Updates

packages/bare-os-seeder/kernel/bin/grep

@@ -115,6 +115,12 @@ async function run(ctx, argv) {
   /** @type {'never' | 'always' | 'auto'} */
   let colorMode = 'never'
   let recursive = false
+  /** @type {string[]} */
+  const includeGlobs = []
+  /** @type {string[]} */
+  const excludeGlobs = []
+  /** @type {string[]} */
+  const excludeDirGlobs = []
 
   const args = argv.slice(1)
   let i = 0
@@ -182,6 +188,36 @@ async function run(ctx, argv) {
         i++
         continue
       }
+      if (a === '--include' && args[i + 1]) {
+        includeGlobs.push(args[++i])
+        i++
+        continue
+      }
+      if (a.startsWith('--include=')) {
+        includeGlobs.push(a.slice('--include='.length))
+        i++
+        continue
+      }
+      if (a === '--exclude' && args[i + 1]) {
+        excludeGlobs.push(args[++i])
+        i++
+        continue
+      }
+      if (a.startsWith('--exclude=')) {
+        excludeGlobs.push(a.slice('--exclude='.length))
+        i++
+        continue
+      }
+      if (a === '--exclude-dir' && args[i + 1]) {
+        excludeDirGlobs.push(args[++i])
+        i++
+        continue
+      }
+      if (a.startsWith('--exclude-dir=')) {
+        excludeDirGlobs.push(a.slice('--exclude-dir='.length))
+        i++
+        continue
+      }
       ctx.console.error('grep: unknown option ' + a)
       ctx.exitCode = 2
       return
@@ -393,7 +429,15 @@ async function run(ctx, argv) {
           continue
         }
         if (st.type === 'directory') {
-          await grepWalkFiles(ctx, p, acc, suppressErrors)
+          await grepWalkFiles(ctx, p, acc, suppressErrors, {
+            includeGlobs,
+            excludeGlobs,
+            excludeDirGlobs,
+            filterCap: Number.parseInt(
+              String(ctx.vfs?.env?.BARE_OS_GREP_FILTER_MAX || '32'),
+              10
+            ) || 32
+          })
         } else {
           acc.push(p)
         }
@@ -589,8 +633,31 @@ const GREP_RECURSE_MAX_DEPTH = 64
  * @param {string[]} acc
  * @param {boolean} suppressErrors
  */
-async function grepWalkFiles(ctx, dir, acc, suppressErrors) {
+/**
+ * @param {string} name
+ * @param {string} pat
+ */
+function grepSimpleGlobMatch(name, pat) {
+  if (!pat || pat === '*') return true
+  if (pat.includes('/')) return name === pat
+  if (pat.startsWith('*') && pat.length > 1 && pat.endsWith('*')) {
+    const mid = pat.slice(1, -1)
+    return mid !== '' && name.includes(mid)
+  }
+  if (pat.startsWith('*')) return name.endsWith(pat.slice(1))
+  if (pat.endsWith('*')) return name.startsWith(pat.slice(0, -1))
+  return name === pat
+}
+
+/**
+ * @param {{ includeGlobs?: string[], excludeGlobs?: string[], excludeDirGlobs?: string[], filterCap?: number }} [opts]
+ */
+async function grepWalkFiles(ctx, dir, acc, suppressErrors, opts = {}) {
   const vfs = ctx.vfs
+  const cap = opts.filterCap && opts.filterCap > 0 ? opts.filterCap : 32
+  const inc = (opts.includeGlobs || []).slice(0, cap)
+  const exc = (opts.excludeGlobs || []).slice(0, cap)
+  const excd = (opts.excludeDirGlobs || []).slice(0, cap)
   /** @param {string} d @param {number} depth */
   const walk = async (d, depth) => {
     if (depth > GREP_RECURSE_MAX_DEPTH) return
@@ -612,12 +679,21 @@ async function grepWalkFiles(ctx, dir, acc, suppressErrors) {
         continue
       }
       if (!st) continue
-      if (st.type === 'directory') await walk(sub, depth + 1)
-      else if (st.type === 'file') acc.push(sub)
-      else if (st.type === 'symlink') {
+      if (st.type === 'directory') {
+        if (excd.some((p) => grepSimpleGlobMatch(n, p))) continue
+        await walk(sub, depth + 1)
+      } else if (st.type === 'file') {
+        if (inc.length && !inc.some((p) => grepSimpleGlobMatch(n, p))) continue
+        if (exc.some((p) => grepSimpleGlobMatch(n, p))) continue
+        acc.push(sub)
+      } else if (st.type === 'symlink') {
         try {
           const ft = await vfs.stat(sub)
-          if (ft && ft.type === 'file') acc.push(sub)
+          if (ft && ft.type === 'file') {
+            if (inc.length && !inc.some((p) => grepSimpleGlobMatch(n, p))) continue
+            if (exc.some((p) => grepSimpleGlobMatch(n, p))) continue
+            acc.push(sub)
+          }
         } catch {
           /* skip */
         }

packages/bare-os-seeder/kernel/bin/sed

@@ -603,12 +603,13 @@ function bareSedMatchAddr(
 /**
  * @param {string[]} lines
  * @param {string[]} scripts
- * @param {{ silent?: boolean, extended?: boolean, readFile?: (p: string) => string | null, writeFile?: (p: string, chunk: string) => void, lastLineHint?: number }} opts
+ * @param {{ silent?: boolean, extended?: boolean, nullData?: boolean, readFile?: (p: string) => string | null, writeFile?: (p: string, chunk: string) => void, lastLineHint?: number }} opts
  * @returns {string}
  */
 function bareSedRun(lines, scripts, opts) {
   const silent = !!opts.silent
   const extended = !!opts.extended
+  const eol = opts.nullData ? '\0' : '\n'
   const readF = opts.readFile || (() => null)
   const writeF = opts.writeFile || (() => {})
   const fullScript = scripts.join('\n')
@@ -697,7 +698,7 @@ function bareSedRun(lines, scripts, opts) {
           }
           if (count) {
             ps = res + str.slice(pos)
-            if (fl.p) emit(ps + '\n')
+            if (fl.p) emit(ps + eol)
           }
           break
         }
@@ -726,15 +727,15 @@ function bareSedRun(lines, scripts, opts) {
           break
         }
         case 'print':
-          emit(ps + '\n')
+          emit(ps + eol)
           break
         case 'printFirst': {
           const nl = ps.indexOf('\n')
-          emit((nl === -1 ? ps : ps.slice(0, nl)) + '\n')
+          emit((nl === -1 ? ps : ps.slice(0, nl)) + eol)
           break
         }
         case 'nextLine':
-          if (autoPrint && !silent) emit(ps + '\n')
+          if (autoPrint && !silent) emit(ps + eol)
           lineIdx++
           nextRead = true
           ci = cmds.length
@@ -763,25 +764,25 @@ function bareSedRun(lines, scripts, opts) {
           break
         }
         case 'quit':
-          if (autoPrint && !silent) emit(ps + '\n')
+          if (autoPrint && !silent) emit(ps + eol)
           quit = /** @type {number} */ (cmd.quitCode) || 0
           break
         case 'list':
-          emit(bareSedListLine(ps) + '\n')
+          emit(bareSedListLine(ps) + eol)
           break
         case 'lineNum':
-          emit(String(lineNo) + '\n')
+          emit(String(lineNo) + eol)
           break
         case 'readFile': {
           const text = readF(/** @type {string} */ (cmd.path))
-          if (text) emit(text.endsWith('\n') ? text : text + '\n')
+          if (text) emit(text.endsWith(eol) ? text : text + eol)
           break
         }
         case 'writeFile':
           writeF(/** @type {string} */ (cmd.path), ps + '\n')
           break
         case 'append':
-          emit(/** @type {string} */ (cmd.text) + '\n')
+          emit(/** @type {string} */ (cmd.text) + eol)
           break
         case 'insert':
           /* handled as emit before line — approximated by prepending to output before autoPrint */
@@ -789,7 +790,7 @@ function bareSedRun(lines, scripts, opts) {
           break
         case 'change':
           autoPrint = false
-          emit(/** @type {string} */ (cmd.text) + '\n')
+          emit(/** @type {string} */ (cmd.text) + eol)
           delLine = true
           break
         case 'b': {
@@ -815,7 +816,7 @@ function bareSedRun(lines, scripts, opts) {
 
     if (quit) break
     if (nextRead) continue
-    if (!delLine && autoPrint) emit(ps + '\n')
+    if (!delLine && autoPrint) emit(ps + eol)
     lineIdx++
   }
 
@@ -825,6 +826,7 @@ function bareSedRun(lines, scripts, opts) {
 async function run(ctx, argv) {
   let silent = false
   let extended = false
+  let nullData = false
   /** @type {string[]} */
   const scripts = []
   /** @type {string[]} */
@@ -835,6 +837,10 @@ async function run(ctx, argv) {
       silent = true
       continue
     }
+    if (a === '-z' || a === '--null-data') {
+      nullData = true
+      continue
+    }
     if (a === '-E' || a === '-r') {
       extended = true
       continue
@@ -913,6 +919,12 @@ async function run(ctx, argv) {
     readCache[rp] = buf ? ctx.b4a.toString(buf) : ''
   }
 
+  const maxNull =
+    Number.parseInt(
+      String(ctx.vfs?.env?.BARE_OS_SED_NULL_MAX_RECORDS || '100000'),
+      10
+    ) || 100000
+
   /** @type {string[]} */
   const lines = []
   async function pushFile(path) {
@@ -923,16 +935,22 @@ async function run(ctx, argv) {
       return false
     }
     const t = ctx.b4a.toString(buf)
-    const ls = t.split(/\r?\n/)
-    if (ls.length && ls[ls.length - 1] === '') ls.pop()
-    lines.push(...ls)
+    if (nullData) {
+      const rec = t.split('\0')
+      const room = maxNull - lines.length
+      lines.push(...rec.slice(0, Math.max(0, room)))
+    } else {
+      const ls = t.split(/\r?\n/)
+      if (ls.length && ls[ls.length - 1] === '') ls.pop()
+      lines.push(...ls)
+    }
     return true
   }
 
   if (!files.length) {
     const s = bareStdin(ctx)
-    const ls = s.split(/\r?\n/)
-    if (ls.length && ls[ls.length - 1] === '') ls.pop()
+    const ls = nullData ? s.split('\0').slice(0, maxNull) : s.split(/\r?\n/)
+    if (!nullData && ls.length && ls[ls.length - 1] === '') ls.pop()
     lines.push(...ls)
   } else {
     for (const f of files) {
@@ -945,6 +963,7 @@ async function run(ctx, argv) {
   const out = bareSedRun(lines, scripts, {
     silent,
     extended,
+    nullData,
     readFile: (p) => readCache[p] ?? null,
     writeFile: (p, chunk) => {
       wAccum[p] = (wAccum[p] || '') + chunk
@@ -965,6 +984,7 @@ async function run(ctx, argv) {
     }
   }
 
-  const t = out.replace(/\n$/, '')
+  const trail = nullData ? /\0$/ : /\n$/
+  const t = out.replace(trail, '')
   ctx.console.log(t)
 }

packages/bare-os-seeder/kernel/init.js

@@ -25,6 +25,9 @@
  * BARE_OS_SELFTEST_FORMAT=tap: TAP-style lines on stderr for CI parsers.
  * BARE_OS_BOOT_ALLOWLIST=1 and /etc/bare-os/boot.allow: only first-word commands in that file (plus shell builtins) run from trusted rc/onboot snippets.
  *
+ * BARE_OS_BOOT_MANIFEST_SIGN=1: verify Ed25519 signature in /etc/bare-os/boot.manifest.sig over the raw
+ * manifest bytes; public key from BARE_OS_BOOT_MANIFEST_PUBKEY_HEX (64 hex chars). Uses ctx.bareOsVerifyBootManifestSignature.
+ *
  * BARE_OS_BOOT_STRICT=1 or true: first execLine throw in trusted boot snippets calls
  * requestBooterExit(1) and stops further boot phases.
  *
@@ -260,6 +263,30 @@ async function loadBootManifest(ctx) {
       bootManifestMemo = null
       return null
     }
+    const signOn =
+      ctx.env &&
+      (ctx.env.BARE_OS_BOOT_MANIFEST_SIGN === '1' ||
+        ctx.env.BARE_OS_BOOT_MANIFEST_SIGN === 'true')
+    if (signOn) {
+      const sigBuf = await drive.get('/etc/bare-os/boot.manifest.sig')
+      const pub =
+        ctx.env && ctx.env.BARE_OS_BOOT_MANIFEST_PUBKEY_HEX
+          ? String(ctx.env.BARE_OS_BOOT_MANIFEST_PUBKEY_HEX).trim()
+          : ''
+      const verifyFn = ctx.bareOsVerifyBootManifestSignature
+      if (typeof verifyFn !== 'function' || !pub) {
+        console.error(
+          '[boot] signed manifest requires ctx.bareOsVerifyBootManifestSignature and BARE_OS_BOOT_MANIFEST_PUBKEY_HEX'
+        )
+        bootManifestMemo = null
+        return null
+      }
+      if (!verifyFn(buf, sigBuf, pub)) {
+        console.error('[boot] boot.manifest.json Ed25519 signature verification failed')
+        bootManifestMemo = null
+        return null
+      }
+    }
     bootManifestMemo = JSON.parse(b4a.toString(buf))
     return bootManifestMemo
   } catch (e) {

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -7,18 +7,18 @@
         "b4a"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/safetyCatch.js",
-      "keys": [
-        "safetyCatch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
         "hypercoreIdEncoding"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/safetyCatch.js",
+      "keys": [
+        "safetyCatch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/compactEncoding.js",
       "keys": [
@@ -31,6 +31,12 @@
         "bareUrl"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/protomux.js",
+      "keys": [
+        "protomux"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEncoding.js",
       "keys": [
@@ -43,12 +49,6 @@
         "bareEvents"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/protomux.js",
-      "keys": [
-        "protomux"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePath.js",
       "keys": [
@@ -109,12 +109,6 @@
         "bareAsyncHooks"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAtomics.js",
       "keys": [
@@ -127,6 +121,12 @@
         "bareAssert"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareBmp.js",
       "keys": [
@@ -175,24 +175,18 @@
         "bareConsole"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
-      "keys": [
-        "bareDebugLog"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDaemon.js",
-      "keys": [
-        "bareDaemon"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBundleId.js",
       "keys": [
         "bareBundleId"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "keys": [
+        "bareDebugLog"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareChannel.js",
       "keys": [
@@ -205,6 +199,12 @@
         "bareDelta"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDaemon.js",
+      "keys": [
+        "bareDaemon"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareDns.js",
       "keys": [
@@ -217,6 +217,12 @@
         "bareDiagnosticsChannel"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareCov.js",
+      "keys": [
+        "bareCov"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEnv.js",
       "keys": [
@@ -229,36 +235,12 @@
         "bareExif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCov.js",
-      "keys": [
-        "bareCov"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDgram.js",
       "keys": [
         "bareDgram"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFfmpeg.js",
-      "keys": [
-        "bareFfmpeg"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
-      "keys": [
-        "bareFfmpegEncodings"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFormat.js",
-      "keys": [
-        "bareFormat"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareFormData.js",
       "keys": [
@@ -266,9 +248,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHeif.js",
+      "path": "/lib/bare/bundles/bareFfmpegEncodings.js",
       "keys": [
-        "bareHeif"
+        "bareFfmpegEncodings"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "keys": [
+        "bareFfmpeg"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFormat.js",
+      "keys": [
+        "bareFormat"
       ]
     },
     {
@@ -283,6 +277,12 @@
         "bareGif"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareGtk.js",
       "keys": [
@@ -295,42 +295,36 @@
         "bareHrtime"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFs.js",
-      "keys": [
-        "bareFs"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHttpParser.js",
       "keys": [
         "bareHttpParser"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
         "bareIco"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareImageResample.js",
-      "keys": [
-        "bareImageResample"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareInspect.js",
-      "keys": [
-        "bareInspect"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHttp1.js",
       "keys": [
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareImageResample.js",
+      "keys": [
+        "bareImageResample"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
@@ -338,15 +332,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareJpeg.js",
+      "path": "/lib/bare/bundles/bareInspect.js",
       "keys": [
-        "bareJpeg"
+        "bareInspect"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareIntl.js",
+      "path": "/lib/bare/bundles/bareJpeg.js",
       "keys": [
-        "bareIntl"
+        "bareJpeg"
       ]
     },
     {
@@ -355,24 +349,30 @@
         "bareIpc"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareLief.js",
       "keys": [
         "bareLief"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareLogger.js",
-      "keys": [
-        "bareLogger"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareLink.js",
       "keys": [
         "bareLink"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareLogger.js",
+      "keys": [
+        "bareLogger"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareInspector.js",
       "keys": [
@@ -386,9 +386,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareModuleResolve.js",
+      "path": "/lib/bare/bundles/bareModule.js",
       "keys": [
-        "bareModuleResolve"
+        "bareModule"
       ]
     },
     {
@@ -397,24 +397,18 @@
         "bareModuleLexer"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareModuleResolve.js",
+      "keys": [
+        "bareModuleResolve"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModuleTraverse.js",
       "keys": [
         "bareModuleTraverse"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModule.js",
-      "keys": [
-        "bareModule"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNodeFetch.js",
-      "keys": [
-        "bareNodeFetch"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNdk.js",
       "keys": [
@@ -428,21 +422,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDev.js",
+      "path": "/lib/bare/bundles/bareNodeFetch.js",
       "keys": [
-        "bareDev"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareOs.js",
-      "keys": [
-        "bareOs"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareOpen.js",
-      "keys": [
-        "bareOpen"
+        "bareNodeFetch"
       ]
     },
     {
@@ -458,15 +440,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePerformance.js",
+      "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
-        "barePerformance"
+        "bareOpen"
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePng.js",
+      "path": "/lib/bare/bundles/bareOs.js",
       "keys": [
-        "barePng"
+        "bareOs"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/barePerformance.js",
+      "keys": [
+        "barePerformance"
       ]
     },
     {
@@ -476,9 +464,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/barePack.js",
+      "path": "/lib/bare/bundles/barePng.js",
       "keys": [
-        "barePack"
+        "barePng"
       ]
     },
     {
@@ -487,18 +475,36 @@
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePack.js",
+      "keys": [
+        "barePack"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePunycode.js",
       "keys": [
         "barePunycode"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareQuerystring.js",
       "keys": [
         "bareQuerystring"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
@@ -512,9 +518,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "path": "/lib/bare/bundles/bareProcess.js",
       "keys": [
-        "bareNodeRuntime"
+        "bareProcess"
       ]
     },
     {
@@ -524,15 +530,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareProcess.js",
+      "path": "/lib/bare/bundles/bareSdl.js",
       "keys": [
-        "bareProcess"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePromClient.js",
-      "keys": [
-        "barePromClient"
+        "bareSdl"
       ]
     },
     {
@@ -542,9 +542,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRepl.js",
+      "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
-        "bareRepl"
+        "barePromClient"
       ]
     },
     {
@@ -553,18 +553,18 @@
         "bareRpc"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSdl.js",
-      "keys": [
-        "bareSdl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
         "bareSemver"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
@@ -578,27 +578,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSidecar.js",
+      "path": "/lib/bare/bundles/bareRepl.js",
       "keys": [
-        "bareSidecar"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStream.js",
-      "keys": [
-        "bareStream"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStorage.js",
-      "keys": [
-        "bareStorage"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStdio.js",
-      "keys": [
-        "bareStdio"
+        "bareRepl"
       ]
     },
     {
@@ -607,6 +589,12 @@
         "bareStringDecoder"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareStorage.js",
+      "keys": [
+        "bareStorage"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSvg.js",
       "keys": [
@@ -614,9 +602,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareStream.js",
       "keys": [
-        "bareSystemLogger"
+        "bareStream"
       ]
     },
     {
@@ -626,15 +614,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
-        "bareTiff"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareTap.js",
-      "keys": [
-        "bareTap"
+        "bareStdio"
       ]
     },
     {
@@ -644,15 +626,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareThread.js",
+      "path": "/lib/bare/bundles/bareTap.js",
       "keys": [
-        "bareThread"
+        "bareTap"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTcp.js",
+      "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
-        "bareTcp"
+        "bareTiff"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "keys": [
+        "bareSystemLogger"
       ]
     },
     {
@@ -668,15 +656,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareThread.js",
       "keys": [
-        "bareTls"
+        "bareThread"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareTty.js",
+      "path": "/lib/bare/bundles/bareTcp.js",
       "keys": [
-        "bareTty"
+        "bareTcp"
       ]
     },
     {
@@ -692,9 +680,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareUnpack.js",
+      "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
-        "bareUnpack"
+        "bareTty"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
       ]
     },
     {
@@ -704,9 +698,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWalkHandles.js",
+      "path": "/lib/bare/bundles/bareUnpack.js",
       "keys": [
-        "bareWalkHandles"
+        "bareUnpack"
       ]
     },
     {
@@ -716,9 +710,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareUnionBundle.js",
+      "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
-        "bareUnionBundle"
+        "bareWalkHandles"
       ]
     },
     {
@@ -740,9 +734,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWhich.js",
+      "path": "/lib/bare/bundles/bareUnionBundle.js",
       "keys": [
-        "bareWhich"
+        "bareUnionBundle"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
+      "keys": [
+        "bareV8ToIstanbul"
       ]
     },
     {
@@ -752,9 +752,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
+      "path": "/lib/bare/bundles/bareWhich.js",
       "keys": [
-        "bareV8ToIstanbul"
+        "bareWhich"
       ]
     },
     {
@@ -769,12 +769,6 @@
         "bareXdiff"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWs.js",
-      "keys": [
-        "bareWs"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareZlib.js",
       "keys": [
@@ -787,6 +781,12 @@
         "bareWorker"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareZmq.js",
       "keys": [

packages/bare-os-seeder/lib/paths.js

@@ -1,6 +1,6 @@
 import path from 'path'
 import { statSync } from 'fs'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath } from 'url'
 import os from 'bare-os'
 
 function cwd() {

packages/bare-os-seeder/lib/pear-multisig-hint.js

@@ -1,9 +1,46 @@
 import { readFile } from 'fs/promises'
 import path from 'path'
+import b4a from 'b4a'
+
+/**
+ * @returns {Promise<((cmd: string, args: string[], opts?: object) => object) | null>}
+ */
+async function loadSpawnSync() {
+  try {
+    const m = await import('bare-subprocess')
+    if (m && typeof m.spawnSync === 'function') return m.spawnSync
+  } catch {
+    /* bare-subprocess missing or native addon unavailable */
+  }
+  try {
+    const m = await import('child_process')
+    if (m && typeof m.spawnSync === 'function') return m.spawnSync
+  } catch {
+    /* Node child_process unavailable */
+  }
+  return null
+}
+
+/**
+ * @param {object} r spawnSync result (Node or bare-subprocess)
+ * @param {'stdout' | 'stderr'} key
+ */
+function pipeText(r, key) {
+  const v = r[key]
+  if (v == null) return ''
+  if (typeof v === 'string') return v
+  try {
+    return b4a.toString(v)
+  } catch {
+    return String(v)
+  }
+}
 
 /**
  * When `pear.multisig.json` exists next to the kernel tree, validate shape and log status.
  * Mirrors Holepunch `pear-multisig-link` style metadata (operational hint, not cryptography).
+ * Subprocess: prefers **`bare-subprocess`** (Pear/Bare); falls back to **`child_process`** on Node.
+ * Do not use **`node:child_process`** — it is not resolvable under Bare.
  * @param {string} kernelRoot
  */
 export async function logPearMultisigKernelHint(kernelRoot) {
@@ -24,6 +61,33 @@ export async function logPearMultisigKernelHint(kernelRoot) {
     console.log(
       `[seeder] pear.multisig.json OK (${signers.length} signers, quorum ${quorum})`
     )
+    if (
+      process.env.BARE_OS_HYPER_MULTISIG_VERIFY === '1' ||
+      process.env.BARE_OS_HYPER_MULTISIG_VERIFY === 'true'
+    ) {
+      const spawnSync = await loadSpawnSync()
+      if (!spawnSync) {
+        console.warn(
+          '[seeder] hyper-multisig verify skipped (no subprocess: install bare-subprocess or use Node)'
+        )
+        return
+      }
+      const r = spawnSync('hyper-multisig', ['verify', f], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe']
+      })
+      if (r.error) {
+        console.warn(
+          '[seeder] hyper-multisig verify skipped (CLI not on PATH):',
+          r.error.message
+        )
+      } else if (r.status !== 0) {
+        const msg = (pipeText(r, 'stderr') || pipeText(r, 'stdout')).trim().slice(0, 400)
+        console.warn('[seeder] hyper-multisig verify failed:', msg || `exit ${r.status}`)
+      } else {
+        console.log('[seeder] hyper-multisig verify OK')
+      }
+    }
   } catch (e) {
     if (/** @type {NodeJS.ErrnoException} */ (e).code === 'ENOENT') return
     console.warn('[seeder] pear.multisig.json:', e?.message || e)

packages/bare-os-seeder/package.json

@@ -10,6 +10,7 @@
     "pear:dev": "node ../../scripts/ensure-pear-node-modules.mjs packages/bare-os-seeder && pear run --dev ."
   },
   "dependencies": {
+    "bare-subprocess": "^5.2.3",
     "bare-os": "^3.8.7",
     "bare-os-protocol": "*",
     "b4a": "^1.6.7",