@ai-ecoverse/slicc-kernel 1.94.4 → 1.95.0

package/dist/kernel-worker.js

@@ -2581,8 +2581,8 @@ async function inParent(g, op, path, old = false) {
   const dir = await access(g.fs, g.cred, parentOf4(path), W_OK | X_OK, linked(g, DIR));
   if (dir.denied === void 0) return stickyEntry(g, op, path, dir);
   if (dir.link) return deny(g, op, dir.denied);
-  const lookup = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
-  if (!lookup || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
+  const lookup2 = dir.denied === dir.path && dir.perm && permits(g.cred, dir.perm, X_OK);
+  if (!lookup2 || await present(g.fs, entryIn(dir, path), false)) deny(g, op, path);
 }
 async function makeIn(g, op, path) {
   for (let dir = parentOf4(path); ; dir = parentOf4(dir)) {
@@ -2902,6 +2902,7 @@ function pollFile(file) {
 }
 var OpenFile = class {
   refs = 1;
+  closers;
   file;
   constructor(file) {
     this.file = file;
@@ -2910,9 +2911,18 @@ var OpenFile = class {
     this.refs += 1;
     return this;
   }
+  onClose(fn) {
+    this.closers ??= /* @__PURE__ */ new Set();
+    this.closers.add(fn);
+    return () => void this.closers?.delete(fn);
+  }
   release() {
     this.refs -= 1;
-    if (this.refs === 0) return this.file.close();
+    if (this.refs !== 0) return;
+    const closers = this.closers;
+    this.closers = void 0;
+    for (const fn of closers ?? []) fn();
+    return this.file.close();
   }
 };
 function openPipe(capacity) {
@@ -3460,7 +3470,8 @@ var KernelSocket = class _KernelSocket {
     return {
       readable: this.readShut || rx.readReady,
       writable: this.writeShut || tx.writeReady,
-      hangup: rx.writersGone && tx.readersGone
+      hangup: rx.writersGone && tx.readersGone,
+      rdhup: rx.writersGone
     };
   }
   changed(signal) {
@@ -5139,7 +5150,7 @@ function clipboardAsker(port) {
 function integrityAsker(port) {
   const asks = /* @__PURE__ */ new Map();
   let next2 = 0;
-  const lookup = (path) => {
+  const lookup2 = (path) => {
     const id2 = ++next2;
     const waiting = Promise.withResolvers();
     asks.set(id2, waiting);
@@ -5153,7 +5164,7 @@ function integrityAsker(port) {
     if (error !== void 0) waiting.reject(new Error(error));
     else waiting.resolve(hash);
   };
-  return { lookup, answer };
+  return { lookup: lookup2, answer };
 }
 
 // src/kernel/net/loopback-names.ts
@@ -11712,7 +11723,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.94.4" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.95.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12099,6 +12110,295 @@ async function procAlias(fs, path, follow2) {
   return step.value;
 }
 
+// src/kernel/eventfd.ts
+var EVENTFD_MAX = 0xfffffffffffffffen;
+var Notifier = class {
+  waiters = [];
+  wait(signal) {
+    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve2, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new KernelError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve2();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve2 of waiters) resolve2();
+  }
+};
+function blocked(signal) {
+  if (signal?.aborted) throw new KernelError("EAGAIN");
+}
+var EventFd = class _EventFd {
+  static SIZE = 8;
+  count;
+  semaphore;
+  changes = new Notifier();
+  constructor(initial, semaphore) {
+    this.count = initial;
+    this.semaphore = semaphore;
+  }
+  async read(max, signal) {
+    if (max < _EventFd.SIZE) throw new KernelError("EINVAL");
+    while (this.count === 0n) {
+      blocked(signal);
+      await this.changes.wait(signal);
+    }
+    const value = this.semaphore ? 1n : this.count;
+    this.count -= value;
+    this.changes.wake();
+    const out = new Uint8Array(_EventFd.SIZE);
+    new DataView(out.buffer).setBigUint64(0, value, true);
+    return out;
+  }
+  async write(bytes, signal) {
+    if (bytes.length < _EventFd.SIZE) throw new KernelError("EINVAL");
+    const value = new DataView(bytes.buffer, bytes.byteOffset, _EventFd.SIZE).getBigUint64(0, true);
+    if (value > EVENTFD_MAX) throw new KernelError("EINVAL");
+    while (EVENTFD_MAX - this.count < value) {
+      blocked(signal);
+      await this.changes.wait(signal);
+    }
+    this.count += value;
+    if (value > 0n) this.changes.wake();
+    return _EventFd.SIZE;
+  }
+  poll() {
+    return { readable: this.count > 0n, writable: this.count < EVENTFD_MAX, hangup: false };
+  }
+  changed(signal) {
+    return this.changes.wait(signal);
+  }
+  close() {
+    this.changes.wake();
+  }
+};
+
+// src/kernel/epoll.ts
+var EPOLL = {
+  IN: 1,
+  OUT: 2,
+  RDHUP: 4,
+  PRI: 8,
+  ERR: 16,
+  HUP: 32,
+  ET: 64,
+  ONESHOT: 128
+};
+var ALWAYS = EPOLL.ERR | EPOLL.HUP;
+var ASKED = EPOLL.IN | EPOLL.OUT | EPOLL.RDHUP;
+var RETRY_MS = 50;
+var UNPOLLABLE = /* @__PURE__ */ new Set(["file", "held", "device"]);
+var EPOLL_OPS = [
+  "epoll-create",
+  "epoll-ctl",
+  "epoll-wait",
+  "eventfd-open"
+];
+function levelOf(file) {
+  const state = pollFile(file);
+  let bits2 = 0;
+  if (state.readable) bits2 |= EPOLL.IN;
+  if (state.writable) bits2 |= EPOLL.OUT;
+  if (state.rdhup) bits2 |= EPOLL.RDHUP;
+  if (state.hangup) bits2 |= file.read ? EPOLL.HUP : EPOLL.ERR;
+  return bits2;
+}
+function due(interest, level) {
+  if (!interest.armed) return 0;
+  const ready2 = level & (interest.events & ASKED | ALWAYS);
+  if (ready2 === 0) return 0;
+  if ((interest.events & EPOLL.ET) !== 0 && interest.reported === interest.gen) return 0;
+  return ready2;
+}
+function consume(interest) {
+  interest.reported = interest.gen;
+  if ((interest.events & EPOLL.ONESHOT) !== 0) interest.armed = false;
+}
+function lookup(fds, fd) {
+  try {
+    return fds.get(fd);
+  } catch {
+    return void 0;
+  }
+}
+function pause(ms, signal) {
+  return new Promise((resolve2) => {
+    const timer = setTimeout(resolve2, ms);
+    signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve2();
+      },
+      { once: true }
+    );
+  });
+}
+var EpollFile = class _EpollFile {
+  regs = /* @__PURE__ */ new Map();
+  changes = new Notifier();
+  cursor = 0;
+  ctl(fds, how, fd, events, data) {
+    const open = fds.get(fd);
+    if (open.file === this) throw new KernelError("EINVAL");
+    const known = this.regs.get(fd);
+    const current = known?.open === open ? known : void 0;
+    if (how === "add" || how === "set" && !current) {
+      if (current) throw new KernelError("EEXIST");
+      if (UNPOLLABLE.has(kernelFdKind(open.file))) throw new KernelError("EPERM");
+      if (open.file instanceof _EpollFile && open.file.reaches(this)) throw new KernelError("ELOOP");
+      if (known) this.drop(known);
+      this.register(fd, open, events, data);
+    } else if (!current) {
+      throw new KernelError("ENOENT");
+    } else if (how === "del") {
+      this.drop(current);
+    } else {
+      current.events = events;
+      current.data = data;
+      current.armed = true;
+      current.gen++;
+    }
+    this.changes.wake();
+  }
+  reaches(target) {
+    if (this === target) return true;
+    return [...this.regs.values()].some(
+      (reg) => reg.open.file instanceof _EpollFile && reg.open.file.reaches(target)
+    );
+  }
+  collect(fds, max) {
+    const list = [...this.regs.values()];
+    const out = [];
+    const start2 = list.length === 0 ? 0 : this.cursor % list.length;
+    for (let i = 0; i < list.length && out.length < max; i++) {
+      const reg = list[(start2 + i) % list.length];
+      if (lookup(fds, reg.fd) !== reg.open) {
+        this.drop(reg);
+        continue;
+      }
+      const bits2 = due(reg, levelOf(reg.open.file));
+      if (bits2 === 0) continue;
+      consume(reg);
+      out.push({ events: bits2, data: reg.data });
+      this.cursor = start2 + i + 1;
+    }
+    return out;
+  }
+  async wait(fds, max, timeoutMs, signal) {
+    const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : Date.now() + timeoutMs;
+    for (; ; ) {
+      const events = this.collect(fds, max);
+      if (events.length > 0 || Date.now() >= deadline) return events;
+      const round = new AbortController();
+      const woken = this.changes.wait(AbortSignal.any([round.signal, signal]));
+      woken.catch(() => void 0);
+      let timer;
+      const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve2) => timer = setTimeout(resolve2, deadline - Date.now()))];
+      try {
+        await Promise.race([woken, ...expiry]);
+      } finally {
+        round.abort();
+        clearTimeout(timer);
+      }
+    }
+  }
+  poll() {
+    const ready2 = [...this.regs.values()].some((reg) => due(reg, levelOf(reg.open.file)) !== 0);
+    return { readable: ready2, writable: false, hangup: false };
+  }
+  changed(signal) {
+    return this.changes.wait(signal);
+  }
+  close() {
+    for (const reg of [...this.regs.values()]) this.drop(reg);
+    this.changes.wake();
+  }
+  register(fd, open, events, data) {
+    const stop = new AbortController();
+    const unhook = open.onClose(() => {
+      this.drop(reg);
+      this.changes.wake();
+    });
+    const reg = {
+      fd,
+      open,
+      events,
+      data,
+      gen: 1,
+      reported: 0,
+      armed: true,
+      stop,
+      unhook
+    };
+    this.regs.set(fd, reg);
+    void this.watch(reg);
+  }
+  drop(reg) {
+    reg.stop.abort();
+    reg.unhook();
+    if (this.regs.get(reg.fd) === reg) this.regs.delete(reg.fd);
+  }
+  async watch(reg) {
+    const file = reg.open.file;
+    const { signal } = reg.stop;
+    while (file.changed && !signal.aborted) {
+      const round = new AbortController();
+      const stop = () => round.abort();
+      signal.addEventListener("abort", stop, { once: true });
+      let failed3 = false;
+      try {
+        await file.changed(round.signal);
+      } catch {
+        failed3 = true;
+      } finally {
+        round.abort();
+        signal.removeEventListener("abort", stop);
+      }
+      if (signal.aborted) return;
+      reg.gen++;
+      this.changes.wake();
+      if (failed3) await pause(RETRY_MS, signal);
+    }
+  }
+};
+function epollAt(fds, fd) {
+  const file = fds.get(fd).file;
+  if (!(file instanceof EpollFile)) throw new KernelError("EINVAL");
+  return file;
+}
+var ok = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
+async function epollSyscall(req, proc) {
+  const { fds } = proc;
+  switch (req.op) {
+    case "epoll-create":
+      return ok(fds.install(new OpenFile(new EpollFile()), 3));
+    case "eventfd-open":
+      return ok(fds.install(new OpenFile(new EventFd(BigInt(req.initial), req.semaphore)), 3));
+    case "epoll-ctl":
+      epollAt(fds, req.epfd).ctl(fds, req.how, req.fd, req.events, req.data);
+      return ok();
+    case "epoll-wait": {
+      const ep = epollAt(fds, req.epfd);
+      if (req.timeoutMs === 0 || proc.owed()) {
+        const now = ep.collect(fds, req.max);
+        if (req.timeoutMs === 0 || now.length > 0) return ok(now);
+      }
+      return ok(await ep.wait(fds, req.max, req.timeoutMs, proc.blocking()));
+    }
+  }
+}
+
 // src/kernel/host-ops.ts
 var HOST_OPS = [
   "lock",
@@ -12989,14 +13289,14 @@ var Resolver = class {
     if (hit && hit.expires > this.now()) return hit.addresses;
     const signal = blocking?.();
     if (signal?.aborted) throw new KernelError("EINTR");
-    let lookup = this.pending.get(id2);
-    if (!lookup) {
+    let lookup2 = this.pending.get(id2);
+    if (!lookup2) {
       const abort = new AbortController();
-      lookup = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
-      this.pending.set(id2, lookup);
-      void lookup.work.then(() => this.pending.delete(id2));
+      lookup2 = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
+      this.pending.set(id2, lookup2);
+      void lookup2.work.then(() => this.pending.delete(id2));
     }
-    return waitFor(lookup, signal);
+    return waitFor(lookup2, signal);
   }
   async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
@@ -13037,17 +13337,17 @@ var Resolver = class {
     }
   }
 };
-function waitFor(lookup, signal) {
-  lookup.waiters++;
+function waitFor(lookup2, signal) {
+  lookup2.waiters++;
   return new Promise((resolve2, reject) => {
     const abort = () => {
-      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      if (--lookup2.waiters === 0) lookup2.abort.abort(new KernelError("EINTR"));
       reject(new KernelError("EINTR"));
     };
     signal?.addEventListener("abort", abort, { once: true });
-    void lookup.work.then((value) => {
+    void lookup2.work.then((value) => {
       if (signal?.aborted) return;
-      lookup.waiters--;
+      lookup2.waiters--;
       signal?.removeEventListener("abort", abort);
       resolve2(value);
     });
@@ -13694,17 +13994,17 @@ function socketAt(fds, fd) {
   if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
   return file;
 }
-var ok = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
+var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
     case "sock-open":
-      return ok(fds.install(new OpenFile(net.socket(req.domain)), 3));
+      return ok2(fds.install(new OpenFile(net.socket(req.domain)), 3));
     case "sock-pair": {
       const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
       try {
-        return ok([first, fds.install(new OpenFile(b), 3)]);
+        return ok2([first, fds.install(new OpenFile(b), 3)]);
       } catch (e) {
         await Promise.resolve(fds.close(first));
         throw e;
@@ -13712,12 +14012,12 @@ async function socketSyscall(req, proc) {
     }
     case "sock-bind":
       socketAt(fds, req.fd).bind(req.addr);
-      return ok();
+      return ok2();
     case "sock-listen":
       socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
-      return ok();
+      return ok2();
     case "sock-accept":
-      return ok(await accept(proc, req.fd, req.nonblock));
+      return ok2(await accept(proc, req.fd, req.nonblock));
     case "sock-connect": {
       const socket = socketAt(fds, req.fd);
       const stamp = net.facadeAt(req.addr) && await proc.stamp?.();
@@ -13727,26 +14027,26 @@ async function socketSyscall(req, proc) {
         throw new KernelError("EINPROGRESS");
       }
       if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
-      return ok();
+      return ok2();
     }
     case "sock-shutdown":
       socketAt(fds, req.fd).shutdown(req.how);
-      return ok();
+      return ok2();
     case "sock-name": {
       const socket = socketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;
       if (req.peer && !addr) throw new KernelError("ENOTCONN");
-      return ok(addr ?? unnamed(socket.domain));
+      return ok2(addr ?? unnamed(socket.domain));
     }
     case "sock-getopt":
-      return ok(socketAt(fds, req.fd).getOption(req.level, req.name));
+      return ok2(socketAt(fds, req.fd).getOption(req.level, req.name));
     case "sock-setopt":
       socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
-      return ok();
+      return ok2();
     case "sock-resolve": {
       const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
       if (addresses.length === 0) throw new KernelError("ENOENT");
-      return ok(addresses);
+      return ok2(addresses);
     }
   }
 }
@@ -14447,6 +14747,9 @@ function isHttpSyscall(req) {
 function isSocketSyscall(req) {
   return req.op.startsWith("sock-");
 }
+function isEpollSyscall(req) {
+  return EPOLL_OPS.includes(req.op);
+}
 function isHostSyscall(req) {
   return HOST_OPS.includes(req.op);
 }
@@ -14537,6 +14840,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "sig-mask",
   "sig-pause",
   ...SOCKET_OPS,
+  ...EPOLL_OPS,
   ...HTTP_OPS,
   ...PTY_OPS,
   ...HOST_OPS
@@ -14651,9 +14955,9 @@ var WasmProcess = class {
     this.options.onPending?.(sig);
     if (this.options.jobs?.keyboard && KEYBOARD.has(sig) && this.waiting.size === 0)
       this.owed = true;
-    const blocked = this.interrupt;
+    const blocked2 = this.interrupt;
     this.interrupt = new AbortController();
-    blocked.abort();
+    blocked2.abort();
     return "deliver";
   }
   async spawn(req) {
@@ -14712,9 +15016,9 @@ var WasmProcess = class {
     this.stopped = sig;
     this.stops++;
     this.resumed = new Promise((resolve2) => this.wake = resolve2);
-    const blocked = this.interrupt;
+    const blocked2 = this.interrupt;
     this.interrupt = new AbortController();
-    blocked.abort();
+    blocked2.abort();
     for (const listener of this.stateListeners) listener("stopped", sig);
     return "stop";
   }
@@ -14764,6 +15068,13 @@ var WasmProcess = class {
       if (isTtySyscall(req)) return this.ttySyscall(req);
       if (isJobSyscall(req)) return this.jobSyscall(req);
       if (isSocketSyscall(req)) return await this.socketSyscall(req, cancelled);
+      if (isEpollSyscall(req)) {
+        return await epollSyscall(req, {
+          fds: this.fds,
+          blocking: () => this.blockingSignal(cancelled),
+          owed: () => this.owed
+        });
+      }
       if (isHttpSyscall(req)) return await this.httpSyscall(req);
       if (isHostSyscall(req)) {
         return await hostSyscall(req, {
@@ -14830,6 +15141,7 @@ var WasmProcess = class {
     if (!read) throw new KernelError(req.peek && file.read ? "EOPNOTSUPP" : "EBADF");
     if (file.tty) this.checkForeground(file.tty);
     if (file.clipboard) return this.readClipboard(file.clipboard, req, cancelled);
+    if (file instanceof EventFd && req.max < EventFd.SIZE) throw new KernelError("EINVAL");
     if (req.max <= 0) return new Uint8Array(0);
     if (file instanceof KernelSocket && file.unconnected) throw new KernelError("ENOTCONN");
     const ready2 = pollFile(file).readable;
@@ -15677,9 +15989,9 @@ var WasmProcess = class {
   }
   timerExpired(which) {
     this.options.onTimer?.(which);
-    const blocked = this.interrupt;
+    const blocked2 = this.interrupt;
     this.interrupt = new AbortController();
-    blocked.abort();
+    blocked2.abort();
   }
   clearAlarm() {
     clearTimeout(this.alarm);
@@ -15783,9 +16095,9 @@ function killThread(thread, caught, sig) {
   Atomics.or(thread.header, SAB_I_SIGNALS, sigbit(sig));
   if (held) return true;
   Atomics.notify(thread.header, SAB_I_SIGNALS);
-  const blocked = thread.interrupt;
+  const blocked2 = thread.interrupt;
   thread.interrupt = new AbortController();
-  blocked.abort();
+  blocked2.abort();
   return true;
 }
 function unblocked(header3) {
@@ -15964,8 +16276,8 @@ function threadInit(opts, program, sab, cred, thread, main) {
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
-  const blocked = opts.fork?.wasi?.blocked ?? opts.blocked;
-  if (blocked && anyBlocked(blocked) && opts.program.abi === "wasi") storeBlocked(header3, blocked);
+  const blocked2 = opts.fork?.wasi?.blocked ?? opts.blocked;
+  if (blocked2 && anyBlocked(blocked2) && opts.program.abi === "wasi") storeBlocked(header3, blocked2);
   const threadSignals = /* @__PURE__ */ new Map();
   const created3 = new Created();
   const process = new WasmProcess(
@@ -19820,6 +20132,8 @@ var Launcher = class {
     const head = await this.head(glue);
     if (!head) return void 0;
     if (isWasm(head)) {
+      const owner2 = await this.wasmOwner(glue, baseName(file).replace(/\.wasm$/, ""), scope);
+      if (owner2) return { ...targetOf(owner2), ...asked };
       return {
         abi: "wasi",
         glue,
@@ -19842,6 +20156,17 @@ var Launcher = class {
     );
     return owners.find((c) => c.name === name2) ?? owners[0];
   }
+  async wasmOwner(wasm, name2, scope) {
+    const leaf = baseName(wasm);
+    const real = await physicalPathAsync(this.base, wasm);
+    const owners = [];
+    for (const command of (await this.commands(scope)).values()) {
+      if (command.abi !== "wasi" || command.script || baseName(command.wasm) !== leaf) continue;
+      if (command.wasm === wasm || await physicalPathAsync(this.base, command.wasm) === real)
+        owners.push(command);
+    }
+    return owners.find((c) => c.name === name2) ?? owners[0];
+  }
   async head(path) {
     try {
       return (await this.base.readFileBuffer(path)).subarray(0, SHEBANG_MAX);
@@ -19929,16 +20254,29 @@ var Launcher = class {
     for (const bin of planned?.bins ?? []) await need(g, "exec", bin, R_OK | X_OK);
   }
   async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const planned = await this.plan(req.file, req.argv, req.cwd, scope, req.argv0);
-    try {
-      await this.mayExec(cred, { ...req, pid: ppid }, planned);
-    } catch (err) {
+    const refused2 = async (err) => {
       await fds.closeAll();
       throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
-    }
+    };
+    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused2);
+    const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
+    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused2);
     if (planned) return planned;
     await fds.closeAll();
-    throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
+    throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
+  }
+  execGuard(cred, pid, tag) {
+    const { dac } = this;
+    return dac && { fs: this.fs, cred, pid, dac, tag, links: this.links.get(pid) };
+  }
+  async execFile(file, cwd, g) {
+    if (!file.split("/").includes("..")) return file;
+    const path = file.startsWith("/") ? file : `${cwd}/${file}`;
+    const slash = path.lastIndexOf("/");
+    const dir = path.slice(0, slash);
+    const walked = g && await need(g, "exec", dir, X_OK, { directory: true });
+    const real = walked && walked.denied === void 0 ? walked.path : await physicalPathAsync(this.base, dir);
+    return joinName(real, path.slice(slash + 1));
   }
   async ticketFile(req, fds) {
     if (req.file.startsWith("/")) return physicalPathAsync(this.base, req.file);
@@ -20037,7 +20375,8 @@ var Launcher = class {
     }
     return manifests;
   }
-  async backing(file, cwd) {
+  async backing(asked, cwd) {
+    const file = await this.execFile(asked, cwd);
     const planned = await this.plan(file, [file], cwd, "");
     return planned && this.backingOf(planned, file, cwd, "");
   }
@@ -20674,8 +21013,8 @@ var Launcher = class {
   }
   signalMasksOf(pid) {
     const masks = this.processes.get(pid)?.signalMasks?.();
-    const [blocked] = this.blockedBy(pid);
-    const sigBlk = blocked ? { sigBlk: blocked } : {};
+    const [blocked2] = this.blockedBy(pid);
+    const sigBlk = blocked2 ? { sigBlk: blocked2 } : {};
     return masks ? { sigIgn: masks.ignored, sigCgt: masks.caught, ...sigBlk } : sigBlk;
   }
   controlsJobs(pid) {
@@ -21123,7 +21462,7 @@ var Launcher = class {
     const scope = account.uid === 0 ? "" : pnpmHomeOf(account, this.pnpmHome);
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
-    const [file = ""] = argv;
+    const file = await this.execFile(argv[0] ?? "", cwd, this.execGuard(credOf(account), 0, tag));
     if (!await this.base.exists(cwd)) await this.stackFor(tag).fs.mkdir(cwd, { recursive: true });
     const planned = await this.plan(file, argv, cwd, scope);
     await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, planned);
@@ -21416,19 +21755,19 @@ function usersOp(l, req) {
   if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();
 }
-function hostOptions(req, port, sealed, clipboard, lookup) {
+function hostOptions(req, port, sealed, clipboard, lookup2) {
   return {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
-    ...req.protect ? { protect: hostProtect(req.protect, lookup) } : {},
+    ...req.protect ? { protect: hostProtect(req.protect, lookup2) } : {},
     ...req.sealed ? { sealed } : {},
     ...req.clipboard ? { clipboard } : {}
   };
 }
-function hostProtect(init, lookup) {
+function hostProtect(init, lookup2) {
   const { integrity, ...rest2 } = protectInit(init);
-  return { ...rest2, ...integrity ? { integrity: { ...integrity, lookup } } : {} };
+  return { ...rest2, ...integrity ? { integrity: { ...integrity, lookup: lookup2 } } : {} };
 }
 function policyAsker(port) {
   const policies = /* @__PURE__ */ new Map();