- SFTP.js: validate handle/offset/len on REQUEST.READ; guard WRITE/FSETSTAT

handle access like other handlers (avoid throwing before doFatalSFTPError).
- bare-openssh-sftp: enqueueSftpReply(reqid, fn) sends SSH_FX_FAILURE on
  handler throw/reject; defensive READ path (buffer/finite offsets).
- Document regression (bad_optional_access / -fno-exceptions) in comments;
  add packages/bare-os-openssh/CHANGELOG.md Unreleased entry.

packages/bare-os-booter/lib/bare-openssh-sftp.js

@@ -182,17 +182,31 @@ export function attachBareOsSftp(
 
   /**
    * Strict SFTP clients (e.g. FileZilla) expect outbound replies in the same order as
-   * requests were received; overlapping async handlers (REALPATH/STAT/OPENDIR/READDIR)
-   * otherwise reorder packets and trigger "request ID mismatch".
+   * requests were received; overlapping async handlers otherwise reorder packets and
+   * trigger "request ID mismatch". After serializing replies here, a rejected handler
+   * that sent no packet could stall clients; thrown errors during SFTP encode have been
+   * seen as native `bad_optional_access` (-fno-exceptions) killing sshd — always emit
+   * STATUS FAILURE on handler failure.
    */
   /** @type {Promise<void>} */
   let sftpReplyChain = Promise.resolve()
 
   /**
+   * @param {number} reqid
    * @param {() => void | Promise<void>} fn
    */
-  function enqueueSftpReply(fn) {
-    const next = sftpReplyChain.then(() => Promise.resolve().then(fn))
+  function enqueueSftpReply(reqid, fn) {
+    const next = sftpReplyChain.then(async () => {
+      try {
+        await Promise.resolve().then(fn)
+      } catch {
+        try {
+          sftp.status(reqid, STATUS_CODE.FAILURE)
+        } catch {
+          /* ignore */
+        }
+      }
+    })
     sftpReplyChain = next.catch(() => {})
   }
 
@@ -243,7 +257,7 @@ export function attachBareOsSftp(
   }
 
   sftp.on('REALPATH', (reqid, p) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const abs = mapPath(p) || homeLogical
       try {
         const st = await vfs.lstat(abs)
@@ -277,14 +291,14 @@ export function attachBareOsSftp(
   })
 
   sftp.on('STAT', (reqid, p) => {
-    enqueueSftpReply(() => statLike(reqid, p, false))
+    enqueueSftpReply(reqid, () => statLike(reqid, p, false))
   })
   sftp.on('LSTAT', (reqid, p) => {
-    enqueueSftpReply(() => statLike(reqid, p, true))
+    enqueueSftpReply(reqid, () => statLike(reqid, p, true))
   })
 
   sftp.on('OPENDIR', (reqid, p) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const abs = mapPath(p)
       if (!abs) return sftp.status(reqid, STATUS_CODE.PERMISSION_DENIED)
       try {
@@ -302,7 +316,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('READDIR', (reqid, handle) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const id = handle.readUInt32BE(0)
       const d = dirs.get(id)
       if (!d || !d.entries) return sftp.status(reqid, STATUS_CODE.FAILURE)
@@ -341,7 +355,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('OPEN', (reqid, filename, flags) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const abs = mapPath(filename)
       if (!abs) return sftp.status(reqid, STATUS_CODE.PERMISSION_DENIED)
       if (bareOsSftpDeniesWriteOpen(abs, homeLogical, flags, OPEN_MODE)) {
@@ -382,19 +396,31 @@ export function attachBareOsSftp(
   })
 
   sftp.on('READ', (reqid, handle, offset, length) => {
-    enqueueSftpReply(() => {
-      const id = handle.readUInt32BE(0)
-      const f = handles.get(id)
-      if (!f || !f.buf) return sftp.status(reqid, STATUS_CODE.FAILURE)
-      const end = Math.min(offset + length, f.buf.length)
-      if (offset >= f.buf.length) return sftp.status(reqid, STATUS_CODE.EOF)
-      const slice = f.buf.subarray(offset, end)
-      sftp.data(reqid, slice)
+    enqueueSftpReply(reqid, () => {
+      try {
+        if (!Buffer.isBuffer(handle) || handle.length < 4) {
+          return sftp.status(reqid, STATUS_CODE.FAILURE)
+        }
+        const id = handle.readUInt32BE(0)
+        const f = handles.get(id)
+        if (!f || !f.buf) return sftp.status(reqid, STATUS_CODE.FAILURE)
+        const off = Number(offset)
+        const len = Number(length)
+        if (!Number.isFinite(off) || !Number.isFinite(len)) {
+          return sftp.status(reqid, STATUS_CODE.FAILURE)
+        }
+        const end = Math.min(off + len, f.buf.length)
+        if (off >= f.buf.length) return sftp.status(reqid, STATUS_CODE.EOF)
+        const slice = f.buf.subarray(off, end)
+        sftp.data(reqid, slice)
+      } catch {
+        sftp.status(reqid, STATUS_CODE.FAILURE)
+      }
     })
   })
 
   sftp.on('FSTAT', (reqid, handle) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const id = handle.readUInt32BE(0)
       const f = handles.get(id)
       if (f) {
@@ -408,7 +434,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('WRITE', (reqid, handle, offset, data) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const id = handle.readUInt32BE(0)
       const f = handles.get(id)
       if (!f || !f.write) return sftp.status(reqid, STATUS_CODE.PERMISSION_DENIED)
@@ -429,7 +455,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('CLOSE', (reqid, handle) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       const id = handle.readUInt32BE(0)
       handles.delete(id)
       dirs.delete(id)
@@ -438,7 +464,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('REMOVE', (reqid, p) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const abs = mapPath(p)
       if (!abs) return sftp.status(reqid, STATUS_CODE.PERMISSION_DENIED)
       try {
@@ -451,7 +477,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('MKDIR', (reqid, p) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const abs = mapPath(p)
       if (!abs) return sftp.status(reqid, STATUS_CODE.PERMISSION_DENIED)
       try {
@@ -464,7 +490,7 @@ export function attachBareOsSftp(
   })
 
   sftp.on('RMDIR', (reqid, p) => {
-    enqueueSftpReply(async () => {
+    enqueueSftpReply(reqid, async () => {
       const abs = mapPath(p)
       if (!abs) return sftp.status(reqid, STATUS_CODE.PERMISSION_DENIED)
       try {
@@ -477,36 +503,36 @@ export function attachBareOsSftp(
   })
 
   sftp.on('SETSTAT', (reqid) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       sftp.status(reqid, STATUS_CODE.OP_UNSUPPORTED)
     })
   })
 
   sftp.on('FSETSTAT', (reqid) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       sftp.status(reqid, STATUS_CODE.OP_UNSUPPORTED)
     })
   })
 
   sftp.on('EXTENDED', (reqid) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       sftp.status(reqid, STATUS_CODE.OP_UNSUPPORTED)
     })
   })
 
   sftp.on('RENAME', (reqid) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       sftp.status(reqid, STATUS_CODE.OP_UNSUPPORTED)
     })
   })
 
   sftp.on('READLINK', (reqid) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       sftp.status(reqid, STATUS_CODE.OP_UNSUPPORTED)
     })
   })
   sftp.on('SYMLINK', (reqid) => {
-    enqueueSftpReply(() => {
+    enqueueSftpReply(reqid, () => {
       sftp.status(reqid, STATUS_CODE.OP_UNSUPPORTED)
     })
   })

packages/bare-os-openssh/CHANGELOG.md

@@ -0,0 +1,6 @@
+# Changelog
+
+## Unreleased
+
+- **SFTP stability:** Harden `REQUEST.READ` parsing in vendored `bare-ssh2` (`handle` / `offset` / `len` must be defined before emit). Align `WRITE` and `FSETSTAT` guards with other handle-based handlers.
+- **Bare OS SFTP shim:** `enqueueSftpReply` now takes `reqid` and sends `SSH_FX_FAILURE` if the queued handler throws or rejects, avoiding stalled clients and reducing risk of uncaught SFTP-path errors surfacing as native aborts (`bad_optional_access` under `-fno-exceptions`) after the serialized-reply ordering change.

packages/bare-os-openssh/vendor/bare-ssh2/lib/protocol/SFTP.js

@@ -2918,7 +2918,12 @@ const SERVER_HANDLERS = {
     const len = bufferParser.readUInt32BE()
     bufferParser.clear()
 
-    if (len === undefined || handle.length > 256)
+    if (
+      handle === undefined ||
+      offset === undefined ||
+      len === undefined ||
+      handle.length > 256
+    )
       return doFatalSFTPError(sftp, 'Malformed READ packet')
 
     sftp._debug && sftp._debug(`SFTP: Inbound: Received READ (id:${reqID})`)
@@ -2941,7 +2946,12 @@ const SERVER_HANDLERS = {
     const data = bufferParser.readString()
     bufferParser.clear()
 
-    if (data === undefined || handle.length > 256)
+    if (
+      data === undefined ||
+      handle === undefined ||
+      offset === undefined ||
+      handle.length > 256
+    )
       return doFatalSFTPError(sftp, 'Malformed WRITE packet')
 
     sftp._debug && sftp._debug(`SFTP: Inbound: Received WRITE (id:${reqID})`)
@@ -3019,7 +3029,11 @@ const SERVER_HANDLERS = {
     const attrs = readAttrs(sftp._biOpt)
     bufferParser.clear()
 
-    if (attrs === undefined || handle.length > 256)
+    if (
+      attrs === undefined ||
+      handle === undefined ||
+      handle.length > 256
+    )
       return doFatalSFTPError(sftp, 'Malformed FSETSTAT packet')
 
     sftp._debug && sftp._debug(`SFTP: Inbound: Received FSETSTAT (id:${reqID})`)

packages/bare-os-seeder/kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-21T21:25:44.827Z",
+  "generatedAt": "2026-04-21T21:59:29.663Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {

packages/bare-os-seeder/kernel/lib/bare/manifest.json

@@ -2,9 +2,9 @@
   "version": 1,
   "bundles": [
     {
-      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
+      "path": "/lib/bare/bundles/safetyCatch.js",
       "keys": [
-        "hypercoreIdEncoding"
+        "safetyCatch"
       ]
     },
     {
@@ -14,9 +14,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/safetyCatch.js",
+      "path": "/lib/bare/bundles/hypercoreIdEncoding.js",
       "keys": [
-        "safetyCatch"
+        "hypercoreIdEncoding"
       ]
     },
     {
@@ -25,12 +25,6 @@
         "compactEncoding"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUrl.js",
-      "keys": [
-        "bareUrl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/protomux.js",
       "keys": [
@@ -38,9 +32,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareEncoding.js",
+      "path": "/lib/bare/bundles/bareUrl.js",
       "keys": [
-        "bareEncoding"
+        "bareUrl"
       ]
     },
     {
@@ -49,6 +43,12 @@
         "barePath"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareEncoding.js",
+      "keys": [
+        "bareEncoding"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareEvents.js",
       "keys": [
@@ -61,18 +61,18 @@
         "bareAbort"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareAbortController.js",
       "keys": [
         "bareAbortController"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
+      "keys": [
+        "bareAnsiEscapes"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAddonResolve.js",
       "keys": [
@@ -80,9 +80,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareCrypto.js",
+      "path": "/lib/bare/bundles/bareAssert.js",
       "keys": [
-        "bareCrypto"
+        "bareAssert"
       ]
     },
     {
@@ -91,12 +91,24 @@
         "bareReadline"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareCrypto.js",
+      "keys": [
+        "bareCrypto"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAppKit.js",
       "keys": [
         "bareAppKit"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/fetch.js",
+      "keys": [
+        "fetch"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareAsyncHooks.js",
       "keys": [
@@ -110,15 +122,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareAssert.js",
+      "path": "/lib/bare/bundles/bareApk.js",
       "keys": [
-        "bareAssert"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/fetch.js",
-      "keys": [
-        "fetch"
+        "bareApk"
       ]
     },
     {
@@ -128,9 +134,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareApk.js",
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
       "keys": [
-        "bareApk"
+        "bareBundleCompile"
       ]
     },
     {
@@ -145,12 +151,6 @@
         "bareBuffer"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
-      "keys": [
-        "bareBundleCompile"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBluetoothApple.js",
       "keys": [
@@ -163,12 +163,6 @@
         "bareConsole"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareBundleEvaluate.js",
       "keys": [
@@ -182,9 +176,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareBundleId.js",
+      "path": "/lib/bare/bundles/bareDebugLog.js",
       "keys": [
-        "bareBundleId"
+        "bareDebugLog"
       ]
     },
     {
@@ -194,9 +188,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDebugLog.js",
+      "path": "/lib/bare/bundles/bareBoot.js",
       "keys": [
-        "bareDebugLog"
+        "bareBoot"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareBundleId.js",
+      "keys": [
+        "bareBundleId"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareCov.js",
+      "keys": [
+        "bareCov"
       ]
     },
     {
@@ -211,24 +217,12 @@
         "bareDns"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareCov.js",
-      "keys": [
-        "bareCov"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareDaemon.js",
       "keys": [
         "bareDaemon"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareExif.js",
-      "keys": [
-        "bareExif"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareEnv.js",
       "keys": [
@@ -236,9 +230,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareDgram.js",
+      "path": "/lib/bare/bundles/bareExif.js",
       "keys": [
-        "bareDgram"
+        "bareExif"
       ]
     },
     {
@@ -253,6 +247,12 @@
         "bareFfmpegEncodings"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDgram.js",
+      "keys": [
+        "bareDgram"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareFormData.js",
       "keys": [
@@ -265,30 +265,12 @@
         "bareFormat"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareGif.js",
       "keys": [
         "bareGif"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareGtk.js",
-      "keys": [
-        "bareGtk"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareHeif.js",
-      "keys": [
-        "bareHeif"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHrtime.js",
       "keys": [
@@ -296,9 +278,21 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareHttpParser.js",
+      "path": "/lib/bare/bundles/bareFileLogger.js",
       "keys": [
-        "bareHttpParser"
+        "bareFileLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareHeif.js",
+      "keys": [
+        "bareHeif"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareGtk.js",
+      "keys": [
+        "bareGtk"
       ]
     },
     {
@@ -307,6 +301,12 @@
         "bareFs"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareHttpParser.js",
+      "keys": [
+        "bareHttpParser"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareIco.js",
       "keys": [
@@ -319,18 +319,18 @@
         "bareImageResample"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareInspect.js",
-      "keys": [
-        "bareInspect"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareHttp1.js",
       "keys": [
         "bareHttp1"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareInspect.js",
+      "keys": [
+        "bareInspect"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareHttps.js",
       "keys": [
@@ -343,18 +343,18 @@
         "bareJpeg"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareIntl.js",
-      "keys": [
-        "bareIntl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareIpc.js",
       "keys": [
         "bareIpc"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareIntl.js",
+      "keys": [
+        "bareIntl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareLogger.js",
       "keys": [
@@ -374,9 +374,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareLink.js",
+      "path": "/lib/bare/bundles/bareMake.js",
       "keys": [
-        "bareLink"
+        "bareMake"
       ]
     },
     {
@@ -385,6 +385,12 @@
         "bareModuleResolve"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareLink.js",
+      "keys": [
+        "bareLink"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareModuleLexer.js",
       "keys": [
@@ -398,9 +404,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareMake.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
       "keys": [
-        "bareMake"
+        "bareMedia"
       ]
     },
     {
@@ -409,48 +415,36 @@
         "bareNdk"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareMedia.js",
-      "keys": [
-        "bareMedia"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareNodeFetch.js",
       "keys": [
         "bareNodeFetch"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareNative.js",
+      "keys": [
+        "bareNative"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNet.js",
       "keys": [
         "bareNet"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareModuleTraverse.js",
-      "keys": [
-        "bareModuleTraverse"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareDev.js",
-      "keys": [
-        "bareDev"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareOpen.js",
       "keys": [
         "bareOpen"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareModuleTraverse.js",
+      "keys": [
+        "bareModuleTraverse"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareOs.js",
       "keys": [
@@ -463,24 +457,30 @@
         "barePerformance"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePng.js",
-      "keys": [
-        "barePng"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/barePipe.js",
       "keys": [
         "barePipe"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/barePng.js",
+      "keys": [
+        "barePng"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePack.js",
       "keys": [
         "barePack"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareNodeRuntime.js",
       "keys": [
@@ -493,12 +493,6 @@
         "barePackDrive"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/barePrebuild.js",
-      "keys": [
-        "barePrebuild"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareQuerystring.js",
       "keys": [
@@ -518,15 +512,15 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRealm.js",
+      "path": "/lib/bare/bundles/barePrebuild.js",
       "keys": [
-        "bareRealm"
+        "barePrebuild"
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRuntime.js",
+      "path": "/lib/bare/bundles/bareRealm.js",
       "keys": [
-        "bareRuntime"
+        "bareRealm"
       ]
     },
     {
@@ -536,9 +530,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareRpc.js",
+      "path": "/lib/bare/bundles/bareRuntime.js",
       "keys": [
-        "bareRpc"
+        "bareRuntime"
       ]
     },
     {
@@ -547,12 +541,24 @@
         "bareSdl"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRepl.js",
+      "keys": [
+        "bareRepl"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/barePromClient.js",
       "keys": [
         "barePromClient"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareRpc.js",
+      "keys": [
+        "bareRpc"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSemver.js",
       "keys": [
@@ -565,48 +571,48 @@
         "bareSignals"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareRepl.js",
-      "keys": [
-        "bareRepl"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareRun.js",
       "keys": [
         "bareRun"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareStringDecoder.js",
-      "keys": [
-        "bareStringDecoder"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareSidecar.js",
-      "keys": [
-        "bareSidecar"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareStream.js",
       "keys": [
         "bareStream"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSvg.js",
-      "keys": [
-        "bareSvg"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareStdio.js",
       "keys": [
         "bareStdio"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSidecar.js",
+      "keys": [
+        "bareSidecar"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStringDecoder.js",
+      "keys": [
+        "bareStringDecoder"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareStorage.js",
+      "keys": [
+        "bareStorage"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSvg.js",
+      "keys": [
+        "bareSvg"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareSystemLogger.js",
       "keys": [
@@ -619,30 +625,30 @@
         "bareStructuredClone"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
-      "keys": [
-        "bareSubprocess"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStorage.js",
-      "keys": [
-        "bareStorage"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareTap.js",
       "keys": [
         "bareTap"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "keys": [
+        "bareSubprocess"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTiff.js",
       "keys": [
         "bareTiff"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTcp.js",
+      "keys": [
+        "bareTcp"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareTimers.js",
       "keys": [
@@ -655,42 +661,42 @@
         "bareTpl"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTcp.js",
-      "keys": [
-        "bareTcp"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareType.js",
       "keys": [
         "bareType"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareTls.js",
-      "keys": [
-        "bareTls"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareUiKit.js",
       "keys": [
         "bareUiKit"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareThread.js",
-      "keys": [
-        "bareThread"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareTty.js",
       "keys": [
         "bareTty"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareTls.js",
+      "keys": [
+        "bareTls"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareUnpack.js",
+      "keys": [
+        "bareUnpack"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareThread.js",
+      "keys": [
+        "bareThread"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8.js",
       "keys": [
@@ -703,24 +709,12 @@
         "bareVm"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareUnpack.js",
-      "keys": [
-        "bareUnpack"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWalkHandles.js",
       "keys": [
         "bareWalkHandles"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWebp.js",
-      "keys": [
-        "bareWebp"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareWebKit.js",
       "keys": [
@@ -728,9 +722,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWebKitGtk.js",
+      "path": "/lib/bare/bundles/bareWebp.js",
       "keys": [
-        "bareWebKitGtk"
+        "bareWebp"
       ]
     },
     {
@@ -739,6 +733,18 @@
         "bareUnionBundle"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareWebKitGtk.js",
+      "keys": [
+        "bareWebKitGtk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWinUi.js",
+      "keys": [
+        "bareWinUi"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
       "keys": [
@@ -752,9 +758,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareWinUi.js",
+      "path": "/lib/bare/bundles/bareWhich.js",
       "keys": [
-        "bareWinUi"
+        "bareWhich"
       ]
     },
     {
@@ -764,15 +770,9 @@
       ]
     },
     {
-      "path": "/lib/bare/bundles/bareZlib.js",
+      "path": "/lib/bare/bundles/bareWs.js",
       "keys": [
-        "bareZlib"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareWhich.js",
-      "keys": [
-        "bareWhich"
+        "bareWs"
       ]
     },
     {
@@ -781,18 +781,18 @@
         "bareWorker"
       ]
     },
-    {
-      "path": "/lib/bare/bundles/bareWs.js",
-      "keys": [
-        "bareWs"
-      ]
-    },
     {
       "path": "/lib/bare/bundles/bareZmq.js",
       "keys": [
         "bareZmq"
       ]
     },
+    {
+      "path": "/lib/bare/bundles/bareZlib.js",
+      "keys": [
+        "bareZlib"
+      ]
+    },
     {
       "path": "/lib/bare/bundles/holesail.js",
       "keys": [
@@ -1607,8 +1607,8 @@
   ],
   "bundleProvenance": {
     "schemaVersion": 1,
-    "generatedAt": "2026-04-21T21:25:45.989Z",
-    "gitCommit": "c50bee46ebd5f05189131385330d077c2332817c",
+    "generatedAt": "2026-04-21T21:59:30.817Z",
+    "gitCommit": "98dd91020ea8898768e864267a2e72429be1cbce",
     "nodeVersion": "v20.20.2",
     "bundleTier": "all",
     "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",

packages/bare-os-seeder/kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1776806744827,
+  "atMs": 1776808769662,
   "commands": [
     "arch",
     "awk",

packages/bare-os-seeder/kernel/share/man/man.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-21T21:25:44.984Z",
+  "generatedAt": "2026-04-21T21:59:29.821Z",
   "pages": [
     {
       "name": "arch",