@nimbus-sh/worker 0.12.0 → 0.13.0

package/dist/facets/manager.js

@@ -15,23 +15,25 @@
  * Long-running processes use a dynamic Worker entrypoint that stays
  * registered in ProcessTable and PortRegistry until exit or kill.
  */
-import { COMMONJS_CELL_IMPORTS, COMMONJS_CELL_RUNTIME_SOURCE, commonJsCellModuleName, commonJsCellReadsBack, commonJsEntryModuleName, declaresWrapperBinding, runtimeCodeModuleName, runtimeFunctionModule, wrapCommonJsCell, } from '@nimbus-sh/core/_shared/commonjs-cell.js';
+import { COMMONJS_CELL_IMPORTS, COMMONJS_CELL_RUNTIME_SOURCE, commonJsCellModuleName, commonJsCellReadsBack, commonJsEntryModuleName, declaresWrapperBinding, RUNTIME_INTERPRETER_MODULE, RUNTIME_INTERPRETER_OPS_MODULE, RUNTIME_INTERPRETER_PRIMORDIALS_MODULE, runtimeCodeModuleName, runtimeExpressionModule, runtimeFunctionModule, wrapCommonJsCell, } from '@nimbus-sh/core/_shared/commonjs-cell.js';
 import { ReadAheadBudget, STDIN_SYNC_READ_BYTES } from '@nimbus-sh/core/runtime/stdin-read.js';
+import { execIdField } from '@nimbus-sh/core/runtime/process-table.js';
 import { exitCodeForSignal } from '@nimbus-sh/core/substrate/lifo/shell/signals.js';
 import { fetchNodeFacetSources } from '../runtime/node-shims-artifact.js';
 import { generateSqliteFacetPreamble } from '../runtime/sqlite-shim.js';
 import { getRealNodeImportsCode } from '@nimbus-sh/core/_shared/real-node-imports.js';
 import { VFS_CURSOR_SEED_SOURCE, serializeFacetVfsCursor, } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
-import { stripLeadingSlashes, vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
+import { normalizeVfsPath, stripLeadingSlashes, vfsPathExtension } from '@nimbus-sh/core/vfs/path.js';
+import { direntTypeOf } from '@nimbus-sh/core/vfs/dirent-type.js';
 import { clearPortCapability, listPortReservations, readPortReservation, readPortReservationByOwner, releasePortReservation, restoreReservedPortCapability, } from '../session/port-capability.js';
 import { deriveResidentOwner } from './resident-identity.js';
 import { z } from 'zod/v4';
 import { RESIDENT_OWNER_KEY_PREFIX, DURABLE_IMAGES_KEY_PREFIX } from '../session/keys.js';
 import { PORT_CAPABILITY_KEY_PREFIX } from '../session/keys.js';
 import { sessionIdentity, unbindPublicPortCapability } from '../router/public-directory.js';
-import { prefetchForRequire, requireFsOverBridge, ClosureBoundExceededError } from '@nimbus-sh/core/runtime/require-resolver.js';
+import { prefetchForRequire, requireFsOverBridge, resolveDeferredImport, ClosureBoundExceededError, } from '@nimbus-sh/core/runtime/require-resolver.js';
 import { findStaticFsReferences } from '@nimbus-sh/core/runtime/static-fs-refs.js';
-import { planFacetData } from './data-plan.js';
+import { linkTargetOf, packageRootOf, planFacetData } from './data-plan.js';
 import { principalTag, profilePrincipal, ReadProfile, verifiedEvidence, } from './read-profile.js';
 /** What the shared read profile may add to one launch: an eighth of its module map's bytes. */
 const READ_PROFILE_LAUNCH_BYTES = Math.floor(VFS_BUNDLE_MAX_BYTES / 8);
@@ -49,6 +51,7 @@ import { DEFAULT_CJS_CONDITIONS, DEFAULT_ESM_CONDITIONS, resolvePackageEntry, pa
 import { isExecDiagEnabled, recordExecTelemetry } from './exec-telemetry.js';
 import { LaunchLearningStore } from './launch-learning-store.js';
 import { disposeRpcResource, disposeRpcResources } from '@nimbus-sh/platform/rpc-dispose.js';
+import { SUPERVISOR_ANSWERING_SRC } from '@nimbus-sh/core/runtime/supervisor-answering.generated.js';
 import { sqliteWasmModuleEntry } from './opencode-staging.js';
 import { FACET_IMAGE_WRITE_SLICE_BYTES, ImageStore, } from '@nimbus-sh/fabric/image-store.js';
 import { fetchStagedBindingAsset, NAPI_WASM_LOADER, NAPI_WASM_TRAMPOLINE, STAGED_BINDING_LOADER_MODULE, STAGED_BINDING_TRAMPOLINE_MODULE, stagedBinding, stagedBindingsFacetImport, stagedBindingsRequiredBy, } from '../runtime/staged-bindings.js';
@@ -69,6 +72,10 @@ import { supervisorBindingProps } from '@nimbus-sh/fabric/supervisor-props.js';
 import { streamedWasmImageDigest, wasmImageDigest } from './wasm-image-digest.js';
 import { prefetchBundleStart, prefetchBundleEnd, setPrefetchCacheBytes, } from '@nimbus-sh/platform/diag-counters.js';
 const launchAdapters = new WeakMap();
+/** The exact type of `entry` in `dir` on a launch's fs, lstat'ing it where its listing could not type it. */
+function launchEntryType(vfs, dir, entry) {
+    return direntTypeOf(entry, () => vfs.stat(`${dir}/${entry.name}`, { followSymlinks: false }));
+}
 function filesOf(fs) {
     let files = launchAdapters.get(fs);
     if (files === undefined) {
@@ -536,6 +543,19 @@ export function findInlineWasmImages(bundle) {
 const SQLITE_FACET_IMPORT = `import __nimbusSqliteWasmModule from "${SQLITE_WASM_MODULE_NAME}";\n` +
     `globalThis.__nimbusSqliteWasmModule = __nimbusSqliteWasmModule;\n` +
     generateSqliteFacetPreamble();
+/**
+ * The runtime-code interpreter, its primordials and its host module, in every
+ * launch's map: the primordials load at the launch's start, the other two
+ * only when the program first produces code no launch staged
+ * (core/_shared/commonjs-cell.ts, RUNTIME CODE).
+ */
+function interpreterModules(sources) {
+    return {
+        [RUNTIME_INTERPRETER_PRIMORDIALS_MODULE]: sources.interpreterPrimordials,
+        [RUNTIME_INTERPRETER_MODULE]: sources.interpreter,
+        [RUNTIME_INTERPRETER_OPS_MODULE]: sources.interpreterOps,
+    };
+}
 /**
  * The entry code as a module of the map, named for the script it came from so
  * its stack frames carry that path; `-e` code is `[eval]`. The runtime may
@@ -565,6 +585,9 @@ ${usesSqlite ? SQLITE_FACET_IMPORT : ''}
 ${stagedBindingsFacetImport(vfsState.stagedBindings)}
 ${facetWasmImportsSource(wasmImports)}
 const __NimbusHostResponse = globalThis.Response;
+// The SUPERVISOR binding's filesystem calls answer a refusal as a value
+// (core vfs-supervisor.ts answeringSupervisor).
+${SUPERVISOR_ANSWERING_SRC}
 
 // The process's code: a module per cell, compiled when first required.
 const __NIMBUS_CODE_CELLS = ${bundleSource.codeCells};
@@ -601,7 +624,7 @@ ${VFS_CURSOR_SEED_SOURCE}
     // ends it early.
     const __entryBudgetMs = Infinity;
     let __drainPasses = 0;
-    const __supervisor = workerEnv?.SUPERVISOR || null;
+    const __supervisor = workerEnv?.SUPERVISOR ? globalThis.__nimbusAnsweringSupervisor(workerEnv.SUPERVISOR) : null;
     // The same store, namespace and data plan a resident boots on, backed by
     // this run's heap (runOnce hosts no SQLite; vfs/facet-resident-store.ts).
     // Declared inside the request, beside the shims, so a loader that reuses
@@ -688,6 +711,7 @@ ${RESIDENCY_MISS_REPORT}
     } catch {}
 
     const mod = { exports: {} };
+    Object.defineProperty(mod, "__nimbusImportMeta", { value: __nimbusFileImportMeta(filename || "/home/user/script.js") });
     // G2 (runtime-pkg wave): see corresponding comment in NodeProcess.run.
     __require.main = mod;
     try {
@@ -706,7 +730,6 @@ ${RESIDENCY_MISS_REPORT}
     } catch (e) {
       if (e instanceof __ProcessExit) { exitCode = e.code; }
       else {
-        globalThis.__nimbusRuntimeCode.noteFailure(e);
         const trace = (e && e.stack) || (e && e.message) || String(e);
         stderr += trace + "\\n";
         exitCode = 1;
@@ -745,14 +768,6 @@ ${RESIDENCY_MISS_REPORT}
       if (exitCode === 0) exitCode = 1;
       if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __nimbusOutEnc.encode(__residencyReport));
     }
-    // A failed launch stages the Function-constructor text its failure is
-    // attributable to (commonjs-cell.ts, stageFailedLaunch).
-    const __stagedCode = exitCode !== 0 ? globalThis.__nimbusRuntimeCode.stageFailedLaunch() : "";
-    if (__stagedCode) {
-      stderr += __stagedCode + "\\n";
-      if (__supervisor && !captureOutput) __queueRpcWrite("stderr", __nimbusOutEnc.encode(__stagedCode + "\\n"));
-    }
-
     await __drainPendingIO();
 
     if (__supervisor) {
@@ -810,7 +825,7 @@ ${RESIDENCY_MISS_REPORT}
 };
 `,
         modules: bundleSource.modules,
-        codeModules: { ...bundleSource.codeModules, [entry.name]: entry.text },
+        codeModules: { ...bundleSource.codeModules, ...interpreterModules(sources), [entry.name]: entry.text },
     };
 }
 /**
@@ -905,6 +920,9 @@ ${stagedBindingsFacetImport(vfsState.stagedBindings)}
 ${facetWasmImportsSource(opts.wasmImports ?? [])}
 const __NIMBUS_ARGS = ${safeArgs};
 const __NimbusHostResponse = globalThis.Response;
+// The SUPERVISOR binding's filesystem calls answer a refusal as a value
+// (core vfs-supervisor.ts answeringSupervisor).
+${SUPERVISOR_ANSWERING_SRC}
 
 // The process's code: a module per cell, compiled when first required. The
 // only other way a string becomes code in a Worker is \`new Function\` at
@@ -1006,7 +1024,7 @@ async function __nimbusEnsureStarted(workerEnv, workerCtx, __startArgs) {
     // time. Same reason argv/env/pid want to move here.
     const __MODULE_VFS_CURSOR = (__startArgs && __startArgs.vfsCursor) || null;
 ${VFS_CURSOR_SEED_SOURCE}
-    const __supervisor = workerEnv?.SUPERVISOR || null;
+    const __supervisor = workerEnv?.SUPERVISOR ? globalThis.__nimbusAnsweringSupervisor(workerEnv.SUPERVISOR) : null;
     __nimbusRuntimeCodeReporter = () => {
       const report = __nimbusFlushRuntimeCode(__supervisor).catch(async (error) => {
         await __nimbusReportLearningFailure(__supervisor, error);
@@ -1138,6 +1156,7 @@ ${RESIDENCY_MISS_REPORT}
     }
 
     const mod = { exports: {} };
+    Object.defineProperty(mod, "__nimbusImportMeta", { value: __nimbusFileImportMeta(filename || "/home/user/script.js") });
     __require.main = mod;
     let __attachedCompletion = null;
     let __attachedExplicitExit = false;
@@ -1174,7 +1193,6 @@ ${RESIDENCY_MISS_REPORT}
         __attachedExplicitExit = true;
         exitCode = e.code;
       } else {
-        globalThis.__nimbusRuntimeCode.noteFailure(e);
         const trace = (e && e.stack) || (e && e.message) || String(e);
         stderr += trace + "\\n";
         exitCode = 1;
@@ -1210,13 +1228,6 @@ ${RESIDENCY_MISS_REPORT}
         if (Number(code ?? 0) === 0) code = 1;
         try { await __supervisor.stderr(__nimbusOutEnc.encode(__residencyReport)); } catch {}
       }
-      // A failed launch stages the Function-constructor text its failure is
-      // attributable to (commonjs-cell.ts, stageFailedLaunch).
-      const __stagedCode = Number(code ?? 0) !== 0 ? globalThis.__nimbusRuntimeCode.stageFailedLaunch() : "";
-      if (__stagedCode) {
-        stderr += __stagedCode + "\\n";
-        try { await __supervisor.stderr(__nimbusOutEnc.encode(__stagedCode + "\\n")); } catch {}
-      }
       await __supervisor.reportExit(code, reason || "", __nimbusDataReadMisses(), [...(globalThis.__nimbusProfileStaged || [])], __nimbusRuntimeCodeLedger(), __nimbusExecutedModuleMisses());
       __nimbusProcessExitReported = true;
     };
@@ -1336,7 +1347,7 @@ export class NimbusProcess extends DurableObject {
 }
 `,
         modules: bundleSource.modules,
-        codeModules: { ...bundleSource.codeModules, [entry.name]: entry.text },
+        codeModules: { ...bundleSource.codeModules, ...interpreterModules(sources), [entry.name]: entry.text },
     };
 }
 /**
@@ -2019,6 +2030,8 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
     if (!((await filesOf(vfs).exists(nmDir)) && (await filesOf(vfs).isDirectory(nmDir))))
         return { added, groups };
     const exts = ['', '.js', '.cjs', '.mjs', '/index.js', '/index.cjs'];
+    // What the admitted groups defer with `import()`; a group does not walk them.
+    const deferred = [];
     async function addOne(path) {
         const stripped = path.replace(/^\/+/, '');
         if ((isBundleModuleCandidate(stripped) || stripped.endsWith('.cjs')) && !isNativeBinPath(stripped)) {
@@ -2033,6 +2046,9 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
             });
             if ('kind' in closure || closure.bundle[stripped] === undefined)
                 return false;
+            for (const deferral of closure.deferred ?? [])
+                if (deferral.alternatives === 1)
+                    deferred.push(deferral);
             for (const [member, cell] of Object.entries(closure.bundle)) {
                 if (bundle[member] !== undefined)
                     continue;
@@ -2190,7 +2206,7 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
                 {
                     const sibs = await (async () => vfs.readdir(entryDir))().catch(() => []);
                     for (const sib of sibs) {
-                        if (sib.type !== 'file')
+                        if ((await launchEntryType(vfs, entryDir, sib)) !== 'file')
                             continue;
                         // Hash-chunk pattern: <name>.<hash>.<cjs|mjs|js>. Hash must
                         // be 6+ chars AND look like a hash, not an English word —
@@ -2218,7 +2234,7 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
                     const sharedStripped = sharedDir.replace(/^\/+/, '');
                     if (await (async () => filesOf(vfs).isDirectory(sharedStripped))().catch(() => false)) {
                         for (const sh of await (async () => vfs.readdir(sharedDir))().catch(() => [])) {
-                            if (sh.type !== 'file')
+                            if ((await launchEntryType(vfs, sharedDir, sh)) !== 'file')
                                 continue;
                             if (!/\.(cjs|mjs|js)$/.test(sh.name))
                                 continue;
@@ -2232,6 +2248,28 @@ export async function greedyAddMainEntries(vfs, cwd, bundle, budgetState, requir
     }
     for (const pkgDir of (await speculativePackageDirs(vfs, cwdStripped, bundle)))
         (await addPkgEntry(pkgDir));
+    // Then the one `import()` a guessed module defers, when it defers only one
+    // and it is a file of its own package, as a guess of its own with its static
+    // closure; what that defers joins the queue. That is how a package proxies
+    // or splits its own code, and it loads whenever the deferring code runs:
+    // vinext imports @vitejs/plugin-rsc by a computed URL (a guess here, as a
+    // project dependency); plugin-rsc imports vitefu, whose CommonJS entry loads
+    // its ESM build with `import('./index.js')`. A module that defers several
+    // chooses among them, and a deferral of another package is an optional
+    // dependency (@vercel/og's `import("sharp")`, caught when absent, whose
+    // 9.2 MB wasm image the launch would compile): a guess does not guess those.
+    const followed = new Set();
+    for (let i = 0; i < deferred.length; i++) {
+        if (rawBytes >= bound || budgetState.fileCount >= VFS_BUNDLE_MAX_FILES)
+            break;
+        const target = await resolveDeferredImport(requireFsOverBridge(vfs), deferred[i], options.pacer?.spend.bind(options.pacer));
+        // Its own package: where the deferral lands, not how it is spelled.
+        const own = packageRootOf(deferred[i].fromDir.replace(/^\/+/, '') + '/_');
+        if (target === null || own === null || packageRootOf(target) !== own || followed.has(target))
+            continue;
+        followed.add(target);
+        await addOne(target);
+    }
     return { added, groups };
 }
 /**
@@ -2760,7 +2798,7 @@ export async function addBinTargetSiblings(vfs, scriptPath, bundle, budgetState,
             if (e.name === '.git')
                 continue;
             const child = dir + '/' + e.name;
-            if (e.type === 'directory') {
+            if ((await launchEntryType(vfs, dir, e)) === 'directory') {
                 if (!shouldVisitBinPackageDirectory(pkgRoot, child, bundleProfile))
                     continue;
                 queue.push(child);
@@ -3120,10 +3158,11 @@ async function addCwdProjectFiles(vfs, cwd, bundle, budgetState) {
             visited++;
             if (e.name === '.' || e.name === '..')
                 continue;
-            if (e.type === 'directory' && SKIP_DIRS.has(e.name))
+            const isDirectory = (await launchEntryType(vfs, dir, e)) === 'directory';
+            if (isDirectory && SKIP_DIRS.has(e.name))
                 continue;
             const child = dir + '/' + e.name;
-            if (e.type === 'directory') {
+            if (isDirectory) {
                 queue.push(child);
                 continue;
             }
@@ -3316,6 +3355,61 @@ async function transformEsmInBundle(bundle, emits, lowered, esbuild, pacer, stor
             lowered.add(path);
     });
 }
+/** A tool's config file: `<tool>.config.js|ts|mjs|cjs|mts|cts` (vite.config.ts, astro.config.mjs). */
+const TOOL_CONFIG = /^(.+)\.config\.(?:c|m)?(?:j|t)s$/;
+/**
+ * The working dir's config files of the tool a launch runs. The tool
+ * executes them (Vite bundles vite.config.ts and imports the result), so
+ * what they import is code that nothing in the program's own graph names,
+ * and a first run would miss it. They are optional roots: a command may
+ * never read its config (`vite --version`), so a config graph past the
+ * map's bound is cut, never a refusal. A config is the tool's when it is
+ * named for the launched package or a package that one depends on (Astro
+ * runs Vite, Vite runs PostCSS); a config of a tool the launch does not run
+ * (eslint.config.js beside Vite) is not. What a config names by a string
+ * (PostCSS's plugins) the tool loads by name: those join the walk's phase 2.
+ */
+export async function toolConfigRoots(vfs, cwd, scriptPath) {
+    if (scriptPath === undefined)
+        return [];
+    // A bin is usually launched by its node_modules/.bin link.
+    let script;
+    try {
+        script = await vfs.realpath(scriptPath);
+    }
+    catch {
+        return [];
+    }
+    const root = packageRootOf(script.replace(/^\/+/, ''));
+    if (root === null)
+        return [];
+    let manifest;
+    try {
+        manifest = JSON.parse(await filesOf(vfs).readFileString(root + '/package.json'));
+    }
+    catch {
+        return [];
+    }
+    const tools = new Set(typeof manifest.name === 'string' ? [manifest.name] : []);
+    for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies']) {
+        const named = manifest[field];
+        if (named && typeof named === 'object')
+            for (const name of Object.keys(named))
+                tools.add(name);
+    }
+    let entries;
+    try {
+        entries = await vfs.readdir(cwd);
+    }
+    catch {
+        return [];
+    }
+    const dir = cwd.replace(/^\/+/, '').replace(/\/+$/, '');
+    return entries.flatMap((entry) => {
+        const tool = entry.type === 'file' ? TOOL_CONFIG.exec(entry.name)?.[1] : undefined;
+        return tool !== undefined && tools.has(tool) ? [{ path: (dir ? dir + '/' : '') + entry.name, config: true }] : [];
+    });
+}
 /**
  * W2.6a: build the prefetch bundle for FacetManager.exec.
  *
@@ -3360,8 +3454,10 @@ async function _buildPrefetchBundle(vfs, { scriptPath, cwd, entryCode, esbuild,
     // executable map. A module that arrives with its text (Vite unlinks its
     // temporary config after loading it) is walked from that text. Files runs
     // only READ are observed reads below: data, never roots, whatever their
-    // extension (Tailwind scans .js/.ts content files as text).
-    const prefetch = (await prefetchForRequire(requireFsOverBridge(vfs), entryCode || '', cwd, scriptPath, maxBundleBytes, pacer?.spend.bind(pacer), undefined, executedModules && executedModules.length > 0 ? executedModules : undefined));
+    // extension (Tailwind scans .js/.ts content files as text). The tool's
+    // configs ride along, as optional roots (RequiredModuleRoot.config).
+    const requiredRoots = [...await toolConfigRoots(vfs, cwd, scriptPath), ...executedModules ?? []];
+    const prefetch = (await prefetchForRequire(requireFsOverBridge(vfs), entryCode || '', cwd, scriptPath, maxBundleBytes, pacer?.spend.bind(pacer), undefined, requiredRoots.length > 0 ? requiredRoots : undefined));
     if ('kind' in prefetch) {
         // A required closure larger than the bound can never launch as a
         // snapshot. Surface it as the process's own failure rather than a
@@ -3772,9 +3868,10 @@ export class FacetManager {
     /** Per resident pid: the shared read profile's entries its launch staged, settled at its exit. */
     residentProfileOffers = new Map();
     /**
-     * The esbuild the bundle's ESM→CJS pass transforms with. composeFacetManager
+     * The service the bundle's ESM→CJS pass transforms with. composeFacetManager
      * sets it: the host's own, or one whose transforms run in the session's
-     * esbuild facet. Never one of this isolate: esbuild-wasm's heap only grows.
+     * transform facet. Never one of this isolate: a transform engine's wasm
+     * memory only grows.
      */
     esbuild = null;
     /**
@@ -3879,8 +3976,11 @@ export class FacetManager {
                 + `"${record.command}" was ${residentLaunchDoing(record)} — restarting it]\x1b[0m\r\n`),
             onAbandoned: (record) => this.hooks.notify?.('\x1b[2m[nimbus: the session restarted again while '
                 + `"${record.command}" was ${residentLaunchDoing(record)} — leaving it stopped]\x1b[0m\r\n`),
-            onRedriveFailed: (record, e) => this.hooks.notify?.(`\x1b[2m[nimbus: "${record.command}" could not be restarted: `
-                + `${errorMessage(e)}]\x1b[0m\r\n`),
+            onRedriveFailed: (record, e) => {
+                console.warn(`[facet-manager] resident pid ${record.pid} ("${record.command}") not re-driven: ${errorMessage(e)}`);
+                this.hooks.notify?.(`\x1b[2m[nimbus: "${record.command}" could not be restarted: `
+                    + `${errorMessage(e)}]\x1b[0m\r\n`);
+            },
         });
         this.launchPump = new PacedWork(ctx, {
             requestTurn: hooks.requestLaunchTurn?.bind(hooks),
@@ -4064,7 +4164,7 @@ export class FacetManager {
      * The entry script as the facet compiles it: each dynamic `import()` routed
      * to the process's ESM loader, with the entry's own URL as the parent (Node
      * names `-e` code `<cwd>/[eval]` and stdin `<cwd>/[stdin]`). The parse runs
-     * in the esbuild facet like every cell's, and its result is kept by content
+     * in the transform facet like every cell's, and its result is kept by content
      * in the session's transform store. The module-map walk reads the script as
      * written, before this.
      */
@@ -4316,15 +4416,7 @@ export class FacetManager {
                     return null;
                 }
             },
-            // A missing or unreadable component is not a link: the lookup ends there.
-            readlink: async (path) => {
-                try {
-                    return await vfs.readlink(path);
-                }
-                catch {
-                    return null;
-                }
-            },
+            linkTarget: (path) => linkTargetOf(vfs, path),
             stat: async (path) => {
                 const st = await filesOf(vfs).stat(path).catch(() => null);
                 return st && { kind: st.type, size: st.size };
@@ -4349,6 +4441,49 @@ export class FacetManager {
         const storageBytes = Math.ceil(plan.bytes * 1.01) + rows * LEDGER_ROW_BYTES + moduleBytes + 65_536;
         return { paths: plan.paths, storageBytes };
     }
+    /**
+     * A one-shot's data plan: what its closure reads synchronously by a path its
+     * code spells out (static-fs-refs.ts; readFileSync, or a read-only openSync),
+     * any size, through any links on it, that the module map does not hold. It
+     * is data-plan.ts's `static` rule for synchronous reads, which needs the
+     * closure and a stat per path but no listing. The store fetches it at boot,
+     * so it is held beside the module map rather than carried in it: `vite
+     * build` reads lightningcss's 15.8 MB image with readFileSync(new
+     * URL('lightningcss_node.wasm', import.meta.url)), which as a map cell
+     * left the closure no room under the map's bound.
+     */
+    async _staticReadPlan(entry, vfsState, cwd, pacer) {
+        if (!this.filesystem)
+            return [];
+        const vfs = this.filesystem.bind({ pid: entry.pid, cred: entry.cred });
+        const held = new Set(vfsState.bundlePaths ?? []);
+        const dir = stripLeadingSlashes(cwd).replace(/\/+$/, '');
+        const reads = new Set();
+        for (const refs of await this._closureStaticRefs(vfs, vfsState.bundlePaths ?? [], pacer)) {
+            for (const ref of refs.exact)
+                if (ref.sync)
+                    reads.add(stripLeadingSlashes(ref.path));
+            for (const ref of refs.cwdRelative)
+                if (ref.sync)
+                    reads.add(normalizeVfsPath((dir ? dir + '/' : '') + ref.path));
+        }
+        const plan = new Set();
+        for (const path of reads) {
+            let target;
+            try {
+                target = stripLeadingSlashes(await vfs.realpath('/' + path));
+            }
+            catch {
+                continue;
+            }
+            if (held.has(target))
+                continue;
+            const stat = await filesOf(vfs).stat(target).catch(() => null);
+            if (stat?.type === 'file')
+                plan.add(target);
+        }
+        return [...plan];
+    }
     /**
      * Paths earlier launches of the same build missed in this session. Other
      * sessions' misses (the shared read profile) join the module map instead,
@@ -4652,6 +4787,10 @@ export class FacetManager {
     async _stagedRuntimeCode(learning, pacer) {
         const modules = new Map();
         for (const [codeKey, entry] of learning.code) {
+            if (entry.kind === 'expression') {
+                modules.set(codeKey, runtimeExpressionModule(entry.code));
+                continue;
+            }
             if (entry.kind !== 'module') {
                 modules.set(codeKey, runtimeFunctionModule(entry.kind, entry.params, entry.body));
                 continue;
@@ -4849,8 +4988,12 @@ export class FacetManager {
             entry = found;
         }
         else {
-            this.processes.reap();
-            entry = this.processes.spawn(command, opts.argv || [], opts.cwd || '/home/user');
+            await this.processes.reap();
+            // A child of the command that ran it, so under its credential: the
+            // program's syscalls answer under the credential the table holds for
+            // its pid. At the top of the table it ran as the session user whoever
+            // started it.
+            entry = this.processes.spawn(command, opts.argv || [], opts.cwd || '/home/user', { parentPid: opts.invokerPid });
             // Short foreground `node -e ...` helpers are quiet by design — only
             // notify for user-facing `node <file>` invocations, which covers the
             // real user intent (running scripts, wrangler, etc.).
@@ -4928,10 +5071,12 @@ export class FacetManager {
         opts.signal?.addEventListener('abort', onShellAbort, { once: true });
         try {
             // A one-shot holds its module map and what it was seen to read (both in
-            // the bundle), and plans nothing beyond them: a data plan is chosen from
-            // a listing of the namespace, and a one-shot takes no listing of its own
-            // (§2.8: the principal's image is where that comes from).
-            const result = await this._execViaLoader(code, opts, entry, vfsState, [], abortController.signal, pacer, diagSink);
+            // the bundle), and plans no listing of the namespace (§2.8: the
+            // principal's image is where that comes from). What its closure reads
+            // synchronously by a path its code spells out needs no listing, and is
+            // its data plan.
+            const dataPlan = await this._staticReadPlan(entry, vfsState, cwd, pacer);
+            const result = await this._execViaLoader(code, opts, entry, vfsState, dataPlan, abortController.signal, pacer, diagSink);
             await this._recordLaunchLearning(vfsState.bundleKey, {
                 code: result.runtimeCode, executedModules: result.moduleMisses, dataReads: result.residencyMisses,
             }).catch((error) => this._learningLost(entry.pid, error));
@@ -5252,7 +5397,7 @@ export class FacetManager {
         }
         const command = opts.command || `opencode ${opts.argv.join(' ')}`.trim();
         const attached = mode === 'attached';
-        const entry = this.processes.spawn(command, ['opencode', ...opts.argv], opts.cwd);
+        const entry = this.processes.spawn(command, ['opencode', ...opts.argv], opts.cwd, { parentPid: opts.invokerPid });
         const pid = entry.pid;
         // attached TUI + headless serve are resident long-running processes; only the
         // attached TUI grabs the terminal (raw-mode stdin + live geometry).
@@ -5400,6 +5545,7 @@ export class FacetManager {
             env: opts.env,
             cwd: opts.cwd,
             command: `opencode serve --port ${port}`,
+            invokerPid: opts.invokerPid,
         }, 'server');
         const servePid = serveStaged.pid;
         try {
@@ -5425,6 +5571,9 @@ export class FacetManager {
                 stdin: '',
                 command: opts.command || 'opencode',
                 attachedTty: true,
+                // The pair's exec id, from the serve: the command that ran `opencode`
+                // may have ended while the serve booted, and been reaped since.
+                invokerPid: servePid,
             });
         }
         catch (e) {
@@ -5732,14 +5881,20 @@ export class FacetManager {
     }
     /**
      * Re-drive a journalled launch after an instance reset. What the journal
-     * row carries is the recipe and nothing else: env and credentials are never
-     * written to storage, so a worker launch's are re-resolved by the embedder
-     * through `hooks.resolveWorkerLaunch`.
+     * row carries is the recipe, and who the launch ran as (its credential and
+     * exec id); env and secrets are never written to storage, so a worker
+     * launch's are re-resolved by the embedder through
+     * `hooks.resolveWorkerLaunch`.
      */
     async _redrive(record, attempt) {
         const { recipe } = record;
+        if (record.cred === undefined) {
+            // Reported through onRedriveFailed, and the row is superseded.
+            throw new Error('its journal entry predates the credential a re-drive runs under, so it is not started as anyone else');
+        }
+        const identity = { cred: record.cred, ...(record.execId === undefined ? {} : { execId: record.execId }) };
         switch (recipe.kind) {
-            case 'node': return this._spawnResident(recipe.code, recipe.opts, attempt);
+            case 'node': return this._spawnResident(recipe.code, recipe.opts, attempt, identity);
             case 'worker': {
                 // Which resolver a worker recipe re-drives through is decided by
                 // `recipe.resident`, and it is not a flag: it is the interpreter
@@ -5771,7 +5926,7 @@ export class FacetManager {
                     vfsTextModules: resolved.vfsTextModules,
                     mainModule,
                     durable: { owner: residentOwner(record) ?? recipe.owner, image: recipe.image },
-                }, attempt);
+                }, attempt, identity);
             }
         }
     }
@@ -5792,10 +5947,12 @@ export class FacetManager {
     /**
      * `attempt` distinguishes the launch the user asked for from the one re-drive
      * an instance reset earns it, and is carried in the journal rather than in
-     * the caller's options because no caller has an opinion about it.
+     * the caller's options because no caller has an opinion about it. So is a
+     * re-drive's credential and exec id, from the row: the process that invoked
+     * the launch went with the instance.
      */
-    async _spawnResident(code, opts, attempt) {
-        this.processes.reap();
+    async _spawnResident(code, opts, attempt, redriven) {
+        await this.processes.reap();
         const command = opts.command || (opts.filename ? `node ${opts.filename}` : 'node <script>');
         const cwd = opts.cwd || '/home/user';
         let entry;
@@ -5807,7 +5964,9 @@ export class FacetManager {
             entry = found;
         }
         else {
-            entry = this.processes.spawn(command, opts.argv || [], cwd);
+            // A child of its invoker, under its credential, as exec's. A re-drive has
+            // no invoker (the journal never holds one): it runs as the row says.
+            entry = this.processes.spawn(command, opts.argv || [], cwd, { parentPid: opts.invokerPid, ...redriven });
         }
         this.processes.setLongRunning(entry.pid);
         if (opts.attachedTty)
@@ -5888,10 +6047,16 @@ export class FacetManager {
                 owner = declared.owner;
             }
         }
+        // The recipe is the launch's inputs; the invoker is a pid of this
+        // instance, which a re-drive outlives, so the row carries who it ran as.
+        const { invokerPid: _invokerPid, ...inputs } = opts;
+        const recipe = { kind: 'node', code, opts: { ...inputs, skipSpawn: undefined, callerPid: undefined } };
+        const ranAs = { cred: entry.cred, ...(entry.execId === undefined ? {} : { execId: entry.execId }) };
         const initial = {
             pid: entry.pid, command, attempt, phase: 'starting', owner,
-            recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
+            recipe,
             restart: residentRestartPolicy(opts.env),
+            ...ranAs,
         };
         let duplicateOf;
         try {
@@ -5930,10 +6095,11 @@ export class FacetManager {
             command,
             attempt,
             phase: 'starting',
-            recipe: { kind: 'node', code, opts: { ...opts, skipSpawn: undefined, callerPid: undefined } },
+            recipe,
             owner,
             ...(held !== null ? { port: held.port, injectedPort: held.port } : {}),
             restart: residentRestartPolicy(opts.env),
+            ...ranAs,
         };
         try {
             if (!ephemeral)
@@ -6236,15 +6402,15 @@ export class FacetManager {
     async spawnWorker(workerCode, command, cwd, opts = {}) {
         return this._spawnWorker(workerCode, command, cwd, opts, 0);
     }
-    /** `attempt` is the journal's re-drive budget, as `_spawnResident` carries it. */
-    async _spawnWorker(workerCode, command, cwd, opts, attempt) {
+    /** `attempt` is the journal's re-drive budget, and `redriven` who a re-drive runs as, as `_spawnResident` carries them. */
+    async _spawnWorker(workerCode, command, cwd, opts, attempt, redriven) {
         if (opts.resident && !opts.durable) {
             opts = { ...opts, durable: { owner: await deriveResidentOwner(cwd, opts.resident.argv) } };
         }
-        this.processes.reap();
+        await this.processes.reap();
         // The table entry carries the same argv the identity is derived from, so
         // a runtime resident reads the same way through either path.
-        const entry = this.processes.spawn(command, opts.resident?.argv ?? [], cwd);
+        const entry = this.processes.spawn(command, opts.resident?.argv ?? [], cwd, { parentPid: opts.invokerPid, ...redriven });
         // Stamp the process-table entry so /api/processes exposes this as a
         // long-running process.
         this.processes.setLongRunning(entry.pid);
@@ -6334,6 +6500,8 @@ export class FacetManager {
                     owner: opts.durable.owner,
                     restart: opts.restart ?? 'never',
                     ...(opts.port !== undefined && opts.port > 0 ? { port: opts.port } : {}),
+                    cred: entry.cred,
+                    ...(entry.execId !== undefined ? { execId: entry.execId } : {}),
                 };
                 // The durable facet name is claimed once, ever, from DO storage — a
                 // re-drive after a reset, an eviction's re-attach and a relaunch all
@@ -6674,7 +6842,8 @@ export class FacetManager {
                 app.status = 'running';
             apps.set(identity.owner, app);
         }
-        return [...apps.values()];
+        // The live pid's exec id, read from its process: the one place it lives.
+        return [...apps.values()].map((app) => (app.pid === null ? app : { ...app, ...execIdField(this.processes.get(app.pid)) }));
     }
     async registerPort(pid, port) {
         if (port > 0 && port < 65536) {