@ai-ecoverse/slicc-kernel 1.130.1 → 1.131.0

package/dist/node-process-worker.js

@@ -6479,7 +6479,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.130.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.131.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node.js

@@ -7394,7 +7394,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.130.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.131.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -17601,7 +17601,7 @@ var TOKEN5 = "[!#$%&'*+.^_`|~0-9a-z-]+";
 var HEADER = new RegExp(`^header:${TOKEN5}$`);
 var METHOD = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var TARGET = /^[\x21-\x7e]+$/;
-var SESSION_EXIT = /^(tailscale|device:[A-Za-z0-9._-]+)$/;
+var SESSION_EXIT = /^(tailscale|device:[A-Za-z0-9._:-]+)$/;
 var HOST = /^[a-z0-9.:-]+$/;
 var UNSAFE = /[\r\n\0]/;
 var POSITIONS = {
@@ -18350,6 +18350,90 @@ async function substituteHead(head, ask) {
 `, values };
 }
 
+// src/kernel/net/sealed-pg.ts
+var PG_MESSAGE_MAX = 16 * 1024;
+var PROTOCOL_3 = 196608;
+var CLEARTEXT = 3;
+function int32(bytes, at) {
+  return bytes[at] << 24 | bytes[at + 1] << 16 | bytes[at + 2] << 8 | bytes[at + 3];
+}
+function sniffPg(start2) {
+  const bytes = Uint8Array.from(start2, (c) => c.charCodeAt(0));
+  if (bytes.length === 0 || bytes[0] !== 0) return bytes.length === 0 ? "more" : "no";
+  if (bytes.length < 8) return "more";
+  const length2 = int32(bytes, 0);
+  return length2 >= 8 && length2 <= PG_MESSAGE_MAX && int32(bytes, 4) === PROTOCOL_3 ? "yes" : "no";
+}
+var PgServer = class {
+  buffer = new Uint8Array(0);
+  skip = 0;
+  lost = false;
+  cleartext = false;
+  feed(bytes) {
+    if (this.lost) return;
+    const data = new Uint8Array(this.buffer.length + bytes.length);
+    data.set(this.buffer);
+    data.set(bytes, this.buffer.length);
+    let at = 0;
+    for (; ; ) {
+      const left = data.length - at;
+      if (this.skip > 0) {
+        const n = Math.min(this.skip, left);
+        this.skip -= n;
+        at += n;
+        if (this.skip > 0) break;
+        continue;
+      }
+      if (left < 5) break;
+      const type = data[at];
+      const whole = 1 + int32(data, at + 1);
+      if (whole < 5 || type === 82 && whole > PG_MESSAGE_MAX) {
+        this.lost = true;
+        this.cleartext = false;
+        this.buffer = new Uint8Array(0);
+        return;
+      }
+      if (type !== 82) {
+        this.skip = whole;
+        continue;
+      }
+      if (left < whole) break;
+      this.cleartext = whole === 9 && int32(data, at + 5) === CLEARTEXT;
+      at += whole;
+    }
+    this.buffer = data.slice(at);
+  }
+};
+function frame3(type, body) {
+  const out = new Uint8Array(5 + body.length);
+  out[0] = type;
+  const length2 = 4 + body.length;
+  out.set([length2 >>> 24 & 255, length2 >>> 16 & 255, length2 >>> 8 & 255, length2 & 255], 1);
+  for (let i = 0; i < body.length; i++) out[5 + i] = body.charCodeAt(i);
+  return out;
+}
+function pgLength(bytes, started) {
+  const header4 = started ? 5 : 4;
+  if (bytes.length < header4) return void 0;
+  const length2 = int32(bytes, started ? 1 : 0);
+  return started ? 1 + length2 : length2;
+}
+async function pgPassword(message3, server, ask) {
+  if (message3[0] !== 112 || !server.cleartext) return { bytes: message3, done: true };
+  server.cleartext = false;
+  let body = "";
+  for (const b of message3.subarray(5)) body += String.fromCharCode(b);
+  if (!body.endsWith("\0") || body.indexOf("\0") !== body.length - 1)
+    return { bytes: message3, done: true };
+  const password = body.slice(0, -1);
+  const placeholders = placeholdersIn(password);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS)
+    return { bytes: message3, done: true };
+  const values = usable(await ask(placeholders));
+  if (Object.keys(values).length === 0) return { bytes: message3, done: true };
+  return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
+}
+
 // src/kernel/net/sealed-smtp.ts
 var SMTP_LINE_MAX = 4096;
 var GREETING = ["EHLO ", "HELO "];
@@ -18471,11 +18555,14 @@ function headEnd2(bytes) {
   return -1;
 }
 function modeOf(start2) {
-  const http = sniffHttp1(start2);
-  const smtp = sniffSmtp(start2);
-  if (http === "yes") return "http1";
-  if (smtp === "yes") return "smtp";
-  return http === "no" && smtp === "no" ? "pass" : void 0;
+  const sniffs = [
+    ["http1", sniffHttp1(start2)],
+    ["smtp", sniffSmtp(start2)],
+    ["pg", sniffPg(start2)]
+  ];
+  const hit = sniffs.find(([, v]) => v === "yes");
+  if (hit) return hit[0];
+  return sniffs.every(([, v]) => v === "no") ? "pass" : void 0;
 }
 function crlf(bytes) {
   for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
@@ -18489,12 +18576,15 @@ var SessionWriter = class {
   failed;
   session = sessionId();
   smtp;
+  pgStarted = false;
   conn;
   s;
+  pg;
   scope;
-  constructor(conn, s, scope) {
+  constructor(conn, s, pg, scope) {
     this.conn = conn;
     this.s = s;
+    this.pg = pg;
     this.scope = scope;
     this.smtp = new SmtpClient(
       (position, placeholders) => this.ask("smtp", position, placeholders)
@@ -18543,6 +18633,7 @@ var SessionWriter = class {
     if (this.mode === "pass") await this.release();
     else if (this.mode === "http1") await this.http1();
     else if (this.mode === "smtp") await this.lines();
+    else if (this.mode === "pg") await this.messages();
     if (this.mode !== "pass" && this.buffer.length > 0)
       this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
     return bytes.length;
@@ -18573,6 +18664,33 @@ var SessionWriter = class {
     }
     if (this.buffer.length > SMTP_LINE_MAX) await this.release();
   }
+  async messages() {
+    for (; ; ) {
+      const whole = pgLength(this.buffer, this.pgStarted);
+      if (whole === void 0 || whole < 4 || whole > PG_MESSAGE_MAX) {
+        if (whole !== void 0) await this.release();
+        return;
+      }
+      if (this.buffer.length < whole) return;
+      const message3 = this.buffer.slice(0, whole);
+      this.buffer = this.buffer.slice(whole);
+      const started = this.pgStarted;
+      this.pgStarted = true;
+      const out = started ? await pgPassword(
+        message3,
+        this.pg,
+        (placeholders) => this.ask("pg", "password-cleartext", placeholders)
+      ).catch(() => ({ bytes: message3, done: true })) : { bytes: message3, done: false };
+      if ("values" in out && out.values) this.remember(out.values);
+      try {
+        await writeAll4(this.conn, out.bytes);
+      } finally {
+        out.bytes.fill(0);
+        message3.fill(0);
+      }
+      if (out.done) return this.release();
+    }
+  }
   idle() {
     this.chain = this.chain.then(() => this.release()).catch((err) => {
       this.failed ??= err;
@@ -18686,9 +18804,18 @@ function idle() {
   return new Promise((resolve2) => setTimeout(() => resolve2(IDLE2), SCRUB_IDLE_MS));
 }
 function sealedConn(conn, s) {
+  const pg = new PgServer();
   const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new SessionWriter(conn, s, scope) : void 0;
-  const reader = new ScrubReader(conn, scope);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, pg, scope) : void 0;
+  const observed = {
+    ...conn,
+    read: async () => {
+      const bytes = await conn.read();
+      if (bytes) pg.feed(bytes);
+      return bytes;
+    }
+  };
+  const reader = new ScrubReader(writer ? observed : conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
@@ -23946,6 +24073,7 @@ var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-identity",
   "fd-info",
   "sig-mask",
+  "sig-inherited",
   "proc-setpgid",
   "tty-pgrp-set",
   "proc-exec",