent(err);
+      }
+      checkOpen(abs, options, existing);
+      const fd = kernel.json(openRequest(abs, options));
+      try {
+        kernel.call({ op: "fd-vfs-stat", fd });
+      } catch (err) {
+        kernel.raw({ op: "fd-close", fd });
+        throw err;
+      }
+      infos.set(fd, { kind: "file" });
+      const handle = syncFile(kernel, fd, abs, options.append === true, () => {
+        infos.delete(fd);
+        handles.delete(fd);
+      });
+      handles.set(fd, handle.invalidate);
+      return handle.file;
     } catch (err) {
-      kernel.raw({ op: "fd-close", fd });
-      throw err;
+      if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+      const devPath = tryDevSync(abs);
+      if (!devPath) throw err;
+      return openDev2(devPath, options);
     }
-    infos.set(fd, { kind: "file" });
-    const handle = syncFile(kernel, fd, abs, options.append === true, () => {
-      infos.delete(fd);
-      handles.delete(fd);
-    });
-    handles.set(fd, handle.invalidate);
-    return handle.file;
   };
   return {
     read: read2,
@@ -13240,7 +13773,7 @@ function syncOps(kernel, shared) {
       kernel.call({ op: "fd-close", fd });
     },
     open: procOpenSync(open, kernel, { resolve, pid: shared.pid }),
-    fs: procFsSync(syncPathOps(kernel, resolve, statOf, open), kernel, {
+    fs: procFsSync(syncPathOps(kernel, resolve, statOf, open, tryDevSync), kernel, {
       resolve,
       pid: shared.pid
     })
@@ -13310,14 +13843,16 @@ function syncFile(kernel, fd, path, append, forget) {
     }
   };
 }
-function syncPathOps(kernel, resolve, statOf, open) {
+function syncPathOps(kernel, resolve, statOf, open, tryDev) {
   return {
     stat: (path) => statOf("stat", path),
     lstat: (path) => statOf("lstat", path),
     exists(path) {
       const abs = resolve(path);
       if (inDev(abs)) return devSync(kernel, devExists(abs));
-      return kernel.json({ op: "exists", path: abs }) === true;
+      if (kernel.json({ op: "exists", path: abs }) === true) return true;
+      const devPath = tryDev(abs);
+      return devPath ? devSync(kernel, devExists(devPath)) : false;
     },
     readdir(path) {
       const abs = resolve(path);
@@ -13342,15 +13877,29 @@ function syncPathOps(kernel, resolve, statOf, open) {
       return String(kernel.json({ op: "readlink", path: abs }));
     },
     statfs(path) {
-      const abs = resolve(path);
+      let abs = resolve(path);
+      if (inDev(abs)) {
+        try {
+          const target = devSync(kernel, devResolveTarget(abs));
+          if (target?.startsWith("/")) abs = target;
+        } catch {
+        }
+      }
       statOf("stat", abs);
       return statFsOf(kernel.json({ op: "statfs", path: abs }));
     },
     readFile(path) {
       const abs = resolve(path);
       if (inDev(abs)) return readWholeSync(open(abs));
-      kernel.call({ op: "fd-path-flush", path: abs });
-      return kernel.bytes({ op: "read", path: abs });
+      try {
+        kernel.call({ op: "fd-path-flush", path: abs });
+        return kernel.bytes({ op: "read", path: abs });
+      } catch (err) {
+        if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+        const devPath = tryDev(abs);
+        if (!devPath) throw err;
+        return readWholeSync(open(devPath));
+      }
     },
     writeFile(path, data, options) {
       const mode = options?.mode;
@@ -13372,6 +13921,7 @@ var encoder3, noLane, JsSyncKernel;
 var init_js_sync = __esm({
   "src/process/js/js-sync.ts"() {
     "use strict";
+    init_physical_path();
     init_signals();
     init_sync_fs_wire();
     init_sync_sab_bridge();
@@ -13768,6 +14318,55 @@ function readable2(read2) {
     { highWaterMark: 0 }
   );
 }
+async function resolveDevAsync(kernel, abs) {
+  try {
+    const resolved2 = await physicalPathAsync(
+      {
+        async lstat(p) {
+          return parseSyncFsStat(await kernel.json({ op: "lstat", path: p })) ?? {};
+        },
+        async readlink(p) {
+          return String(await kernel.json({ op: "readlink", path: p }));
+        }
+      },
+      abs
+    );
+    return resolved2 !== abs && inDev(resolved2) ? resolved2 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function vfsStat(kernel, abs, op, tryDev) {
+  try {
+    await kernel.call({ op: "fd-path-flush", path: abs });
+    const s = parseSyncFsStat(await kernel.json({ op, path: abs }));
+    if (!s) throw new JsCallError("EIO", op);
+    return s;
+  } catch (err) {
+    if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+    const devPath = await tryDev(abs);
+    if (!devPath) throw err;
+    return devAsync(kernel, devStat(devPath, op === "stat"));
+  }
+}
+async function vfsOpen(kernel, abs, options, statOf, infos, handles) {
+  const existing = await statOf(isExclusive(options) ? "lstat" : "stat", abs).catch(absent);
+  checkOpen(abs, options, existing);
+  const fd = await kernel.json(openRequest(abs, options));
+  try {
+    await kernel.call({ op: "fd-vfs-stat", fd });
+  } catch (err) {
+    await kernel.raw({ op: "fd-close", fd });
+    throw err;
+  }
+  infos.set(fd, { kind: "file" });
+  const handle = fileHandle(kernel, fd, abs, options.append === true, () => {
+    infos.delete(fd);
+    handles.delete(fd);
+  });
+  handles.set(fd, handle.invalidate);
+  return handle.file;
+}
 function createContext(o) {
   const { kernel } = o;
   const infos = /* @__PURE__ */ new Map();
@@ -13775,6 +14374,7 @@ function createContext(o) {
   const pending = /* @__PURE__ */ new Set();
   const random = o.random ?? ((bytes) => void crypto.getRandomValues(bytes));
   const resolve = (path) => resolvePath(o.cwd, path);
+  const tryDev = (abs) => resolveDevAsync(kernel, abs);
   let exiting;
   const exit = (code2 = 0) => {
     exiting ??= code2;
@@ -13817,32 +14417,25 @@ function createContext(o) {
   const statOf = async (op, path) => {
     const abs = resolve(path);
     if (inDev(abs)) return devAsync(kernel, devStat(abs, op === "stat"));
-    await kernel.call({ op: "fd-path-flush", path: abs });
-    const s = parseSyncFsStat(await kernel.json({ op, path: abs }));
-    if (!s) throw new JsCallError("EIO", op);
-    return s;
+    return vfsStat(kernel, abs, op, tryDev);
   };
+  const devIo = { infos, handles, read: read2, write: writeAll };
   const open = async (path, options = {}) => {
     const abs = resolve(path);
-    if (inDev(abs)) return openDev(kernel, abs, options, { infos, handles, read: read2, write: writeAll });
-    const existing = await statOf(isExclusive(options) ? "lstat" : "stat", abs).catch(absent);
-    checkOpen(abs, options, existing);
-    const fd = await kernel.json(openRequest(abs, options));
+    if (inDev(abs)) return openDev(kernel, abs, options, devIo);
     try {
-      await kernel.call({ op: "fd-vfs-stat", fd });
+      return await vfsOpen(kernel, abs, options, statOf, infos, handles);
     } catch (err) {
-      await kernel.raw({ op: "fd-close", fd });
-      throw err;
+      if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+      const devPath = await tryDev(abs);
+      if (!devPath) throw err;
+      return openDev(kernel, devPath, options, devIo);
     }
-    infos.set(fd, { kind: "file" });
-    const handle = fileHandle(kernel, fd, abs, options.append === true, () => {
-      infos.delete(fd);
-      handles.delete(fd);
-    });
-    handles.set(fd, handle.invalidate);
-    return handle.file;
   };
-  const fs = procFsAsync(pathOps(kernel, resolve, statOf, open), kernel, { resolve, pid: o.pid });
+  const fs = procFsAsync(pathOps(kernel, resolve, statOf, open, tryDev), kernel, {
+    resolve,
+    pid: o.pid
+  });
   const lane = o.lane ?? laneOf(void 0);
   if (o.lane && o.lane !== noLane) kernel.syncLane = o.lane;
   const syncKernel = new JsSyncKernel(lane, kernel, unwind);
@@ -14038,14 +14631,16 @@ async function sendSome(kernel, fd, body, signal) {
     await kernel.blocking({ op: "fd-select", read: [], write: [fd], timeoutMs: -1 }, signal);
   }
 }
-function pathOps(kernel, resolve, statOf, open) {
+function pathOps(kernel, resolve, statOf, open, tryDev) {
   return {
     stat: (path) => statOf("stat", path),
     lstat: (path) => statOf("lstat", path),
     async exists(path) {
       const abs = resolve(path);
       if (inDev(abs)) return devAsync(kernel, devExists(abs));
-      return await kernel.json({ op: "exists", path: abs }) === true;
+      if (await kernel.json({ op: "exists", path: abs }) === true) return true;
+      const devPath = await tryDev(abs);
+      return devPath ? devAsync(kernel, devExists(devPath)) : false;
     },
     async readdir(path) {
       const abs = resolve(path);
@@ -14070,15 +14665,26 @@ function pathOps(kernel, resolve, statOf, open) {
       return String(await kernel.json({ op: "readlink", path: abs }));
     },
     async statfs(path) {
-      const abs = resolve(path);
+      let abs = resolve(path);
+      if (inDev(abs)) {
+        const target = await devAsync(kernel, devResolveTarget(abs)).catch(() => void 0);
+        if (target?.startsWith("/")) abs = target;
+      }
       await statOf("stat", abs);
       return statFsOf(await kernel.json({ op: "statfs", path: abs }));
     },
     async readFile(path) {
       const abs = resolve(path);
       if (inDev(abs)) return readWhole(await open(abs));
-      await kernel.call({ op: "fd-path-flush", path: abs });
-      return kernel.bytes({ op: "read", path: abs });
+      try {
+        await kernel.call({ op: "fd-path-flush", path: abs });
+        return await kernel.bytes({ op: "read", path: abs });
+      } catch (err) {
+        if (!(err instanceof JsCallError) || err.code !== "ENOENT") throw err;
+        const devPath = await tryDev(abs);
+        if (!devPath) throw err;
+        return readWhole(await open(devPath));
+      }
     },
     async writeFile(path, data, options) {
       const mode = options?.mode;
@@ -14100,6 +14706,7 @@ var KERNEL_INFO, JsExit, encoder4;
 var init_js_context = __esm({
   "src/process/js/js-context.ts"() {
     "use strict";
+    init_physical_path();
     init_signals();
     init_sync_fs_wire();
     init_version();