buninu-linux 0.13.56 → 0.15.58

package/initramfs/lib/dhcp.js

@@ -0,0 +1,124 @@
+// DHCPv4 codec and lease state machine. Network/configuration adapters are
+// separate so protocol tests never change the host's addresses or resolver.
+import { randomBytes } from 'node:crypto';
+export const TYPE = { DISCOVER:1, OFFER:2, REQUEST:3, DECLINE:4, ACK:5, NAK:6, RELEASE:7 };
+export const ipv4 = text => {
+  const parts=String(text).split('.');
+  if(parts.length!==4 || parts.some(p=>!/^\d{1,3}$/.test(p)||Number(p)>255))throw new Error(`invalid IPv4 address: ${text}`);
+  return Buffer.from(parts.map(Number));
+};
+const address=b=>[...b].join('.');
+export function checksum(b) {let n=0;for(let i=0;i<b.length;i+=2)n+=(b[i]<<8)|(b[i+1]??0);while(n>>>16)n=(n&65535)+(n>>>16);return (~n)&65535;}
+export function encode({type,xid,mac,requested,server,ciaddr='0.0.0.0',hostname,secs=0,broadcast=true}) {
+  const b=Buffer.alloc(240);b[0]=1;b[1]=1;b[2]=6;b.writeUInt32BE(xid,4);b.writeUInt16BE(Math.min(65535,secs),8);
+  b.writeUInt16BE(broadcast?0x8000:0,10);ipv4(ciaddr).copy(b,12);Buffer.from(mac).copy(b,28,0,6);b.writeUInt32BE(0x63825363,236);
+  const options=[];
+  const option=(code,value)=>{value=Buffer.from(value);if(value.length>255)throw new Error('DHCP option too long');options.push(Buffer.from([code,value.length]),value);};
+  option(53,[type]);option(61,[1,...mac]);
+  if(requested)option(50,ipv4(requested));if(server)option(54,ipv4(server));
+  if(hostname)option(12,Buffer.from(hostname));
+  if(type!==TYPE.RELEASE){option(55,[1,3,6,15,28,51,58,59]);option(57,[5,220]);}
+  const packet=Buffer.concat([b,...options,Buffer.from([255])]);
+  return packet.length<300?Buffer.concat([packet,Buffer.alloc(300-packet.length)]):packet;
+}
+export function decode(b,{xid,mac}={}) {
+  if(b.length<240||b[0]!==2||b[1]!==1||b[2]!==6||b.readUInt32BE(236)!==0x63825363)return null;
+  if(xid!==undefined&&b.readUInt32BE(4)!==xid)return null;
+  if(mac&&!b.subarray(28,34).equals(Buffer.from(mac)))return null;
+  const options=new Map();
+  function parse(start,end){for(let i=start;i<end;){const code=b[i++];if(code===255)return true;if(!code)continue;if(i>=end)return false;const len=b[i++];if(i+len>end)return false;options.set(code,Buffer.concat([options.get(code)??Buffer.alloc(0),b.subarray(i,i+len)]));i+=len;}return true;}
+  if(!parse(240,b.length))return null;
+  const overload=options.get(52);if(overload&&(overload.length!==1||overload[0]>3))return null;
+  if(overload?.[0]&1)if(!parse(108,236))return null;
+  if(overload?.[0]&2)if(!parse(44,108))return null;
+  if(options.get(53)?.length!==1)return null;
+  for(const code of [1,28,51,54,58,59])if(options.has(code)&&options.get(code).length!==4)return null;
+  for(const code of [3,6])if(options.has(code)&&(!options.get(code).length||options.get(code).length%4))return null;
+  const ip=code=>options.has(code)?address(options.get(code)):undefined;
+  const ips=code=>{const v=options.get(code),out=[];if(v)for(let i=0;i<v.length;i+=4)out.push(address(v.subarray(i,i+4)));return out;};
+  const number=code=>options.get(code)?.readUInt32BE(0);
+  return {type:options.get(53)[0],xid:b.readUInt32BE(4),address:address(b.subarray(16,20)),server:ip(54),mask:ip(1),routers:options.has(3)?ips(3):undefined,dns:options.has(6)?ips(6):undefined,lease:number(51),t1:number(58),t2:number(59)};
+}
+export function prefixOf(mask) {
+  const n=ipv4(mask).readUInt32BE(),inverse=(~n)>>>0;
+  if((inverse&(inverse+1))!==0)throw new Error('DHCP supplied a non-contiguous subnet mask');
+  return 32-Math.log2(inverse+1);
+}
+export function leaseFrom(reply,previous,now) {
+  const ip=reply.address==='0.0.0.0'?previous?.address:reply.address;
+  const server=reply.server,mask=reply.mask??previous?.mask;
+  if(!ip||ip==='0.0.0.0'||!server||!mask||!reply.lease)throw new Error('DHCP ACK is missing address, server, mask or lease duration');
+  const prefix=prefixOf(mask),seconds=reply.lease;
+  let t1=reply.t1??seconds*.5,t2=reply.t2??seconds*.875;
+  if(!(t1>0&&t1<t2&&t2<seconds)){t1=seconds*.5;t2=seconds*.875;}
+  return {address:ip,server,mask,prefix,routers:reply.routers??previous?.routers??[],dns:reply.dns??previous?.dns??[],seconds,
+    acquiredAt:now,renewAt:now+t1*1000,rebindAt:now+t2*1000,expiresAt:now+seconds*1000};
+}
+// SOCK_DGRAM AF_PACKET supplies/consumes the Ethernet header itself.
+export function wrapIPv4(payload,source='0.0.0.0',destination='255.255.255.255') {
+  const b=Buffer.alloc(28+payload.length);b[0]=0x45;b.writeUInt16BE(b.length,2);b[8]=64;b[9]=17;
+  ipv4(source).copy(b,12);ipv4(destination).copy(b,16);b.writeUInt16BE(checksum(b.subarray(0,20)),10);
+  b.writeUInt16BE(68,20);b.writeUInt16BE(67,22);b.writeUInt16BE(8+payload.length,24);payload.copy(b,28);
+  // IPv4 allows zero UDP checksum; the IPv4 header is checksummed above.
+  return b;
+}
+export function unwrapIPv4(b) {
+  if(b.length<28||b[0]>>>4!==4||b[9]!==17)return null;
+  const h=(b[0]&15)*4,n=b.readUInt16BE(2);
+  if(h<20||n>b.length||n<h+8||(b.readUInt16BE(6)&0x3fff)||checksum(b.subarray(0,h)))return null;
+  const len=b.readUInt16BE(h+4);
+  if(b.readUInt16BE(h)!==67||b.readUInt16BE(h+2)!==68||len<8||h+len>n)return null;
+  if(b.readUInt16BE(h+6)){
+    const pseudo=Buffer.alloc(12);b.copy(pseudo,0,12,20);pseudo[9]=17;pseudo.writeUInt16BE(len,10);
+    if(checksum(Buffer.concat([pseudo,b.subarray(h,h+len)])))return null;
+  }
+  return b.subarray(h+8,h+len);
+}
+export class NakError extends Error {}
+export class DhcpClient {
+  constructor({transport,mac,hostname,timeout=60,signal,log=()=>{},now=Date.now,sleep=ms=>Bun.sleep(ms),random=Math.random}) {
+    Object.assign(this,{transport,mac,hostname,timeout,signal,log,now,sleep,random});
+  }
+  get stopped(){return this.signal?.aborted;}
+  async exchange(fields,types,deadline,server) {
+    const xid=randomBytes(4).readUInt32BE(),start=this.now();let retry=0,next=start;
+    while(!this.stopped&&this.now()<deadline){
+      if(this.now()>=next){
+        const packet=encode({...fields,xid,mac:this.mac,hostname:this.hostname,secs:Math.floor((this.now()-start)/1000)});
+        this.transport.send(packet,fields.broadcast===false?server:undefined);
+        next=this.now()+Math.min(64000,4000*2**Math.min(retry++,4))*(.75+.5*this.random());
+      }
+      // Bound the work per iteration so unrelated traffic cannot starve timers.
+      for(let i=0;i<64;i++){
+        const packet=this.transport.receive();if(!packet)break;
+        const reply=decode(packet,{xid,mac:this.mac});
+        if(!reply||!types.includes(reply.type)||!reply.server||(server&&reply.server!==server))continue;
+        if(reply.type===TYPE.NAK)throw new NakError('DHCP server rejected the lease');
+        return {reply,sentAt:start};
+      }
+      await this.sleep(Math.min(20,Math.max(1,deadline-this.now())));
+    }
+    return null;
+  }
+  async acquire() {
+    const deadline=this.now()+this.timeout*1000;
+    while(!this.stopped&&this.now()<deadline){
+      this.log('DHCPDISCOVER');
+      const offer=await this.exchange({type:TYPE.DISCOVER},[TYPE.OFFER],deadline);
+      if(!offer)return null;
+      if(offer.reply.address==='0.0.0.0')continue;
+      this.log(`DHCPOFFER ${offer.reply.address} from ${offer.reply.server}`);
+      try {
+        const result=await this.exchange({type:TYPE.REQUEST,requested:offer.reply.address,server:offer.reply.server},[TYPE.ACK,TYPE.NAK],Math.min(deadline,this.now()+16000),offer.reply.server);
+        if(result){if(result.reply.address!==offer.reply.address)continue;return leaseFrom(result.reply,offer.reply,result.sentAt);}
+      }catch(error){if(!(error instanceof NakError))throw error;await this.sleep(1000);}
+    }
+    return null;
+  }
+  async renew(lease,rebind=false) {
+    this.log(rebind?'DHCPREQUEST broadcast (rebinding)':'DHCPREQUEST unicast (renewing)');
+    const result=await this.exchange({type:TYPE.REQUEST,ciaddr:lease.address,broadcast:rebind},[TYPE.ACK,TYPE.NAK],rebind?lease.expiresAt:lease.rebindAt,rebind?undefined:lease.server);
+    return result?leaseFrom(result.reply,lease,result.sentAt):null;
+  }
+  release(lease){this.transport.send(encode({type:TYPE.RELEASE,xid:randomBytes(4).readUInt32BE(),mac:this.mac,ciaddr:lease.address,server:lease.server,broadcast:false}),lease.server);}
+}

package/initramfs/lib/dlopen.js

@@ -3,8 +3,7 @@
 // init.js opens musl on its own because it runs before /proc exists and must
 // not import anything. Every other command imports this module instead, so
 // the symbol table, the errno plumbing and the error messages live in one
-// place. The library is located relative to this file (/lib in the guest),
-// which also lets the commands run from a checkout for testing.
+// place. Automatic lookup follows the runtime ABI; BUNINU_LIBC overrides it.
 
 import { dlopen, FFIType, ptr, read, CString, toArrayBuffer } from "bun:ffi";
 
@@ -20,11 +19,13 @@ const architectures = {
 export const arch = architectures[process.arch]
   ?? (() => { throw new Error(`unsupported CPU architecture ${process.arch}`); })();
 
-// BUNINU_LIBC lets the commands run on a glibc host for testing:
-//   BUNINU_LIBC=/lib/aarch64-linux-gnu/libc.so.6 bun initramfs/bin/ip addr
-export const libcPath = process.env.BUNINU_LIBC ?? `${import.meta.dir}/${arch.libc}`;
-
-export const libc = dlopen(libcPath, {
+// Automatic lookup must not mix bionic, glibc and musl runtime ABIs.
+// An explicit override is authoritative: report its error instead of hiding it.
+const android = process.platform === "android";
+const glibc = !android && !!process.report?.getReport?.().header?.glibcVersionRuntime;
+export const libcFamily = android ? "bionic" : glibc ? "glibc" : "musl";
+const errnoSymbol = android ? "__errno" : "__errno_location";
+const definitions = {
   mount: {
     args: [FFIType.ptr, FFIType.ptr, FFIType.ptr, FFIType.u64, FFIType.ptr],
     returns: FFIType.i32,
@@ -41,7 +42,7 @@ export const libc = dlopen(libcPath, {
     args: [],
     returns: FFIType.void,
   },
-  __errno_location: {
+  [errnoSymbol]: {
     args: [],
     returns: FFIType.ptr,
   },
@@ -77,6 +78,14 @@ export const libc = dlopen(libcPath, {
     args: [FFIType.i32, FFIType.i32, FFIType.i32],
     returns: FFIType.i32,
   },
+  bind: { args: [FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+  inet_pton: { args: [FFIType.i32, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+  connect: { args: [FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+  getsockname: { args: [FFIType.i32, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+  setsockopt: { args: [FFIType.i32, FFIType.i32, FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i32 },
+  send: { args: [FFIType.i32, FFIType.ptr, FFIType.u64, FFIType.i32], returns: FFIType.i64 },
+  sendto: { args: [FFIType.i32, FFIType.ptr, FFIType.u64, FFIType.i32, FFIType.ptr, FFIType.u32], returns: FFIType.i64 },
+  recv: { args: [FFIType.i32, FFIType.ptr, FFIType.u64, FFIType.i32], returns: FFIType.i64 },
   syscall: {
     args: [FFIType.i64, FFIType.i64, FFIType.ptr, FFIType.i64],
     returns: FFIType.i32,
@@ -93,13 +102,51 @@ export const libc = dlopen(libcPath, {
     args: [FFIType.ptr],
     returns: FFIType.i32,
   },
-});
+};
+const override = process.env.BUNINU_LIBC;
+const candidates = override !== undefined ? [override]
+  : android ? ["libc.so", "/apex/com.android.runtime/lib64/bionic/libc.so", "/system/lib64/libc.so"]
+  : glibc ? ["libc.so.6", `/lib/${process.arch === "x64" ? "x86_64" : "aarch64"}-linux-gnu/libc.so.6`, `/usr/lib/${process.arch === "x64" ? "x86_64" : "aarch64"}-linux-gnu/libc.so.6`]
+  : [`${import.meta.dir}/${arch.libc}`, arch.libc, `/lib/${arch.libc}`, `/lib/ld-musl-${process.arch === "x64" ? "x86_64" : "aarch64"}.so.1`, "libc.so"];
+// Bun requires at least one symbol per dlopen call. Defer opening until a
+// symbol is requested; unrelated missing symbols never prevent an import.
+export let libcPath;
+const handles = [], bound = new Map();
+let closed = false;
+function resolve(name) {
+  if (bound.has(name)) return bound.get(name);
+  const failures = [];
+  for (const path of libcPath === undefined ? candidates : [libcPath]) {
+    try {
+      const handle = dlopen(path, { [name]: definitions[name] });
+      libcPath = path; handles.push(handle); bound.set(name, handle.symbols[name]);
+      return handle.symbols[name];
+    } catch (error) { failures.push(`${path}: ${error.message}`); }
+  }
+  throw new Error(`Cannot load libc symbol ${name}:\n${failures.join("\n")}`);
+}
+export const libc = {
+  symbols: new Proxy({}, {
+    get(_target, name) {
+      if (closed) throw new Error("libc is closed");
+      if (!Object.hasOwn(definitions, name)) return undefined;
+      const symbol = resolve(name);
+      // Compile the errno accessor before the native call, so first-use FFI
+      // compilation cannot clobber the errno that the caller wants to inspect.
+      // An absent accessor only fails when errno() is actually requested.
+      if (name !== errnoSymbol && !bound.has(errnoSymbol)) {
+        try { resolve(errnoSymbol); } catch {}
+      }
+      return symbol;
+    },
+  }),
+  close() { if (closed) return; closed = true; for (const handle of handles) handle.close(); },
+};
 
 export const cString = (value) => new TextEncoder().encode(`${value}\0`);
 
 // musl reports failure as -1 plus errno; the raw syscall() wrapper does too.
-const errnoLocation = libc.symbols.__errno_location();
-export const errno = () => read.i32(errnoLocation);
+export const errno = () => read.i32(libc.symbols[errnoSymbol]());
 export const strerror = (code) => new CString(libc.symbols.strerror(code)).toString();
 
 export const Errno = {

package/initramfs/lib/fbdev.js

@@ -261,6 +261,26 @@ export const clear = (display, color = { r: 0, g: 0, b: 0, a: 255 }) => {
   }
 };
 
+// msync is a file writeback operation, not a universal fbdev present API.
+// DRM mappings may have no backing fsync operation (vfs_fsync_range then
+// returns EINVAL). Keep working drivers' deferred-I/O sync, but probe unsupported
+// mappings only once. The address is the original mmap base, and flags are fixed.
+export const syncFramebuffer = (display, native = {
+  msync: (...args) => libc.symbols.msync(...args), errno, strerror,
+}) => {
+  if (display.msyncUnsupported) return;
+  for (;;) {
+    if (native.msync(display.address, display.memoryLength, MS_SYNC) !== -1) return;
+    const code = native.errno();
+    if (code === 4) continue; // EINTR
+    if (code === 22 || code === 95) { // EINVAL / EOPNOTSUPP on this device mapping
+      display.msyncUnsupported = true;
+      return;
+    }
+    throw new Error(`msync(${display.path}): ${native.strerror(code)}`);
+  }
+};
+
 export const flush = (display) => {
   const visibleBytes = display.width * display.bytesPerPixel;
   for (let y = 0; y < display.height; y++) {
@@ -269,9 +289,7 @@ export const flush = (display) => {
       + display.xOffset * display.bytesPerPixel;
     display.memory.set(row, position);
   }
-  if (libc.symbols.msync(display.address, display.memoryLength, MS_SYNC) === -1) {
-    fail(`msync(${display.path})`);
-  }
+  syncFramebuffer(display);
 };
 
 // Copies an RGBA ImageData (HTML canvas layout, 4 bytes per pixel, rows of

package/initramfs/lib/gpu.js

@@ -0,0 +1,77 @@
+// Explicit one-shot GPU coldplug. Importing this module never loads a driver.
+import * as fs from "node:fs";
+import { join, basename } from "node:path";
+
+const drivers = new Set(["i915", "xe", "amdgpu", "radeon", "nouveau", "virtio_gpu", "vmwgfx"]);
+export const isGpuPath = (_module, path) => path.startsWith("kernel/drivers/gpu/");
+export const isGpuDriver = (module, path) => isGpuPath(module, path) && drivers.has(module.replaceAll("-", "_"));
+
+export const framebufferUsers = ({ root = "/", io = fs } = {}) => {
+  const users = [];
+  for (const pid of io.readdirSync(join(root, "proc")).filter(name => /^\d+$/.test(name))) {
+    try {
+      const dir = join(root, "proc", pid, "fd");
+      let busy = false;
+      for (const fd of io.readdirSync(dir)) {
+        try { if (/^\/dev\/fb\d+(?: \(deleted\))?$/.test(io.readlinkSync(join(dir, fd)))) busy = true; }
+        catch (error) { if (error.code !== "ENOENT") throw error; }
+      }
+      // An mmap can outlive its fd.
+      if (/\/dev\/fb\d+(?:\s|$)/m.test(io.readFileSync(join(root, "proc", pid, "maps"), "utf8"))) busy = true;
+      if (busy) users.push(pid);
+    } catch (error) {
+      if (error.code !== "ENOENT" && error.code !== "ESRCH") throw error;
+    }
+  }
+  return users;
+};
+
+export const configureGpu = ({ autoload, tryModprobe, root = "/", io = fs, env = process.env, log = console.log } = {}) => {
+  const result = { devices: [], renderNodes: [], framebuffers: [], errors: [], blocked: false };
+  const say = text => { try { log(`[gpu] ${text}`); } catch {} };
+  try {
+    const gid = env.BUNINU_RENDER_GID === undefined ? 0 : Number(env.BUNINU_RENDER_GID);
+    if (!Number.isInteger(gid) || gid < 0 || gid >= 0xffffffff || env.BUNINU_RENDER_GID === "")
+      throw Error("BUNINU_RENDER_GID must be a numeric group ID");
+    const users = framebufferUsers({ root, io });
+    if (users.length) {
+      result.blocked = true;
+      say(`not loaded: framebuffer in use by PID ${users.join(", ")}; exit bunterm/fbdev and run cfg.gpu before reopening it`);
+      return result;
+    }
+    // A virtio GPU may not appear on the virtio bus until its PCI transport loads.
+    try { tryModprobe("virtio_pci"); } catch (error) { result.errors.push(`virtio_pci: ${error?.message ?? error}`); }
+    result.devices = autoload({ buses: ["pci", "virtio"], acceptModule: isGpuDriver });
+    for (const device of result.devices) {
+      if (device.error) result.errors.push(`${device.bus}/${device.device}: ${device.error}`);
+      say(`${device.bus}/${device.device} ${device.modules.join(" ")}: ${device.error ?? (device.loaded.length ? "loaded " + device.loaded.join(" ") : "already loaded/probed")}`);
+    }
+    const list = path => { try { return io.readdirSync(join(root, path)); } catch (error) { if (error.code === "ENOENT") return []; throw error; } };
+    for (const name of list("dev/dri").filter(name => /^renderD\d+$/.test(name)).sort()) {
+      const path = join(root, "dev/dri", name);
+      try {
+        if (!io.statSync(path).isCharacterDevice()) continue;
+        io.chownSync(path, 0, gid);
+        io.chmodSync(path, 0o660);
+        let driver = "unknown";
+        try {
+          const device = join(root, "sys/class/drm", name, "device");
+          driver = basename(io.readlinkSync(join(device, "driver")));
+          // virtio DRM nodes can point at the parent PCI transport device.
+          if (driver === "virtio-pci") for (const child of io.readdirSync(device).filter(n => /^virtio\d+$/.test(n))) {
+            const candidate = basename(io.readlinkSync(join(device, child, "driver")));
+            if (candidate === "virtio_gpu" || candidate === "virtio-gpu") { driver = candidate; break; }
+          }
+        } catch {}
+        result.renderNodes.push({ path: `/dev/dri/${name}`, driver, gid });
+        say(`/dev/dri/${name}: driver=${driver}, root:${gid} mode=0660`);
+      } catch (error) { result.errors.push(`${name}: ${error?.message ?? error}`); }
+    }
+    result.framebuffers = list("dev").filter(name => /^fb\d+$/.test(name)).sort().map(name => `/dev/${name}`);
+    say(`framebuffer: ${result.framebuffers.join(", ") || "none"}; reopen framebuffer clients after GPU handoff`);
+    if (!result.renderNodes.length) say("no accessible render node yet; check kernel firmware/driver messages and GPU support, then retry cfg.gpu after probing finishes");
+    say("clients still need their own Mesa/Vulkan driver; non-root clients need the render node's numeric group");
+  } catch (error) { result.errors.push(String(error?.message ?? error)); }
+  for (const error of result.errors) say(`failed: ${error}; init continues`);
+  return result;
+};

package/initramfs/lib/ping.js

@@ -0,0 +1,110 @@
+import { isIP } from 'node:net';
+import { randomBytes } from 'node:crypto';
+
+export function parsePing(args) {
+  const o={count:4,interval:1,timeout:2,deadline:Infinity,size:56,ttl:64,family:0,quiet:false,timestamp:false};
+  const values={c:'count',i:'interval',W:'timeout',w:'deadline',s:'size',t:'ttl',I:'source'};
+  let positional=false;
+  for(let i=0;i<args.length;i++){
+    const arg=args[i];
+    if(!positional&&arg==='--'){positional=true;continue;}
+    if(!positional&&(arg==='--help'||arg==='-h')){o.help=true;continue;}
+    if(!positional&&arg.startsWith('-')&&arg!=='-'){
+      for(let j=1;j<arg.length;j++){
+        const flag=arg[j];
+        if(values[flag]){const value=arg.slice(j+1)||args[++i];if(value===undefined||value==='')throw Error(`-${flag} requires a value`);if(flag!=='I'&&(!Number.isFinite(Number(value))||!value.trim()))throw Error(`invalid ${values[flag]}`);o[values[flag]]=flag==='I'?value:Number(value);break;}
+        if(flag==='4'||flag==='6')o.family=Number(flag);
+        else if(flag==='q')o.quiet=true;
+        else if(flag==='D')o.timestamp=true;
+        else if(flag!=='n')throw Error(`unknown option -${flag}`);
+      }
+    }else{if(o.host)throw Error('only one destination is supported');o.host=arg;}
+  }
+  if(o.help)return o;
+  if(!o.host)throw Error('destination required (see ping --help)');
+  for(const key of ['count','size','ttl'])if((key!=='count'||o.count!==Infinity)&&(!Number.isInteger(o[key])||o[key]<(key==='size'?0:1)))throw Error(`invalid ${key}`);
+  if(o.size>65507||o.ttl>255||o.count>Number.MAX_SAFE_INTEGER&&o.count!==Infinity)throw Error('count, packet size or TTL out of range');
+  for(const key of ['interval','timeout','deadline'])if(!(o[key]>0)||(!Number.isFinite(o[key])&&!(key==='deadline'&&o[key]===Infinity)))throw Error(`invalid ${key}`);
+  if(o.interval<.002)throw Error('minimum interval is 0.002 seconds');
+  return o;
+}
+export function checksum(bytes) {
+  let sum=0;for(let i=0;i<bytes.length;i+=2)sum+=(bytes[i]<<8)|(bytes[i+1]??0);
+  while(sum>>>16)sum=(sum&65535)+(sum>>>16);return (~sum)&65535;
+}
+export function echoPacket(family,id,seq,size) {
+  const b=Buffer.alloc(size+8);b[0]=family===6?128:8;b.writeUInt16BE(id,4);b.writeUInt16BE(seq,6);randomBytes(size).copy(b,8);
+  if(family===4)b.writeUInt16BE(checksum(b),2);return b;
+}
+export function isEchoReply(bytes,{family,raw,id,seq,packet}) {
+  let offset=0;
+  if(raw&&family===4){if(bytes.length<20||bytes[0]>>>4!==4||bytes[9]!==1)return false;offset=(bytes[0]&15)*4;if(offset<20||offset>bytes.length-8)return false;}
+  const b=bytes.subarray(offset);
+  return b.length===packet.length&&b[0]===(family===6?129:0)&&b[1]===0&&b.readUInt16BE(4)===id&&b.readUInt16BE(6)===seq&&b.subarray(8).equals(packet.subarray(8))&&(family===6||checksum(b)===0);
+}
+export async function runPing(o,{log=console.log,error=console.error,forceRaw=false}={}) {
+  if(!['linux','android'].includes(process.platform))throw Error('ping currently supports Linux and Android; Windows needs an ICMP API backend');
+  const {libc,ptr,cString,errno,SysError,check}=await import('./dlopen.js');
+  const c=libc.symbols;
+  let family=o.family||isIP(o.host)||4,address=o.host;
+  if(isIP(address)&&isIP(address)!==family)throw Error('destination does not match selected address family');
+  if(!isIP(address)){
+    const records=await Bun.dns.lookup(address,{family});address=records.find(r=>r.family===family)?.address;
+    if(!address)throw Error(`no IPv${family} address for ${o.host}`);
+  }
+  const af=family===6?10:2;
+  const sockaddr=value=>{
+    const b=Buffer.alloc(family===6?28:16);b.writeUInt16LE(af,0);
+    if(c.inet_pton(af,ptr(cString(value)),ptr(b.subarray(family===6?8:4)))!==1)throw Error(`invalid IPv${family} address: ${value}`);
+    return b;
+  };
+  let raw=forceRaw,fd=c.socket(af,(raw?3:2)|0x80800,family===6?58:1);
+  if(fd<0&&!raw){const code=errno();if(![1,13,93,97].includes(code))throw new SysError('ICMP socket',code);raw=true;fd=c.socket(af,3|0x80800,family===6?58:1);}
+  if(fd<0)throw new SysError('ICMP socket (allow ping_group_range or CAP_NET_RAW)');
+  let stop=false;const interrupt=()=>{stop=true};let transmitted=0,received=0,min=Infinity,max=0,sum=0,sumSquares=0;
+  const started=performance.now(),pending=new Map();let next=started;
+  const prefix=()=>o.timestamp?`[${(Date.now()/1000).toFixed(6)}] `:'';
+  try{
+    if(o.source){
+      if(isIP(o.source)){const src=sockaddr(o.source);check('bind source address',c.bind(fd,ptr(src),src.length));}
+      else{const name=cString(o.source);check('bind interface',c.setsockopt(fd,1,25,ptr(name),name.length));}
+    }
+    const ttl=Buffer.alloc(4);ttl.writeInt32LE(o.ttl);check('set TTL',c.setsockopt(fd,family===6?41:0,family===6?16:2,ptr(ttl),4));
+    const remote=sockaddr(address);check('connect',c.connect(fd,ptr(remote),remote.length));
+    const local=Buffer.alloc(28),length=Buffer.alloc(4);length.writeUInt32LE(local.length);check('getsockname',c.getsockname(fd,ptr(local),ptr(length)));
+    const id=raw?randomBytes(2).readUInt16BE():local.readUInt16BE(2);
+    log(`PING ${o.host} (${address}) ${o.size} data bytes`);
+    process.on('SIGINT',interrupt);process.on('SIGTERM',interrupt);
+    const buffer=Buffer.alloc(65536);
+    while(!stop&&performance.now()-started<o.deadline*1000){
+      let now=performance.now();
+      if(transmitted<o.count&&now>=next){
+        const seq=(transmitted+1)&65535;
+        // Avoid confusing a sequence that wrapped while an old probe is pending.
+        if(!pending.has(seq)){
+          const packet=echoPacket(family,id,seq,o.size);const sent=Number(c.send(fd,ptr(packet),packet.length,0));
+          if(sent!==packet.length)throw new SysError('send');
+          transmitted++;pending.set(seq,{packet,start:now});
+        }
+        next=now+o.interval*1000;
+      }
+      for(let n=0;n<64;n++){
+        const size=Number(c.recv(fd,ptr(buffer),buffer.length,0));
+        if(size<0){const code=errno();if(code===11)break;if(code===4)continue;if([101,111,113].includes(code)){if(!o.quiet)error(`${prefix()}ping: ${new SysError('receive',code).message}`);break;}throw new SysError('receive',code);}
+        const b=buffer.subarray(0,size),offset=raw&&family===4?(b[0]&15)*4:0;
+        if(size<offset+8)continue;const seq=b.readUInt16BE(offset+6),p=pending.get(seq);
+        if(!p||!isEchoReply(b,{family,raw,id,seq,packet:p.packet}))continue;
+        const ms=performance.now()-p.start;pending.delete(seq);received++;min=Math.min(min,ms);max=Math.max(max,ms);sum+=ms;sumSquares+=ms*ms;
+        if(!o.quiet)log(`${prefix()}${p.packet.length} bytes from ${address}: icmp_seq=${seq}${raw&&family===4?` ttl=${b[8]}`:''} time=${ms.toFixed(3)} ms`);
+      }
+      now=performance.now();for(const [seq,p] of pending)if(now-p.start>=o.timeout*1000){pending.delete(seq);if(!o.quiet)log(`${prefix()}Request timeout for icmp_seq=${seq}`);}
+      if(transmitted>=o.count&&!pending.size)break;
+      const sendDelay=transmitted<o.count?next-now:10;
+      await Bun.sleep(Math.max(1,Math.min(10,sendDelay,started+o.deadline*1000-now)));
+    }
+  }finally{process.removeListener('SIGINT',interrupt);process.removeListener('SIGTERM',interrupt);c.close(fd);}
+  log(`\n--- ${o.host} ping statistics ---`);
+  log(`${transmitted} packets transmitted, ${received} received, ${transmitted?((transmitted-received)/transmitted*100).toFixed(0):0}% packet loss, time ${Math.round(performance.now()-started)}ms`);
+  if(received)log(`rtt min/avg/max/mdev = ${min.toFixed(3)}/${(sum/received).toFixed(3)}/${max.toFixed(3)}/${Math.sqrt(Math.max(0,sumSquares/received-(sum/received)**2)).toFixed(3)} ms`);
+  return received>0&&!(Number.isFinite(o.deadline)&&Number.isFinite(o.count)&&received<o.count)?0:1;
+}

package/initramfs/lib/raw-image.js

@@ -0,0 +1,47 @@
+// Retain immutable raw pixels until an operation actually needs a Skia Image.
+// The native image store owns these handles; encoded images remain ordinary Skia images.
+const rawImages = new WeakMap();
+export const rawImageData = image => rawImages.get(image);
+export const skiaImage = image => rawImages.get(image)?.materialize() ?? image;
+
+export function createRawImage(CanvasKit, pixels, width, height, colorType) {
+  let decoded = null, closed = false;
+  const data = {
+    pixels, width, height, colorType,
+    opaque: undefined,
+    materialize() {
+      if (closed) throw Error('raw image is closed');
+      if (!decoded) {
+        decoded = CanvasKit.MakeImage({width, height, colorType,
+          alphaType: CanvasKit.AlphaType.Unpremul, colorSpace: CanvasKit.ColorSpace.SRGB}, pixels, width * 4);
+        if (!decoded) throw Error('raw image rejected');
+      }
+      return decoded;
+    },
+  };
+  const image = {
+    width: () => width,
+    height: () => height,
+    delete() {
+      if (closed) return;
+      closed = true;
+      decoded?.delete(); decoded = null;
+      data.pixels = pixels = null;
+      rawImages.delete(image);
+    },
+  };
+  rawImages.set(image, data);
+  return image;
+}
+
+// Check actual bytes once; raw protocol support does not imply opacity.
+export function rawImageOpaque(data) {
+  if (data.opaque === undefined) {
+    const pixels = data.pixels;
+    data.opaque = true;
+    for (let i = 3; i < pixels.length; i += 4) {
+      if (pixels[i] !== 255) { data.opaque = false; break; }
+    }
+  }
+  return data.opaque;
+}

package/initramfs/lib/xdg-open.js

@@ -0,0 +1,42 @@
+import { realpathSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+export function browserTarget(target, cwd = process.cwd()) {
+  if (/^about:/i.test(target)) return target;
+  if (/^https?:\/\//i.test(target)) {
+    // Reject malformed URLs before starting a new terminal.
+    try { return new URL(target).href; }
+    catch { throw openError("Invalid HTTP/HTTPS URL", 1); }
+  }
+  const fileUrl = /^file:/i.test(target);
+  if (!fileUrl && /^[a-z][a-z0-9+.-]*:/i.test(target)) {
+    throw openError("Unsupported URL scheme; use http://, https://, about: or a local file", 4);
+  }
+  const path = realpathSync(fileUrl ? fileURLToPath(target) : resolve(cwd, target));
+  if (!statSync(path).isFile()) throw openError("Expected a regular file", 4);
+  // Encode spaces, #, %, and non-ASCII characters as URL path components.
+  return pathToFileURL(path).href;
+}
+
+export function parseOpenArgs(args) {
+  if (args.length === 1 && ["-h", "--help", "--manual"].includes(args[0])) return { help: true };
+  if (args.length === 1 && args[0] === "--version") return { version: true };
+  if (args.length !== 1 || !args[0]) throw openError("Usage: xdg-open URL | FILE (see --help)", 1);
+  if (args[0].startsWith("-")) throw openError("Use ./ before a filename beginning with '-'", 1);
+  return { target: args[0] };
+}
+
+export function openError(message, exitCode) {
+  return Object.assign(new Error(message), { exitCode });
+}
+
+export function openExitCode(error) {
+  return error.exitCode ?? (["ENOENT", "ENOTDIR"].includes(error.code) ? 2 : 4);
+}
+
+export function releaseVersion(text) {
+  const value = /^VERSION_ID=(.*)$/m.exec(text)?.[1]?.trim();
+  if (!value) throw new Error("VERSION_ID missing from os-release");
+  return value.replace(/^["']|["']$/g, "");
+}