Further Cleanup

packages/bare-os-booter/index.js

@@ -309,6 +309,17 @@ import {
   exitHostProcess,
   teardownBareOsBootResources
 } from './lib/bare-os-lifecycle-manager.js'
+import {
+  applyHostFlagsFromArgv,
+  hostArgv
+} from '../../lib/bare-os-host-flags.mjs'
+import { BARE_OS_HOST_ENV_FORWARD_KEYS } from './lib/bare-os-host-env-keys.js'
+import {
+  parseUnionReadPrefixes,
+  parseUnionWriteDenyPrefixes,
+  parseIpcChannelMaxBytesMap,
+  createReadLine
+} from './lib/booter-host-session.js'
 
 const { randomUUID, randomBytes } = bareCrypto
 
@@ -381,170 +392,10 @@ function kernelCapabilityStrictErrorKey(key) {
 const KERNEL_CAPABILITY_SEED_STRICT_MISSING_MSG =
   'seeder capabilities missing kernelCapabilityWords'
 
-/**
- * @param {Record<string, string>} env
- * @returns {string[]}
- */
-function parseUnionReadPrefixes(env) {
-  const raw = env && env.BARE_OS_VFS_UNION_PREFIXES
-  if (raw == null || !String(raw).trim()) return []
-  return String(raw)
-    .split(/[,:]+/)
-    .map((s) => s.trim())
-    .filter((s) => s.startsWith('/'))
-}
-
-/**
- * @param {Record<string, string>} env
- * @returns {string[]}
- */
-function parseUnionWriteDenyPrefixes(env) {
-  const raw = env && env.BARE_OS_VFS_UNION_WRITE_DENY
-  if (raw == null || !String(raw).trim()) return []
-  return String(raw)
-    .split(/[,:]+/)
-    .map((s) => s.trim())
-    .filter((s) => s.startsWith('/'))
-}
-
-/**
- * @param {Record<string, string>} env
- * @returns {Map<string, number> | null}
- */
-function parseIpcChannelMaxBytesMap(env) {
-  const raw = env && env.BARE_OS_IPC_CHANNEL_MAX_BYTES
-  if (raw == null || !String(raw).trim()) return null
-  try {
-    const o = JSON.parse(String(raw))
-    if (!o || typeof o !== 'object') return null
-    const m = new Map()
-    for (const [k, v] of Object.entries(o)) {
-      const n = Number(v)
-      if (
-        typeof k === 'string' &&
-        /^[a-zA-Z0-9._-]+$/.test(k) &&
-        Number.isFinite(n) &&
-        n > 0
-      ) {
-        m.set(k, Math.min(Math.floor(n), 16 * 1024 * 1024))
-      }
-    }
-    return m.size ? m : null
-  } catch {
-    return null
-  }
-}
-
 function bootStorePath() {
   return defaultBootCorestorePath(_pkg, import.meta.url)
 }
 
-/**
- * @returns {Promise<{
- *   readLine: (p: string) => Promise<string | null>,
- *   interactiveAvailable: boolean,
- *   skipInteractive: boolean,
- *   stdout: import('stream').Writable | null,
- *   stdin: import('stream').Readable | null
- * }>}
- */
-async function createReadLine() {
-  const { stdin, stdout } = await resolveStdio()
-
-  const skipInteractive = globalThis.process?.env?.BARE_OS_SKIP_REPL === '1'
-  if (skipInteractive) {
-    return {
-      readLine: async () => null,
-      interactiveAvailable: false,
-      skipInteractive: true,
-      stdout,
-      stdin
-    }
-  }
-
-  if (!stdin || !stdout) {
-    bareOsHostBooterWarn(
-      'stdio_missing',
-      'No stdin/stdout (neither process nor bare-stdio). Cannot run interactive shell.'
-    )
-    return {
-      readLine: async () => null,
-      interactiveAvailable: false,
-      skipInteractive: false,
-      stdout,
-      stdin
-    }
-  }
-
-  const ttyRawCapable =
-    Boolean(stdin.isTTY) &&
-    typeof stdin.setRawMode === 'function' &&
-    typeof stdout.write === 'function'
-
-  /** Prefer fish-style raw editor on TTY — bare-readline / stream reader only (no Node readline). */
-  if (ttyRawCapable) {
-    /** Lazy: avoid bare-readline attaching to stdin before createFishReadLine runs. */
-    let ttyFallback = undefined
-    const lazyRawReadLine = async (prompt) => {
-      if (ttyFallback === undefined) {
-        try {
-          ttyFallback = await createBareReadlineQuestion(stdin, stdout)
-        } catch {
-          ttyFallback =
-            looksLikeInteractiveStdin(stdin) &&
-            typeof stdout.write === 'function'
-              ? createStreamLineReader(stdin, stdout)
-              : false
-        }
-      }
-      if (ttyFallback === false) return null
-      return ttyFallback(prompt)
-    }
-    return {
-      readLine: lazyRawReadLine,
-      interactiveAvailable: true,
-      skipInteractive: false,
-      stdout,
-      stdin
-    }
-  }
-
-  try {
-    const readLine = await createBareReadlineQuestion(stdin, stdout)
-    return {
-      readLine,
-      interactiveAvailable: true,
-      skipInteractive: false,
-      stdout,
-      stdin
-    }
-  } catch {
-    /* bare-readline failed to load */
-  }
-
-  if (looksLikeInteractiveStdin(stdin) && typeof stdout.write === 'function') {
-    return {
-      readLine: createStreamLineReader(stdin, stdout),
-      interactiveAvailable: true,
-      skipInteractive: false,
-      stdout,
-      stdin
-    }
-  }
-
-  bareOsHostBooterWarn(
-    'line_input_unavailable',
-    'No line input. Set BARE_OS_SKIP_REPL=1 to exit after boot.'
-  )
-  return {
-    readLine: async () => null,
-    interactiveAvailable: false,
-    skipInteractive: false,
-    stdout,
-    stdin
-  }
-}
-
 /**
  * @param {SwarmDisk} disk
  * @param {import('corestore').default} store
@@ -591,289 +442,7 @@ async function executeKernel(disk, store, swarm, initSource) {
   }
   const hostEnv = globalThis.process?.env
   if (hostEnv && typeof hostEnv === 'object') {
-    for (const k of [
-      'BARE_OS_PIPELINE_MAX_STAGES',
-      'BARE_OS_PIPELINE_MAX_BYTES',
-      'BARE_OS_PIPELINE_MAX_LINES',
-      'BARE_OS_BOOT_PROFILE',
-      'BARE_OS_ONBOOT',
-      'BARE_OS_BOOT_STRICT',
-      'BARE_OS_RC_D_SKIP',
-      'BARE_OS_BOOT_MINIMAL',
-      'BARE_OS_BOOT_SKIP',
-      'BARE_OS_BOOT_TRACE',
-      'BARE_OS_KERNEL_SELFTEST',
-      'BARE_OS_AUDIT',
-      'BARE_OS_AUDIT_JSON',
-      'BARE_OS_AUDIT_REDACT',
-      'BARE_OS_IMAGE_DIGEST',
-      'BARE_OS_EXEC_MAX_DEPTH',
-      'BARE_OS_IPC_MAX_BYTES',
-      'BARE_OS_VFS_WATCH',
-      'BARE_OS_BOOT_ALLOWLIST',
-      'BARE_OS_SELFTEST_FORMAT',
-      'BARE_OS_PEAR_CHANNEL',
-      'BARE_OS_PEAR_RELEASE',
-      'PEAR_CHANNEL',
-      'BARE_OS_IPC_RPC_TOKEN',
-      'BARE_OS_IPC_FANOUT',
-      'BARE_OS_IPC_JSON_MAX_BYTES',
-      'BARE_OS_HTTP_ALLOWLIST',
-      'BARE_OS_HTTP_DENYLIST',
-      'BARE_OS_IRC',
-      'BARE_OS_IRC_ALLOWLIST',
-      'BARE_OS_IRC_DENYLIST',
-      'BARE_OS_DISCORD',
-      'DISCORD_TOKEN',
-      'DISCORD_GUILD_ID',
-      'DISCORD_ID_WHITELIST',
-      'DISCORD_USER_INSTALL',
-      'DISCORD_ENV_FILE',
-      'BARE_OS_DISCORD_ENV_FILE',
-      'BARE_OS_TLS_PIN_SHA256',
-      'BARE_OS_BARE_MODULES',
-      'BARE_OS_BARE_DRIVE_BUNDLES',
-      'BARE_OS_BARE_SUBPROCESS_BRIDGE',
-      'BARE_OS_BARE_SUBPROCESS_TIMEOUT_MS',
-      'BARE_OS_CTX_BARE_SUBPROCESS_SPAWN',
-      'BARE_OS_PROC_BLIND_PEER_RELAY_HINTS',
-      'BARE_OS_PROC_PROTOMUX_EXTENSIONS_REGISTRY',
-      'BARE_OS_FIND_EXEC_MAX',
-      'BARE_OS_XARGS_MAX_PROCS',
-      'BARE_OS_YES_MAX_LINES',
-      'BARE_OS_SHUF_MAX_LINES',
-      'BARE_OS_SPLIT_MAX_FILES',
-      'BARE_OS_SSH_BIND_ALL',
-      'BARE_OS_SSH_LISTEN_PORT',
-      'BARE_OS_NPROC',
-      'BARE_OS_PHYS_PAGES_HINT',
-      'BARE_OS_BOOT_MANIFEST',
-      'BARE_OS_BOOT_MANIFEST_SIGN',
-      'BARE_OS_BOOT_MANIFEST_PUBKEY_HEX',
-      'BARE_OS_SANDBOX_SCRIPT',
-      'BARE_OS_TUI',
-      'BARE_OS_TUI_NO_ALTSCREEN',
-      'BARE_OS_TUI_DEBUG',
-      'BARE_OS_VFS_UNION_PREFIXES',
-      'BARE_OS_URANDOM_CRYPTO',
-      'BARE_OS_INITD_MAX_PARALLEL',
-      'BARE_OS_VFS_BIN_CACHE',
-      'BARE_OS_VFS_BIN_CACHE_BLAKE2B',
-      'BARE_OS_VFS_ENFORCE_ACL',
-      'BARE_OS_VFS_BIN_INDEX_BUILD',
-      'BARE_OS_VFS_SYSTEM_IMAGE_WRITE',
-      'BARE_OS_VFS_LIB_BARE_CACHE',
-      'BARE_OS_BOOT_PERF_DETAIL',
-      'BARE_OS_BIN_HYPERBEE_INDEX',
-      'BARE_OS_SANDBOX_WORKER',
-      'BARE_OS_BLIND_BOOTSTRAP_URL',
-      'BARE_OS_BLIND_BOOTSTRAP_JSON',
-      'BARE_OS_MIRROR_READ_KEY',
-      'BARE_OS_PEER_FIREWALL_E2E_JSON',
-      'BARE_OS_PEAR_SECURE_ENCLAVE_JSON',
-      'BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON',
-      'BARE_OS_SEED_RPC_HANDSHAKE',
-      'BARE_OS_SEED_CAP_STRICT',
-      'BARE_OS_SEED_CAP_FAIL',
-      'BARE_OS_VFS_UNION_WRITE_DENY',
-      'BARE_OS_VFS_SYSTEM_RO_ALIAS',
-      'BARE_OS_VFS_HYPERBLOBS_DEDUP',
-      'BARE_OS_IPC_CHANNEL_MAX_BYTES',
-      'BARE_OS_IPC_MAX_CHANNELS',
-      'BARE_OS_POSIX_MQ_MAX_MSGS',
-      'BARE_OS_POSIX_MQ_MSG_BYTES',
-      'BARE_OS_PIPELINE_ABS_MAX_BYTES',
-      'BARE_OS_PIPELINE_ABS_MAX_LINES',
-      'BARE_OS_VFS_MAX_OPEN',
-      'BARE_OS_SHELL_STREAMING',
-      'BARE_OS_SHELL_STREAMING_MULT',
-      'BARE_OS_STREAMING_MULTIPLIER',
-      'BARE_OS_SHELL_CMDSUBST',
-      'BARE_OS_SHELL_CMDSUBST_MAX_BYTES',
-      'BARE_OS_SHELL_UNTIL',
-      'BARE_OS_SH_EXTENDED_PROFILE',
-      'BARE_OS_SHELL_LOOP_CONTROL',
-      'BARE_OS_SHELL_PIPEFAIL',
-      'BARE_OS_SHELL_PIPESTATUS',
-      'BARE_OS_SHELL_READ_BUILTIN',
-      'BARE_OS_SHELL_READ_MAX_BYTES',
-      'BARE_OS_SHELL_POSIX_MODE',
-      'BARE_OS_SHELL_GROUPING',
-      'BARE_OS_SHELL_DOUBLE_BRACKET',
-      'BARE_OS_SHELL_ERREXIT',
-      'BARE_OS_SHELL_NOUNSET',
-      'BARE_OS_TELEMETRY_NDJSON',
-      'BARE_OS_TELEMETRY_OTEL',
-      'BARE_OS_TELEMETRY_OTEL_JSONL',
-      'BARE_OS_VAR_LOG_DEBUG',
-      'BARE_OS_PROC_POLL_MS',
-      'BARE_OS_TIMER_EVERY_MS_MONOTONIC',
-      'BARE_OS_TRACE_ID',
-      'BARE_OS_SHELL_PARAM_EXPANSION',
-      'BARE_OS_EXEC_LINE_BUDGET_MS',
-      'BARE_OS_TIMER_BUDGET_MS',
-      'BARE_OS_DELEGATE_MAX_PER_MIN',
-      'BARE_OS_DELEGATE_GIT_MAX_PER_MIN',
-      'BARE_OS_DELEGATE_CURL_MAX_PER_MIN',
-      'BARE_OS_DELEGATE_WGET_MAX_PER_MIN',
-      'BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN',
-      'BARE_OS_DELEGATE_AUDIT_ONLY',
-      'BARE_OS_BOOT_POLICY',
-      'BARE_OS_BOOT_POLICY_STRICT',
-      'BARE_OS_INITD_JOURNAL_MAX_LINES',
-      'BARE_OS_LAZY_PERSONAL_DRIVE',
-      'BARE_OS_SYSTEM_REVISION_ID',
-      'BARE_OS_SYSTEM_REVISION_PENDING',
-      'BARE_OS_SYSTEM_SLOT',
-      'BARE_OS_DELEGATE_ALLOW',
-      'BARE_OS_DNS_ALLOWLIST',
-      'BARE_OS_KERNEL_HOT_RELOAD',
-      'BARE_OS_KERNEL_EXT_D_HOT_RELOAD',
-      'BARE_OS_IPC_NAMESPACE',
-      'BARE_OS_OFFLINE_LKG_BOOT',
-      'BARE_OS_LKG_SYSTEM_KEY_HEX',
-      'BARE_OS_BUILD_ID',
-      'BARE_OS_BOOT_POLICY_DIGEST_SKETCH',
-      'BARE_OS_KERNEL_STARTUP_CLASS',
-      'BARE_OS_BOOT_BUDGET_MS_COLD',
-      'BARE_OS_BOOT_BUDGET_MS_BARE_STDLIB',
-      'BARE_OS_BARE_STDLIB_RESOLVE_CONCURRENCY',
-      'BARE_OS_BOOT_CAPABILITY_CONTRACT_DEBUG',
-      'BARE_OS_BOOT_EXT_RESOLUTION_TRACE',
-      'BARE_OS_KERNEL_EXT_GRAPH',
-      'BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS',
-      'BARE_OS_BOOT_RC_RESOLUTION_TRACE',
-      'BARE_OS_WARM_REBOOT',
-      'BARE_OS_WARM_REBOOT_EXTRA_CYCLES',
-      'BARE_OS_WASM_KERNEL',
-      'BARE_OS_WASM_KERNEL_SYSCALL',
-      'BARE_OS_WASM_KERNEL_MONOTONIC_MS',
-      'BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT',
-      'BARE_OS_WASM_KERNEL_CTX_API_PEEK',
-      'BARE_OS_WASM_KERNEL_POSIX_PROFILE_PEEK',
-      'BARE_OS_POSIX_FD_SIM',
-      'BARE_OS_POSIX_FD_SIM_MAX_BYTES',
-      'BARE_OS_POSIX_SOCKET_FD_BRIDGE',
-      'BARE_OS_POSIX_SOCKET_CONNECT_TIMEOUT_MS',
-      'BARE_OS_POSIX_SOCKET_SCM_RIGHTS',
-      'BARE_OS_POSIX_SOCKET_SCM_RIGHTS_MAX_FDS',
-      'BARE_OS_POSIX_FCNTL_BLOCKING_WAIT',
-      'BARE_OS_FCNTL_LOCK_WAIT_MS_MAX',
-      'BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE',
-      'BARE_OS_HRPC_AUDIT',
-      'BARE_OS_HRPC_EMIT_UNLISTED',
-      'BARE_OS_HRPC_ALLOWLIST_JSON',
-      'BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON',
-      'BARE_OS_BLIND_RELAY_TOPOLOGY_JSON',
-      'BARE_OS_MIRROR_DRIVE_COMPOSITION_HINT_JSON',
-      'BARE_OS_REPLICATION_PLAN_JSON',
-      'BARE_OS_REPLICATION_PEER_PRIORITY_JSON',
-      'BARE_OS_PEAR_DOCTOR_STATE_JSON',
-      'BARE_OS_PEAR_INSPECT_PROBE',
-      'BARE_OS_PEAR_DOCTOR_MODULE',
-      'BARE_OS_HYPERDHT_STATS_JSON',
-      'BARE_OS_RUNBIN_DEFAULT_TIMEOUT_MS',
-      'BARE_OS_VFS_SNAPSHOTS',
-      'BARE_OS_VFS_QUOTA_MODE',
-      'BARE_OS_VFS_QUOTA_GRACE_MS',
-      'BARE_OS_VFS_WATCH_CONSISTENCY',
-      'BARE_OS_KEY_HANDLE_TTL_MS',
-      'BARE_OS_EVENT_BUS_NDJSON',
-      'BARE_OS_HOST_STORAGE_JSON',
-      'BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS',
-      'BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS',
-      'BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS',
-      'BARE_OS_PEAR_RUNTIME_VERSION',
-      'BARE_OS_BARE_RUNTIME_VERSION',
-      'BARE_OS_CURL_RESOLVE_MAP_JSON',
-      'BARE_OS_HTTP_PROXY_MAP_JSON',
-      'BARE_OS_SOCKS_PROXY_MAP_JSON',
-      'BARE_OS_BARE_CRYPTO_VERSION',
-      'BARE_OS_BARE_BOOT_VERSION',
-      'BARE_OS_BARE_LOGGER_VERSION',
-      'BARE_OS_BARE_TLS_VERSION',
-      'BARE_OS_BARE_PACK_VERSION',
-      'BARE_OS_BARE_ADDON_POLICY_VERSION',
-      'BARE_OS_PEAR_IPC_PACKAGE_VERSION',
-      'BARE_OS_PEAR_UPDATER_CHANNEL',
-      'BARE_OS_PEAR_UPDATER_MODULE',
-      'BARE_OS_PEAR_UPDATER_DELEGATE',
-      'BARE_OS_PEAR_UPDATER_SNAPSHOT_JSON',
-      'BARE_OS_PEAR_RUNTIME_CHANNEL',
-      'BARE_OS_PEAR_RUNTIME_STAGE',
-      'BARE_OS_PEAR_INSPECTOR_ATTACH_HINT',
-      'BARE_OS_PEAR_RUNTIME_SNAPSHOT_JSON',
-      'BARE_OS_CORESTORE_SNAPSHOT_STATE_JSON',
-      'BARE_OS_CORESTORE_SNAPSHOT_PAUSED',
-      'BARE_OS_REPLICATION_PAUSED',
-      'BARE_OS_HAPPY_EYEBALLS_V3_MODE',
-      'BARE_OS_BIN_WORKER_WASM_MS_MAX',
-      'BARE_OS_PROBE_ID_BARE_MODULE_CRYPTO_STAGING',
-      'BARE_OS_PROBE_ID_PEAR_INSPECT_LOGGER_TLS',
-      'BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE',
-      'BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE',
-      'BARE_OS_BARE_RPC_PROBE_CLASS',
-      'BARE_OS_MTLS_PROXY_MAP_JSON',
-      'BARE_OS_THREAD_POOL_TELEMETRY_JSON',
-      'BARE_OS_HAPPY_EYEBALLS_V4_MODE',
-      'BARE_OS_PROC_RLIMITS_JSON',
-      'BARE_OS_SUBPROCESS_BRIDGE_UID_GID_MAP_JSON',
-      'BARE_OS_HDMS_VAULT_ROTATE_COUNT',
-      'BARE_OS_HOLESAIL_INITD',
-      'BARE_OS_HOLESAIL_MANAGED',
-      'BARE_OS_HOLESAIL_SERVER',
-      'BARE_OS_HOLESAIL_CLIENT',
-      'BARE_OS_HOLESAIL_KEY',
-      'BARE_OS_HOLESAIL_SECURE',
-      'BARE_OS_HOLESAIL_PORT',
-      'BARE_OS_HOLESAIL_HOST',
-      'BARE_OS_HOLESAIL_UDP',
-      'BARE_OS_HOLESAIL_LOG',
-      'BARE_OS_HOLESAIL_DEBUG',
-      'BARE_OS_HOLESAIL_STATE',
-      'BARE_OS_HOLESAIL_KERNEL',
-      'BARE_OS_HOLESAIL_KERNEL_SERVER',
-      'BARE_OS_HOLESAIL_KERNEL_CLIENT',
-      'BARE_OS_HOLESAIL_KERNEL_KEY',
-      'BARE_OS_HOLESAIL_KERNEL_SECURE',
-      'BARE_OS_HOLESAIL_KERNEL_PORT',
-      'BARE_OS_HOLESAIL_KERNEL_HOST',
-      'BARE_OS_HOLESAIL_KERNEL_UDP',
-      'BARE_OS_HOLESAIL_KERNEL_LOG',
-      'BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON',
-      'BARE_OS_SUBPROCESS_BRIDGE_META_JSON',
-      'BARE_OS_HOST_BARE_OS_PROC',
-      'BARE_OS_HOST_OS_JSON',
-      'BARE_OS_NET_TRANSPORT_STATS_JSON',
-      'BARE_OS_UDX_TUNING_JSON',
-      'BARE_OS_HYPERSWARM_TUNING_JSON',
-      'BARE_OS_DHT_ADDRESS_CLASS_ALLOWLIST',
-      'BARE_OS_PEER_DENYLIST_HEX',
-      'BARE_OS_PEER_REQUIRE_CAPS_JSON',
-      'BARE_OS_PEER_ADMISSION_AUDIT_NDJSON',
-      'BARE_OS_PEER_ADMISSION_AUDIT_RATE_MS',
-      'BARE_OS_DISK_OS_PATH_MANIFEST',
-      'BARE_OS_DISK_OS_SEARCH_MANIFEST_ONLY',
-      'BARE_OS_DISK_OS_MANIFEST_CACHE_MS',
-      'BARE_OS_PATH_CAPABILITY_ENFORCE_READ',
-      'BARE_OS_PATH_CAPABILITY_PREFIX',
-      'BARE_OS_SAVEVAULT_PRESNAPSHOT_HINT',
-      'BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND',
-      'BARE_OS_KERNEL_DEBUG',
-      'BARE_OS_PEAR_INSPECT',
-      'BARE_OS_KERNEL_PROFILE_WARM',
-      'BARE_OS_REPLICATION_SYNC_WINDOWS',
-      'BARE_OS_HDMS_SUPPORT_CORRELATION_ID',
-      'BARE_OS_BIN_WORKER_ALLOW',
-      'BARE_OS_BIN_WORKER_OFFLOAD',
-      'BARE_OS_BIN_WORKER_CPU_MS_MAX',
-      'BARE_OS_IPC_AUDIT',
-      'BARE_OS_DELEGATE_MAX_CONCURRENT',
-      'BARE_OS_DELEGATE_GIT_MAX_CONCURRENT',
-      'BARE_OS_DELEGATE_CURL_MAX_CONCURRENT',
-      'BARE_OS_DELEGATE_WGET_MAX_CONCURRENT',
-      'BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT'
-    ]) {
+    for (const k of BARE_OS_HOST_ENV_FORWARD_KEYS) {
       const v = hostEnv[k]
       if (v != null && v !== '') shellEnv[k] = v
     }
@@ -11288,33 +10857,7 @@ function bareOsProtomuxTuningFromEnv(env) {
 }
 
 async function main() {
-  const hostArgv = (() => {
-    if (
-      typeof globalThis.Bare !== 'undefined' &&
-      Array.isArray(globalThis.Bare.argv)
-    ) {
-      const a0 = String(globalThis.Bare.argv[0] || '')
-      const base = a0.split(/[/\\]/).pop() || ''
-      return globalThis.Bare.argv.slice(base === 'bare' ? 2 : 1)
-    }
-    return globalThis.process?.argv?.slice(2) || []
-  })()
-  for (let i = 0; i < hostArgv.length; i++) {
-    const a = hostArgv[i]
-    let datadir = null
-    if (a === '--datadir' || a === '--data-dir') datadir = hostArgv[++i]
-    else if (a.startsWith('--datadir=')) datadir = a.slice('--datadir='.length)
-    else if (a.startsWith('--data-dir='))
-      datadir = a.slice('--data-dir='.length)
-    if (datadir != null && String(datadir).trim()) {
-      if (!globalThis.process) globalThis.process = { env: {} }
-      if (!globalThis.process.env) globalThis.process.env = {}
-      globalThis.process.env.BARE_OS_HOST_DATA = path.resolve(
-        String(datadir).trim()
-      )
-      break
-    }
-  }
+  applyHostFlagsFromArgv(hostArgv())
 
   await ensureBareFetchGlobals()
   const hostEnvMain = globalThis.process?.env

packages/bare-os-booter/lib/bare-os-host-env-keys.js

@@ -0,0 +1,287 @@
+/**
+ * Host environment keys copied into the guest shell env at boot.
+ * Keep this list exhaustive; executeKernel forwards any non-empty value.
+ */
+export const BARE_OS_HOST_ENV_FORWARD_KEYS = Object.freeze([
+      'BARE_OS_PIPELINE_MAX_STAGES',
+      'BARE_OS_PIPELINE_MAX_BYTES',
+      'BARE_OS_PIPELINE_MAX_LINES',
+      'BARE_OS_BOOT_PROFILE',
+      'BARE_OS_ONBOOT',
+      'BARE_OS_BOOT_STRICT',
+      'BARE_OS_RC_D_SKIP',
+      'BARE_OS_BOOT_MINIMAL',
+      'BARE_OS_BOOT_SKIP',
+      'BARE_OS_BOOT_TRACE',
+      'BARE_OS_KERNEL_SELFTEST',
+      'BARE_OS_AUDIT',
+      'BARE_OS_AUDIT_JSON',
+      'BARE_OS_AUDIT_REDACT',
+      'BARE_OS_IMAGE_DIGEST',
+      'BARE_OS_EXEC_MAX_DEPTH',
+      'BARE_OS_IPC_MAX_BYTES',
+      'BARE_OS_VFS_WATCH',
+      'BARE_OS_BOOT_ALLOWLIST',
+      'BARE_OS_SELFTEST_FORMAT',
+      'BARE_OS_PEAR_CHANNEL',
+      'BARE_OS_PEAR_RELEASE',
+      'PEAR_CHANNEL',
+      'BARE_OS_IPC_RPC_TOKEN',
+      'BARE_OS_IPC_FANOUT',
+      'BARE_OS_IPC_JSON_MAX_BYTES',
+      'BARE_OS_HTTP_ALLOWLIST',
+      'BARE_OS_HTTP_DENYLIST',
+      'BARE_OS_IRC',
+      'BARE_OS_IRC_ALLOWLIST',
+      'BARE_OS_IRC_DENYLIST',
+      'BARE_OS_DISCORD',
+      'DISCORD_TOKEN',
+      'DISCORD_GUILD_ID',
+      'DISCORD_ID_WHITELIST',
+      'DISCORD_USER_INSTALL',
+      'DISCORD_ENV_FILE',
+      'BARE_OS_DISCORD_ENV_FILE',
+      'BARE_OS_TLS_PIN_SHA256',
+      'BARE_OS_BARE_MODULES',
+      'BARE_OS_BARE_DRIVE_BUNDLES',
+      'BARE_OS_BARE_SUBPROCESS_BRIDGE',
+      'BARE_OS_BARE_SUBPROCESS_TIMEOUT_MS',
+      'BARE_OS_CTX_BARE_SUBPROCESS_SPAWN',
+      'BARE_OS_PROC_BLIND_PEER_RELAY_HINTS',
+      'BARE_OS_PROC_PROTOMUX_EXTENSIONS_REGISTRY',
+      'BARE_OS_FIND_EXEC_MAX',
+      'BARE_OS_XARGS_MAX_PROCS',
+      'BARE_OS_YES_MAX_LINES',
+      'BARE_OS_SHUF_MAX_LINES',
+      'BARE_OS_SPLIT_MAX_FILES',
+      'BARE_OS_SSH_BIND_ALL',
+      'BARE_OS_SSH_LISTEN_PORT',
+      'BARE_OS_NPROC',
+      'BARE_OS_PHYS_PAGES_HINT',
+      'BARE_OS_BOOT_MANIFEST',
+      'BARE_OS_BOOT_MANIFEST_SIGN',
+      'BARE_OS_BOOT_MANIFEST_PUBKEY_HEX',
+      'BARE_OS_SANDBOX_SCRIPT',
+      'BARE_OS_TUI',
+      'BARE_OS_TUI_NO_ALTSCREEN',
+      'BARE_OS_TUI_DEBUG',
+      'BARE_OS_VFS_UNION_PREFIXES',
+      'BARE_OS_URANDOM_CRYPTO',
+      'BARE_OS_INITD_MAX_PARALLEL',
+      'BARE_OS_VFS_BIN_CACHE',
+      'BARE_OS_VFS_BIN_CACHE_BLAKE2B',
+      'BARE_OS_VFS_ENFORCE_ACL',
+      'BARE_OS_VFS_BIN_INDEX_BUILD',
+      'BARE_OS_VFS_SYSTEM_IMAGE_WRITE',
+      'BARE_OS_VFS_LIB_BARE_CACHE',
+      'BARE_OS_BOOT_PERF_DETAIL',
+      'BARE_OS_BIN_HYPERBEE_INDEX',
+      'BARE_OS_SANDBOX_WORKER',
+      'BARE_OS_BLIND_BOOTSTRAP_URL',
+      'BARE_OS_BLIND_BOOTSTRAP_JSON',
+      'BARE_OS_MIRROR_READ_KEY',
+      'BARE_OS_PEER_FIREWALL_E2E_JSON',
+      'BARE_OS_PEAR_SECURE_ENCLAVE_JSON',
+      'BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON',
+      'BARE_OS_SEED_RPC_HANDSHAKE',
+      'BARE_OS_SEED_CAP_STRICT',
+      'BARE_OS_SEED_CAP_FAIL',
+      'BARE_OS_VFS_UNION_WRITE_DENY',
+      'BARE_OS_VFS_SYSTEM_RO_ALIAS',
+      'BARE_OS_VFS_HYPERBLOBS_DEDUP',
+      'BARE_OS_IPC_CHANNEL_MAX_BYTES',
+      'BARE_OS_IPC_MAX_CHANNELS',
+      'BARE_OS_POSIX_MQ_MAX_MSGS',
+      'BARE_OS_POSIX_MQ_MSG_BYTES',
+      'BARE_OS_PIPELINE_ABS_MAX_BYTES',
+      'BARE_OS_PIPELINE_ABS_MAX_LINES',
+      'BARE_OS_VFS_MAX_OPEN',
+      'BARE_OS_SHELL_STREAMING',
+      'BARE_OS_SHELL_STREAMING_MULT',
+      'BARE_OS_STREAMING_MULTIPLIER',
+      'BARE_OS_SHELL_CMDSUBST',
+      'BARE_OS_SHELL_CMDSUBST_MAX_BYTES',
+      'BARE_OS_SHELL_UNTIL',
+      'BARE_OS_SH_EXTENDED_PROFILE',
+      'BARE_OS_SHELL_LOOP_CONTROL',
+      'BARE_OS_SHELL_PIPEFAIL',
+      'BARE_OS_SHELL_PIPESTATUS',
+      'BARE_OS_SHELL_READ_BUILTIN',
+      'BARE_OS_SHELL_READ_MAX_BYTES',
+      'BARE_OS_SHELL_POSIX_MODE',
+      'BARE_OS_SHELL_GROUPING',
+      'BARE_OS_SHELL_DOUBLE_BRACKET',
+      'BARE_OS_SHELL_ERREXIT',
+      'BARE_OS_SHELL_NOUNSET',
+      'BARE_OS_TELEMETRY_NDJSON',
+      'BARE_OS_TELEMETRY_OTEL',
+      'BARE_OS_TELEMETRY_OTEL_JSONL',
+      'BARE_OS_VAR_LOG_DEBUG',
+      'BARE_OS_PROC_POLL_MS',
+      'BARE_OS_TIMER_EVERY_MS_MONOTONIC',
+      'BARE_OS_TRACE_ID',
+      'BARE_OS_SHELL_PARAM_EXPANSION',
+      'BARE_OS_EXEC_LINE_BUDGET_MS',
+      'BARE_OS_TIMER_BUDGET_MS',
+      'BARE_OS_DELEGATE_MAX_PER_MIN',
+      'BARE_OS_DELEGATE_GIT_MAX_PER_MIN',
+      'BARE_OS_DELEGATE_CURL_MAX_PER_MIN',
+      'BARE_OS_DELEGATE_WGET_MAX_PER_MIN',
+      'BARE_OS_DELEGATE_SYSTEMCTL_MAX_PER_MIN',
+      'BARE_OS_DELEGATE_AUDIT_ONLY',
+      'BARE_OS_BOOT_POLICY',
+      'BARE_OS_BOOT_POLICY_STRICT',
+      'BARE_OS_INITD_JOURNAL_MAX_LINES',
+      'BARE_OS_LAZY_PERSONAL_DRIVE',
+      'BARE_OS_SYSTEM_REVISION_ID',
+      'BARE_OS_SYSTEM_REVISION_PENDING',
+      'BARE_OS_SYSTEM_SLOT',
+      'BARE_OS_DELEGATE_ALLOW',
+      'BARE_OS_DNS_ALLOWLIST',
+      'BARE_OS_KERNEL_HOT_RELOAD',
+      'BARE_OS_KERNEL_EXT_D_HOT_RELOAD',
+      'BARE_OS_IPC_NAMESPACE',
+      'BARE_OS_OFFLINE_LKG_BOOT',
+      'BARE_OS_LKG_SYSTEM_KEY_HEX',
+      'BARE_OS_BUILD_ID',
+      'BARE_OS_BOOT_POLICY_DIGEST_SKETCH',
+      'BARE_OS_KERNEL_STARTUP_CLASS',
+      'BARE_OS_BOOT_BUDGET_MS_COLD',
+      'BARE_OS_BOOT_BUDGET_MS_BARE_STDLIB',
+      'BARE_OS_BARE_STDLIB_RESOLVE_CONCURRENCY',
+      'BARE_OS_BOOT_CAPABILITY_CONTRACT_DEBUG',
+      'BARE_OS_BOOT_EXT_RESOLUTION_TRACE',
+      'BARE_OS_KERNEL_EXT_GRAPH',
+      'BARE_OS_KERNEL_EXT_RESOLUTION_JSON_ALWAYS',
+      'BARE_OS_BOOT_RC_RESOLUTION_TRACE',
+      'BARE_OS_WARM_REBOOT',
+      'BARE_OS_WARM_REBOOT_EXTRA_CYCLES',
+      'BARE_OS_WASM_KERNEL',
+      'BARE_OS_WASM_KERNEL_SYSCALL',
+      'BARE_OS_WASM_KERNEL_MONOTONIC_MS',
+      'BARE_OS_WASM_KERNEL_HOSTNAME_IMPORT',
+      'BARE_OS_WASM_KERNEL_CTX_API_PEEK',
+      'BARE_OS_WASM_KERNEL_POSIX_PROFILE_PEEK',
+      'BARE_OS_POSIX_FD_SIM',
+      'BARE_OS_POSIX_FD_SIM_MAX_BYTES',
+      'BARE_OS_POSIX_SOCKET_FD_BRIDGE',
+      'BARE_OS_POSIX_SOCKET_CONNECT_TIMEOUT_MS',
+      'BARE_OS_POSIX_SOCKET_SCM_RIGHTS',
+      'BARE_OS_POSIX_SOCKET_SCM_RIGHTS_MAX_FDS',
+      'BARE_OS_POSIX_FCNTL_BLOCKING_WAIT',
+      'BARE_OS_FCNTL_LOCK_WAIT_MS_MAX',
+      'BARE_OS_VFS_WARM_CACHE_PREFIX_INVALIDATE',
+      'BARE_OS_HRPC_AUDIT',
+      'BARE_OS_HRPC_EMIT_UNLISTED',
+      'BARE_OS_HRPC_ALLOWLIST_JSON',
+      'BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON',
+      'BARE_OS_BLIND_RELAY_TOPOLOGY_JSON',
+      'BARE_OS_MIRROR_DRIVE_COMPOSITION_HINT_JSON',
+      'BARE_OS_REPLICATION_PLAN_JSON',
+      'BARE_OS_REPLICATION_PEER_PRIORITY_JSON',
+      'BARE_OS_PEAR_DOCTOR_STATE_JSON',
+      'BARE_OS_PEAR_INSPECT_PROBE',
+      'BARE_OS_PEAR_DOCTOR_MODULE',
+      'BARE_OS_HYPERDHT_STATS_JSON',
+      'BARE_OS_RUNBIN_DEFAULT_TIMEOUT_MS',
+      'BARE_OS_VFS_SNAPSHOTS',
+      'BARE_OS_VFS_QUOTA_MODE',
+      'BARE_OS_VFS_QUOTA_GRACE_MS',
+      'BARE_OS_VFS_WATCH_CONSISTENCY',
+      'BARE_OS_KEY_HANDLE_TTL_MS',
+      'BARE_OS_EVENT_BUS_NDJSON',
+      'BARE_OS_HOST_STORAGE_JSON',
+      'BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS',
+      'BARE_OS_BOOT_POLICY_ALLOWED_CTX_METHODS',
+      'BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS',
+      'BARE_OS_PEAR_RUNTIME_VERSION',
+      'BARE_OS_BARE_RUNTIME_VERSION',
+      'BARE_OS_CURL_RESOLVE_MAP_JSON',
+      'BARE_OS_HTTP_PROXY_MAP_JSON',
+      'BARE_OS_SOCKS_PROXY_MAP_JSON',
+      'BARE_OS_BARE_CRYPTO_VERSION',
+      'BARE_OS_BARE_BOOT_VERSION',
+      'BARE_OS_BARE_LOGGER_VERSION',
+      'BARE_OS_BARE_TLS_VERSION',
+      'BARE_OS_BARE_PACK_VERSION',
+      'BARE_OS_BARE_ADDON_POLICY_VERSION',
+      'BARE_OS_PEAR_IPC_PACKAGE_VERSION',
+      'BARE_OS_PEAR_UPDATER_CHANNEL',
+      'BARE_OS_PEAR_UPDATER_MODULE',
+      'BARE_OS_PEAR_UPDATER_DELEGATE',
+      'BARE_OS_PEAR_UPDATER_SNAPSHOT_JSON',
+      'BARE_OS_PEAR_RUNTIME_CHANNEL',
+      'BARE_OS_PEAR_RUNTIME_STAGE',
+      'BARE_OS_PEAR_INSPECTOR_ATTACH_HINT',
+      'BARE_OS_PEAR_RUNTIME_SNAPSHOT_JSON',
+      'BARE_OS_CORESTORE_SNAPSHOT_STATE_JSON',
+      'BARE_OS_CORESTORE_SNAPSHOT_PAUSED',
+      'BARE_OS_REPLICATION_PAUSED',
+      'BARE_OS_HAPPY_EYEBALLS_V3_MODE',
+      'BARE_OS_BIN_WORKER_WASM_MS_MAX',
+      'BARE_OS_PROBE_ID_BARE_MODULE_CRYPTO_STAGING',
+      'BARE_OS_PROBE_ID_PEAR_INSPECT_LOGGER_TLS',
+      'BARE_OS_PROBE_ID_HYPERCORE_PACK_HRPC_LIFECYCLE',
+      'BARE_OS_HIDE_PROC_HYPERCORE_PACK_HRPC_LIFECYCLE',
+      'BARE_OS_BARE_RPC_PROBE_CLASS',
+      'BARE_OS_MTLS_PROXY_MAP_JSON',
+      'BARE_OS_THREAD_POOL_TELEMETRY_JSON',
+      'BARE_OS_HAPPY_EYEBALLS_V4_MODE',
+      'BARE_OS_PROC_RLIMITS_JSON',
+      'BARE_OS_SUBPROCESS_BRIDGE_UID_GID_MAP_JSON',
+      'BARE_OS_HDMS_VAULT_ROTATE_COUNT',
+      'BARE_OS_HOLESAIL_INITD',
+      'BARE_OS_HOLESAIL_MANAGED',
+      'BARE_OS_HOLESAIL_SERVER',
+      'BARE_OS_HOLESAIL_CLIENT',
+      'BARE_OS_HOLESAIL_KEY',
+      'BARE_OS_HOLESAIL_SECURE',
+      'BARE_OS_HOLESAIL_PORT',
+      'BARE_OS_HOLESAIL_HOST',
+      'BARE_OS_HOLESAIL_UDP',
+      'BARE_OS_HOLESAIL_LOG',
+      'BARE_OS_HOLESAIL_DEBUG',
+      'BARE_OS_HOLESAIL_STATE',
+      'BARE_OS_HOLESAIL_KERNEL',
+      'BARE_OS_HOLESAIL_KERNEL_SERVER',
+      'BARE_OS_HOLESAIL_KERNEL_CLIENT',
+      'BARE_OS_HOLESAIL_KERNEL_KEY',
+      'BARE_OS_HOLESAIL_KERNEL_SECURE',
+      'BARE_OS_HOLESAIL_KERNEL_PORT',
+      'BARE_OS_HOLESAIL_KERNEL_HOST',
+      'BARE_OS_HOLESAIL_KERNEL_UDP',
+      'BARE_OS_HOLESAIL_KERNEL_LOG',
+      'BARE_OS_SUBPROCESS_BRIDGE_JOBS_JSON',
+      'BARE_OS_SUBPROCESS_BRIDGE_META_JSON',
+      'BARE_OS_HOST_BARE_OS_PROC',
+      'BARE_OS_HOST_OS_JSON',
+      'BARE_OS_NET_TRANSPORT_STATS_JSON',
+      'BARE_OS_UDX_TUNING_JSON',
+      'BARE_OS_HYPERSWARM_TUNING_JSON',
+      'BARE_OS_DHT_ADDRESS_CLASS_ALLOWLIST',
+      'BARE_OS_PEER_DENYLIST_HEX',
+      'BARE_OS_PEER_REQUIRE_CAPS_JSON',
+      'BARE_OS_PEER_ADMISSION_AUDIT_NDJSON',
+      'BARE_OS_PEER_ADMISSION_AUDIT_RATE_MS',
+      'BARE_OS_DISK_OS_PATH_MANIFEST',
+      'BARE_OS_DISK_OS_SEARCH_MANIFEST_ONLY',
+      'BARE_OS_DISK_OS_MANIFEST_CACHE_MS',
+      'BARE_OS_PATH_CAPABILITY_ENFORCE_READ',
+      'BARE_OS_PATH_CAPABILITY_PREFIX',
+      'BARE_OS_SAVEVAULT_PRESNAPSHOT_HINT',
+      'BARE_OS_VFS_WARM_CACHE_INVALIDATE_ON_APPEND',
+      'BARE_OS_KERNEL_DEBUG',
+      'BARE_OS_PEAR_INSPECT',
+      'BARE_OS_KERNEL_PROFILE_WARM',
+      'BARE_OS_REPLICATION_SYNC_WINDOWS',
+      'BARE_OS_HDMS_SUPPORT_CORRELATION_ID',
+      'BARE_OS_BIN_WORKER_ALLOW',
+      'BARE_OS_BIN_WORKER_OFFLOAD',
+      'BARE_OS_BIN_WORKER_CPU_MS_MAX',
+      'BARE_OS_IPC_AUDIT',
+      'BARE_OS_DELEGATE_MAX_CONCURRENT',
+      'BARE_OS_DELEGATE_GIT_MAX_CONCURRENT',
+      'BARE_OS_DELEGATE_CURL_MAX_CONCURRENT',
+      'BARE_OS_DELEGATE_WGET_MAX_CONCURRENT',
+      'BARE_OS_DELEGATE_SYSTEMCTL_MAX_CONCURRENT'
+    ])

packages/bare-os-booter/lib/bare-os-kernel-errno.js

@@ -1,49 +0,0 @@
-/**
- * Stable errno-style codes for kernel/VFS/shell surfaces (POSIX-inspired naming).
- * Use with `bareOsErrnoName(code)` for diagnostics; map to exit status in utilities separately.
- * @module bare-os-kernel-errno
- */
-
-export const BARE_OS_ERRNO = Object.freeze({
-  EPERM: 1,
-  ENOENT: 2,
-  EIO: 5,
-  EBADF: 9,
-  EAGAIN: 11,
-  ENOMEM: 12,
-  EACCES: 13,
-  EEXIST: 17,
-  ENOTDIR: 20,
-  EISDIR: 21,
-  EINVAL: 22,
-  ENOSPC: 28,
-  EPIPE: 32,
-  ENOTSUP: 95,
-  ETIMEDOUT: 110
-})
-
-const _NAME_BY_NUM = Object.freeze(
-  Object.fromEntries(
-    Object.entries(BARE_OS_ERRNO).map(([k, v]) => [String(v), k])
-  )
-)
-
-/**
- * @param {number} code
- * @returns {string}
- */
-export function bareOsErrnoName(code) {
-  const n = Number(code)
-  return _NAME_BY_NUM[String(n)] || `EUNKNOWN_${n}`
-}
-
-/**
- * @param {string} name
- * @returns {number | undefined}
- */
-export function bareOsErrnoFromName(name) {
-  const k = String(name || '').toUpperCase()
-  return /** @type {number | undefined} */ (
-    BARE_OS_ERRNO[/** @type {keyof typeof BARE_OS_ERRNO} */ (k)]
-  )
-}

packages/bare-os-booter/lib/booter-host-session.js

@@ -0,0 +1,170 @@
+/**
+ * Booter session helpers: guest env prefix maps and TTY readline setup.
+ */
+import {
+  createBareReadlineQuestion,
+  createStreamLineReader,
+  looksLikeInteractiveStdin
+} from './cli-readline.js'
+import { resolveStdio } from './resolve-stdio.js'
+import { bareOsHostBooterWarn } from './bare-os-host-booter-log.js'
+
+/**
+ * @param {Record<string, string>} env
+ * @returns {string[]}
+ */
+export function parseUnionReadPrefixes(env) {
+  const raw = env && env.BARE_OS_VFS_UNION_PREFIXES
+  if (raw == null || !String(raw).trim()) return []
+  return String(raw)
+    .split(/[,:]+/)
+    .map((s) => s.trim())
+    .filter((s) => s.startsWith('/'))
+}
+
+/**
+ * @param {Record<string, string>} env
+ * @returns {string[]}
+ */
+export function parseUnionWriteDenyPrefixes(env) {
+  const raw = env && env.BARE_OS_VFS_UNION_WRITE_DENY
+  if (raw == null || !String(raw).trim()) return []
+  return String(raw)
+    .split(/[,:]+/)
+    .map((s) => s.trim())
+    .filter((s) => s.startsWith('/'))
+}
+
+/**
+ * @param {Record<string, string>} env
+ * @returns {Map<string, number> | null}
+ */
+export function parseIpcChannelMaxBytesMap(env) {
+  const raw = env && env.BARE_OS_IPC_CHANNEL_MAX_BYTES
+  if (raw == null || !String(raw).trim()) return null
+  try {
+    const o = JSON.parse(String(raw))
+    if (!o || typeof o !== 'object') return null
+    const m = new Map()
+    for (const [k, v] of Object.entries(o)) {
+      const n = Number(v)
+      if (
+        typeof k === 'string' &&
+        /^[a-zA-Z0-9._-]+$/.test(k) &&
+        Number.isFinite(n) &&
+        n > 0
+      ) {
+        m.set(k, Math.min(Math.floor(n), 16 * 1024 * 1024))
+      }
+    }
+    return m.size ? m : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * @returns {Promise<{
+ *   readLine: (p: string) => Promise<string | null>,
+ *   interactiveAvailable: boolean,
+ *   skipInteractive: boolean,
+ *   stdout: import('stream').Writable | null,
+ *   stdin: import('stream').Readable | null
+ * }>}
+ */
+export async function createReadLine() {
+  const { stdin, stdout } = await resolveStdio()
+
+  const skipInteractive = globalThis.process?.env?.BARE_OS_SKIP_REPL === '1'
+  if (skipInteractive) {
+    return {
+      readLine: async () => null,
+      interactiveAvailable: false,
+      skipInteractive: true,
+      stdout,
+      stdin
+    }
+  }
+
+  if (!stdin || !stdout) {
+    bareOsHostBooterWarn(
+      'stdio_missing',
+      'No stdin/stdout (neither process nor bare-stdio). Cannot run interactive shell.'
+    )
+    return {
+      readLine: async () => null,
+      interactiveAvailable: false,
+      skipInteractive: false,
+      stdout,
+      stdin
+    }
+  }
+
+  const ttyRawCapable =
+    Boolean(stdin.isTTY) &&
+    typeof stdin.setRawMode === 'function' &&
+    typeof stdout.write === 'function'
+
+  /** Prefer fish-style raw editor on TTY — bare-readline / stream reader only (no Node readline). */
+  if (ttyRawCapable) {
+    /** Lazy: avoid bare-readline attaching to stdin before createFishReadLine runs. */
+    let ttyFallback = undefined
+    const lazyRawReadLine = async (prompt) => {
+      if (ttyFallback === undefined) {
+        try {
+          ttyFallback = await createBareReadlineQuestion(stdin, stdout)
+        } catch {
+          ttyFallback =
+            looksLikeInteractiveStdin(stdin) &&
+            typeof stdout.write === 'function'
+              ? createStreamLineReader(stdin, stdout)
+              : false
+        }
+      }
+      if (ttyFallback === false) return null
+      return ttyFallback(prompt)
+    }
+    return {
+      readLine: lazyRawReadLine,
+      interactiveAvailable: true,
+      skipInteractive: false,
+      stdout,
+      stdin
+    }
+  }
+
+  try {
+    const readLine = await createBareReadlineQuestion(stdin, stdout)
+    return {
+      readLine,
+      interactiveAvailable: true,
+      skipInteractive: false,
+      stdout,
+      stdin
+    }
+  } catch {
+    /* bare-readline failed to load */
+  }
+
+  if (looksLikeInteractiveStdin(stdin) && typeof stdout.write === 'function') {
+    return {
+      readLine: createStreamLineReader(stdin, stdout),
+      interactiveAvailable: true,
+      skipInteractive: false,
+      stdout,
+      stdin
+    }
+  }
+
+  bareOsHostBooterWarn(
+    'line_input_unavailable',
+    'No line input. Set BARE_OS_SKIP_REPL=1 to exit after boot.'
+  )
+  return {
+    readLine: async () => null,
+    interactiveAvailable: false,
+    skipInteractive: false,
+    stdout,
+    stdin
+  }
+}

packages/bare-os-booter/lib/corestore-opts.js

@@ -1,15 +1,7 @@
 /**
- * Corestore 7.11+ constructor extras used by the booter host store.
- * `treeCache` forwards to Hypercore default storage (proof/tree node cache).
+ * Re-export shared Corestore ctor extras (single source: repo `lib/`).
  */
-export const BARE_OS_CORESTORE_TREE_CACHE = { maxSize: 8192 }
-
-/**
- * @param {Record<string, unknown>} [extra]
- */
-export function bareOsCorestoreConstructOpts(extra) {
-  return {
-    treeCache: BARE_OS_CORESTORE_TREE_CACHE,
-    ...(extra && typeof extra === 'object' ? extra : {})
-  }
-}
+export {
+  BARE_OS_CORESTORE_TREE_CACHE,
+  bareOsCorestoreConstructOpts
+} from '../../../lib/bare-os-corestore-opts.mjs'

packages/bare-os-booter/lib/shell-arithmetic.js

@@ -0,0 +1,100 @@
+/**
+ * POSIX-ish $(( )) arithmetic used by the guest shell.
+ */
+import { shellCheckUnboundParam } from './shell-nounset.js'
+
+/**
+ * Expand `$VAR`, `${VAR}`, and `$N` inside arithmetic before identifier substitution.
+ * @param {string} inner
+ * @param {Record<string, string>} env
+ */
+export function bareOsArithmeticExpandDollarForms(inner, env) {
+  const s = String(inner || '')
+  if (s.length > 4096) throw new Error('shell: arithmetic: expression too long')
+  /** @type {string[]} */
+  const parts = []
+  let i = 0
+  let replacements = 0
+  const maxRep = 256
+  while (i < s.length) {
+    if (s[i] !== '$') {
+      parts.push(s[i++])
+      continue
+    }
+    if (++replacements > maxRep)
+      throw new Error('shell: arithmetic: expansion limit exceeded')
+    if (i + 1 >= s.length) {
+      parts.push('$')
+      i++
+      continue
+    }
+    if (s[i + 1] === '{') {
+      const end = s.indexOf('}', i + 2)
+      if (end === -1) {
+        parts.push('$')
+        i++
+        continue
+      }
+      const name = s.slice(i + 2, end).trim()
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        throw new Error('shell: arithmetic: invalid ${} in expression')
+      shellCheckUnboundParam(name, env)
+      const raw = env[name]
+      const n = Number.parseInt(String(raw ?? '0').trim(), 10)
+      parts.push(String(Number.isFinite(n) ? n : 0))
+      i = end + 1
+      continue
+    }
+    const c1 = s[i + 1]
+    if (/[0-9]/.test(c1)) {
+      shellCheckUnboundParam(c1, env)
+      const raw = env[c1]
+      const n = Number.parseInt(String(raw ?? '0').trim(), 10)
+      parts.push(String(Number.isFinite(n) ? n : 0))
+      i += 2
+      continue
+    }
+    if (!/[A-Za-z_]/.test(c1)) {
+      parts.push('$')
+      i++
+      continue
+    }
+    let k = i + 2
+    while (k < s.length && /[A-Za-z0-9_]/.test(s[k])) k++
+    const name = s.slice(i + 1, k)
+    shellCheckUnboundParam(name, env)
+    const raw = env[name]
+    const n = Number.parseInt(String(raw ?? '0').trim(), 10)
+    parts.push(String(Number.isFinite(n) ? n : 0))
+    i = k
+  }
+  return parts.join('')
+}
+
+/**
+ * @param {string} expr
+ * @param {Record<string, string>} env
+ */
+export function bareOsEvalArithmeticExpr(expr, env) {
+  const pre = bareOsArithmeticExpandDollarForms(String(expr || ''), env)
+  const src = pre.trim()
+  if (!src) return '0'
+  if (!/^[A-Za-z0-9_+\-*/%()\s]+$/.test(src)) {
+    throw new Error('shell: arithmetic: invalid token')
+  }
+  const replaced = src.replace(/\b[A-Za-z_][A-Za-z0-9_]*\b/g, (name) => {
+    shellCheckUnboundParam(name, env)
+    const raw = env[name]
+    const n = Number.parseInt(String(raw ?? '0').trim(), 10)
+    return String(Number.isFinite(n) ? n : 0)
+  })
+  let out = 0
+  try {
+    out = Function('"use strict"; return (' + replaced + ');')()
+  } catch {
+    throw new Error('shell: arithmetic: invalid expression')
+  }
+  const num = Number(out)
+  if (!Number.isFinite(num)) throw new Error('shell: arithmetic: non-finite result')
+  return String(Math.trunc(num))
+}

packages/bare-os-booter/lib/shell-nounset.js

@@ -0,0 +1,28 @@
+/** @see execShellLine — nounset violations surface as exit status 1 */
+export const BARE_OS_SHELL_NOUNSET_ERROR = 'BARE_OS_SHELL_NOUNSET'
+
+/**
+ * @param {Record<string, string> | null | undefined} env
+ */
+export function shellNounsetEnvOn(env) {
+  return (
+    env &&
+    (env.BARE_OS_SHELL_NOUNSET === '1' || env.BARE_OS_SHELL_NOUNSET === 'true')
+  )
+}
+
+/**
+ * @param {string} name
+ * @param {Record<string, string>} env
+ */
+export function shellCheckUnboundParam(name, env) {
+  if (!shellNounsetEnvOn(env) || !name) return
+  const n = name.trim()
+  if (n === '?' || /^\d+$/.test(n)) return
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(n)) return
+  if (!Object.prototype.hasOwnProperty.call(env, n)) {
+    const e = new Error(`unbound variable: ${n}`)
+    e.code = BARE_OS_SHELL_NOUNSET_ERROR
+    throw e
+  }
+}

packages/bare-os-booter/lib/shell.js

@@ -15,131 +15,13 @@ import {
 } from './bare-os-theme-presets.js'
 import { pathnameExpandShellWord, bareOsFnmatch } from './shell-glob.js'
 import { bareOsKernelMetricSet } from './bare-os-kernel-metrics.js'
+import {
+  BARE_OS_SHELL_NOUNSET_ERROR,
+  shellCheckUnboundParam
+} from './shell-nounset.js'
+import { bareOsEvalArithmeticExpr } from './shell-arithmetic.js'
 
-/** @see execShellLine — nounset violations surface as exit status 1 */
-export const BARE_OS_SHELL_NOUNSET_ERROR = 'BARE_OS_SHELL_NOUNSET'
-
-/**
- * @param {Record<string, string> | null | undefined} env
- */
-function shellNounsetEnvOn(env) {
-  return (
-    env &&
-    (env.BARE_OS_SHELL_NOUNSET === '1' || env.BARE_OS_SHELL_NOUNSET === 'true')
-  )
-}
-
-/**
- * @param {string} name
- * @param {Record<string, string>} env
- */
-function shellCheckUnboundParam(name, env) {
-  if (!shellNounsetEnvOn(env) || !name) return
-  const n = name.trim()
-  if (n === '?' || /^\d+$/.test(n)) return
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(n)) return
-  if (!Object.prototype.hasOwnProperty.call(env, n)) {
-    const e = new Error(`unbound variable: ${n}`)
-    e.code = BARE_OS_SHELL_NOUNSET_ERROR
-    throw e
-  }
-}
-
-/**
- * Expand `$VAR`, `${VAR}`, and `$N` inside arithmetic before identifier substitution.
- * @param {string} inner
- * @param {Record<string, string>} env
- */
-function bareOsArithmeticExpandDollarForms(inner, env) {
-  const s = String(inner || '')
-  if (s.length > 4096) throw new Error('shell: arithmetic: expression too long')
-  /** @type {string[]} */
-  const parts = []
-  let i = 0
-  let replacements = 0
-  const maxRep = 256
-  while (i < s.length) {
-    if (s[i] !== '$') {
-      parts.push(s[i++])
-      continue
-    }
-    if (++replacements > maxRep)
-      throw new Error('shell: arithmetic: expansion limit exceeded')
-    if (i + 1 >= s.length) {
-      parts.push('$')
-      i++
-      continue
-    }
-    if (s[i + 1] === '{') {
-      const end = s.indexOf('}', i + 2)
-      if (end === -1) {
-        parts.push('$')
-        i++
-        continue
-      }
-      const name = s.slice(i + 2, end).trim()
-      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
-        throw new Error('shell: arithmetic: invalid ${} in expression')
-      shellCheckUnboundParam(name, env)
-      const raw = env[name]
-      const n = Number.parseInt(String(raw ?? '0').trim(), 10)
-      parts.push(String(Number.isFinite(n) ? n : 0))
-      i = end + 1
-      continue
-    }
-    const c1 = s[i + 1]
-    if (/[0-9]/.test(c1)) {
-      shellCheckUnboundParam(c1, env)
-      const raw = env[c1]
-      const n = Number.parseInt(String(raw ?? '0').trim(), 10)
-      parts.push(String(Number.isFinite(n) ? n : 0))
-      i += 2
-      continue
-    }
-    if (!/[A-Za-z_]/.test(c1)) {
-      parts.push('$')
-      i++
-      continue
-    }
-    let k = i + 2
-    while (k < s.length && /[A-Za-z0-9_]/.test(s[k])) k++
-    const name = s.slice(i + 1, k)
-    shellCheckUnboundParam(name, env)
-    const raw = env[name]
-    const n = Number.parseInt(String(raw ?? '0').trim(), 10)
-    parts.push(String(Number.isFinite(n) ? n : 0))
-    i = k
-  }
-  return parts.join('')
-}
-
-/**
- * @param {string} expr
- * @param {Record<string, string>} env
- */
-function bareOsEvalArithmeticExpr(expr, env) {
-  const pre = bareOsArithmeticExpandDollarForms(String(expr || ''), env)
-  const src = pre.trim()
-  if (!src) return '0'
-  if (!/^[A-Za-z0-9_+\-*/%()\s]+$/.test(src)) {
-    throw new Error('shell: arithmetic: invalid token')
-  }
-  const replaced = src.replace(/\b[A-Za-z_][A-Za-z0-9_]*\b/g, (name) => {
-    shellCheckUnboundParam(name, env)
-    const raw = env[name]
-    const n = Number.parseInt(String(raw ?? '0').trim(), 10)
-    return String(Number.isFinite(n) ? n : 0)
-  })
-  let out = 0
-  try {
-    out = Function('"use strict"; return (' + replaced + ');')()
-  } catch {
-    throw new Error('shell: arithmetic: invalid expression')
-  }
-  const num = Number(out)
-  if (!Number.isFinite(num)) throw new Error('shell: arithmetic: non-finite result')
-  return String(Math.trunc(num))
-}
+export { BARE_OS_SHELL_NOUNSET_ERROR }
 
 const SHELL_BUILTINS = new Set([
   'alias',

packages/bare-os-booter/lib/vfs-policy.js

@@ -0,0 +1,161 @@
+/**
+ * VFS path-class policy and Hyperdrive batch/diff helpers.
+ */
+/**
+ * Policy-oriented path class for VFS routing (system vs personal vs pseudo vs mount vs volatile).
+ * Used by operator tooling and future policy engines; routing itself stays in `createVfs`.
+ * @param {string} p
+ * @returns {'system' | 'personal' | 'pseudo' | 'mount' | 'volatile' | 'snapshot' | 'unknown'}
+ */
+export function classifyBareOsVfsPathClass(p) {
+  const path = String(p || '').replace(/\\/g, '/')
+  if (!path.startsWith('/')) return 'unknown'
+  if (path === '/snapshots' || path.startsWith('/snapshots/')) return 'snapshot'
+  if (path.startsWith('/proc/') || path === '/proc') return 'pseudo'
+  if (path.startsWith('/sys/') || path === '/sys') return 'pseudo'
+  if (path.startsWith('/dev/') || path === '/dev') return 'pseudo'
+  if (path.startsWith('/run/') || path === '/run') return 'volatile'
+  if (
+    path.startsWith('/mnt/') ||
+    path.startsWith('/media/') ||
+    path.startsWith('/mount/')
+  )
+    return 'mount'
+  if (path.startsWith('/home/')) return 'personal'
+  if (path === '/root' || path.startsWith('/root/')) return 'personal'
+  if (path.startsWith('/tmp/') || path === '/tmp') return 'volatile'
+  if (
+    path.startsWith('/boot/') ||
+    path.startsWith('/bin/') ||
+    path.startsWith('/lib/') ||
+    path.startsWith('/etc/') ||
+    path === '/etc' ||
+    path.startsWith('/usr/') ||
+    path.startsWith('/var/')
+  )
+    return 'system'
+  return 'system'
+}
+
+/**
+ * Declarative policy evaluation over {@link classifyBareOsVfsPathClass} (allow/deny/audit rule stack).
+ * Later rules override earlier allow/deny; **`audit`** matches are recorded but do not change verdict.
+ * @param {string} p
+ * @param {{ id?: string, effect: 'allow' | 'deny' | 'audit', pathClass?: string, prefix?: string }[]} [rules]
+ * @returns {{ path: string, pathClass: string, matched: { id?: string, effect: 'allow' | 'deny' | 'audit' }[], verdict: 'neutral' | 'allow' | 'deny', auditHits: number, metrics: { rulesEvaluated: number, matchCount: number } }}
+ */
+export function evaluateBareOsVfsPathPolicy(p, rules = []) {
+  const path = String(p || '').replace(/\\/g, '/')
+  const pathClass = classifyBareOsVfsPathClass(path)
+  /** @type {{ id?: string, effect: 'allow' | 'deny' | 'audit' }[]} */
+  const matched = []
+  let verdict = 'neutral'
+  let auditHits = 0
+  let rulesEvaluated = 0
+  for (const r of rules) {
+    rulesEvaluated++
+    if (
+      !r ||
+      (r.effect !== 'allow' && r.effect !== 'deny' && r.effect !== 'audit')
+    )
+      continue
+    if (r.pathClass && r.pathClass !== pathClass) continue
+    if (r.prefix && !path.startsWith(String(r.prefix))) continue
+    matched.push({ id: r.id, effect: r.effect })
+    if (r.effect === 'audit') {
+      auditHits++
+      continue
+    }
+    verdict = r.effect
+  }
+  return {
+    path,
+    pathClass,
+    matched,
+    verdict,
+    auditHits,
+    metrics: { rulesEvaluated, matchCount: matched.length }
+  }
+}
+
+/**
+ * Parse optional **`BARE_OS_VFS_POLICY_RULES_JSON`** env: `{ "rules": [ ... ] }`.
+ * @param {Record<string, unknown> | null | undefined} env
+ */
+export function parseBareOsVfsPolicyRulesFromEnv(env) {
+  const raw = env && env.BARE_OS_VFS_POLICY_RULES_JSON
+  if (raw == null || raw === '') return []
+  try {
+    const j = JSON.parse(String(raw))
+    if (j && typeof j === 'object' && Array.isArray(j.rules)) return j.rules
+  } catch {
+    /* ignore */
+  }
+  return []
+}
+
+/**
+ * Batch put helper: uses Hyperdrive `batch()` when present, else sequential `put`.
+ * @param {{ put?: Function, batch?: () => { put: Function, flush?: () => Promise<void> } }} drive
+ * @param {{ path: string, buf: Uint8Array | ArrayBuffer, opts?: Record<string, unknown> }[]} puts
+ */
+export async function bareOsVfsBatchPut(drive, puts) {
+  if (!drive || typeof drive.put !== 'function') {
+    throw new Error('bareOsVfsBatchPut: drive.put required')
+  }
+  if (!Array.isArray(puts) || !puts.length) return
+  if (typeof drive.batch === 'function') {
+    const b = drive.batch()
+    for (const row of puts) {
+      const p = String(row.path || '').trim()
+      if (!p) continue
+      await b.put(p, row.buf, row.opts)
+    }
+    if (typeof b.flush === 'function') await b.flush()
+    return
+  }
+  for (const row of puts) {
+    const p = String(row.path || '').trim()
+    if (!p) continue
+    await drive.put(p, row.buf, row.opts)
+  }
+}
+
+/**
+ * Collect diff entries when the drive exposes `diff` (signature varies by Hyperdrive version).
+ * @param {{ diff?: (...args: unknown[]) => AsyncIterable<unknown> | Iterable<unknown> }} drive
+ * @param {unknown} a
+ * @param {unknown} b
+ * @param {{ maxEntries?: number, diffOpts?: Record<string, unknown> }} [opts]
+ */
+export async function bareOsHyperdriveDiffCollect(drive, a, b, opts = {}) {
+  if (!drive || typeof drive.diff !== 'function') {
+    return { ok: false, error: 'diff-unavailable' }
+  }
+  const max = opts.maxEntries ?? 5000
+  /** @type {unknown[]} */
+  const entries = []
+  try {
+    const raw = drive.diff(a, b, opts.diffOpts)
+    if (raw && Symbol.asyncIterator in raw) {
+      for await (const ent of /** @type {AsyncIterable<unknown>} */ (raw)) {
+        entries.push(ent)
+        if (entries.length >= max) break
+      }
+    } else if (raw && Symbol.iterator in raw) {
+      for (const ent of /** @type {Iterable<unknown>} */ (raw)) {
+        entries.push(ent)
+        if (entries.length >= max) break
+      }
+    } else {
+      return { ok: false, error: 'diff-not-iterable' }
+    }
+    return {
+      ok: true,
+      entries,
+      truncated: entries.length >= max
+    }
+  } catch (e) {
+    return { ok: false, error: (e && e.message) || String(e) }
+  }
+}

packages/bare-os-booter/lib/vfs-proc-id-maps.js

@@ -0,0 +1,135 @@
+/**
+ * Capability-word /proc filename → id maps (words 6–11).
+ */
+/** Capability word 6 `/proc` pseudo files → {@link ./bare-os-proc-replication-operator-surface.js} ids. */
+export const BARE_OS_PROC_FILE_TO_ID_REPLICATION_OPERATOR_SURFACE = Object.freeze({
+  bare_os_udx_extended: 'udx_extended',
+  bare_os_dht_status: 'dht_status',
+  bare_os_replication_backpressure: 'replication_backpressure',
+  bare_os_ipc_backpressure: 'ipc_backpressure',
+  bare_os_delegate_red: 'delegate_red',
+  bare_os_build_attestation_pointer: 'build_attestation_pointer',
+  bare_os_pear_ipc_health: 'pear_ipc_health',
+  bare_os_hypercore_lengths: 'hypercore_lengths',
+  bare_os_slo_hints: 'slo_hints',
+  bare_os_locale: 'locale',
+  bare_os_worker_budget: 'worker_budget',
+  bare_os_sandbox_profile: 'sandbox_profile',
+  bare_os_dns_map_active: 'dns_map_active',
+  bare_os_git_delegate_stats: 'git_delegate_stats',
+  bare_os_replication_operator_panel: 'replication_operator_panel'
+})
+
+/** Capability word 7 `/proc` pseudo files → {@link ./bare-os-proc-pear-corestore-hrpc.js} ids. */
+export const BARE_OS_PROC_FILE_TO_ID_PEAR_CORESTORE_HRPC = Object.freeze({
+  bare_os_async_hooks_lag: 'async_hooks_lag',
+  bare_os_autopass_session_sketch: 'autopass_session_sketch',
+  bare_os_bare_diagnostics_channel: 'diagnostics_channel',
+  bare_os_bare_net_interfaces: 'bare_net_interfaces',
+  bare_os_bare_thread_pool: 'thread_pool',
+  bare_os_blind_relay_router: 'blind_relay_router',
+  bare_os_compact_encoding_profile: 'compact_encoding_profile',
+  bare_os_corestore_gc_hint: 'corestore_gc_hint',
+  bare_os_git_lfs_pointer_stats: 'git_lfs_pointer_stats',
+  bare_os_hrpc_bridge_health: 'hrpc_bridge_health',
+  bare_os_hyperdb_readonly_index: 'hyperdb_readonly_index',
+  bare_os_pear_build_fingerprint: 'pear_build_fingerprint',
+  bare_os_pear_runtime_channel: 'pear_runtime_channel',
+  bare_os_protomux_channels: 'protomux_channels',
+  bare_os_security_context: 'security_context',
+  bare_os_updater_download_state: 'updater_download_state'
+})
+
+/** Capability word 8 `/proc` pseudo files → {@link ./bare-os-proc-bare-runtime-proto-mux.js} ids. */
+export const BARE_OS_PROC_FILE_TO_ID_BARE_RUNTIME_PROTO_MUX = Object.freeze({
+  bare_os_bare_kit_bridge: 'bare_kit_bridge',
+  bare_os_brittle_snapshot_ci: 'brittle_snapshot_ci',
+  bare_os_cellery_sidecar_hint: 'cellery_sidecar_hint',
+  bare_os_form_data_delegate_limits: 'form_data_delegate_limits',
+  bare_os_gip_transport_sketch: 'gip_transport_sketch',
+  bare_os_http_dht_proxy_route: 'http_dht_proxy_route',
+  bare_os_hyper_multisig_trust_pointer: 'hyper_multisig_trust_pointer',
+  bare_os_hypercore_signing_status: 'hypercore_signing_status',
+  bare_os_hypermininet_topology: 'hypermininet_topology',
+  bare_os_libmqjs_queue_depth: 'libmqjs_queue_depth',
+  bare_os_oidc_publishing_pointer: 'oidc_publishing_pointer',
+  bare_os_pear_sidecar_bundle_index: 'pear_sidecar_bundle_index',
+  bare_os_protomux_rpc_pool_health: 'protomux_rpc_pool_health',
+  bare_os_react_native_bare_kit: 'react_native_bare_kit',
+  bare_os_rocksdb_pointer: 'rocksdb_pointer',
+  bare_os_safe_sodium_buffer_policy: 'safe_sodium_buffer_policy',
+  bare_os_sandbox_worker_queue: 'sandbox_worker_queue',
+  bare_os_structured_clone_profile: 'structured_clone_profile'
+})
+
+/** Capability word 9 `/proc` pseudo files → {@link ./bare-os-proc-bare-module-crypto-staging.js} ids. */
+export const BARE_OS_PROC_FILE_TO_ID_BARE_MODULE_CRYPTO_STAGING = Object.freeze({
+  bare_os_pear_stage_pointer: 'pear_stage_pointer',
+  bare_os_pear_updater_state: 'pear_updater_state',
+  bare_os_pear_appling_manifest: 'pear_appling_manifest',
+  bare_os_drive_resolve_cache: 'drive_resolve_cache',
+  bare_os_bare_module_resolution: 'bare_module_resolution',
+  bare_os_bare_crypto_policy: 'bare_crypto_policy',
+  bare_os_bare_ipc_bridge: 'bare_ipc_bridge',
+  bare_os_bare_vm_sandbox_sketch: 'bare_vm_sandbox_sketch',
+  bare_os_bare_daemon_hooks: 'bare_daemon_hooks',
+  bare_os_bare_storage_quota: 'bare_storage_quota',
+  bare_os_bare_worker_pool: 'bare_worker_pool',
+  bare_os_pear_wakeups_schedule: 'pear_wakeups_schedule',
+  bare_os_pear_drop_events: 'pear_drop_events',
+  bare_os_pear_radio_state: 'pear_radio_state',
+  bare_os_hypercore_repair_hint: 'hypercore_repair_hint',
+  bare_os_hyperdrive_sparse_index: 'hyperdrive_sparse_index',
+  bare_os_protomux_channel_alias_v2: 'protomux_channel_alias_v2',
+  bare_os_structured_clone_budget_v2: 'structured_clone_budget_v2',
+  bare_os_form_data_delegate_limits_v2: 'form_data_delegate_limits_v2'
+})
+
+/** Capability word 10 `/proc` pseudo files → {@link ./bare-os-proc-pear-inspect-logger-tls.js} ids. */
+export const BARE_OS_PROC_FILE_TO_ID_PEAR_INSPECT_LOGGER_TLS = Object.freeze({
+  bare_os_activity_queue_depth: 'activity_queue_depth',
+  bare_os_autobase_writer_hint: 'autobase_writer_hint',
+  bare_os_bare_boot_phase_map: 'bare_boot_phase_map',
+  bare_os_bare_inspect_policy: 'bare_inspect_policy',
+  bare_os_bare_logger_policy: 'bare_logger_policy',
+  bare_os_bare_performance_counters: 'bare_performance_counters',
+  bare_os_bare_rpc_registry_sketch: 'bare_rpc_registry_sketch',
+  bare_os_bare_signals_mask: 'bare_signals_mask',
+  bare_os_bare_stream_backpressure: 'bare_stream_backpressure',
+  bare_os_bare_timers_budget: 'bare_timers_budget',
+  bare_os_bare_tls_session_hint: 'bare_tls_session_hint',
+  bare_os_bare_ws_gateway_sketch: 'bare_ws_gateway_sketch',
+  bare_os_blind_pairing_sketch: 'blind_pairing_sketch',
+  bare_os_broadcast_encryption_hint: 'broadcast_encryption_hint',
+  bare_os_pear_api_allowlist_sketch: 'pear_api_allowlist_sketch',
+  bare_os_pear_doctor_state: 'pear_doctor_state',
+  bare_os_pear_rti_pointer: 'pear_rti_pointer',
+  bare_os_pear_user_dirs_map: 'pear_user_dirs_map',
+  bare_os_pear_workshop_flags: 'pear_workshop_flags'
+})
+
+/** Capability word 11 `/proc` pseudo files → {@link ./bare-os-proc-hypercore-pack-hrpc-lifecycle.js} ids. */
+export const BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE = Object.freeze({
+  bare_os_autopass_rotation_sketch: 'autopass_rotation_sketch',
+  bare_os_bare_addon_policy: 'bare_addon_policy',
+  bare_os_bare_pack_cache: 'bare_pack_cache',
+  bare_os_bare_signals_profile: 'bare_signals_profile',
+  bare_os_bare_timers_histogram: 'bare_timers_histogram',
+  bare_os_bundle_preload_hint: 'bundle_preload_hint',
+  bare_os_drive_version_graph: 'drive_version_graph',
+  bare_os_git_lfs_budget: 'git_lfs_budget',
+  bare_os_hrpc_allowlist_sketch: 'hrpc_allowlist_sketch',
+  bare_os_hypercore_replicate_budget: 'hypercore_replicate_budget',
+  bare_os_indexer_catchup: 'indexer_catchup',
+  bare_os_multisig_quorum_pointer: 'multisig_quorum_pointer',
+  bare_os_net_qos_class: 'net_qos_class',
+  bare_os_pear_runtime_matrix: 'pear_runtime_matrix',
+  bare_os_protomux_backpressure: 'protomux_backpressure',
+  bare_os_relay_geo_hint: 'relay_geo_hint',
+  bare_os_sidecar_resource_cap: 'sidecar_resource_cap',
+  bare_os_storage_tier_hint: 'storage_tier_hint',
+  bare_os_wave11_operator_slo_v2: 'wave11_operator_slo_v2',
+  bare_os_wave11_peer_qos_sketch: 'wave11_peer_qos_sketch',
+  bare_os_kernel_program: 'kernel_program',
+  bare_os_giant_phase_program: 'giant_phase_program'
+})

packages/bare-os-booter/package.json

@@ -10,7 +10,7 @@
     "start": "node ../../scripts/ensure-pear-node-modules.mjs packages/bare-os-booter && bare index.js",
     "dev": "node ../../scripts/ensure-pear-node-modules.mjs packages/bare-os-booter && bare index.js",
     "bin:dev": "bare ../../bin/bare-os-booter.mjs --no-updates",
-    "test": "../../node_modules/.bin/brittle-bare test.identity.js && node --require ./scripts/bare-node-test-shim.cjs ../../node_modules/.bin/brittle-node test.js test.bare-os-chat-service.js test.bare-os-chat-wire.js test.bare-os-chat-roundtrip.js test.bare-holesail.js test.bare-holesail-managed.js test.bare-os-www.js test.bare-os-bind-fallback.js test.bare-os-ssh-holesail.js test.bare-openssh-pty.js test.bare-openssh-sftp.js test.hrpc-allowlist.js test.socket-scm-rights.js test.peer-system-seed.js test.peer-visibility-proc.js test.qvac-host.js test.qvac-gpu-probe.js test.qvac-models-store.js test.tui-sdk.js test.irc-tls.js test.bare-discord-env.js test.bare-discord-initd.js",
+    "test": "../../node_modules/.bin/brittle-bare test.identity.js && node --require ./scripts/bare-node-test-shim.cjs ../../node_modules/.bin/brittle-node test.kernel.js test.vfs.js test.shell.js test.initd-fish.js test.coreutils.js test.runtime.js test.bare-os-chat-service.js test.bare-os-chat-wire.js test.bare-os-chat-roundtrip.js test.bare-holesail.js test.bare-holesail-managed.js test.bare-os-www.js test.bare-os-bind-fallback.js test.bare-os-ssh-holesail.js test.bare-openssh-pty.js test.bare-openssh-sftp.js test.hrpc-allowlist.js test.socket-scm-rights.js test.peer-system-seed.js test.peer-visibility-proc.js test.qvac-host.js test.qvac-gpu-probe.js test.qvac-models-store.js test.tui-sdk.js test.irc-tls.js test.bare-discord-env.js test.bare-discord-initd.js",
     "test:bare": "../../node_modules/.bin/brittle-bare test.identity.js test.bare-smoke.js test.bare-discord-load.js",
     "test:shell-bracket": "node --require ./scripts/bare-node-test-shim.cjs ../../node_modules/.bin/brittle-node test.shell-bracket-smoke.mjs",
     "test:peer-seed": "node --require ./scripts/bare-node-test-shim.cjs ../../node_modules/.bin/brittle-node test.peer-system-seed.js",
@@ -88,6 +88,12 @@
         "node_modules/.bin",
         "node_modules/.package-lock.json",
         "test.js",
+        "test.kernel.js",
+        "test.vfs.js",
+        "test.shell.js",
+        "test.initd-fish.js",
+        "test.coreutils.js",
+        "test.runtime.js",
         "test.identity.js",
         "test.bare-smoke.js",
         "test.bare-holesail.js",

packages/bare-os-booter/test.txt

@@ -1,15 +0,0 @@
-
-h
-
-
-
-
-
-
-
-
-
-
-
-
-pppThis is a test

packages/bare-os-booter/test/_helpers.js

@@ -0,0 +1,440 @@
+import test from 'brittle'
+import b4a from 'b4a'
+import Hyperdrive from 'hyperdrive'
+import Corestore from 'corestore'
+import { mkdirSync, rmSync } from 'node:fs'
+import { readFile, readdir } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createRequire } from 'node:module'
+import { PassThrough } from 'node:stream'
+import { XTERM_CLEAR_SCROLLBACK_AND_VIEWPORT } from '../lib/terminal-escapes.js'
+import { runKernelFromSource, runBinCommand } from '../lib/kernel-runner.js'
+import { createGitFsFromVfs } from '../lib/git-fs-adapter.js'
+import { runGitCli } from '../lib/git-cli.js'
+import {
+  createStreamLineReader,
+  sanitizeInteractiveShellLine
+} from '../lib/cli-readline.js'
+import {
+  createVfs,
+  BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE
+} from '../lib/vfs.js'
+import { parseHdmsPairArgv } from '../lib/hdms-cli-argv.js'
+import hcCrypto from 'hypercore-crypto'
+import idEnc from 'hypercore-id-encoding'
+import {
+  decodeRwShareOffer,
+  decodeShareOffer,
+  HDMS_AUTOPASS_SHARE_KEY,
+  HDMS_AUTOPASS_SHARE_RW_KEY,
+  normalizeWriterSecretHex
+} from '../lib/hdms-share-offer.js'
+import { buildBareOsHypercorePackHrpcLifecycleProcJson } from '../lib/bare-os-proc-hypercore-pack-hrpc-lifecycle.js'
+import { buildBareOsPearCorestoreHrpcProcJson } from '../lib/bare-os-proc-pear-corestore-hrpc.js'
+import { buildBareOsPearInspectLoggerTlsProcJson } from '../lib/bare-os-proc-pear-inspect-logger-tls.js'
+import { buildBareOsBareRuntimeProtoMuxProcJson } from '../lib/bare-os-proc-bare-runtime-proto-mux.js'
+import { buildBareOsBootGraphProcJson } from '../lib/bare-os-boot-graph-proc.js'
+import { pathnameExpandShellWord } from '../lib/shell-glob.js'
+import { createBareOsIpc } from '../lib/bare-os-ipc.js'
+import { BareOsSwarmConnectionManager } from '../lib/bare-os-swarm-connection-manager.js'
+import {
+  createBareOsLifecycleStateMachine,
+  runTransactionalLifecycleHooks
+} from '../lib/bare-os-lifecycle-manager.js'
+import {
+  bareOsRegisterCorestoreSuspendResumeHooks,
+  bareOsInstallCorestoreSuspendResumeHooks
+} from '../lib/corestore-host-lifecycle.js'
+import { bareOsFindOrphanProcessRows } from '../lib/bare-os-process-table.js'
+import {
+  topologicalOrderKernelExtensions,
+  resolveKernelExtensionsFull
+} from '../lib/kernel-extension-resolver.js'
+import { createBareOsProtomuxAliasRegistry } from '../lib/bare-os-protomux-alias-registry.js'
+import { bareOsHttpUrlAllowed } from '../lib/bare-os-http-policy.js'
+import {
+  bareOsParseBareAclText,
+  bareOsAclDeniesSubject
+} from '../lib/bare-os-vfs-acl-enforce.js'
+import { raceWithAbortAndTimeout } from '../lib/bare-os-abort.js'
+import {
+  tokenize,
+  expandWord,
+  execShellLine,
+  expandArgvAliases,
+  defaultShellAliases,
+  loadBarerc,
+  BARERC_SKELETON,
+  splitTokensBySemicolon,
+  splitTokensByAndOr,
+  bareOsShellAstSnapshot,
+  planShellRedirections,
+  buildShellExecutionGraph,
+  dispatchShellTrapSignal,
+  BARE_OS_EXIT_STATUS_ENV,
+  syncBareOsExitStatusEnv,
+  getBareOsPipelineLimits,
+  DEFAULT_PIPELINE_MAX_STAGES,
+} from '../lib/shell.js'
+import { tokenizeBareShellLineDetailed } from '../lib/shell-tokenizer.js'
+import { decodeBareOsDollarQuote } from '../lib/shell-lex.js'
+import {
+  applyBareOsThemeFromEnv,
+  bareOsListThemeNames
+} from '../lib/bare-os-theme-presets.js'
+import {
+  bareParseLsColors,
+  bareSerializeLsColors,
+  bareLsColorOpenSgrFromMap,
+  bareDefaultDircolorsDatabase,
+  bareParseDircolorsDatabase
+} from 'bare-os-lscolors'
+import { BARE_OS_CTX_API_VERSION } from '../lib/bare-os-ctx-api.js'
+import { buildBareOsRuntimeCaps } from '../lib/bare-os-runtime-caps.js'
+import {
+  bareOsBareModulesEnabled,
+  bareOsBareModuleManifestEmbeddedRef,
+  buildBareCtxObjectFromHost,
+  buildPearCtxObjectFromHost,
+  loadBareModuleManifest,
+  maybeMergeBareFromDrive
+} from '../lib/bare-os-ctx-bare.js'
+import { maybeBareOsBuildBinManifest } from '../lib/bare-os-bin-index.js'
+import {
+  createFishReadLine,
+  fuzzyMatch,
+  stripAnsi,
+  parseHistoryFile,
+  formatHistoryFile,
+  dedupeConsecutiveHistory,
+  searchHistoryEntries,
+  shouldPersistShellHistoryCommand,
+  scrubShellHistoryEntries,
+  SHELL_BUILTINS,
+  resolveShellPromptHookSegment
+} from '../lib/fish-readline.js'
+import {
+  parseCompletionContext,
+  rankCompletionItems,
+  suggestGhostFromHistory,
+  suggestGhostFromFs,
+  ghostReplaceCurrentWord,
+  longestCommonCompletionPrefix,
+  completeLine,
+  levenshtein
+} from '../lib/completion-engine.js'
+import {
+  fieldMatches,
+  dowFieldMatches,
+  parseCronLine,
+  jobMatchesDate
+} from '../lib/bare-cron.js'
+import '../lib/bare-openssh.js'
+import {
+  bareInitdReadinessSnapshot,
+  bareInitdShutdownActiveUnitsReverse,
+  getBareServiceRuntime,
+  registerBareInitdDisposer,
+  registerKernelShutdownHook,
+  runKernelShutdownHooks,
+  startBareInitd,
+  stopBareInitd,
+  getLastBareInitdDagSnapshotJson
+} from '../lib/bare-initd.js'
+import {
+  appendVarLog,
+  ensureBareOsVarLogTree,
+  KERNEL_CONSOLE_LOG,
+  BOOT_LOG
+} from '../lib/bare-os-var-log.js'
+import {
+  bareOsKernelMetricsReset,
+  bareOsKernelMetricsSnapshot
+} from '../lib/bare-os-kernel-metrics.js'
+import { parseUnitDropInText } from '../lib/bare-initd-user.js'
+import {
+  bareOsHyperswarmOptsFromEnv,
+  bareOsBootJoinPeerHexFromEnv
+} from '../lib/swarm-opts.js'
+import {
+  bareOsBootInitPrefetchEnabled,
+  bareOsBootWarmBinDownloadDiffEnabled
+} from '../lib/boot-prefetch.js'
+import { bareOsProcessTableSnapshot } from '../lib/bare-os-process-table.js'
+import { buildBareOsSyscallsProcJson } from '../lib/bare-os-syscalls-proc-json.js'
+import {
+  bareOsParseSendmsgScmRights,
+  wantPosixSocketScmRights
+} from '../lib/bare-os-socket-scm-rights.js'
+import {
+  parseBareOsHrpcAllowlistJson,
+  bareOsHrpcAllowlistDeniesRoute
+} from '../lib/bare-os-hrpc-allowlist.js'
+import { buildBareOsProtomuxExtensionsProcJson } from '../lib/bare-os-protomux-extensions-proc.js'
+import { createBareOsDiskOsBridge } from '../lib/bare-os-disk-os-bridge.js'
+import { buildBareOsReplicationLiveSketch } from '../lib/bare-os-replication-proc-live.js'
+import {
+  evaluateBareOsPeerAdmission,
+  bareOsFormatPeerAdmissionAuditEvent,
+  bareOsPeerAdmissionAuditRateAllow
+} from '../lib/bare-os-peer-admission.js'
+import {
+  parseDelegateAllowSet,
+  isDelegateKindAllowed
+} from '../lib/host-delegate-registry.js'
+import {
+  bareOsAuditAppend,
+  bareOsAuditVerifyRows
+} from '../lib/bare-os-audit-chain.js'
+import { bareOsDrainFcntlLockWaiters } from '../lib/bare-os-fcntl-cooperative-lock.js'
+import { buildBareOsReplicationOperatorSurfaceProcJson } from '../lib/bare-os-proc-replication-operator-surface.js'
+import {
+  DEFAULT_CURL_USER_AGENT,
+  DEFAULT_WGET_USER_AGENT
+} from '../lib/http-fetch-url.js'
+import { filenameFromContentDisposition } from '../lib/curl-cli.js'
+import { encodeUstarHeader, runTarCli } from '../lib/tar-cli.js'
+
+
+export {
+  test,
+  b4a,
+  Hyperdrive,
+  Corestore,
+  mkdirSync,
+  rmSync,
+  readFile,
+  readdir,
+  path,
+  fileURLToPath,
+  PassThrough,
+  XTERM_CLEAR_SCROLLBACK_AND_VIEWPORT,
+  runKernelFromSource,
+  runBinCommand,
+  createGitFsFromVfs,
+  runGitCli,
+  createStreamLineReader,
+  sanitizeInteractiveShellLine,
+  createVfs,
+  BARE_OS_PROC_FILE_TO_ID_HYPERCORE_PACK_HRPC_LIFECYCLE,
+  parseHdmsPairArgv,
+  hcCrypto,
+  idEnc,
+  decodeRwShareOffer,
+  decodeShareOffer,
+  HDMS_AUTOPASS_SHARE_KEY,
+  HDMS_AUTOPASS_SHARE_RW_KEY,
+  normalizeWriterSecretHex,
+  buildBareOsHypercorePackHrpcLifecycleProcJson,
+  buildBareOsPearCorestoreHrpcProcJson,
+  buildBareOsPearInspectLoggerTlsProcJson,
+  buildBareOsBareRuntimeProtoMuxProcJson,
+  buildBareOsBootGraphProcJson,
+  pathnameExpandShellWord,
+  createBareOsIpc,
+  BareOsSwarmConnectionManager,
+  createBareOsLifecycleStateMachine,
+  runTransactionalLifecycleHooks,
+  bareOsRegisterCorestoreSuspendResumeHooks,
+  bareOsInstallCorestoreSuspendResumeHooks,
+  bareOsFindOrphanProcessRows,
+  topologicalOrderKernelExtensions,
+  resolveKernelExtensionsFull,
+  createBareOsProtomuxAliasRegistry,
+  bareOsHttpUrlAllowed,
+  bareOsParseBareAclText,
+  bareOsAclDeniesSubject,
+  raceWithAbortAndTimeout,
+  tokenize,
+  expandWord,
+  execShellLine,
+  expandArgvAliases,
+  defaultShellAliases,
+  loadBarerc,
+  BARERC_SKELETON,
+  splitTokensBySemicolon,
+  splitTokensByAndOr,
+  bareOsShellAstSnapshot,
+  planShellRedirections,
+  buildShellExecutionGraph,
+  dispatchShellTrapSignal,
+  BARE_OS_EXIT_STATUS_ENV,
+  syncBareOsExitStatusEnv,
+  getBareOsPipelineLimits,
+  DEFAULT_PIPELINE_MAX_STAGES,
+  tokenizeBareShellLineDetailed,
+  decodeBareOsDollarQuote,
+  applyBareOsThemeFromEnv,
+  bareOsListThemeNames,
+  bareParseLsColors,
+  bareSerializeLsColors,
+  bareLsColorOpenSgrFromMap,
+  bareDefaultDircolorsDatabase,
+  bareParseDircolorsDatabase,
+  BARE_OS_CTX_API_VERSION,
+  buildBareOsRuntimeCaps,
+  bareOsBareModulesEnabled,
+  bareOsBareModuleManifestEmbeddedRef,
+  buildBareCtxObjectFromHost,
+  buildPearCtxObjectFromHost,
+  loadBareModuleManifest,
+  maybeMergeBareFromDrive,
+  maybeBareOsBuildBinManifest,
+  createFishReadLine,
+  fuzzyMatch,
+  stripAnsi,
+  parseHistoryFile,
+  formatHistoryFile,
+  dedupeConsecutiveHistory,
+  searchHistoryEntries,
+  shouldPersistShellHistoryCommand,
+  scrubShellHistoryEntries,
+  SHELL_BUILTINS,
+  resolveShellPromptHookSegment,
+  parseCompletionContext,
+  rankCompletionItems,
+  suggestGhostFromHistory,
+  suggestGhostFromFs,
+  ghostReplaceCurrentWord,
+  longestCommonCompletionPrefix,
+  completeLine,
+  levenshtein,
+  fieldMatches,
+  dowFieldMatches,
+  parseCronLine,
+  jobMatchesDate,
+  bareInitdReadinessSnapshot,
+  bareInitdShutdownActiveUnitsReverse,
+  getBareServiceRuntime,
+  registerBareInitdDisposer,
+  registerKernelShutdownHook,
+  runKernelShutdownHooks,
+  startBareInitd,
+  stopBareInitd,
+  getLastBareInitdDagSnapshotJson,
+  appendVarLog,
+  ensureBareOsVarLogTree,
+  KERNEL_CONSOLE_LOG,
+  BOOT_LOG,
+  bareOsKernelMetricsReset,
+  bareOsKernelMetricsSnapshot,
+  parseUnitDropInText,
+  bareOsHyperswarmOptsFromEnv,
+  bareOsBootJoinPeerHexFromEnv,
+  bareOsBootInitPrefetchEnabled,
+  bareOsBootWarmBinDownloadDiffEnabled,
+  bareOsProcessTableSnapshot,
+  buildBareOsSyscallsProcJson,
+  bareOsParseSendmsgScmRights,
+  wantPosixSocketScmRights,
+  parseBareOsHrpcAllowlistJson,
+  bareOsHrpcAllowlistDeniesRoute,
+  buildBareOsProtomuxExtensionsProcJson,
+  createBareOsDiskOsBridge,
+  buildBareOsReplicationLiveSketch,
+  evaluateBareOsPeerAdmission,
+  bareOsFormatPeerAdmissionAuditEvent,
+  bareOsPeerAdmissionAuditRateAllow,
+  parseDelegateAllowSet,
+  isDelegateKindAllowed,
+  bareOsAuditAppend,
+  bareOsAuditVerifyRows,
+  bareOsDrainFcntlLockWaiters,
+  buildBareOsReplicationOperatorSurfaceProcJson,
+  DEFAULT_CURL_USER_AGENT,
+  DEFAULT_WGET_USER_AGENT,
+  filenameFromContentDisposition,
+  encodeUstarHeader,
+  runTarCli
+}
+
+/** bare-ssh2 needs Bare `require.addon` (bare-crypto); skip auto-start in brittle-node. */
+if (
+  typeof process !== 'undefined' &&
+  process.env &&
+  process.env.BARE_OS_INITD_DISABLED === undefined
+) {
+  process.env.BARE_OS_INITD_DISABLED = 'bare-openssh'
+}
+
+export const __dirname = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+export const require = createRequire(path.join(__dirname, 'package.json'))
+export const TAR_BLK = 512
+
+/** @param {Uint8Array[]} parts */
+export function concatTarParts(parts) {
+  let n = 0
+  for (const p of parts) n += p.length
+  const out = new Uint8Array(n)
+  let o = 0
+  for (const p of parts) {
+    out.set(p, o)
+    o += p.length
+  }
+  return out
+}
+
+export function headerFromInit(init, name) {
+  if (!init?.headers) return undefined
+  const h = init.headers
+  if (typeof h.get === 'function') return h.get(name)
+  return undefined
+}
+
+export function testCorestoreDir(name) {
+  const dir = path.join(
+    __dirname,
+    '.test-data',
+    name + '-' + process.pid + '-' + Math.random().toString(36).slice(2)
+  )
+  mkdirSync(path.dirname(dir), { recursive: true })
+  return dir
+}
+
+export function testCtx(drive, personal, env) {
+  const shellEnv = {
+    HOME: '/home/user',
+    PATH: '/bin',
+    USER: 'user',
+    UID: '1000',
+    GID: '1000',
+    PWD: '/home/user',
+    BARE_OS_EXIT_STATUS: '0',
+    BARE_OS_SSH_LISTEN_PORT: '0',
+    ...env
+  }
+  const bareOsIpc = createBareOsIpc()
+  const vfs = createVfs(drive, personal, shellEnv, null, { bareOsIpc })
+  const ctx = {
+    drive,
+    personalDrive: personal,
+    vfs,
+    bareOsIpc,
+    env: shellEnv,
+    console,
+    b4a,
+    async bareOsApplyTheme() {
+      return applyBareOsThemeFromEnv(this)
+    },
+    bareOsListThemes() {
+      return bareOsListThemeNames()
+    }
+  }
+  return ctx
+}
+
+/** Personal-drive path backing logical `/home/<seg>/…` (matches `vfs.js`). */
+export function personalHomeBacking(homePath, rel = '') {
+  const seg = homePath.replace(/^\/home\//, '').split('/')[0] || 'user'
+  const r = String(rel).replace(/^\//, '')
+  return r ? `/.bare-os/home/${seg}/${r}` : `/.bare-os/home/${seg}`
+}
+
+/** Built `/bin/<name>` body from the repo kernel tree. */
+export async function readBuiltBin(name) {
+  const fs = await import('node:fs/promises')
+  const p = path.join(__dirname, '../../kernel/bin', name)
+  return fs.readFile(p, 'utf8')
+}
+

packages/bare-os-booter/text.txt

@@ -1 +0,0 @@
-o