@ai-ecoverse/slicc-kernel 1.125.12 → 1.126.0

package/dist/kernel-worker.js

@@ -6699,7 +6699,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.125.12" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.126.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -8331,10 +8331,10 @@ function tunnelRequestUrl(req, origin) {
     throw new HttpError(400, "malformed request target");
   }
   const hosts = fieldValues(req.headers, "host");
-  const hostOk = hosts.every(
+  const hostOk2 = hosts.every(
     (h) => URL.canParse(`https://${h}`) && new URL(`https://${h}`).host === base.host
   );
-  if (url.origin !== base.origin || !hostOk) {
+  if (url.origin !== base.origin || !hostOk2) {
     throw new HttpError(421, `this tunnel is for ${base.host}`);
   }
   return url.href;
@@ -17662,6 +17662,10 @@ function controlsOf(o, session, protocol, chain2, shape) {
     ...o.insecure ? insecureOf(session, chain2, shape) : { hostnameMatches: checked || !session.nameMismatch }
   };
 }
+function verdictOf(o, session) {
+  if (o.bundled !== true || isIP(o.servername) || session.verifyResult !== 0) return false;
+  return o.checkHostname !== false || !session.nameMismatch;
+}
 async function infoOf(o, session) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
@@ -17674,7 +17678,9 @@ async function infoOf(o, session) {
     authorized: code === void 0,
     ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
     peerCertificates: chain2,
-    ...controlsOf(o, session, protocol, chain2, shape)
+    ...controlsOf(o, session, protocol, chain2, shape),
+    verified: verdictOf(o, session),
+    handshakeAt: Date.now()
   };
 }
 var FATAL_ALERT = -30592;
@@ -17792,6 +17798,7 @@ function sessionOf(info, servername) {
   return {
     path: "kernel",
     substitutes: false,
+    verified: info.verified,
     protocol: info.protocol,
     alpnProtocol: info.alpnProtocol,
     authorized: info.authorized,
@@ -17905,7 +17912,8 @@ async function prepareWith(support, req, servername, cert) {
     insecure: req.insecure === true,
     ...req.sni === false ? { sni: false } : {},
     ...req.checkHostname === false ? { checkHostname: false } : {},
-    clientCertificate: cert !== void 0
+    clientCertificate: cert !== void 0,
+    bundled: own === void 0
   };
   let session;
   try {
@@ -22645,6 +22653,79 @@ function scrubStdio(fds, scrubber) {
   }
 }
 
+// src/kernel/sealed-session.ts
+var SESSION_WINDOW_MS = 6e4;
+var SESSION_PLACEHOLDERS = 16;
+var SESSION_PLACEHOLDER = /^fnox_proxy_[0-9a-f]{24}$/;
+var SESSION_ID = /^[A-Za-z0-9_-]{16,128}$/;
+var TOKEN5 = "[!#$%&'*+.^_`|~0-9a-z-]+";
+var HEADER = new RegExp(`^header:${TOKEN5}$`);
+var METHOD = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var TARGET = /^[\x21-\x7e]+$/;
+var EXIT = /^(page|proxy|tailscale|device:[\x21-\x7e]+)$/;
+var HOST = /^[a-z0-9.:-]+$/;
+var UNSAFE = /[\r\n\0]/;
+var POSITIONS = {
+  http1: (position) => HEADER.test(position),
+  smtp: (position) => position === "auth-plain" || position === "auth-login",
+  pg: (position) => position === "password-cleartext"
+};
+function boundHost(servername) {
+  const lower = servername.toLowerCase();
+  return lower.endsWith(".") ? lower.slice(0, -1) : lower;
+}
+function headOk(f) {
+  if (f.protocol !== "http1") return f.head === void 0;
+  const head = f.head;
+  return head !== void 0 && typeof head.method === "string" && METHOD.test(head.method) && typeof head.path === "string" && TARGET.test(head.path);
+}
+function placeholdersOk(list) {
+  if (!Array.isArray(list) || list.length === 0 || list.length > SESSION_PLACEHOLDERS) return false;
+  return new Set(list).size === list.length && list.every((p) => typeof p === "string" && SESSION_PLACEHOLDER.test(p));
+}
+function hostOk(host) {
+  return typeof host === "string" && HOST.test(host) && boundHost(host) === host;
+}
+function sessionAskable(f, now) {
+  if (!Object.hasOwn(POSITIONS, f.protocol) || typeof f.position !== "string") return false;
+  if (!POSITIONS[f.protocol](f.position)) return false;
+  if (typeof f.session !== "string" || !SESSION_ID.test(f.session)) return false;
+  if (f.verified !== true || !hostOk(f.host) || typeof f.handshakeAt !== "number") return false;
+  if (!Number.isInteger(f.port) || f.port < 1 || f.port > 65535) return false;
+  const age = now - f.handshakeAt;
+  if (!Number.isFinite(age) || age < 0 || age > SESSION_WINDOW_MS) return false;
+  return typeof f.exit === "string" && EXIT.test(f.exit) && placeholdersOk(f.placeholders) && headOk(f);
+}
+function sessionRequest(f) {
+  return {
+    v: 1,
+    op: "sessionMaterialize",
+    caller: f.stamp,
+    stamp: f.stamp,
+    session: f.session,
+    host: f.host,
+    port: f.port,
+    protocol: f.protocol,
+    position: f.position,
+    verified: true,
+    handshakeAt: f.handshakeAt,
+    exit: f.exit,
+    placeholders: [...f.placeholders],
+    ...f.head ? { head: { method: f.head.method, path: f.head.path } } : {}
+  };
+}
+function sessionValues(reply, asked) {
+  if (typeof reply !== "object" || reply === null || Array.isArray(reply)) return void 0;
+  const { error, values } = reply;
+  if (error !== void 0 || typeof values !== "object" || values === null) return void 0;
+  const out = {};
+  for (const ph of asked) {
+    const value2 = values[ph];
+    if (typeof value2 === "string" && value2.length > 0 && !UNSAFE.test(value2)) out[ph] = value2;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+
 // src/kernel/sealed.ts
 var SEALED_MAX_BYTES = 64 * 1024;
 var SEALED_TIMEOUT_MS = 1e4;
@@ -22839,6 +22920,15 @@ var SealedBroker = class {
     };
   }
   async consume(fields) {
+    const req = { ...fields, v: 1, op: "materializeConsume", caller: fields.stamp };
+    return this.ask(req, swapOf);
+  }
+  async sessionMaterialize(fields, now = Date.now()) {
+    if (!sessionAskable(fields, now)) return void 0;
+    const req = sessionRequest(fields);
+    return this.ask(req, (reply) => sessionValues(reply, req.placeholders));
+  }
+  async ask(req, parse) {
     const { hook } = this;
     if (!hook) return void 0;
     const control = new AbortController();
@@ -22846,14 +22936,8 @@ var SealedBroker = class {
     const stopped = new Promise((resolve2) => {
       control.signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
-    const req = {
-      ...fields,
-      v: 1,
-      op: "materializeConsume",
-      caller: fields.stamp
-    };
     try {
-      const asked = Promise.resolve().then(() => hook(req, { signal: control.signal })).then(swapOf, () => void 0);
+      const asked = Promise.resolve().then(() => hook(req, { signal: control.signal })).then(parse, () => void 0);
       return await Promise.race([asked, stopped]);
     } finally {
       clearTimeout(timer);