Updates

kernel/README.md

@@ -29,7 +29,9 @@ Files in this directory are **read from disk by the seeder** (or copied into `pa
 2. Run `npm run build -w bare-os-coreutils` to refresh `kernel/bin/*`.
 3. Run seeder again to re-stage the drive (or use a fresh Corestore for a clean image).
 
-Pear bundles use the **vendored** tree under `packages/bare-os-seeder/kernel/`; keep it in sync by running the same build before `pear stage`. **`npm test`** runs **`scripts/verify-kernel-seeder-parity.mjs`** (after **`bare-os-coreutils`** build) so the two trees match byte-for-byte.
+Pear bundles use the **vendored** tree under `packages/bare-os-seeder/kernel/`; keep it in sync by running the same build before `pear stage`. **`npm test`** runs **`scripts/verify-kernel-seeder-parity.mjs`** (after **`bare-os-coreutils`** build) so the two trees match byte-for-byte and every **`kernel/bin/*`** file contains the **`BARE_OS_BIN_API`** pragma (coreutils **`runtime.js`** and hand-written stubs such as **`systemctl`** / **`journalctl`**).
+
+Optional **system** image examples: **`etc/bare-os/boot.allow.example`** (copy to **`boot.allow`** when using host **`BARE_OS_BOOT_ALLOWLIST=1`**), **`etc/bare-os/crontab.example`** (system-wide cron lines merged ahead of user **`~/.crontab`**).
 
 ## See also
 

kernel/bin/awk

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/basename

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/cat

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/chgrp

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/chmod

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/chown

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/cksum

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/clear

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/cp

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/crontab

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/cut

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/date

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/dirname

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/du

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/echo

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/env

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/exit

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/false

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/find

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
@@ -117,7 +118,7 @@ async function run(ctx, argv) {
   const rest = []
   for (let i = 1; i < argv.length; i++) {
     const a = argv[i]
-    if (a === '-maxdepth' && argv[i + 1]) {
+    if ((a === '-maxdepth' || a === '-depth') && argv[i + 1]) {
       maxDepth = Number.parseInt(argv[++i], 10)
       continue
     }

kernel/bin/getconf

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/git-pear

@@ -0,0 +1,82 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar =
+    type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+async function run(ctx, argv) {
+  const sub = argv[1]
+  if (sub === 'help' || sub === undefined) {
+    ctx.console.log(`git-pear — Git-in-Pear helpers (gip-transport / gip-remote)
+
+  Remote form: git+pear://… (see Holepunch gip-transport + gip-remote).
+
+  Typical flow:
+    git remote add origin 'git+pear://<key-or-link>'
+    git push origin main
+
+  Pear app channel metadata for images: set BARE_OS_PEAR_CHANNEL / BARE_OS_PEAR_RELEASE on the host.
+`)
+    ctx.exitCode = 0
+    return
+  }
+  ctx.console.error('git-pear: unknown subcommand; use git-pear help')
+  ctx.exitCode = 1
+}

kernel/bin/grep

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/hdms

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/head

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/help

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/hostname

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/id

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/journalctl

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — stub; booter delegates to systemctl-cli (kernel-runner). */
 /** Booter delegates journalctl to systemctl-cli.js (kernel-runner). */
 async function run(ctx, argv) {
   ctx.console.error(

kernel/bin/jq

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/ln

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/login

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/logname

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/logout

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/ls

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/man

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/mkdir

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/mkfifo

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/mktemp

@@ -0,0 +1,89 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
+/** Shared helpers for drive-resident /bin scripts (prepended before each command). */
+function bareStdin(ctx) {
+  return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''
+}
+
+/** @param {number} mode @param {'file' | 'directory' | 'symlink'} type */
+function bareFormatModeString(mode, type) {
+  const typeChar =
+    type === 'directory' ? 'd' : type === 'symlink' ? 'l' : '-'
+  const perm = mode & 0o777
+  const r = (bit) => (perm & bit ? 'r' : '-')
+  const w = (bit) => (perm & bit ? 'w' : '-')
+  const x = (bit) => (perm & bit ? 'x' : '-')
+  return (
+    typeChar +
+    r(0o400) +
+    w(0o200) +
+    x(0o100) +
+    r(0o040) +
+    w(0o020) +
+    x(0o010) +
+    r(0o004) +
+    w(0o002) +
+    x(0o001)
+  )
+}
+
+/** @param {number} mtimeMs @param {number} [nowMs] */
+function bareFormatLsMtime(mtimeMs, nowMs) {
+  const now = nowMs != null ? nowMs : Date.now()
+  const d = new Date(mtimeMs)
+  const months = [
+    'Jan',
+    'Feb',
+    'Mar',
+    'Apr',
+    'May',
+    'Jun',
+    'Jul',
+    'Aug',
+    'Sep',
+    'Oct',
+    'Nov',
+    'Dec'
+  ]
+  const mon = months[d.getMonth()]
+  const day = String(d.getDate()).padStart(2, ' ')
+  const sixMo = 180 * 24 * 3600 * 1000
+  if (Math.abs(now - mtimeMs) > sixMo) {
+    const yr = String(d.getFullYear()).padStart(4, ' ')
+    return mon + ' ' + day + '  ' + yr
+  }
+  const hh = String(d.getHours()).padStart(2, '0')
+  const mm = String(d.getMinutes()).padStart(2, '0')
+  return mon + ' ' + day + ' ' + hh + ':' + mm
+}
+
+/** @param {number} size */
+function barePosixBlocks(size) {
+  return Math.ceil(Number(size) / 512) || 0
+}
+
+async function run(ctx, argv) {
+  let wantDir = false
+  /** @type {string | null} */
+  let template = null
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i]
+    if (a === '-d') wantDir = true
+    else if (!a.startsWith('-')) template = a
+  }
+  const rnd = () =>
+    Math.random().toString(36).slice(2, 10) +
+    Math.random().toString(36).slice(2, 6)
+  let rel = template || 'tmp.XXXXXX'
+  if (rel.includes('XXXXXX')) rel = rel.replace(/XXXXXX/g, rnd())
+  else rel = `${rel.replace(/\/+$/, '')}.${rnd()}`
+  const full = rel.startsWith('/') ? rel : `/tmp/${rel.replace(/^\/+/, '')}`
+  try {
+    if (wantDir) await ctx.vfs.mkdir(full, { recursive: false })
+    else await ctx.vfs.writeFile(full, ctx.b4a.from(''))
+    ctx.console.log(full)
+    ctx.exitCode = 0
+  } catch (e) {
+    ctx.console.error('mktemp: ' + ((e && e.message) || e))
+    ctx.exitCode = 1
+  }
+}

kernel/bin/mv

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/nl

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/od

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/pathchk

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/printenv

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/printf

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/pwd

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/readlink

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/rm

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/rmdir

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/savevault

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/sed

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/seq

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/sleep

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/sort

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/stat

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/systemctl

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — stub; booter delegates to systemctl-cli (kernel-runner). */
 /** Booter delegates systemctl to systemctl-cli.js (kernel-runner). */
 async function run(ctx, argv) {
   ctx.console.error(

kernel/bin/tail

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/tee

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/test

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/time

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/touch

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/tr

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/true

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/tty

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/uname

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/wc

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/which

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/whoami

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/bin/xargs

@@ -1,3 +1,4 @@
+/* BARE_OS_BIN_API 1.0.0 — bump when staged /bin script semantics change (see developer guide). */
 /** Shared helpers for drive-resident /bin scripts (prepended before each command). */
 function bareStdin(ctx) {
   return typeof ctx.shellStdin === 'string' ? ctx.shellStdin : ''

kernel/etc/bare-os/boot.allow.example

@@ -0,0 +1,7 @@
+# When BARE_OS_BOOT_ALLOWLIST=1, only first tokens listed here (plus builtins like export, cd, :)
+# may run from /etc/bare-os/rc, rc.d, rc.local, kernel.d, and onboot lines.
+#
+# Example entries (one command name per line):
+# echo
+# cat
+# systemctl

kernel/etc/bare-os/crontab.example

@@ -0,0 +1,4 @@
+# System crontab (image): minute hour dom month dow command
+# Merged with ~/.crontab and ~/.config/bare-os/timers/*.timer by bare-cron.
+#
+# * * * * * echo tick

kernel/init.js

@@ -22,6 +22,8 @@
  *   profile, rc, rc.d, rc.local, kernel.d, onboot (os-release and motd always run).
  *
  * BARE_OS_KERNEL_SELFTEST=1 or true: after boot snippets, run a short trusted self-check via execLine.
+ * BARE_OS_SELFTEST_FORMAT=tap: TAP-style lines on stderr for CI parsers.
+ * BARE_OS_BOOT_ALLOWLIST=1 and /etc/bare-os/boot.allow: only first-word commands in that file (plus shell builtins) run from trusted rc/onboot snippets.
  *
  * BARE_OS_BOOT_STRICT=1 or true: first execLine throw in trusted boot snippets calls
  * requestBooterExit(1) and stops further boot phases.
@@ -138,6 +140,60 @@ function shouldSkipRcDName(name, patterns) {
   return false
 }
 
+/**
+ * @param {Record<string, unknown>} ctx
+ * @returns {Promise<Set<string> | null>} null when allowlist disabled
+ */
+async function loadBootAllowSet(ctx) {
+  const v = ctx.env && ctx.env.BARE_OS_BOOT_ALLOWLIST
+  if (v !== '1' && v !== 'true') return null
+  const { drive, b4a } = ctx
+  const out = new Set()
+  try {
+    const buf = await drive.get('/etc/bare-os/boot.allow')
+    if (!buf) return out
+    for (const line of b4a.toString(buf).split(/\r?\n/)) {
+      const t = line.trim()
+      if (!t || t.startsWith('#')) continue
+      out.add(t)
+    }
+  } catch {
+    /* ignore */
+  }
+  return out
+}
+
+/**
+ * @param {string} line
+ */
+function firstShellCommandWord(line) {
+  const s = line.trim()
+  const m = s.match(/^(\S+)/)
+  return m ? m[1] : ''
+}
+
+/**
+ * @param {string} line
+ * @param {Set<string>} allow
+ */
+function bootLineAllowed(line, allow) {
+  const w = firstShellCommandWord(line)
+  if (!w) return true
+  if (
+    w === 'export' ||
+    w === 'unset' ||
+    w === 'readonly' ||
+    w === ':' ||
+    w === 'umask' ||
+    w === 'cd'
+  ) {
+    return true
+  }
+  if (allow.has(w)) return true
+  const base = w.includes('/') ? w.split('/').pop() : w
+  return !!(base && allow.has(base))
+}
+
 /**
  * @param {Record<string, unknown>} ctx
  * @param {string} label
@@ -167,6 +223,15 @@ async function bootTimed(ctx, label, fn, phaseLog) {
       ctx.console.error(`[boot] ${label}: ${ms}ms`)
     }
   }
+  if (typeof ctx.bareOsEmitBootEvent === 'function') {
+    ctx.bareOsEmitBootEvent({
+      type: 'boot',
+      phase: label,
+      ms,
+      ts: Date.now(),
+      sessionId: (ctx.env && ctx.env.BARE_OS_SESSION_ID) || ''
+    })
+  }
 }
 
 /**
@@ -177,9 +242,18 @@ async function bootTimed(ctx, label, fn, phaseLog) {
 async function runRcLines(ctx, text) {
   const { execLine, console } = ctx
   const strict = bootStrict(ctx)
+  const allow = await loadBootAllowSet(ctx)
   for (const line of text.split(/\r?\n/)) {
     const t = line.trim()
     if (!t || t.startsWith('#')) continue
+    if (allow && !bootLineAllowed(t, allow)) {
+      console.error('[boot] command not in boot.allow: ' + t.slice(0, 120))
+      if (strict) {
+        if (typeof ctx.requestBooterExit === 'function') ctx.requestBooterExit(1)
+        return false
+      }
+      continue
+    }
     try {
       await execLine(t)
     } catch (e) {
@@ -269,6 +343,7 @@ async function runOnboot(ctx) {
   if (!ctx.bareOsSkipRepl) return true
   const { execLine, console, drive, b4a, env } = ctx
   const strict = bootStrict(ctx)
+  const allow = await loadBootAllowSet(ctx)
   /** @type {string[]} */
   const lines = []
   const fromEnv = env && env.BARE_OS_ONBOOT
@@ -293,6 +368,14 @@ async function runOnboot(ctx) {
     }
   }
   for (const line of lines) {
+    if (allow && !bootLineAllowed(line, allow)) {
+      console.error('[boot] onboot command not in boot.allow: ' + line.slice(0, 120))
+      if (strict) {
+        if (typeof ctx.requestBooterExit === 'function') ctx.requestBooterExit(1)
+        return false
+      }
+      continue
+    }
     try {
       await execLine(line)
     } catch (e) {
@@ -442,23 +525,48 @@ async function runKernelSelftest(ctx) {
   if (v !== '1' && v !== 'true') return true
   const { execLine, console } = ctx
   const strict = bootStrict(ctx)
-  const lines = [
-    ':',
-    'true',
-    'false; echo selftest_false_ok',
-    'systemctl list-units 2>/dev/null || true'
+  const fmt = (ctx.env && ctx.env.BARE_OS_SELFTEST_FORMAT) || ''
+  const tap = String(fmt).toLowerCase() === 'tap'
+  let tapN = 0
+  /** @param {string} name */
+  function tapLine(ok, name, detail) {
+    if (!tap) return
+    tapN++
+    if (ok) {
+      console.error(`ok ${tapN} ${name}`)
+    } else {
+      console.error(`not ok ${tapN} ${name}${detail ? ' — ' + detail : ''}`)
+    }
+  }
+  if (tap) {
+    console.error('TAP version 13')
+  }
+  /** @type {[string, string][]} */
+  const specs = [
+    [':', 'colon-builtin'],
+    ['true', 'true-builtin'],
+    ['false; echo selftest_false_ok', 'false-sequencing'],
+    ['test -f /proc/version && echo selftest_proc', 'proc-version'],
+    ['echo selftest_vfs | tee /dev/null', 'pipeline-tee-devnull'],
+    ['systemctl list-units 2>/dev/null || true', 'systemctl-list']
   ]
-  for (const line of lines) {
+  for (const [line, name] of specs) {
     try {
       await execLine(line)
+      tapLine(true, name, '')
     } catch (e) {
-      console.error('selftest: ' + ((e && e.message) || String(e)))
+      const msg = (e && e.message) || String(e)
+      console.error('selftest: ' + msg)
+      tapLine(false, name, msg)
       if (strict) {
         if (typeof ctx.requestBooterExit === 'function') ctx.requestBooterExit(1)
         return false
       }
     }
   }
+  if (tap) {
+    console.error(`1..${tapN}`)
+  }
   return true
 }