@ai-ecoverse/slicc-kernel 1.103.0 → 1.103.2

package/dist/kernel-worker.js

@@ -978,6 +978,7 @@ function view(target, overrides) {
 var S_IFDIR = 16384;
 var S_IFREG = 32768;
 var S_IFLNK = 40960;
+var S_IFSOCK = 49152;
 var PERM_MASK = 4095;
 var S_ISGID2 = 1024;
 var READ_ATTEMPTS = 3;
@@ -1245,7 +1246,8 @@ var OpfsFs = class {
     return Object.keys(fields).length > 0 ? fields : void 0;
   }
   async stampNew(path, owner, directory) {
-    const fields = await this.newFields(path, owner, directory);
+    const owned4 = await this.newFields(path, owner, directory);
+    const fields = owner?.socket && !directory ? { ...owned4, socket: true } : owned4;
     if (fields) await this.meta.update(path, (entry) => ({ ...entry, path, ...fields }));
   }
   guarded = [];
@@ -1445,7 +1447,8 @@ var OpfsFs = class {
   }
   mode(path, directory, meta) {
     const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
-    return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
+    const type = directory ? S_IFDIR : meta?.socket ? S_IFSOCK : S_IFREG;
+    return type | (meta?.mode ?? fallback);
   }
   id = crypto.randomUUID();
   dirTimes = /* @__PURE__ */ new Map();
@@ -1524,10 +1527,12 @@ var OpfsFs = class {
     const modified = file?.lastModified ?? 0;
     const kept = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
     const mtime = touched ?? kept;
+    const socket = !directory && meta?.socket === true;
     return {
-      isFile: !directory,
+      isFile: !directory && !socket,
       isDirectory: directory,
       isSymbolicLink: false,
+      ...socket ? { isSocket: true } : {},
       size: file?.size ?? 0,
       mode: this.mode(path, directory, meta),
       mtime: new Date(mtime),
@@ -3563,6 +3568,7 @@ var KernelSocket = class _KernelSocket {
   queue = [];
   backlog = 0;
   boundAt;
+  named;
   changes = new Changes();
   room = new Changes();
   options = /* @__PURE__ */ new Map();
@@ -3628,10 +3634,13 @@ var KernelSocket = class _KernelSocket {
     for (const wait2 of waits) wait2.catch(() => void 0);
     return pipeCall(() => Promise.race(waits));
   }
-  bind(addr, kernel = false) {
+  bindable(addr) {
     if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    this.local = this.net.bind(this, addr, kernel);
+  }
+  bind(addr, kernel = false, name2) {
+    this.bindable(addr);
+    this.local = this.net.bind(this, addr, kernel, name2);
     this.boundAt = this.local;
   }
   listen(backlog, cred) {
@@ -3669,7 +3678,7 @@ var KernelSocket = class _KernelSocket {
   waitRoom(signal) {
     return this.room.wait(signal);
   }
-  connect(addr, viaUplink = true, cred, stamp, waits = true) {
+  connect(addr, viaUplink = true, cred, stamp, waits = true, name2) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
@@ -3677,7 +3686,7 @@ var KernelSocket = class _KernelSocket {
     this.failed = void 0;
     const route = viaUplink && addr.family === "inet" ? this.net.uplinkFor(addr.host) : void 0;
     if (route) return this.dial(addr, route);
-    const target = this.net.target(addr);
+    const target = this.net.target(addr, name2);
     if (!this.local) {
       if (addr.family === "inet") {
         this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
@@ -3838,7 +3847,7 @@ var KernelSocket = class _KernelSocket {
       this.readShut = true;
       this.writeShut = true;
     }
-    if (this.boundAt) this.net.release(this.boundAt, this);
+    if (this.boundAt) this.net.release(this.boundAt, this, this.named);
     this.boundAt = void 0;
     this.changes.wake();
   }
@@ -3855,7 +3864,8 @@ var KernelSocket = class _KernelSocket {
 function canonicalHost(host) {
   return host === "0.0.0.0" ? "127.0.0.1" : host;
 }
-function keyOf(addr) {
+function keyOf(addr, name2) {
+  if (name2) return `node:${name2.key}`;
   return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
 }
 var LOCAL_ONLY = new Routes();
@@ -3934,28 +3944,30 @@ var LoopbackNet = class {
     void socket.connect(addr, false, void 0, void 0, false);
     return socket;
   }
-  bind(socket, addr, kernel = false) {
+  bind(socket, addr, kernel = false, name2) {
     if (addr.family === "unix") {
       if (addr.path === "") throw new KernelError("EINVAL");
     } else this.bindable(addr, kernel);
     const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
-    const key = keyOf(named);
-    if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
+    const key = keyOf(named, name2);
+    if (this.bound.has(key) && !name2) throw new KernelError("EADDRINUSE");
     this.bound.set(key, socket);
+    socket.named = name2;
     return named;
   }
-  release(addr, socket) {
-    const key = keyOf(addr);
+  release(addr, socket, name2) {
+    const key = keyOf(addr, name2);
     if (this.bound.get(key) === socket) this.bound.delete(key);
   }
-  target(addr) {
+  target(addr, name2) {
     if (addr.family === "inet" && !isLoopback(canonicalHost(addr.host))) {
       throw new KernelError("ENETUNREACH");
     }
-    const key = keyOf(addr);
+    const key = keyOf(addr, name2);
     if (!this.bound.has(key)) this.activators.get(key)?.();
     const socket = this.bound.get(key);
     if (!socket?.listening) throw new KernelError("ECONNREFUSED");
+    if (name2 && socket.named?.typed && !name2.typed) throw new KernelError("ECONNREFUSED");
     return socket;
   }
   ephemeral() {
@@ -10814,6 +10826,7 @@ function statJson(s) {
     isDirectory: s.isDirectory,
     isFile: s.isFile,
     isSymbolicLink: s.isSymbolicLink,
+    ...s.isSocket ? { isSocket: true } : {},
     size: s.size,
     mode: s.mode,
     mtimeMs: s.mtime.getTime(),
@@ -12184,7 +12197,7 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 var EARLY_WHOLE_FILE = 64 * 1024;
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.103.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.103.2" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -14604,6 +14617,7 @@ async function runChild(req, deps) {
         ...req.argv0 !== void 0 ? { argv0: req.argv0 } : {},
         env: req.env,
         cwd: req.cwd,
+        ...req.chdir ? { chdir: req.chdir } : {},
         ...req.pgid !== void 0 ? { pgid: req.pgid } : {},
         ...req.session ? { session: req.session } : {}
       },
@@ -14889,6 +14903,47 @@ async function semSyscall(req, proc) {
   }
 }
 
+// src/kernel/socket-nodes.ts
+function filePath(addr) {
+  if (addr.family !== "unix" || addr.path === "" || addr.path.startsWith("\0")) return void 0;
+  return normalizePath(addr.path);
+}
+function nameOf(st) {
+  return { key: `${st.dev ?? 0}:${st.ino}`, typed: st.isSocket === true };
+}
+function codeOf3(err) {
+  return err?.code;
+}
+function socketNames(deps) {
+  const { fs } = deps;
+  return {
+    async make(path) {
+      const g = deps.guard();
+      if (g) await inParent(g, "bind", path);
+      const owner = deps.owner();
+      try {
+        await deps.create(path, owner);
+      } catch (err) {
+        if (codeOf3(err) === "EEXIST") throw new KernelError("EADDRINUSE");
+        throw err;
+      }
+      const remove = () => fs.rm(path, { file: true }).catch(() => void 0);
+      try {
+        if (!deps.owners && owner.mode !== void 0) await fs.chmod(path, owner.mode);
+        return { ...nameOf(await fs.lstat(path)), remove };
+      } catch (err) {
+        await remove();
+        throw err;
+      }
+    },
+    async find(path) {
+      const g = deps.guard();
+      if (g) await need(g, "connect", path, W_OK, { directory: false });
+      return nameOf(await fs.stat(path));
+    }
+  };
+}
+
 // src/kernel/net/datagram-wire.ts
 function encodeReceived(got) {
   const host = new TextEncoder().encode(got.host);
@@ -14955,7 +15010,7 @@ async function socketSyscall(req, proc) {
       }
     }
     case "sock-bind":
-      anySocketAt(fds, req.fd).bind(req.addr);
+      await bind(proc, req.fd, req.addr);
       return ok3();
     case "sock-listen":
       socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
@@ -14993,8 +15048,10 @@ async function connect(req, proc) {
     target.connectTo(req.addr);
     return ok3();
   }
+  const path = filePath(req.addr);
+  const name2 = path !== void 0 ? await proc.names?.find(path) : void 0;
   const stamp = proc.net.facadeAt(req.addr) && await proc.stamp?.();
-  const dialing = target.connect(req.addr, true, proc.cred?.(), stamp || void 0);
+  const dialing = target.connect(req.addr, true, proc.cred?.(), stamp || void 0, true, name2);
   if (req.nonblock) {
     dialing?.catch(() => void 0);
     throw new KernelError("EINPROGRESS");
@@ -15002,6 +15059,22 @@ async function connect(req, proc) {
   if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
   return ok3();
 }
+async function bind(proc, fd, addr) {
+  const socket = anySocketAt(proc.fds, fd);
+  const path = filePath(addr);
+  if (!(socket instanceof KernelSocket) || path === void 0 || !proc.names) {
+    socket.bind(addr);
+    return;
+  }
+  socket.bindable(addr);
+  const name2 = await proc.names.make(path);
+  try {
+    socket.bind({ family: "unix", path }, false, name2);
+  } catch (err) {
+    await name2.remove();
+    throw err;
+  }
+}
 async function datagram(req, proc) {
   const dgram = dgramAt(proc.fds, req.fd);
   if (req.op === "sock-sendto") {
@@ -15609,6 +15682,11 @@ function heldIo(fs, nodes, changed) {
       const held = st.isFile ? await node(path) : void 0;
       return held ? { ...st, size: await held.serial(() => held.size()) } : st;
     },
+    async lstat(path) {
+      const st = await fs.lstat(path);
+      const held = st.isFile && !st.isSymbolicLink ? await node(path) : void 0;
+      return held ? { ...st, size: await held.serial(() => held.size()) } : st;
+    },
     async readFileBuffer(path) {
       const held = await node(path);
       if (!held) return fs.readFileBuffer(path);
@@ -16022,13 +16100,23 @@ var WasmProcess = class {
     return "deliver";
   }
   async spawn(req) {
-    const { file, argv, argv0, env, cwd, stdio, inherit: inherit2, exec, pgid, session, deathSignal } = req;
+    const { file, argv, argv0, env, cwd, chdir, stdio, inherit: inherit2, exec, pgid, session, deathSignal } = req;
     if (deathSignal !== void 0 && (exec || !isSignal(deathSignal))) {
       throw new KernelError("EINVAL");
     }
     const group = { ...pgid !== void 0 ? { pgid } : {}, ...session ? { session } : {} };
     const named = argv0 !== void 0 ? { argv0 } : {};
-    const spawned = { file, argv, ...named, env, cwd, ...group, ...exec ? { exec } : {} };
+    const moved2 = chdir ? { chdir } : {};
+    const spawned = {
+      file,
+      argv,
+      ...named,
+      env,
+      cwd,
+      ...moved2,
+      ...group,
+      ...exec ? { exec } : {}
+    };
     const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (deathSignal !== void 0) this.onDeath(pgid === 0 || session ? -pid : pid, deathSignal);
     if (!exec) return pid;
@@ -16895,7 +16983,19 @@ var WasmProcess = class {
       blocking: () => this.blockingSignal(cancelled),
       resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
       cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid }),
-      stamp: () => this.connectorStamp()
+      stamp: () => this.connectorStamp(),
+      names: socketNames({
+        fs: this.heldFs(),
+        guard: () => this.guarded(),
+        create: (path, owner) => this.nodes.createExclusive(path, owner),
+        owner: () => ({
+          uid: this.cred.euid,
+          gid: this.cred.egid,
+          mode: 511 & ~this.umask,
+          socket: true
+        }),
+        owners: this.options.owners === true
+      })
     });
   }
   tty(fd) {
@@ -18969,8 +19069,8 @@ var FSA_CAPABILITIES = {
   ranges: true,
   sessions: true
 };
-var codeOf3 = (err) => err?.code;
-var denied = (err) => codeOf3(err) === "EACCES" || err?.name === "NotAllowedError";
+var codeOf4 = (err) => err?.code;
+var denied = (err) => codeOf4(err) === "EACCES" || err?.name === "NotAllowedError";
 function attrOf(st) {
   return {
     kind: st.isDirectory ? "directory" : st.isSymbolicLink ? "symlink" : "file",
@@ -18992,7 +19092,7 @@ function kernelFsHandlers(fs) {
     try {
       return await fs.stat(path);
     } catch (err) {
-      if (codeOf3(err) === "ENOENT") return void 0;
+      if (codeOf4(err) === "ENOENT") return void 0;
       throw err;
     }
   }
@@ -19185,7 +19285,7 @@ function parseFstab(text) {
   });
   return lines2;
 }
-function codeOf4(err) {
+function codeOf5(err) {
   const code = err?.code;
   return typeof code === "string" ? code : "EIO";
 }
@@ -19223,18 +19323,18 @@ async function mountLine({ line, spec, invalid }, mount, signal, retries, discar
       break;
     } catch (err) {
       failed3 = err;
-      if (FINAL.has(codeOf4(err)) || attempt === retries.length) break;
+      if (FINAL.has(codeOf5(err)) || attempt === retries.length) break;
       await wait(retries[attempt], signal);
     }
   }
-  const code = codeOf4(failed3);
+  const code = codeOf5(failed3);
   return { line, target: spec.target, code, error: String(failed3?.message ?? code) };
 }
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf5 = (err) => err?.code;
-var unreachable = (err) => codeOf5(err) === "ENOTCONN";
+var codeOf6 = (err) => err?.code;
+var unreachable = (err) => codeOf6(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -19411,7 +19511,7 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     try {
       return { opened: await opening2(), restore: void 0 };
     } catch (err) {
-      if (!flags2.write || codeOf5(err) !== "EACCES") throw err;
+      if (!flags2.write || codeOf6(err) !== "EACCES") throw err;
       const was = await client.call("stat", { path: rel(path) });
       const mode = was.mode ?? 0;
       if (mode & 128) throw err;
@@ -21432,6 +21532,13 @@ var Launcher = class {
     await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
   }
+  async enterable(g, cwd) {
+    if (!g) return;
+    const denied2 = new Error(`cannot change to ${cwd}: Permission denied`);
+    await need(g, "chdir", cwd, X_OK, { directory: true }).catch((err) => {
+      throw err.code === "EACCES" ? Object.assign(denied2, { code: "EACCES" }) : err;
+    });
+  }
   execGuard(cred, pid, tag) {
     const { dac } = this;
     return dac && { fs: this.fs, cred, pid, dac, tag, links: this.links.get(pid) };
@@ -22048,6 +22155,13 @@ var Launcher = class {
         throw new SpawnError(group);
       }
       const cred = grant ? grant.cred : this.credOf(ppid);
+      if (req.chdir && !grant) {
+        const g = this.execGuard(cred, ppid);
+        await this.enterable(g, req.cwd).catch(async (err) => {
+          await fds.closeAll();
+          throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+        });
+      }
       const scope = grant ? "" : await this.scopeOf(cred.euid);
       const file = booked === void 0 ? req.file : await this.ticketFile(req, fds);
       const planned = await this.checkedPlan({ ...req, file }, { ppid, cred, scope }, fds);
@@ -22644,6 +22758,7 @@ var Launcher = class {
     const scope = account.uid === 0 ? "" : pnpmHomeOf(account, this.pnpmHome);
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
+    await this.enterable(this.execGuard(credOf(account), 0, tag), cwd);
     const file = await this.execFile(argv[0] ?? "", cwd, this.execGuard(credOf(account), 0, tag));
     if (!await this.base.exists(cwd)) await this.stackFor(tag).fs.mkdir(cwd, { recursive: true });
     const planned = await this.plan(file, argv, cwd, scope);