@ai-ecoverse/slicc-kernel 1.97.0 → 1.97.2

package/dist/node-process-worker.js

@@ -4529,7 +4529,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.97.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.97.2" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -6417,8 +6417,8 @@ function createSyncFsSabBridge(transport, opts = {}) {
     access: (path, mode, kind = "access", nofollow) => {
       run({ op: "access", path, mode, arg2: kind, ...nofollow ? { nofollow } : {} }, path);
     },
-    hold: (path, held, open, handle, want = 0) => {
-      const mode = (held ? 1 : 0) | (open ? 2 : 0);
+    hold: (path, held2, open, handle, want = 0) => {
+      const mode = (held2 ? 1 : 0) | (open ? 2 : 0);
       if (mode === 3) return json2({ op: "hold", path, mode: mode | want }, path);
       run({ op: "hold", path, mode, ...handle !== void 0 ? { handle } : {} }, path);
       return void 0;
@@ -6968,7 +6968,7 @@ function appendThrough(h, stream, bytes) {
 }
 function createStreamOps(h) {
   const { Fs, statOf, ensureLoaded, ensureCapacity, flushNode, bridgeOf, rangedOf } = h;
-  const held = (stream, change) => {
+  const held2 = (stream, change) => {
     const s = stream.node.live;
     if ((stream.flags & 3) === 0 || s.orphan) return;
     const before = s.writers ?? 0;
@@ -7049,12 +7049,12 @@ function createStreamOps(h) {
         if (stream.fd !== void 0) Fs.closeStream?.(stream.fd);
         throw err;
       }
-      held(stream, 1);
+      held2(stream, 1);
     },
     dup(stream) {
       if (!Fs.isFile(stream.node.mode)) return;
       stream.node.live.openCount++;
-      held(stream, 1);
+      held2(stream, 1);
     },
     close(stream) {
       const node = stream.node;
@@ -7062,7 +7062,7 @@ function createStreamOps(h) {
       const s = node.live;
       s.openCount = Math.max(0, s.openCount - 1);
       if (s.openCount > 0) {
-        held(stream, -1);
+        held2(stream, -1);
         return;
       }
       try {
@@ -7073,7 +7073,7 @@ function createStreamOps(h) {
         s.ranges = false;
         s.len = 0;
         s.loaded = false;
-        held(stream, -1);
+        held2(stream, -1);
         opened2(node, false);
       }
     },
@@ -7261,6 +7261,7 @@ function liveRoot(Fs, bridge) {
   invalidateLiveVfs(Fs, plugin);
   guardRenames(Fs);
   guardKeptNodes(Fs, plugin.handled);
+  guardStaleNodes(Fs, plugin);
   guardStatfs(Fs);
   const memfs = root.memfs ?? root.node_ops;
   const live = plugin.node_ops;
@@ -7328,7 +7329,7 @@ function guardKeptNodes(Fs, handled) {
   const lookupPath = Fs.lookupPath.bind(Fs);
   Fs.open = (path, flags, mode) => {
     const name2 = path.slice(path.lastIndexOf("/") + 1);
-    if (![...handled].some((held) => held.name === name2)) return open(path, flags, mode);
+    if (![...handled].some((held2) => held2.name === name2)) return open(path, flags, mode);
     let node;
     try {
       node = lookupPath(path, { follow: true }).node;
@@ -7339,6 +7340,33 @@ function guardKeptNodes(Fs, handled) {
     return open(path, flags, mode);
   };
 }
+function outdated(node, view, before) {
+  const s = node.live;
+  if (s.named === void 0) {
+    s.named = before;
+    return false;
+  }
+  if (s.named === before) return false;
+  const { now, changed: changed2 } = view.changedSince(s.named, liveNodePath(node));
+  s.named = now;
+  return changed2 && s.openCount === 0 && !s.dirty && node !== node.mount.root && !node.mounted;
+}
+function guardStaleNodes(Fs, plugin) {
+  const lookupNode = Fs.lookupNode?.bind(Fs);
+  const forget = Fs.hashRemoveNode?.bind(Fs);
+  if (!lookupNode || !forget || Fs.sliccStale) return;
+  Fs.sliccStale = true;
+  Fs.lookupNode = (parent, name2) => {
+    const view = parent.live ? parent.mount.opts.bridge.changes : void 0;
+    const before = view?.now() ?? 0;
+    const node = lookupNode(parent, name2);
+    if (!view || !ownedBy(plugin, node) || !outdated(node, view, before)) return node;
+    forget(node);
+    const fresh = lookupNode(parent, name2);
+    if (fresh.live) fresh.live.named = before;
+    return fresh;
+  };
+}
 function guardRenames(Fs) {
   const rename = Fs.rename?.bind(Fs);
   if (!rename || Fs.sliccRename) return;
@@ -7431,8 +7459,8 @@ function linkLive(Fs, from, to, follow2) {
   try {
     bridge.link(path, base === "/" ? `/${name2}` : `${base}/${name2}`);
   } catch (err) {
-    const refused2 = toErrno(Fs, err);
-    if (refused2.errno !== wasiErrno("EPERM") || linkable(bridge, path)) throw refused2;
+    const refused3 = toErrno(Fs, err);
+    if (refused3.errno !== wasiErrno("EPERM") || linkable(bridge, path)) throw refused3;
     throw new Fs.ErrnoError(wasiErrno("EMLINK"));
   }
   source.live.stat = void 0;
@@ -7480,6 +7508,118 @@ var init_live_vfs_fs = __esm({
   }
 });
 
+// src/process/process-locks.ts
+function lockTarget(stream) {
+  if (stream.sliccKernelFile && stream.sliccKernelFd !== void 0) {
+    return { fd: stream.sliccKernelFd };
+  }
+  const node = stream.node;
+  return node.live && node.mount ? { path: liveNodePath(node) } : void 0;
+}
+function errnoOf(err) {
+  const code2 = err?.code;
+  if (typeof code2 === "string") return wasiErrno(code2);
+  const errno2 = err?.errno;
+  return typeof errno2 === "number" ? errno2 : wasiErrno("EIO");
+}
+function sizeOf(Fs, stream) {
+  const st = Fs.fstat?.(stream.fd);
+  return st?.size ?? 0;
+}
+function kindOf(type) {
+  if (type === F_RDLCK) return "read";
+  if (type === F_WRLCK) return "write";
+  return type === F_UNLCK ? "unlock" : void 0;
+}
+function readFlock(view, at, base) {
+  const kind = kindOf(view.getInt16(at, true));
+  if (kind === void 0) return void 0;
+  const start2 = base(view.getInt16(at + 2, true)) + Number(view.getBigInt64(at + 8, true));
+  return { kind, start: start2, len: Number(view.getBigInt64(at + 16, true)) };
+}
+function writeHolder(view, at, found) {
+  if (!found) {
+    view.setInt16(at, F_UNLCK, true);
+    return;
+  }
+  view.setInt16(at, found.kind === "read" ? F_RDLCK : F_WRLCK, true);
+  view.setInt16(at + 2, 0, true);
+  view.setBigInt64(at + 8, BigInt(found.start), true);
+  view.setBigInt64(at + 16, BigInt(found.len), true);
+  view.setInt32(at + 24, found.pid, true);
+}
+function refused2(kind, flags) {
+  const access = flags & O_ACCMODE2;
+  return kind === "write" && access === O_RDONLY || kind === "read" && access === O_WRONLY4;
+}
+function baseOf(Fs, stream) {
+  return (whence) => whence === SEEK_CUR2 ? stream.position : whence === SEEK_END2 ? sizeOf(Fs, stream) : 0;
+}
+function recordLock(fcntl, deps) {
+  return (fd, cmd, varargs) => {
+    if (cmd !== F_GETLK && cmd !== F_SETLK && cmd !== F_SETLKW) return fcntl(fd, cmd, varargs);
+    const Fs = deps.fs();
+    const buffer = deps.memory();
+    const stream = Fs?.getStream(fd);
+    const target = stream ? lockTarget(stream) : void 0;
+    if (!Fs || !buffer || !stream || !target) return fcntl(fd, cmd, varargs);
+    const view = new DataView(buffer);
+    const at = view.getUint32(varargs, true);
+    const lock = readFlock(view, at, baseOf(Fs, stream));
+    if (!lock || cmd === F_GETLK && lock.kind === "unlock") return -wasiErrno("EINVAL");
+    try {
+      if (cmd === F_GETLK) {
+        writeHolder(
+          view,
+          at,
+          deps.kernel.getLock(target, lock.kind, lock.start, lock.len)
+        );
+        return 0;
+      }
+      if (refused2(lock.kind, stream.flags)) return -wasiErrno("EBADF");
+      if (lock.kind !== "write") deps.flush();
+      deps.kernel.setLock(target, lock.kind, lock.start, lock.len, cmd === F_SETLKW);
+      if (lock.kind !== "unlock") held.set(Fs, true);
+      return 0;
+    } catch (err) {
+      return -errnoOf(err);
+    }
+  };
+}
+function closeDropsLocks(Fs, kernel) {
+  const close = Fs.close;
+  if (typeof close !== "function") return;
+  Fs.close = (stream) => {
+    const target = held.has(Fs) && !stream.sliccKernelFile ? lockTarget(stream) : void 0;
+    close.call(Fs, stream);
+    if (!target) return;
+    try {
+      kernel.closeLocks(target);
+    } catch {
+    }
+  };
+}
+var F_GETLK, F_SETLK, F_SETLKW, F_RDLCK, F_WRLCK, F_UNLCK, SEEK_CUR2, SEEK_END2, O_ACCMODE2, O_RDONLY, O_WRONLY4, held;
+var init_process_locks = __esm({
+  "src/process/process-locks.ts"() {
+    "use strict";
+    init_live_vfs_fs();
+    init_wasi_errno();
+    F_GETLK = 12;
+    F_SETLK = 13;
+    F_SETLKW = 14;
+    F_RDLCK = 0;
+    F_WRLCK = 1;
+    F_UNLCK = 2;
+    SEEK_CUR2 = 1;
+    SEEK_END2 = 2;
+    O_ACCMODE2 = 3;
+    O_RDONLY = 0;
+    O_WRONLY4 = 1;
+    held = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // src/process/process-pty.ts
 function failed2(e) {
   const code2 = e?.code;
@@ -7635,7 +7775,7 @@ function wrapperFactories(deps) {
   const { pty, timer } = deps;
   return {
     ...timer ? { setitimer: (f) => kernelTimer(f, timer) } : {},
-    fcntl: (f) => cloexecFcntl(f, deps),
+    fcntl: (f) => cloexecFcntl(deps.locks ? recordLock(f, { ...deps.locks, fs: deps.fs }) : f, deps),
     pipe2: (f) => cloexecPipe2(f, deps),
     dup3: (f) => cloexecByFlag(quietTarget(f, deps), 2, deps),
     socket: (f) => cloexecByFlag(f, 1, deps),
@@ -7769,7 +7909,7 @@ function noFollowUtimes(imports, fs, glue, memory = () => void 0) {
     }
   );
 }
-function errnoOf(err) {
+function errnoOf2(err) {
   const { errno: errno2, code: code2 } = err ?? {};
   if (typeof errno2 === "number") return errno2;
   if (typeof code2 === "string") return wasiErrno(code2);
@@ -7804,7 +7944,7 @@ function syncFsync(imports, fs, glue) {
         const result = stream.stream_ops.fsync?.(stream);
         return typeof result === "number" ? result : 0;
       } catch (err) {
-        return errnoOf(err);
+        return errnoOf2(err);
       }
     };
   }
@@ -7845,7 +7985,7 @@ function positioned(original, write2, deps) {
         if (moved < len) break;
       }
     } catch (err) {
-      return errnoOf(err);
+      return errnoOf2(err);
     }
     view.setUint32(Number(rest2[rest2.length - 1]), done, true);
     return 0;
@@ -7881,7 +8021,7 @@ function useFileMmap(Fs, deps) {
     const shared = (flags & MAP_TYPE) !== MAP_PRIVATE && (prot & PROT_WRITE) !== 0;
     const kfd = stream.sliccKernelFile ? stream.sliccKernelFd : void 0;
     if (shared && kfd !== void 0) throw new Fs.ErrnoError(wasiErrno("ENODEV"));
-    if (stream.stream_ops.mmap && kfd === void 0 || !memalign || !memory || length <= 0 || shared || (stream.flags & O_ACCMODE2) === O_WRONLY4 || !Fs.isFile(stream.node.mode)) {
+    if (stream.stream_ops.mmap && kfd === void 0 || !memalign || !memory || length <= 0 || shared || (stream.flags & O_ACCMODE3) === O_WRONLY5 || !Fs.isFile(stream.node.mode)) {
       return mmap.call(fs, stream, length, position, prot, flags);
     }
     const data = staging(Fs, length);
@@ -7894,7 +8034,7 @@ function useFileMmap(Fs, deps) {
         }
       }
     } catch (err) {
-      throw new Fs.ErrnoError(errnoOf(err));
+      throw new Fs.ErrnoError(errnoOf2(err));
     }
     const size = Math.ceil(length / MAP_ALIGN) * MAP_ALIGN;
     const ptr = memalign(MAP_ALIGN, size);
@@ -8003,8 +8143,8 @@ function useDevRemoval(Fs) {
     const remove = fs[name2];
     if (typeof remove !== "function") continue;
     fs[name2] = (path) => {
-      const refused2 = devRemoval(absoluteOf(path, Fs.cwd()), fs.sliccCred);
-      if (refused2) throw new Fs.ErrnoError(wasiErrno(refused2));
+      const refused3 = devRemoval(absoluteOf(path, Fs.cwd()), fs.sliccCred);
+      if (refused3) throw new Fs.ErrnoError(wasiErrno(refused3));
       remove.call(Fs, path);
     };
   }
@@ -8107,7 +8247,7 @@ function useMounts(Fs, env = {}, live = false) {
   const open = Fs.open.bind(Fs);
   Fs.open = (path, flags, mode) => {
     const instead = backing[path];
-    if (!instead || (flags & (O_ACCMODE2 | O_CREAT)) !== 0) return open(path, flags, mode);
+    if (!instead || (flags & (O_ACCMODE3 | O_CREAT)) !== 0) return open(path, flags, mode);
     try {
       return open(path, flags, mode);
     } catch (e) {
@@ -8120,14 +8260,14 @@ function cString(memory, at) {
   const bytes = new Uint8Array(memory.buffer, at);
   return new TextDecoder().decode(bytes.subarray(0, bytes.indexOf(0)));
 }
-function baseOf(Fs, dirfd) {
+function baseOf2(Fs, dirfd) {
   return dirfd === AT_FDCWD ? Fs.cwd?.() ?? "/" : Fs.getStream?.(dirfd)?.path ?? "/";
 }
 function readonlyRefusal(Fs, memory, call2) {
   if (!(call2.amode & W_ACCESS)) return 0;
   try {
     const name2 = cString(memory, call2.path);
-    const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
+    const abs = name2.startsWith("/") ? name2 : `${baseOf2(Fs, call2.dirfd)}/${name2}`;
     const follow2 = (call2.flags & AT_SYMLINK_NOFOLLOW2) === 0;
     const { node } = Fs.lookupPath.call(Fs, abs, {
       follow: follow2
@@ -8142,7 +8282,7 @@ function readonlyRefusal(Fs, memory, call2) {
 }
 function kernelChecks(Fs, memory, call2) {
   const name2 = cString(memory, call2.path);
-  const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
+  const abs = name2.startsWith("/") ? name2 : `${baseOf2(Fs, call2.dirfd)}/${name2}`;
   const lookupPath = Fs.lookupPath;
   const { node } = lookupPath.call(Fs, abs, { follow: (call2.flags & AT_SYMLINK_NOFOLLOW2) === 0 });
   const bridge = node.live ? node.mount.opts.bridge : void 0;
@@ -8156,14 +8296,14 @@ function kernelAccess(imports, fs, memory, glue) {
     const Fs = fs();
     const heap = memory();
     const call2 = { dirfd, path, amode: amode & 7, flags };
-    const refused2 = Fs?.lookupPath && heap ? readonlyRefusal(Fs, heap, call2) : 0;
-    if (refused2 !== 0) return refused2;
+    const refused3 = Fs?.lookupPath && heap ? readonlyRefusal(Fs, heap, call2) : 0;
+    if (refused3 !== 0) return refused3;
     const rc = own(dirfd, path, amode, flags);
     if (rc !== 0 || !Fs?.lookupPath || !heap) return rc;
     try {
       return kernelChecks(Fs, heap, { dirfd, path, amode: amode & 7, flags });
     } catch (err) {
-      return -errnoOf(err);
+      return -errnoOf2(err);
     }
   });
 }
@@ -8178,7 +8318,7 @@ function kernelLink(imports, fs, memory, glue) {
       if (!Fs?.lookupPath || !heap) return own(olddirfd, oldpath, newdirfd, newpath, flags);
       const at = (dirfd, ptr) => {
         const name2 = cString(heap, ptr);
-        return name2.startsWith("/") ? name2 : `${baseOf(Fs, dirfd)}/${name2}`;
+        return name2.startsWith("/") ? name2 : `${baseOf2(Fs, dirfd)}/${name2}`;
       };
       try {
         const from = at(olddirfd, oldpath);
@@ -8186,7 +8326,7 @@ function kernelLink(imports, fs, memory, glue) {
         const follow2 = (flags & AT_SYMLINK_FOLLOW) !== 0;
         if (linkLive(Fs, from, to, follow2)) return 0;
       } catch (err) {
-        return -errnoOf(err);
+        return -errnoOf2(err);
       }
       return own(olddirfd, oldpath, newdirfd, newpath, flags);
     },
@@ -8203,7 +8343,7 @@ function kernelChdir(Fs) {
     try {
       bridge?.access?.(liveNodePath(node), X_ACCESS, "eaccess", false);
     } catch (err) {
-      throw new ErrnoError(errnoOf(err));
+      throw new ErrnoError(errnoOf2(err));
     }
     chdir.call(Fs, path);
   };
@@ -8220,13 +8360,14 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW2, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY4, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS2, W_ACCESS, X_ACCESS, AT_SYMLINK_FOLLOW, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW2, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY5, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE3, O_CREAT, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS2, W_ACCESS, X_ACCESS, AT_SYMLINK_FOLLOW, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
     init_dev_removal();
     init_loopback_names();
     init_live_vfs_fs();
+    init_process_locks();
     init_process_pty();
     init_wasi_errno();
     O_CLOEXEC = 524288;
@@ -8269,12 +8410,12 @@ var init_process_fds = __esm({
     PROT_WRITE = 2;
     MAP_PRIVATE = 2;
     MAP_TYPE = 15;
-    O_WRONLY4 = 1;
+    O_WRONLY5 = 1;
     MAP_ALIGN = 65536;
     DIR_MODE = 16749;
     LINK_MODE = 41408;
     CHAR_DEVICE = 8630;
-    O_ACCMODE2 = 3;
+    O_ACCMODE3 = 3;
     O_CREAT = 64;
     field = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
     rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
@@ -8873,10 +9014,10 @@ function procfsBridge(fs, tree) {
       ],
       () => fs.link(from, to, follow2)
     ),
-    hold: (p, held, open, handle, want) => {
+    hold: (p, held2, open, handle, want) => {
       if (handle !== void 0 && snapshots.delete(handle)) return void 0;
-      if (!held) return fs.hold?.(p, held, open, handle);
-      return via(p, snapshot, () => fs.hold?.(p, held, open, void 0, want) ?? late(p));
+      if (!held2) return fs.hold?.(p, held2, open, handle);
+      return via(p, snapshot, () => fs.hold?.(p, held2, open, void 0, want) ?? late(p));
     },
     kept: (handle) => snapshots.has(handle) || fs.kept?.(handle) === true,
     pinned: (handle) => {
@@ -11250,12 +11391,12 @@ function vfsPromoter(Fs, sys, streams, livePath) {
       const version = ranged?.pinnedVersion;
       const pin = ranged && version !== void 0 ? { version, size: ranged.size() } : void 0;
       const handle = stream.node.live?.handle;
-      const held = { ...pin ? { pin } : {}, ...handle !== void 0 ? { handle } : {} };
+      const held2 = { ...pin ? { pin } : {}, ...handle !== void 0 ? { handle } : {} };
       kfd = sys.openVfs(
         livePath(stream),
         stream.flags,
         stream.position,
-        contents !== void 0 ? { contents, orphan: true } : Object.keys(held).length > 0 ? held : void 0
+        contents !== void 0 ? { contents, orphan: true } : Object.keys(held2).length > 0 ? held2 : void 0
       );
       promoted.set(stream.shared, kfd);
     }
@@ -11284,7 +11425,7 @@ function kernelEntry2(stream, kernel) {
   }
   const device2 = stream.path === void 0 ? void 0 : NAMED_DEVICES[stream.path];
   const kind = stream.sliccKernelFile ? "file" : stream.tty ? "tty" : device2 ?? "stream";
-  const access = kind === "tty" ? O_RDWR4 : (stream.flags ?? O_RDWR4) & O_ACCMODE3;
+  const access = kind === "tty" ? O_RDWR4 : (stream.flags ?? O_RDWR4) & O_ACCMODE4;
   return { fd: stream.fd, kernel, kind, flags: access, ...cloexec };
 }
 function describeInherited(Fs, sys, streams, livePath, actions = []) {
@@ -11314,7 +11455,7 @@ function describeInherited(Fs, sys, streams, livePath, actions = []) {
 function deviceOfStream(stream) {
   const device2 = stream.path === void 0 ? void 0 : DEVICES2[stream.path];
   if (!device2 || stream.sliccKernelFd !== void 0) return void 0;
-  const access = ACCESS[stream.flags & O_ACCMODE3];
+  const access = ACCESS[stream.flags & O_ACCMODE4];
   return { device: device2, ...access ? { access } : {} };
 }
 function inheritedSlot(fd, stream) {
@@ -11387,13 +11528,13 @@ function restoreForkedStreams(Fs, streams, table) {
     }
   }
 }
-var O_RDWR4, O_ACCMODE3, O_CREAT3, O_EXCL2, O_TRUNC3, PLACEHOLDER_DIR, NAMED_DEVICES, ACCESS, DEVICES2, FIFO_MODE, nextStreamIno, streamInos;
+var O_RDWR4, O_ACCMODE4, O_CREAT3, O_EXCL2, O_TRUNC3, PLACEHOLDER_DIR, NAMED_DEVICES, ACCESS, DEVICES2, FIFO_MODE, nextStreamIno, streamInos;
 var init_process_fork = __esm({
   "src/process/process-fork.ts"() {
     "use strict";
     init_process_fds();
     O_RDWR4 = 2;
-    O_ACCMODE3 = 3;
+    O_ACCMODE4 = 3;
     O_CREAT3 = 64;
     O_EXCL2 = 128;
     O_TRUNC3 = 512;
@@ -11863,7 +12004,7 @@ function socketNode(Fs, addr) {
   const fs = Fs;
   let stream;
   try {
-    stream = Fs.open(addr.path, O_WRONLY5 | O_CREAT4 | O_EXCL3, 493);
+    stream = Fs.open(addr.path, O_WRONLY6 | O_CREAT4 | O_EXCL3, 493);
   } catch (e) {
     if (e?.errno === wasiErrno("EEXIST")) {
       throw new SyscallError("EADDRINUSE");
@@ -11995,7 +12136,7 @@ function createSocketKernel(deps) {
     })
   };
 }
-var O_RDWR5, KILLED_BY_SIGPIPE2, O_WRONLY5, O_CREAT4, O_EXCL3;
+var O_RDWR5, KILLED_BY_SIGPIPE2, O_WRONLY6, O_CREAT4, O_EXCL3;
 var init_process_sockets = __esm({
   "src/process/process-sockets.ts"() {
     "use strict";
@@ -12005,7 +12146,7 @@ var init_process_sockets = __esm({
     init_wasi_errno();
     O_RDWR5 = 2;
     KILLED_BY_SIGPIPE2 = 128 + 13;
-    O_WRONLY5 = 1;
+    O_WRONLY6 = 1;
     O_CREAT4 = 64;
     O_EXCL3 = 128;
   }
@@ -12180,6 +12321,16 @@ function kernelSys(transport) {
     mountList() {
       return json2(call2({ op: "mount-list" }, "mount-list"));
     },
+    setLock(target, kind, start2, len, wait2) {
+      const req = { op: "lk-set", ...target, kind, start: start2, len, ...wait2 ? { wait: wait2 } : {} };
+      call2(req, "lk-set");
+    },
+    getLock(target, kind, start2, len) {
+      return json2(call2({ op: "lk-get", ...target, kind, start: start2, len }, "lk-get"));
+    },
+    closeLocks(target) {
+      call2({ op: "lk-close", ...target }, "lk-close");
+    },
     ptyNumber(fd) {
       return json2(call2({ op: "pty-number", fd }, `pty-number ${fd}`));
     },
@@ -12209,7 +12360,7 @@ function openDevice(Fs, fd, meta) {
   return openAt(Fs, fd, `/dev/${meta.device}`, accessMode(meta.access));
 }
 function openHeld(Fs, fd, meta) {
-  return "dir" in meta ? openAt(Fs, fd, meta.dir, O_RDONLY | O_DIRECTORY2) : openDevice(Fs, fd, meta);
+  return "dir" in meta ? openAt(Fs, fd, meta.dir, O_RDONLY2 | O_DIRECTORY2) : openDevice(Fs, fd, meta);
 }
 function openAt(Fs, fd, path, flags) {
   let stream;
@@ -12232,7 +12383,7 @@ function wireKernelStdio(Fs, streams, sys) {
     const meta = kind === "device" || kind === "held" ? sys?.heldMeta?.(fd) : void 0;
     if (meta && openHeld(Fs, fd, meta)) continue;
     if (kind && PLACED.has(kind)) {
-      const flags = sys?.access ? stream.flags & ~O_ACCMODE4 | accessMode(sys.access(fd)) : stream.flags;
+      const flags = sys?.access ? stream.flags & ~O_ACCMODE5 | accessMode(sys.access(fd)) : stream.flags;
       Fs.closeStream(fd);
       const kernel = { fd, kernel: fd, kind, flags };
       placeKernelStream(Fs, streams, kernel).flags = flags;
@@ -12384,6 +12535,7 @@ async function runWasmProcess(init, port3, deps = {}) {
           fs: () => ownValue(module, "FS"),
           heap: () => memory ? new Int32Array(memory.buffer) : void 0,
           pty: sys,
+          locks: { kernel: sys, memory: () => memory?.buffer, flush: () => early() },
           timer: {
             arm: (ms) => {
               transport.call(
@@ -12441,6 +12593,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     cred: init.owners ? init.cred : void 0
   });
   early = () => signals.quiet(() => vfs.flushDirty());
+  closeDropsLocks(running.FS, sys);
   const sigpipe = () => running.sliccSigpipe?.() === 1;
   const restartable = () => signals.restartable();
   const owners = init.owners ? { owners: true } : {};
@@ -12457,7 +12610,6 @@ async function runWasmProcess(init, port3, deps = {}) {
   atExit = () => streams.exiting();
   useMounts(running.FS, init.env, true);
   useZeroDevices(running.FS);
-  useDevRemoval(running.FS);
   useProcfs(running.FS, sys, init.pid);
   if (init.fork) restoreForkedStreams(running.FS, streams, init.fork.streams ?? []);
   else {
@@ -12469,6 +12621,7 @@ async function runWasmProcess(init, port3, deps = {}) {
   streams.useControllingTerminal();
   streams.useKernelFdMetadata();
   useDevFd(running.FS);
+  useDevRemoval(running.FS);
   useFileMmap(running.FS, {
     sys,
     memory: () => memory,
@@ -12568,7 +12721,7 @@ function runMain(running, init) {
     return status2;
   }
 }
-var FS_OPS, O_RDONLY, O_WRONLY6, O_RDWR6, O_ACCMODE4, O_DIRECTORY2, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
+var FS_OPS, O_RDONLY2, O_WRONLY7, O_RDWR6, O_ACCMODE5, O_DIRECTORY2, accessMode, PLACED, GLUE_TRAILER, evaluateGlue, EVAL_BLOCKED;
 var init_process_runtime = __esm({
   "src/process/process-runtime.ts"() {
     "use strict";
@@ -12584,18 +12737,19 @@ var init_process_runtime = __esm({
     init_process_fds();
     init_process_fork();
     init_process_http();
+    init_process_locks();
     init_process_signals();
     init_process_sockets();
     init_procfs();
     init_realm_user();
     init_kernel_streams();
     FS_OPS = new Set(SYNC_FS_OPS);
-    O_RDONLY = 0;
-    O_WRONLY6 = 1;
+    O_RDONLY2 = 0;
+    O_WRONLY7 = 1;
     O_RDWR6 = 2;
-    O_ACCMODE4 = 3;
+    O_ACCMODE5 = 3;
     O_DIRECTORY2 = 65536;
-    accessMode = (access) => access === "read" ? O_RDONLY : access === "write" ? O_WRONLY6 : O_RDWR6;
+    accessMode = (access) => access === "read" ? O_RDONLY2 : access === "write" ? O_WRONLY7 : O_RDWR6;
     PLACED = /* @__PURE__ */ new Set(["stream", "file", "socket", "clipboard", "sealed"]);
     GLUE_TRAILER = [
       "if (typeof ENV !== 'undefined') Object.assign(ENV, Module.sliccEnv);",
@@ -14704,12 +14858,12 @@ function unsupportedImport(module, memory, extended = false, foreign = {}) {
   const wasix = imports.some((i) => i.module === WASIX);
   const wasi = wasix || imports.some((i) => i.module === PREVIEW1);
   const scope2 = { extended, wasi, wasix, pie: dylinkInfo(module) !== void 0, memory };
-  const refused2 = imports.find((imp) => !accepted(imp, scope2));
-  if (refused2) {
-    if (refused2.kind === "memory" || refused2.module === "wasi") {
-      return `imports ${refused2.module}.${refused2.name}: no WASI program this host runs`;
+  const refused3 = imports.find((imp) => !accepted(imp, scope2));
+  if (refused3) {
+    if (refused3.kind === "memory" || refused3.module === "wasi") {
+      return `imports ${refused3.module}.${refused3.name}: no WASI program this host runs`;
     }
-    return `imports ${refused2.module}.${refused2.name}: no WASI preview1 program (an Emscripten one runs with its glue)`;
+    return `imports ${refused3.module}.${refused3.name}: no WASI preview1 program (an Emscripten one runs with its glue)`;
   }
   const unanswerable = extended ? void 0 : firstOther(foreign);
   if (unanswerable) return noErrno(unanswerable);
@@ -14770,7 +14924,7 @@ function fillMemory(memory, copy2) {
   if (pages2 > 0) memory.grow(pages2);
   new Uint8Array(memory.buffer).set(copy2);
 }
-function sizeOf(main) {
+function sizeOf2(main) {
   return () => main.memory?.buffer.byteLength ?? 0;
 }
 function memoryOf(instance, imported) {
@@ -14964,19 +15118,19 @@ async function runWasiProcess(init, port3) {
     call: kernelCall,
     say,
     gate
-  } = kernelOf(init, port3, signals, sizeOf(main));
+  } = kernelOf(init, port3, signals, sizeOf2(main));
   const id = identify(transport, init);
   const stats = init.env.SLICC_WASI_STATS === "1" ? new WasiStats() : void 0;
   const call2 = stats ? timedCalls(stats, kernelCall) : kernelCall;
   const { module } = init.program;
-  const refused2 = unsupportedImport(
+  const refused3 = unsupportedImport(
     module,
     init.program.memory,
     init.program.imports !== void 0,
     init.program.foreign
   );
-  if (refused2) {
-    say(refused2);
+  if (refused3) {
+    say(refused3);
     return 126;
   }
   const fork = init.fork?.wasi;
@@ -15017,7 +15171,7 @@ async function runWasiProcess(init, port3) {
   });
   restoreExportedMemory(instance, memory, init);
   main.memory = memoryOf(instance, memory);
-  publishMemory(init.sab, sizeOf(main)());
+  publishMemory(init.sab, sizeOf2(main)());
   signals.bind(instance.exports);
   if (importsSigactionHook(module)) signals.useHook();
   if (fork?.signals) signals.restore(fork.signals);
@@ -15361,17 +15515,17 @@ function processEntry(port3, run = runWasmProcess, wasi = loadWasi, js = loadJs,
     message: err instanceof Error ? err.stack ?? err.message : String(err),
     ...code2 === void 0 ? {} : { code: code2 }
   });
-  let refused2;
+  let refused3;
   const sealOnce = () => {
-    if (refused2 === void 0) {
+    if (refused3 === void 0) {
       try {
         seal();
-        refused2 = null;
+        refused3 = null;
       } catch (error) {
-        refused2 = { error };
+        refused3 = { error };
       }
     }
-    return refused2;
+    return refused3;
   };
   return (data) => {
     const type = data?.type;