Updates

kernel/README.md

@@ -14,13 +14,13 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 
 ## Contents
 
-- **`init.js`** — Kernel entry: must define `async function start(ctx)`. Boot order: **`/etc/os-release`** → **`/etc/motd`** → **`/etc/bare-os/rc`** → **`/etc/bare-os/rc.d/*`** (sorted; skips dotfiles and `*~`) → banner → **`readLine` / `execLine`** loop (boot snippet errors are logged, not fatal). Custom kernels may call **`ctx.registerKernelShutdownHook(fn)`** before initd disposers; see [`developer-guide/02-the-context-object.md`](../developer-guide/02-the-context-object.md).
+- **`init.js`** — Kernel entry: must define `async function start(ctx)`. Boot order: **`/etc/os-release`** → **`/etc/motd`** → **`/etc/bare-os/rc`** → **`/etc/bare-os/rc.d/*`** (sorted; only names starting with a digit, plus skips dotfiles, `*~`, `README*`, `*.md`) → banner → **`readLine` / `execLine`** loop (boot snippet errors are logged, not fatal). Custom kernels may call **`ctx.registerKernelShutdownHook(fn)`** before initd disposers; see [`developer-guide/02-the-context-object.md`](../developer-guide/02-the-context-object.md).
 - **`bin/`** — **Tier-1 utilities** built by [bare-os-coreutils](../packages/bare-os-coreutils/README.md). Each file is **`runtime.js`** + optional **`lib/*-engine.js`** (**`sed`**, **`awk`**) or **`lib/man-render.js`** (**`man`**) + **`async function run(ctx, argv)`** (no ESM **`import`** in **`src/`**).
 - **`share/man/man.json`** — Merged manual database for **`/bin/man`** (built by **`bare-os-coreutils`**; see [handbook ch.10](../handbook/10-manpages-and-online-help.md)).
 - **`etc/os-release`** — Static OS metadata (`NAME`, `VERSION`, …).
 - **`etc/motd`** — Optional message printed after **`os-release`** (distributors can customize).
 - **`etc/bare-os/rc`** — Optional boot snippet: one **`execLine`** per non-comment line (trusted).
-- **`etc/bare-os/rc.d/`** — Optional extra snippets, same line rules, run after **`rc`** in filename order.
+- **`etc/bare-os/rc.d/`** — Optional extra snippets (basename must start with a digit), same line rules, run after **`rc`** in filename order. Human-oriented notes live in **`.README`** (a dotfile so legacy **`init.js`** never executes it).
 
 ## Editing workflow
 

kernel/bin/awk

@@ -1260,7 +1260,7 @@ async function bareAwkRun(program, opts, io) {
   } else {
     for (const f of files) {
       const buf = await io.readFile(f)
-      const text = buf ? new TextDecoder().decode(buf) : ''
+      const text = buf && io.bytesToString ? io.bytesToString(buf) : ''
       const lines = text.split(/\r?\n/)
       if (lines.length && lines[lines.length - 1] === '') lines.pop()
       await runOnFile(f, lines)
@@ -1346,6 +1346,9 @@ async function run(ctx, argv) {
   })()
 
   const io = {
+    bytesToString(buf) {
+      return buf ? ctx.b4a.toString(buf, 'utf8') : ''
+    },
     print(s) {
       const t = s.replace(/\n$/, '')
       ctx.console.log(t)

kernel/bin/wc

@@ -60,10 +60,10 @@ function barePosixBlocks(size) {
   return Math.ceil(Number(size) / 512) || 0
 }
 
-function count(s) {
+function count(s, b4a) {
   const lines = (s.match(/\n/g) || []).length
   const words = s.trim() ? s.trim().split(/\s+/).length : 0
-  const bytes = new TextEncoder().encode(s).length
+  const bytes = b4a.from(s, 'utf8').length
   return { lines, words, bytes }
 }
 
@@ -72,7 +72,7 @@ async function run(ctx, argv) {
   const files = argv.slice(1).filter((a) => !a.startsWith('-'))
   if (!files.length) {
     const s = bareStdin(ctx)
-    const c = count(s)
+    const c = count(s, ctx.b4a)
     ctx.console.log(' ' + c.lines + ' ' + c.words + ' ' + c.bytes)
     return
   }
@@ -86,7 +86,7 @@ async function run(ctx, argv) {
       continue
     }
     const s = ctx.b4a.toString(buf)
-    const c = count(s)
+    const c = count(s, ctx.b4a)
     tLines += c.lines
     tWords += c.words
     tBytes += c.bytes

kernel/etc/bare-os/rc

@@ -1,4 +1,4 @@
 # Optional boot-time shell lines (one command per non-comment line).
-# Executed by /boot/init.js after /etc/os-release and /etc/motd, then /etc/bare-os/rc.d/*, before the main banner.
+# Executed by /boot/init.js after /etc/os-release and /etc/motd, then /etc/bare-os/rc.d/* (digit-prefixed names only), before the main banner.
 # Example (uncomment to use):
 # export BARE_OS_SHOW_RC=1

kernel/etc/bare-os/rc.d/.README

@@ -0,0 +1,14 @@
+# Optional boot snippets (trusted)
+
+Only **filenames that start with a digit** are executed (e.g. `10-local`,
+`20-proxy`), after `/etc/bare-os/rc`, in **lexicographic order**. This keeps
+documentation files (this file is named `.README` so even older kernels skip it)
+from being run as shell.
+
+Each snippet is treated like `rc`: one shell command per non-empty, non-comment
+line. Lines starting with `#` and blank lines are ignored.
+
+Dotfiles, names ending in `~`, `README*`, `*.md`, and any name not starting with
+a digit are skipped.
+
+Only ship snippets you trust — they run with full `execLine` power.

kernel/etc/bare-os/rc.d/README

@@ -1,11 +0,0 @@
-# Optional boot snippets (trusted)
-
-Files in this directory are executed after `/etc/bare-os/rc`, in **lexicographic
-order** by filename. Use numeric prefixes (e.g. `10-local`, `20-proxy`) to
-control order. Each file is treated like `rc`: one shell command per non-empty,
-non-comment line.
-
-Lines starting with `#` and blank lines are ignored. Dotfiles and names ending
-in `~` are skipped.
-
-Only ship snippets you trust — they run with full `execLine` power.

kernel/init.js

@@ -66,9 +66,20 @@ async function runRcFileAt(ctx, drivePath, label) {
   }
 }
 
+/**
+ * Only run rc.d files whose name starts with a digit (e.g. `10-local`).
+ * Skips README*, *.md, dotfiles, and *~ so documentation is never exec'd as shell.
+ * @param {string} name basename from readdir
+ */
+function isBareOsRcSnippetFile(name) {
+  if (!name || name.startsWith('.') || name.endsWith('~')) return false
+  if (/^README(\.|$)/i.test(name)) return false
+  if (/\.md$/i.test(name)) return false
+  return /^[0-9]/.test(name)
+}
+
 /**
  * Optional snippets under /etc/bare-os/rc.d/ — executed in lexicographic order.
- * Skips dotfiles and names ending in ~.
  * @param {Record<string, unknown>} ctx
  */
 async function runBareOsRcDir(ctx) {
@@ -83,7 +94,7 @@ async function runBareOsRcDir(ctx) {
     }
     names.sort()
     for (const name of names) {
-      if (!name || name.startsWith('.') || name.endsWith('~')) continue
+      if (!isBareOsRcSnippetFile(name)) continue
       const p = `/etc/bare-os/rc.d/${name}`
       try {
         const buf = await drive.get(p)