buninu-linux 0.10.56 → 0.11.56

package/NOTICE.md

@@ -284,8 +284,9 @@ committed source files, but their contents are redistributed in the image.
 
 | Package | Version | Package license | Project / package page | Installed license and notices (relative to `/usr/lib/node_modules/`) |
 |---|---|---|---|---|
-| `buninu-browser` | 0.2.2 | MIT for the browser's own code; bundled components retain their own terms | https://github.com/jjtseng93/buninu-browser | `buninu-browser/LICENSE`, `THIRD_PARTY_NOTICES.md`, `LICENSES/` and vendor notices within that package |
-| `@drxiaozhi/casty` | 1.3.4 | MIT | https://github.com/jjtseng93/casty | `@drxiaozhi/casty/LICENSE` |
+| `buninu-browser` | 0.2.3 | MIT for the browser's own code; bundled components retain their own terms | https://github.com/jjtseng93/buninu-browser | `buninu-browser/LICENSE`, `THIRD_PARTY_NOTICES.md`, `LICENSES/` and vendor notices within that package |
+| `buninu-land` | 0.1.2 | MIT for its own code; bundled components retain their own terms | https://github.com/jjtseng93/buninu-land | `buninu-land/LICENSE`, `THIRD_PARTY_NOTICES.md`, `LICENSES/`, `SOURCES.md`, protocol XML notices and vendor notices |
+| `@drxiaozhi/casty` | 1.3.6 | MIT | https://github.com/jjtseng93/casty | `@drxiaozhi/casty/LICENSE` |
 | `@drxiaozhi/jspulse` | 0.2.1 | LGPL-2.1-or-later, with additional component notices | https://github.com/jjtseng93/jspulse | `@drxiaozhi/jspulse/LICENSE`, `NOTICE.md`, `LICENSES/` and source-file notices within that package |
 | `@drxiaozhi/jspinyin` | 0.1.1 | MIT; hanzipinyin material under the Unlicense | https://www.npmjs.com/package/@drxiaozhi/jspinyin | `@drxiaozhi/jspinyin/LICENSE` and `@drxiaozhi/jspinyin/LICENSE-hanzipinyin.md` |
 
@@ -317,6 +318,17 @@ LGPL-2.1-or-later. Within `/usr/lib/node_modules/buninu-browser/`, retain:
 The decoder's `cpu.wasm` remains a separate, replaceable file. Do not remove
 the source archive or rebuild material merely to reduce the image size.
 
+### Buninu Land
+
+The compositor package is extracted in full, including its CanvasKit WASM,
+loader, protocol XML, source provenance, patches and license collection.
+Retain `THIRD_PARTY_NOTICES.md`, `SOURCES.md`, `vendor-manifest.json`,
+`LICENSES/`, `vendor/canvaskit/LICENSE`, and the notices embedded in the
+Wayland protocol XML files. These cover Buninu Browser-derived code,
+CanvasKit/Skia and embedded libraries, Wayland protocols, and the Hyprland
+window-management/input reference credit (`LICENSES/hyprland.txt`).
+The distribution-owned launcher uses the separately bundled Casty package.
+
 ### jspulse source and notices
 
 jspulse is shipped as JavaScript source, with its LGPL license, modification

package/README.md

@@ -689,6 +689,7 @@ If there is no sound, check step 4's terminal for errors, and make sure
 | --- | --- | --- |
 | `buninu-linux-help` | render this buninu-linux README from `/usr/share/doc/buninu-linux/README.md` | `buninu-linux-help` |
 | `buninu-browser` | early-stage, experimental JavaScript/WASM browser with the bundled casty terminal frontend; not yet a general-purpose browser replacement | `buninu-browser --help` |
+| `buninu-land` | experimental software-rendered Wayland compositor with the bundled casty terminal frontend | `buninu-land --help` |
 | `jspulse` | PulseAudio-compatible audio server and ALSA mixer controls; use `--alsa` on Buninu Linux | `jspulse --help` |
 | `jspinyin` | Chinese pinyin input panel, opened with the system jsmdcui in TUI mode; not a system-wide input method | — |
 | `mount` | `mount(2)` with type detection, `-o` parsing, `LABEL=`/`UUID=`, bind/move/remount; loads required filesystem and disk modules | `mount --help` → `/usr/share/doc/buninu-linux/mount.md` |
@@ -707,7 +708,7 @@ If there is no sound, check step 4's terminal for errors, and make sure
 | `mmd`, `mcopy`, `mdir` | create directories, copy files and list contents in a FAT image without mounting it; use `-i IMAGE` and `::/path` | — |
 | `parted` | create and inspect GPT partitions in a disk image; script-mode subset | `parted --help` |
 | `stripansi` | remove ANSI escape sequences from stdin, `-`, or one or more files and concatenate the results | — |
-| `chroot` | `chroot(2)` into another root directory, mounting `/proc`, `/sys`, `/dev`, `/dev/pts`, `/run`, `/tmp` and `/etc/resolv.conf` for you and unmounting them afterwards | `chroot --help` |
+| `chroot` | `chroot(2)` into another root directory, mounting `/proc`, `/sys`, `/dev`, `/dev/pts`, `/run`, `/tmp` and `/etc/resolv.conf` for you; supports `-b HOST[:GUEST]` and `--shared-tmp`, with automatic cleanup on exit | `chroot --help` |
 | `bunterm` | a graphical terminal on the framebuffer: Skia (CanvasKit) text with CJK, colour emoji, seamless box drawing, kitty graphics images, with the mouse working, wheel scrollback included (`--no-mouse` turns it off); xterm.js's emulator core over Bun's built-in PTY | `bunterm --help` |
 
 Besides `bun` (and `sh`/`node` pointing at it), `/bin` includes the commands
@@ -738,6 +739,32 @@ REPL, then run `jspulse --alsa` in another terminal or use `jspulse --alsa &` to
 buninu-browser about:audio
 ```
 
+### Buninu Land (early-stage, experimental)
+
+Run `buninu-land` inside `bunterm` (or another Kitty-graphics terminal) to
+open the Wayland desktop. The compositor and Casty are bundled; startup
+requires no npm download.
+
+```sh
+buninu-land
+```
+
+The socket directory defaults to `$TMPDIR`, or the system temporary directory
+if `TMPDIR` is unset; an explicitly set `XDG_RUNTIME_DIR` takes precedence.
+No environment setup is needed to launch the compositor.
+
+In another terminal, set the Wayland client's `XDG_RUNTIME_DIR` to that socket
+directory and `WAYLAND_DISPLAY` to the compositor's socket name (normally `wayland-buninu`;
+additional instances use `wayland-buninu1`, `wayland-buninu2`, and so on),
+then start a Wayland client. Clients inside a chroot can share the socket
+with `chroot --shared-tmp` when the host's `TMPDIR` points to that directory.
+
+The `/bin/buninu-land` launcher sets `CASTY_BROWSER` to
+`/usr/lib/node_modules/buninu-land/compositor.js` and runs the bundled Casty.
+`--casty` forwards arguments to Casty; `--headless`, `--help`, `--version`,
+README options and reserved native frontends go through the package entry.
+The package's CanvasKit WASM and license files are retained unchanged.
+
 ### Archive tools and other examples
 
 The small `tar` reads the archive's own headers for links and listing, so
@@ -872,9 +899,45 @@ apk add libgcc libstdc++
 # and /etc/resolv.conf are mounted for you and removed again on exit
 chroot /mnt
 chroot /mnt /bin/bun --version
-chroot -n /mnt /bin/sh        # traditional: mount nothing
+chroot -n /mnt /bin/sh        # skip automatic mounts (explicit -b still applies)
 ```
 
+
+Share host files and directories with repeatable `-b` options, placed before
+the root filesystem path:
+
+```sh
+# Mount a host directory at a different path inside the guest
+chroot -b /home/user/project:/work /mnt /bin/sh
+
+# Omit the guest path to expose the same absolute path inside the guest
+chroot -b /home/user/project /mnt /bin/sh
+
+# Share multiple paths, including individual files
+chroot -b /home/user/project:/work -b /etc/hosts:/etc/hosts /mnt /bin/sh
+
+# Share the host temporary directory, including Wayland sockets
+export TMPDIR=/tmp
+chroot --shared-tmp /mnt /bin/sh
+# Equivalent to:
+chroot -b "$TMPDIR:/tmp" /mnt /bin/sh
+```
+
+`--shared-tmp` expands to `-b "$TMPDIR:/tmp"` and replaces the automatic
+`/tmp` tmpfs. `TMPDIR` must be set and its source path must exist. The option
+does not rewrite environment variables inside the guest; set `TMPDIR=/tmp`
+there if the host uses a different path. For Buninu Land clients, set the
+guest's `XDG_RUNTIME_DIR=/tmp` and `WAYLAND_DISPLAY` to the compositor's socket
+name, and ensure the host's `TMPDIR` is the directory containing that socket.
+
+Host paths may be relative; guest paths must be absolute. Missing guest
+mount destinations are created. Directories are bound recursively, and a
+repeated destination uses the last argument. Bind failures abort setup and
+clean up its mounts, even with `-k`. Normally mounts are removed when the
+command exits; `-k` / `--keep-mounts` keeps them after a successful setup.
+Use `-v` to report mounts and unmounts. Full details: `chroot --help` or the
+[chroot manual](initramfs/usr/share/doc/buninu-linux/chroot.md).
+
 ## Environment and dependencies
 
 The default JS build uses host Bun. The native build-tool dependencies below
@@ -1101,7 +1164,7 @@ index.js                  entry point: -f / -b / -r / --arch / --docker / --expo
 Dockerfile                Debian-based oven/bun:1.4.2 plus the shell build toolchain
 fetch-alpine.sh           [fetch]  kernel, EFI stub, musl, network/input/display modules
 fetch-bun.sh              [fetch]  Bun, libstdc++, libgcc
-fetch-npm.sh              [fetch]  pinned browser, casty, jspulse and jspinyin tarballs (download only)
+fetch-npm.sh              [fetch]  pinned browser, land, casty, jspulse and jspinyin tarballs (download only)
 build-uki.sh              [build]  UKI; calls scripts/pack-initramfs.sh
 build-image.sh            [build]  GPT disk image; shared with the hello-world EFI
 run-qemu.sh               [run]    QEMU q35 (x86_64) or virt (aarch64), KVM/HVF/TCG
@@ -1129,11 +1192,12 @@ tampered with is fetched again and has to pass the same hash before a script
 extracts from it. Bumping a version changes both the file name and the hash, so
 it always refetches.
 
-The four application packages are pinned separately in
-`scripts/npm-packages.md`: `buninu-browser@0.2.3`,
-`@drxiaozhi/casty@1.3.4`, `@drxiaozhi/jspulse@0.2.1`, and
+The five application packages are pinned separately in
+`scripts/npm-packages.md`: `buninu-browser@0.2.3`, `buninu-land@0.1.2`,
+`@drxiaozhi/casty@1.3.6`, `@drxiaozhi/jspulse@0.2.1`, and
 `@drxiaozhi/jspinyin@0.1.1`. These were npm's `latest` versions when checked
-on 2026-10-11, with buninu-browser updated to npm's `latest` on 2026-10-12;
+on 2026-10-11, with buninu-browser updated on 2026-10-12, and
+casty 1.3.6 and buninu-land 0.1.2 verified on 2026-10-16;
 fetch never resolves `latest` or a version range at runtime.
 Each registry tarball was checked against its published SHA-512 integrity
 before its SHA-256 was recorded in the shared pins file.
@@ -1159,7 +1223,7 @@ dependency resolution run. JS extraction uses the initramfs JS `tar` and
 requires a host Bun; shell/Docker extraction uses the host `tar`, without Bun.
 The source `initramfs/` and project `package.json` are not modified by packing.
 
-The image gets `/usr/lib/package.json` with the four exact dependencies and
+The image gets `/usr/lib/package.json` with the five exact dependencies and
 standard `node_modules/.bin` links. This reserves a normal package-manager
 layout for later `cd /usr/lib` and `bun i --backend=copyfile`; no lockfile is
 fabricated. `bun i` alone retains the pinned versions, not newer releases.
@@ -1556,6 +1620,7 @@ for the userspace session.
   * [Playing YouTube with sound (experimental)](#playing-youtube-with-sound-experimental)
 - [Commands inside /bin](#commands-inside-bin)
   * [Buninu Browser (early-stage, experimental)](#buninu-browser-early-stage-experimental)
+  * [Buninu Land (early-stage, experimental)](#buninu-land-early-stage-experimental)
   * [Archive tools and other examples](#archive-tools-and-other-examples)
 - [Optional chroot and native binaries](#optional-chroot-and-native-binaries)
   * [Debian and Chromium with casty](#debian-and-chromium-with-casty)
@@ -1609,8 +1674,8 @@ architecture under `native/<arch>/lib/`, and the built image redistributes
 several more. Each stays
 under its own terms, with platform license texts in [`LICENSES/`](LICENSES/).
 
-The build also fetches four SHA-256-pinned npm releases and redistributes
-them under `/usr/lib/node_modules`: `buninu-browser`, `@drxiaozhi/casty`,
+The build also fetches five SHA-256-pinned npm releases and redistributes
+them under `/usr/lib/node_modules`: `buninu-browser`, `buninu-land`, `@drxiaozhi/casty`,
 `@drxiaozhi/jspulse` and `@drxiaozhi/jspinyin`. Their license and notice files
 remain inside their package directories. Exact download URLs and hashes are
 in [`scripts/npm-packages.md`](scripts/npm-packages.md); versions, upstream
@@ -1630,9 +1695,10 @@ when redistributing the image.
 | Linux kernels and networking, storage, xHCI, USB and HID modules | GPL-2.0-only with the Linux syscall note | image only |
 | systemd EFI stub | LGPL-2.1-or-later | image only |
 | Bun | MIT, plus the licenses of what it statically links | image only |
-| buninu-browser 0.2.2 | MIT for its own code; bundled components have their own licenses | npm download → image |
+| buninu-browser 0.2.3 | MIT for its own code; bundled components have their own licenses | npm download → image |
+| buninu-land 0.1.2 | MIT for its own code; bundled components retain their own licenses and notices | npm download → image |
 | wasmpeg / FFmpeg (`@wasmpeg/cpu` 1.0.1, bundled in buninu-browser) | LGPL-2.1-or-later, plus component notices; source archive and rebuild documentation retained | browser package → image |
-| `@drxiaozhi/casty` 1.3.4 | MIT | npm download → image |
+| `@drxiaozhi/casty` 1.3.6 | MIT | npm download → image |
 | `@drxiaozhi/jspulse` 0.2.1 | LGPL-2.1-or-later, plus component notices | npm download → image |
 | `@drxiaozhi/jspinyin` 0.1.1 | MIT; hanzipinyin material under the Unlicense | npm download → image |
 | CanvasKit 0.41.1 (`initramfs/lib/canvaskit/`, Skia compiled to WebAssembly) | BSD-3-Clause (`LICENSES/BSD-3-Clause-Skia.txt`) | committed |

package/initramfs/bin/buninu-land

@@ -0,0 +1,26 @@
+#!/bin/bun
+// Keep the offline casty launcher outside the npm package so package updates
+// preserve the distribution entry point.
+import { resolve, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const root = resolve(import.meta.dir, "..");
+const modules = join(root, "usr/lib/node_modules");
+const browser = join(modules, "buninu-land");
+const entry = join(browser, "index.js");
+const { chooseFrontend } = await import(pathToFileURL(entry).href);
+const args = process.argv.slice(2);
+const choice = chooseFrontend(args);
+const casty = choice.frontend === "casty";
+const forwarded = casty ? choice.args : args;
+// Bun consumes a leading separator after the script path; preserve Casty's
+// own separator when --casty is followed directly by -- engine flags.
+const runtimeArgs = forwarded[0] === "--" ? ["--", ...forwarded] : forwarded;
+const child = Bun.spawn({
+  cmd: [process.execPath, casty ? join(modules, "@drxiaozhi/casty/index.js") : entry,
+    ...runtimeArgs],
+  env: casty ? { ...process.env, CASTY_BROWSER: join(browser, "compositor.js") } : process.env,
+  stdio: ["inherit", "inherit", "inherit"],
+});
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(signal, () => child.kill(signal));
+process.exit(await child.exited);

package/initramfs/bin/chroot

@@ -10,6 +10,8 @@
 
 import { chmodSync, existsSync, mkdirSync, realpathSync, statSync, readFileSync, writeFileSync } from "node:fs";
 import { libc, cString, ptr, errno, strerror, Errno } from "../lib/dlopen.js";
+import { dirname } from "node:path";
+import { parseChrootArguments, resolveBindings, resolveGuestPath } from "../lib/chroot-options.js";
 import { showDocument } from "../lib/document.js";
 
 const MS = { RDONLY: 1n, NOSUID: 2n, NODEV: 4n, NOEXEC: 8n, BIND: 4096n, REC: 16384n, SLAVE: 1n << 19n };
@@ -23,27 +25,18 @@ const fail = (message, status = 125) => {
 const usage = () => {
   console.error(`Usage:
   chroot NEWROOT [COMMAND [ARGUMENT...]]
-  chroot [-n] [-k] [-v] NEWROOT [COMMAND [ARGUMENT...]]
+  chroot [-n] [-k] [-v] [-b HOST[:GUEST]] [--shared-tmp] NEWROOT [COMMAND [ARGUMENT...]]
   chroot -h | --help          full manual (chroot.md)`);
   process.exit(125);
 };
 
 // ------------------------------------------------------------- arguments --
 
-const options = { mount: true, keep: false, verbose: false };
-const positional = [];
-const argv = process.argv.slice(2);
-for (let index = 0; index < argv.length; index++) {
-  const argument = argv[index];
-  if (positional.length > 0) { positional.push(argument); continue; }
-  if (argument === "--") { positional.push(...argv.slice(index + 1)); break; }
-  if (argument === "-h" || argument === "--help") { await showDocument("chroot"); process.exit(0); }
-  else if (argument === "-n" || argument === "--no-mount") options.mount = false;
-  else if (argument === "-k" || argument === "--keep-mounts") options.keep = true;
-  else if (argument === "-v" || argument === "--verbose") options.verbose = true;
-  else if (argument.startsWith("-") && argument.length > 1) { console.error(`chroot: unknown option ${argument}`); usage(); }
-  else positional.push(argument);
-}
+let parsed;
+try { parsed = parseChrootArguments(process.argv.slice(2)); }
+catch (error) { fail(error.message); }
+const { options, positional } = parsed;
+if (parsed.help) { await showDocument("chroot"); process.exit(0); }
 if (positional.length === 0) usage();
 
 const [target, ...command] = positional;
@@ -55,6 +48,10 @@ try {
   fail(`cannot change root directory to ${target}: ${error.code === "ENOENT" ? "no such directory" : error.message}`);
 }
 if (root === "/") fail("refusing to chroot to /");
+let bindings;
+try { bindings = resolveBindings(options.binds); }
+catch (error) { fail(`invalid bind: ${error.message}`); }
+
 
 const report = (message) => { if (options.verbose) console.error(`chroot: ${message}`); };
 
@@ -80,57 +77,39 @@ const made = [];
 // Prepares one mount. `inside` is the path within the new root. A target that
 // is already a mount point, or that cannot be created on a read-only root, is
 // left alone rather than treated as a failure: the command may still run.
-const prepare = ({ inside, source, type, flags = 0n, data, file = false }) => {
+const prepare = ({ inside, source, type, flags = 0n, data, file = false, required = false }) => {
+  inside = resolveGuestPath(root, inside);
+  if (!required && bindings.some(bind => {
+    const destination = resolveGuestPath(root, bind.inside);
+    return inside === destination || inside.startsWith(destination + "/");
+  })) return;
+  if (required && made.includes(inside)) throw Error(`bind destination is already used by this invocation: ${inside}`);
   const point = `${root}${inside}`;
-  if (mountPoints().includes(point)) {
+  if (!required && mountPoints().includes(point)) {
     report(`${inside} is already mounted`);
     return;
   }
   if (!existsSync(point)) {
     try {
-      if (file) writeFileSync(point, "");
+      if (file) { mkdirSync(dirname(point), { recursive: true, mode: 0o755 }); writeFileSync(point, "", { flag: "wx" }); }
       else mkdirSync(point, { recursive: true, mode: 0o755 });
     } catch (error) {
+      if (required) throw Error(`cannot create ${inside}: ${error.message}`);
       report(`cannot create ${inside}: ${error.message}; skipped`);
       return;
     }
   }
   if (mountSyscall(source, point, type, flags, data) === -1) {
+    if (required) throw Error(`bind ${source} -> ${inside}: ${strerror(errno())}`);
     report(`mount ${inside}: ${strerror(errno())}; skipped`);
     return;
   }
   made.push(inside);
   report(`mounted ${inside}`);
-};
-
-if (options.mount) {
-  prepare({ inside: "/proc", source: "proc", type: "proc", flags: MS.NOSUID | MS.NODEV | MS.NOEXEC });
-  prepare({ inside: "/sys", source: "sysfs", type: "sysfs", flags: MS.NOSUID | MS.NODEV | MS.NOEXEC });
-  // /dev is bound rather than mounted fresh so the devices, the pty
-  // multiplexer and anything the host added are all there. The bind is then
-  // made a slave: mounts appearing inside do not propagate back to the host,
-  // and unmounting it later does not take the host's /dev with it.
-  prepare({ inside: "/dev", source: "/dev", type: "none", flags: MS.BIND | MS.REC });
-  if (made.includes("/dev")) {
-    if (mountSyscall("none", `${root}/dev`, "none", MS.REC | MS.SLAVE) === -1) {
-      report(`making /dev a slave mount: ${strerror(errno())}`);
-    }
-    // Only needed when the host has no /dev/pts of its own to bring along.
-    if (!existsSync(`${root}/dev/pts/ptmx`)) {
-      prepare({ inside: "/dev/pts", source: "devpts", type: "devpts", flags: MS.NOSUID | MS.NOEXEC, data: "gid=5,mode=620,ptmxmode=666" });
-    }
+  if (required && !file && mountSyscall("none", point, "none", MS.REC | MS.SLAVE) === -1) {
+    throw Error(`making ${inside} a slave mount: ${strerror(errno())}`);
   }
-  prepare({ inside: "/run", source: "tmpfs", type: "tmpfs", flags: MS.NOSUID | MS.NODEV, data: "mode=755" });
-  prepare({ inside: "/tmp", source: "tmpfs", type: "tmpfs", flags: MS.NOSUID | MS.NODEV, data: "mode=1777" });
-  // A bound file, so name resolution inside follows the host's configuration
-  // and nothing inside the root is modified.
-  if (existsSync("/etc/resolv.conf") && existsSync(`${root}/etc`)) {
-  
-    chmodSync(`/etc/resolv.conf`, 0o644);
-    
-    prepare({ inside: "/etc/resolv.conf", source: "/etc/resolv.conf", type: "none", flags: MS.BIND, file: true });
-  }
-}
+};
 
 // Mount points are recorded by their path inside the new root. Until
 // chroot(2) has happened they are reached through this prefix; afterwards
@@ -167,10 +146,52 @@ const cleanup = () => {
 
 process.on("exit", cleanup);
 
+try {
+  if (options.mount) {
+    prepare({ inside: "/proc", source: "proc", type: "proc", flags: MS.NOSUID | MS.NODEV | MS.NOEXEC });
+    prepare({ inside: "/sys", source: "sysfs", type: "sysfs", flags: MS.NOSUID | MS.NODEV | MS.NOEXEC });
+    // /dev is bound rather than mounted fresh so the devices, the pty
+    // multiplexer and anything the host added are all there. The bind is then
+    // made a slave: mounts appearing inside do not propagate back to the host,
+    // and unmounting it later does not take the host's /dev with it.
+    prepare({ inside: "/dev", source: "/dev", type: "none", flags: MS.BIND | MS.REC });
+    if (made.includes("/dev")) {
+      if (mountSyscall("none", `${root}/dev`, "none", MS.REC | MS.SLAVE) === -1) {
+        report(`making /dev a slave mount: ${strerror(errno())}`);
+      }
+      // Only needed when the host has no /dev/pts of its own to bring along.
+      if (!existsSync(`${root}/dev/pts/ptmx`)) {
+        prepare({ inside: "/dev/pts", source: "devpts", type: "devpts", flags: MS.NOSUID | MS.NOEXEC, data: "gid=5,mode=620,ptmxmode=666" });
+      }
+    }
+    prepare({ inside: "/run", source: "tmpfs", type: "tmpfs", flags: MS.NOSUID | MS.NODEV, data: "mode=755" });
+    prepare({ inside: "/tmp", source: "tmpfs", type: "tmpfs", flags: MS.NOSUID | MS.NODEV, data: "mode=1777" });
+    // A bound file, so name resolution inside follows the host's configuration
+    // and nothing inside the root is modified.
+    if (existsSync("/etc/resolv.conf") && existsSync(`${root}/etc`)) {
+
+      chmodSync(`/etc/resolv.conf`, 0o644);
+
+      prepare({ inside: "/etc/resolv.conf", source: "/etc/resolv.conf", type: "none", flags: MS.BIND, file: true });
+    }
+  }
+
+  for (const binding of bindings) {
+    prepare({ ...binding, type: "none", flags: MS.BIND | (binding.file ? 0n : MS.REC), required: true });
+  }
+} catch (error) {
+  // --keep-mounts applies to a prepared session, not a failed setup.
+  options.keep = false;
+  cleanup();
+  fail(error.message);
+}
+
+
 // ----------------------------------------------------------------- enter --
 
 if (libc.symbols.chroot(ptr(cString(root))) === -1) {
   const code = errno();
+  options.keep = false;
   cleanup();
   fail(`cannot change root directory to ${target}: ${code === Errno.EPERM ? "must be superuser" : strerror(code)}`);
 }

package/initramfs/buninu/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.4.21 - 2026-10-15
+
+- Sync jsgotty to 1.1.16: Turn on pixel report
+
+## 0.4.20 - 2026-10-13
+
+- Sync bunmsh to 0.4.0:
+  * Add a pure JavaScript awk fallback, file diff with line alignment, cmp,
+    uniq, expr, and egrep/fgrep aliases; extend sed and other utility builtins
+    for configure scripts and compiler builds.
+  * Improve compound commands, here-documents, parameter expansion, function
+    and loop control, descriptor redirection, and pipeline/subshell state
+    transfer for Autoconf and GCC bootstrap workloads.
+  * In `set -o posix` mode, use plain ls output and pass only exported variables
+    and command-prefix assignments to external programs. Default mode retains
+    ls icons and its existing environment behavior.
+  * Preserve the existing background-process behavior and stable
+    `Bun.sha.procs` indices. POSIX and awk compatibility remain partial; see
+    the bundled bunmsh PORTING.md for limitations.
+- Sync jsgotty to 1.1.15: forward Kitty graphics to the terminal in `--client`
+  mode and avoid applying the corresponding cursor movement twice.
+
 ## 0.4.19 - 2026-10-12
 
 - Sync bunmsh to 0.3.11: more POSIX syntax

package/initramfs/buninu/apps/jsgotty/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "jsgotty",
-  "version": "1.1.15",
+  "version": "1.1.16",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsgotty",
-      "version": "1.1.15",
+      "version": "1.1.16",
       "dependencies": {
         "node-addon-api": "^7.1.1",
         "ws": "^8.18.3"

package/initramfs/buninu/apps/jsgotty/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsgotty",
-  "version": "1.1.15",
+  "version": "1.1.16",
   "description": "Share your terminal as a web application: A JavaScript rewrite of GoTTY",
   "license": "MIT",
   "bin": {

package/initramfs/buninu/apps/jsgotty/static/js/gotty.js

@@ -12530,6 +12530,7 @@
 	              (this.fontSizeOverride = fontSizeValue),
 	              (this.term = new r.Terminal({
 	                allowProposedApi: !0,
+	                windowOptions: { getWinSizePixels: true, getCellSizePixels: true },
 	                customGlyphs: !0,
 	                rescaleOverlappingGlyphs: !0,
 	                fontFamily:

package/initramfs/buninu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "description": "Buninu is a portable, self-bootstrapping Unix-like userspace built on Bun that runs across operating systems",
   "type": "module",
   "main": "./bin/init.js",

package/initramfs/lib/bunterm/geometry.js

@@ -0,0 +1,15 @@
+// Report the content area in the same pixel units as SGR 1016, not fb margins.
+export function attachGeometry({ term, renderer, reply }) {
+  term.options.windowOptions = { ...term.options.windowOptions, getWinSizePixels: true, getCellSizePixels: true };
+  return term.parser.registerCsiHandler({ final: 't' }, params => {
+    if (params[0] === 14 && params[1] !== 2) {
+      reply(`\x1b[4;${Math.round(term.rows * renderer.cellHeight)};${Math.round(term.cols * renderer.cellWidth)}t`);
+      return true;
+    }
+    if (params[0] === 16) {
+      reply(`\x1b[6;${Math.round(renderer.cellHeight)};${Math.round(renderer.cellWidth)}t`);
+      return true;
+    }
+    return false;
+  });
+}

package/initramfs/lib/bunterm/pointer-report.js

@@ -0,0 +1,10 @@
+// Supply both coordinate systems: xterm selects cells (1006) or pixels (1016).
+// Pixels are relative to the terminal content, excluding framebuffer margins.
+export function terminalMouseEvent(report, renderer, button, action) {
+  const x = Math.floor(report.x - renderer.offsetX);
+  const y = Math.floor(report.y - renderer.offsetY);
+  return {
+    col: Math.floor(x / renderer.cellWidth), row: Math.floor(y / renderer.cellHeight),
+    x, y, button, action, ctrl: false, alt: false, shift: false,
+  };
+}

package/initramfs/lib/bunterm/terminal.js

@@ -21,6 +21,8 @@ import { Renderer, defaultTheme } from "./renderer.js";
 import { ImageStore } from "./images.js";
 import { openKeyboard, translateKeys } from "./input.js";
 import { claimVirtualConsole } from "./vt.js";
+import { attachGeometry } from "./geometry.js";
+import { terminalMouseEvent } from "./pointer-report.js";
 import { attachClipboard } from "./clipboard.js";
 
 const require = createRequire(import.meta.url);
@@ -160,6 +162,7 @@ export const createSession = ({
   });
   backend.onData(pump);
   term.onData((data) => backend.write(Buffer.from(data, "utf8")));
+  attachGeometry({ term, renderer, reply: text => backend.write(Buffer.from(text, "utf8")) });
   // OSC 52 copy and paste go straight to xclip; replies return to the program.
   // Without it (--no-clipboard) xterm.js ignores OSC 52 and nothing reaches xclip.
   if (clipboard) attachClipboard({ term, reply: (text) => backend.write(Buffer.from(text, "utf8")), onError });
@@ -181,7 +184,7 @@ export const createSession = ({
   // Turns a pointer report from mouse.js into the mouse sequences the
   // program asked for. xterm.js's CoreMouseService owns the protocol: it
   // knows which events the program enabled (DECSET 1000/1002/1003), encodes
-  // them (SGR 1006 or the default form) and sends them through onData, so
+  // them (SGR 1006, pixel 1016, or the default form) and sends them through onData, so
   // nothing here builds an escape sequence. Reports arrive only while a
   // pointer is open, and this is the only place the terminal sees one.
   const CoreMouseButton = { LEFT: 0, MIDDLE: 1, RIGHT: 2, NONE: 3, WHEEL: 4 };
@@ -223,11 +226,9 @@ export const createSession = ({
       if (report.wheel) wheelScroll(report.wheel);
       return;
     }
-    const column = Math.floor((report.x - renderer.offsetX) / renderer.cellWidth);
-    const row = Math.floor((report.y - renderer.offsetY) / renderer.cellHeight);
     const send = (button, action) => {
       try {
-        service.triggerMouseEvent({ col: column, row, button, action, ctrl: false, alt: false, shift: false });
+        service.triggerMouseEvent(terminalMouseEvent(report, renderer, button, action));
       } catch (error) {
         onError(error);
       }

package/initramfs/lib/chroot-options.js

@@ -0,0 +1,69 @@
+import { realpathSync, statSync, lstatSync, readlinkSync } from 'node:fs';
+import { posix, resolve } from 'node:path';
+
+export function parseChrootArguments(argv, env = process.env) {
+  const options = { mount: true, keep: false, verbose: false, binds: [] };
+  let positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--') { positional = argv.slice(i + 1); break; }
+    if (arg === '-h' || arg === '--help') return { options, positional, help: true };
+    if (arg === '-n' || arg === '--no-mount') options.mount = false;
+    else if (arg === '-k' || arg === '--keep-mounts') options.keep = true;
+    else if (arg === '-v' || arg === '--verbose') options.verbose = true;
+    else if (arg === '-b' || arg === '--bind') {
+      if (++i >= argv.length || !argv[i] || argv[i].startsWith('-')) throw Error(`${arg} requires HOST[:GUEST]`);
+      options.binds.push(argv[i]);
+    } else if (arg.startsWith('--bind=')) {
+      if (!arg.slice(7)) throw Error('--bind requires HOST[:GUEST]');
+      options.binds.push(arg.slice(7));
+    } else if (arg === '--shared-tmp') {
+      if (!env.TMPDIR) throw Error('--shared-tmp requires TMPDIR to be set');
+      options.binds.push(`${env.TMPDIR}:/tmp`);
+    } else if (arg.startsWith('-') && arg.length > 1) throw Error(`unknown option ${arg}`);
+    else { positional = argv.slice(i); break; }
+  }
+  return { options, positional, help: false };
+}
+
+export function resolveBindings(specs, cwd = process.cwd()) {
+  const bindings = new Map();
+  for (const spec of specs) {
+    const colon = spec.indexOf(':');
+    const host = colon < 0 ? spec : spec.slice(0, colon);
+    const guest = colon < 0 ? resolve(cwd, host) : spec.slice(colon + 1);
+    if (!host || !guest || host.includes('\0') || guest.includes('\0')) throw Error(`invalid bind: ${spec}`);
+    if (!posix.isAbsolute(guest)) throw Error(`bind guest path must be absolute: ${guest}`);
+    const inside = posix.normalize(guest);
+    if (inside === '/') throw Error('bind destination must not replace the chroot root');
+    const source = realpathSync(resolve(cwd, host));
+    bindings.set(inside, { inside, source, file: !statSync(source).isDirectory() });
+  }
+  // Parents must be mounted before children. For a repeated destination, the
+  // last argument wins, including --shared-tmp versus an explicit /tmp bind.
+  return [...bindings.values()].sort((a, b) => a.inside.split('/').length - b.inside.split('/').length);
+}
+
+// Resolve guest symlinks as chroot would: absolute links start at NEWROOT,
+// never at the host's /. Missing suffixes are created by the mount caller.
+export function resolveGuestPath(root, inside) {
+  const todo = inside.split('/'), parts = [];
+  let links = 0;
+  while (todo.length) {
+    const part = todo.shift();
+    if (!part || part === '.') continue;
+    if (part === '..') { parts.pop(); continue; }
+    const candidate = `${root}/${[...parts, part].join('/')}`;
+    let entry;
+    try { entry = lstatSync(candidate); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (entry?.isSymbolicLink()) {
+      if (++links > 40) throw Error(`too many symlinks in bind destination: ${inside}`);
+      const target = readlinkSync(candidate);
+      if (target.startsWith('/')) parts.length = 0;
+      todo.unshift(...target.split('/'));
+    } else parts.push(part);
+  }
+  if (!parts.length) throw Error('bind destination resolves to the chroot root');
+  return '/' + parts.join('/');
+}

package/initramfs/usr/share/doc/buninu-linux/bunterm.md

@@ -82,7 +82,10 @@ Every pointing device under `/dev/input/event*` is opened and an arrow is
 drawn on the screen. Clicks, drags and wheel notches reach the program as
 the xterm mouse sequences it asked for: nothing is sent unless the program
 enabled reporting (`DECSET 1000`, `1002` or `1003`), and what is sent follows
-the mode it chose, SGR (`1006`) included. `jsmdcui`, `micro`, `htop`, `vim`
+the mode it chose, including SGR cell coordinates (`1006`) and SGR pixel
+coordinates (`1016`). Mode 1016 also answers DECRQM queries; pixel positions
+exclude the framebuffer margins and preserve movement within a cell.
+CSI 14t/16t report the content and cell dimensions in those same pixel units. `jsmdcui`, `micro`, `htop`, `vim`
 and anything else that speaks the protocol work with no configuration.
 
 When the program is not reading the mouse, the wheel scrolls instead: back

package/initramfs/usr/share/doc/buninu-linux/chroot.md

@@ -11,7 +11,7 @@ every mount it made when the command exits.
 
 ```sh
 chroot NEWROOT [COMMAND [ARGUMENT...]]
-chroot [-n] [-k] [-v] NEWROOT [COMMAND [ARGUMENT...]]
+chroot [-n] [-k] [-v] [-b HOST[:GUEST]] [--shared-tmp] NEWROOT [COMMAND [ARGUMENT...]]
 chroot -h | --help
 ```
 
@@ -30,7 +30,7 @@ With no COMMAND it runs `$SHELL` if that exists inside NEWROOT, otherwise
 | `/tmp` | `tmpfs` | scratch space that does not touch the root filesystem |
 | `/etc/resolv.conf` | bind of the host's file | name resolution, without editing anything inside |
 
-A mount point that already exists as a mount is left alone. A directory that
+For automatic mounts, a destination that is already mounted is left alone. A directory that
 is missing is created; if the root filesystem is read-only and that fails,
 that one mount is skipped and the rest still happen — use `-v` to see which.
 
@@ -42,11 +42,30 @@ host's `/dev` with it.
 
 | Option | Meaning |
 |---|---|
-| `-n`, `--no-mount` | Do not mount anything: the behaviour of the traditional `chroot`. Note that Bun itself cannot start without `/proc` and `/dev/urandom`, so `-n` suits statically linked programs. |
+| `-n`, `--no-mount` | Skip automatic system mounts; explicit `-b` mounts still apply. Without binds, this is the behaviour of the traditional `chroot`. Note that Bun itself cannot start without `/proc` and `/dev/urandom`, so `-n` suits statically linked programs. |
+| `-b HOST[:GUEST]`, `--bind HOST[:GUEST]` | Bind a host directory or file into the new root; repeat for multiple paths. Without GUEST, use HOST’s absolute path inside the guest. |
+| `--shared-tmp` | Equivalent to `-b "$TMPDIR:/tmp"`; TMPDIR must be set and exist. Replaces the automatic `/tmp` tmpfs. |
 | `-k`, `--keep-mounts` | Leave the mounts in place after the command exits, to enter the same root again cheaply. Clean up later with `umount -R`. |
 | `-v`, `--verbose` | Report every mount and unmount. |
 | `--` | End of options; everything after it is NEWROOT and COMMAND. |
 
+Bind options must appear before NEWROOT. Host paths may be relative to the
+current directory; guest paths must be absolute. Missing destination directories
+and file placeholders are created. Guest symlinks are resolved relative to
+NEWROOT, including absolute symlinks. Binding over the guest root `/` is rejected.
+
+Explicit binds replace automatic mounts at or below their destination. Directories
+are bound recursively and made slave mounts, like `/dev`; files use a plain bind.
+A repeated destination uses the last argument, so a later `-b HOST:/tmp` can
+override `--shared-tmp` (and vice versa). Parent binds are applied before children.
+Explicit bind failures abort with status 125 and clean up this invocation's mounts,
+even with `-k`. Existing mounts may be covered by a new explicit bind and are
+revealed again when it is removed. Source data is shared, not copied.
+
+`--shared-tmp` only adds the bind; it does not rewrite environment variables.
+If the host's TMPDIR path is different from `/tmp`, applications in the guest may
+need `TMPDIR=/tmp` in their environment.
+
 ## Examples
 
 ```sh
@@ -63,6 +82,21 @@ chroot -v /mnt /bin/sh -c 'ls /proc | head -3'
 # Traditional behaviour: nothing is mounted for you
 chroot -n /mnt /bin/sh
 
+# Share a host directory at a different guest path
+chroot -b /home/user/project:/work /mnt /bin/sh
+
+# Share the same absolute path inside the guest
+chroot -b /home/user/project /mnt /bin/sh
+
+# Share files, or multiple paths
+chroot -b /home/user/project:/work -b /etc/hosts:/etc/hosts /mnt /bin/sh
+
+# Share the host temporary directory (including Unix sockets)
+export TMPDIR=/tmp
+chroot --shared-tmp /mnt /bin/sh
+# Equivalent explicit bind:
+chroot -b "$TMPDIR:/tmp" /mnt /bin/sh
+
 # Keep the mounts for repeated visits
 chroot -k /mnt /bin/sh -c 'true'
 chroot -k /mnt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.10.56",
+  "version": "0.11.56",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/npm-packages.md

@@ -1,14 +1,19 @@
 # npm packages
 # Latest versions checked on 2026-10-11; SHA-256 pins verified against registry SHA-512 integrity.
 # buninu-browser updated and verified on 2026-10-12.
+# casty 1.3.6 and buninu-land 0.1.2 verified on 2026-10-16.
 
 "buninu-browser@0.2.3":
   - https://registry.npmjs.org/buninu-browser/-/buninu-browser-0.2.3.tgz
   - sha256:0f7c9cd9df689d7b0900fdf3172851125ebd8aba12bed555be7e091d427146e8
 
-"@drxiaozhi/casty@1.3.4":
-  - https://registry.npmjs.org/@drxiaozhi/casty/-/casty-1.3.4.tgz
-  - sha256:1899179d173702721c2f6e8bbffab51ca3421e899ac59c58b2588cfc342fa0df
+"buninu-land@0.1.2":
+  - https://registry.npmjs.org/buninu-land/-/buninu-land-0.1.2.tgz
+  - sha256:0b682e1d57f953d9fa9415369c320e4e35bf7575c2859673c26a0789f5369490
+
+"@drxiaozhi/casty@1.3.6":
+  - https://registry.npmjs.org/@drxiaozhi/casty/-/casty-1.3.6.tgz
+  - sha256:2b5f84e3a63c2c16fa92dc88faa43eec54edc2fe69154e5270af3cd9e7f472b8
 
 "@drxiaozhi/jspulse@0.2.1":
   - https://registry.npmjs.org/@drxiaozhi/jspulse/-/jspulse-0.2.1.tgz

package/test/bunterm-pixelmouse.test.js

@@ -0,0 +1,27 @@
+import {test,expect} from 'bun:test';
+import {Terminal} from '../initramfs/lib/xterm/xterm-headless.mjs';
+import {terminalMouseEvent} from '../initramfs/lib/bunterm/pointer-report.js';
+test('bunterm negotiates 1016 and emits real pixel press, release and same-cell motion',async()=>{
+ const term=new Terminal({cols:80,rows:24,allowProposedApi:true}),out=[];term.onData(s=>out.push(s));
+ const write=s=>new Promise(r=>term.write(s,r));
+ const renderer={offsetX:5,offsetY:7,cellWidth:10,cellHeight:20};
+ const send=(x,y,action)=>term._core.coreMouseService.triggerMouseEvent(terminalMouseEvent({x,y},renderer,0,action));
+ try{
+ await write('\x1b[?1016$p');expect(out.pop()).toBe('\x1b[?1016;2$y');
+ await write('\x1b[?1003h\x1b[?1006h\x1b[?1016h\x1b[?1016$p');expect(out.pop()).toBe('\x1b[?1016;1$y');
+ send(30,68,1);expect(out.pop()).toBe('\x1b[<0;25;61M');
+ send(30,68,0);expect(out.pop()).toBe('\x1b[<0;25;61m');
+ send(31,68,32);expect(out.pop()).toBe('\x1b[<32;26;61M');
+ send(32,68,32);expect(out.pop()).toBe('\x1b[<32;27;61M');
+ await write('\x1b[?1016l\x1b[?1006h');send(30,68,1);expect(out.pop()).toBe('\x1b[<0;3;4M');
+ }finally{term.dispose();}
+});
+
+test('geometry queries use terminal content pixels and exclude framebuffer margins',async()=>{
+ const {attachGeometry}=await import('../initramfs/lib/bunterm/geometry.js');
+ const term=new Terminal({cols:80,rows:24,allowProposedApi:true}),out=[];
+ const renderer={offsetX:5,offsetY:7,cellWidth:10,cellHeight:20};
+ const handler=attachGeometry({term,renderer,reply:s=>out.push(s)});
+ try{await new Promise(r=>term.write('\x1b[14t\x1b[16t',r));expect(out).toEqual(['\x1b[4;480;800t','\x1b[6;20;10t']);}
+ finally{handler.dispose();term.dispose();}
+});

package/test/chroot-bind.test.js

@@ -0,0 +1,70 @@
+import {test,expect} from 'bun:test';
+import {mkdtempSync,mkdirSync,writeFileSync,readFileSync,symlinkSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {parseChrootArguments,resolveBindings,resolveGuestPath} from '../initramfs/lib/chroot-options.js';
+
+test('chroot bind arguments expand shared tmp, repeat, and stop at NEWROOT',()=>{
+ const result=parseChrootArguments(['-n','-b','/host:/guest','--shared-tmp','--bind=/same','/root','echo','-b','unchanged'],{TMPDIR:'/host temp'});
+ expect(result.options).toMatchObject({mount:false,binds:['/host:/guest','/host temp:/tmp','/same']});
+ expect(result.positional).toEqual(['/root','echo','-b','unchanged']);
+ expect(()=>parseChrootArguments(['--shared-tmp','/root'],{})).toThrow('TMPDIR');
+ expect(()=>parseChrootArguments(['-b'])).toThrow('requires');
+ expect(()=>parseChrootArguments(['--bind='])).toThrow('requires');
+ expect(parseChrootArguments(['--','-root','sh']).positional).toEqual(['-root','sh']);
+});
+
+test('bind resolution preserves same-path destinations and confines guest symlinks',()=>{
+ const dir=mkdtempSync(join(tmpdir(),'buninu-bind-path-'));
+ try{
+  mkdirSync(join(dir,'root'));mkdirSync(join(dir,'host'));writeFileSync(join(dir,'file'),'data');
+  const binds=resolveBindings(['host','file:/etc/config','host:/tmp','file:/tmp'],dir);
+  expect(binds.find(b=>b.inside===join(dir,'host'))?.source).toBe(join(dir,'host'));
+  expect(binds.find(b=>b.inside==='/tmp')?.file).toBe(true);
+  expect(()=>resolveBindings(['host:relative'],dir)).toThrow('absolute');
+  expect(()=>resolveBindings(['host:/'],dir)).toThrow('root');
+  expect(()=>resolveBindings(['missing:/ok'],dir)).toThrow();
+  symlinkSync('/run/tmp',join(dir,'root/tmp'));
+  expect(resolveGuestPath(join(dir,'root'),'/tmp')).toBe('/run/tmp');
+  symlinkSync('../../outside',join(dir,'root/escape'));
+  expect(resolveGuestPath(join(dir,'root'),'/escape')).toBe('/outside');
+ }finally{rmSync(dir,{recursive:true,force:true});}
+});
+
+// Execute the actual CLI with recorded syscall bindings. No host mounts or
+// chroot occur; this also exercises failure cleanup and the -n interaction.
+async function invoke(argumentsFor,env={}) {
+ const dir=mkdtempSync(join(tmpdir(),'buninu-bind-cli-')),root=join(dir,'root'),host=join(dir,'host'),log=join(dir,'calls');
+ mkdirSync(root);mkdirSync(host);mkdirSync(join(dir,'fail'));writeFileSync(join(dir,'file'),'data');
+ const mock=join(dir,'libc.js');
+ writeFileSync(mock,`import {appendFileSync} from 'node:fs';
+ const record=(name,...args)=>appendFileSync(${JSON.stringify(log)},JSON.stringify([name,...args.map(a=>typeof a==='bigint'?String(a):a)])+'\\n');
+ export const ptr=x=>x,cString=x=>x,errno=()=>1,strerror=()=> 'mock mount denied',Errno={EINVAL:22,EPERM:1};
+ export const libc={symbols:{mount:(...a)=>{record('mount',...a);return a[0]?.endsWith('/fail')?-1:0;},umount2:(...a)=>{record('umount',...a);return 0;},chroot:(...a)=>{record('chroot',...a);return 0;}}};`);
+ const source=readFileSync(new URL('../initramfs/bin/chroot',import.meta.url),'utf8')
+  .replace('"../lib/dlopen.js"',JSON.stringify(mock))
+  .replace('"../lib/chroot-options.js"',JSON.stringify(new URL('../initramfs/lib/chroot-options.js',import.meta.url).pathname))
+  .replace('import { showDocument } from "../lib/document.js";','const showDocument=async()=>{};');
+ const entry=join(dir,'chroot.mjs');writeFileSync(entry,source);
+ try{
+  const child=Bun.spawn([process.execPath,entry,...argumentsFor({dir,root,host}),root,'/bin/true'],{env:{...process.env,...env,TMPDIR:host},stdout:'pipe',stderr:'pipe'});
+  const stderr=new Response(child.stderr).text();const status=await child.exited;
+  return {status,stderr:await stderr,calls:readFileSync(log,'utf8').trim().split('\n').map(JSON.parse),root,host,dir};
+ }finally{rmSync(dir,{recursive:true,force:true});}
+}
+
+test('explicit binds work with -n, create files, and unwind in reverse depth order',async()=>{
+ const r=await invoke(({dir,host})=>['-n','-b',`${host}:/work`,'-b',`${dir}/file:/work/config/file`]);
+ expect(r.status).toBe(0);
+ expect(r.calls.filter(c=>c[0]==='mount'&&c[1]===r.host)[0]).toEqual(['mount',r.host,r.root+'/work','none','20480',null]);
+ expect(r.calls.filter(c=>c[0]==='umount').map(c=>c[1])).toEqual(['/work/config/file','/work']);
+});
+test('shared tmp replaces default tmpfs and bind failure cleans up even with -k',async()=>{
+ const shared=await invoke(()=>['--shared-tmp']);expect(shared.status).toBe(0);
+ expect(shared.calls.some(c=>c[0]==='mount'&&c[1]===shared.host&&c[2]===shared.root+'/tmp')).toBe(true);
+ expect(shared.calls.some(c=>c[0]==='mount'&&c[1]==='tmpfs'&&c[2]===shared.root+'/tmp')).toBe(false);
+ const failure=await invoke(({host,dir})=>['-n','-k','-b',`${host}:/first`,'-b',`${dir}/fail:/second`]);
+ expect(failure.status).toBe(125);expect(failure.stderr).toContain('mock mount denied');
+ expect(failure.calls.some(c=>c[0]==='chroot')).toBe(false);
+ expect(failure.calls.filter(c=>c[0]==='umount').map(c=>c[1])).toEqual([failure.root+'/first']);
+});

package/test/fetch-npm.test.js

@@ -21,9 +21,9 @@ const server = Bun.serve({
 afterAll(() => { server.stop(true); rmSync(work, { recursive: true, force: true }); });
 const url = `http://127.0.0.1:${server.port}/archive`;
 
-test("four exact registry pins share an architecture-independent cache", () => {
+test("five exact registry pins share an architecture-independent cache", () => {
   expect(npmPackages.map(({ name, version }) => `${name}@${version}`)).toEqual([
-    "buninu-browser@0.2.3", "@drxiaozhi/casty@1.3.4",
+    "buninu-browser@0.2.3", "buninu-land@0.1.2", "@drxiaozhi/casty@1.3.6",
     "@drxiaozhi/jspulse@0.2.1", "@drxiaozhi/jspinyin@0.1.1",
   ]);
   expect(basename(npmDownloadsDir)).toBe("npm");

package/test/stage-npm.test.js

@@ -16,7 +16,7 @@ const fresh = () => { const dir = join(work, String(sequence++)); mkdirSync(dir)
 async function fixture() {
   const downloadsDir = fresh();
   const packages = [];
-  for (const name of ["buninu-browser", "@drxiaozhi/casty", "@drxiaozhi/jspulse", "@drxiaozhi/jspinyin"]) {
+  for (const name of ["buninu-browser", "buninu-land", "@drxiaozhi/casty", "@drxiaozhi/jspulse", "@drxiaozhi/jspinyin"]) {
     const bin = name.split("/").pop();
     const data = await new Bun.Archive({
       "package/package.json": JSON.stringify({ name, version: "1.0.0", type: "module", bin: { [bin]: "index.js" } }),
@@ -104,6 +104,39 @@ test("distribution launcher ensures resources then forwards to local casty witho
   expect(JSON.parse(result.stdout)).toEqual({ args: ["https://example.test", "--", "--chromium"], engine: join(browser, "buninu-browser.js") });
 });
 
+test("land launcher selects bundled casty and preserves package frontend dispatch", async () => {
+  const cfg = await fixture(), root = fresh();
+  stageNpm(root, cfg);
+  const land = join(root, "usr/lib/node_modules/buninu-land");
+  mkdirSync(join(root, "bin"));
+  const launcher = join(root, "bin/buninu-land");
+  copyFileSync(new URL("../initramfs/bin/buninu-land", import.meta.url), launcher);
+  writeFileSync(join(land, "index.js"), `
+    export const chooseFrontend = args => ({
+      frontend: !args.length || args[0] === '--casty' || args[0] === 'about:blank' ? 'casty' : 'other',
+      args: args[0] === '--casty' ? args.slice(1) : args,
+    });
+    if (import.meta.main) console.log(JSON.stringify({ package: true, args: process.argv.slice(2) }));
+  `);
+  writeFileSync(join(root, "usr/lib/node_modules/@drxiaozhi/casty/index.js"),
+    "console.log(JSON.stringify({args:process.argv.slice(2),engine:process.env.CASTY_BROWSER}));");
+  for (const args of [[], ['about:blank'], ['--casty', '--', '--socket=wayland-test']]) {
+    const result = spawnSync(process.execPath, [launcher, ...args], {
+      encoding: "utf8", env: { ...process.env, CASTY_BROWSER: '/previous/browser' },
+    });
+    expect(result.status).toBe(0);
+    expect(JSON.parse(result.stdout)).toEqual({
+      args: args[0] === '--casty' ? args.slice(1) : args,
+      engine: join(land, "compositor.js"),
+    });
+  }
+  for (const args of [['--headless', '--help'], ['--help'], ['--version'], ['--docs'], ['--gtk']]) {
+    const result = spawnSync(process.execPath, [launcher, ...args], { encoding: "utf8" });
+    expect(result.status).toBe(0);
+    expect(JSON.parse(result.stdout)).toEqual({ package: true, args });
+  }
+});
+
 test.skipIf(!npmPackages.every(pkg => existsSync(join(npmDownloadsDir, pkg.archive))))("real cached pins: JS and shell staging agree; browser headless help starts", () => {
   const js = fresh(), shell = fresh();
   stageNpm(js);
@@ -127,4 +160,12 @@ test.skipIf(!npmPackages.every(pkg => existsSync(join(npmDownloadsDir, pkg.archi
   const help = spawnSync(process.execPath, [join(js, "bin/buninu-browser"), "--headless", "--help"], { encoding: "utf8", timeout: 15000 });
   expect(help.status).toBe(0);
   expect(help.stdout).toContain("Usage");
+  copyFileSync(new URL("../initramfs/bin/buninu-land", import.meta.url), join(js, "bin/buninu-land"));
+  for (const args of [["--help"], ["--headless", "--help"], ["--version"]]) {
+    const landHelp = spawnSync(process.execPath, [join(js, "bin/buninu-land"), ...args], { encoding: "utf8", timeout: 15000 });
+    expect(landHelp.status).toBe(0);
+    expect(landHelp.stdout).toContain(args[0] === "--version" ? "0.1.2" : args[0] === "--headless" ? "Wayland compositor" : "Usage");
+  }
+  expect(existsSync(join(js, "usr/lib/node_modules/buninu-land/vendor/canvaskit/canvaskit.wasm"))).toBe(true);
+  expect(existsSync(join(js, "usr/lib/node_modules/buninu-land/LICENSES/hyprland.txt"))).toBe(true);
 }, 30000);