@ai-ecoverse/slicc-kernel 1.133.1 → 1.133.3

package/dist/node-process-worker.js

@@ -6520,7 +6520,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.133.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.133.3" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node.js

@@ -7403,7 +7403,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.133.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.133.3" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -11674,7 +11674,11 @@ var MountFs = class _MountFs {
     }
   }
   async pread(path, offset, length2, version, redirects = 0) {
-    const real = await this.follow(path);
+    const gone = (at) => (err) => {
+      const stale = version !== void 0 && err.code === "ENOENT";
+      throw stale ? errnoError("ESTALE", `${at} is gone from the host`) : err;
+    };
+    const real = await this.follow(path).catch(gone(path));
     const found = this.at(real);
     const { pread } = this.base;
     if (!found && pread) {
@@ -11687,7 +11691,7 @@ var MountFs = class _MountFs {
     }
     if (!found) return (await this.base.readFileBuffer(real)).slice(offset, offset + length2);
     const { mount, rel: rel2 } = found;
-    if ((await this.table.getattr(mount, real, rel2)).kind === "directory") {
+    if ((await this.table.getattr(mount, real, rel2).catch(gone(real))).kind === "directory") {
       throw errnoError("EISDIR", real);
     }
     await this.table.commitOverlapping(real, offset, length2);
@@ -11699,10 +11703,7 @@ var MountFs = class _MountFs {
       truncate: false,
       exclusive: false,
       ...version !== void 0 ? { ifMatch: version } : {}
-    }).catch((err) => {
-      const gone = version !== void 0 && err.code === "ENOENT";
-      throw gone ? errnoError("ESTALE", `${real} is gone from the host`) : err;
-    });
+    }).catch(gone(real));
     const chunk2 = mount.caps.maxIo ?? DEFAULT_IO;
     const chunks2 = [];
     let total = 0;
@@ -19341,10 +19342,32 @@ var KEY_ERRORS = [
   [-15232, "ERR_OSSL_BAD_DECRYPT"],
   [-15360, "ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED"]
 ];
-function keyRefused(err) {
-  const code = err instanceof TlsError ? err.code : 0;
+var PBE_OIDS = [
+  [42, 134, 72, 134, 247, 13, 1, 5],
+  [42, 134, 72, 134, 247, 13, 1, 12, 1]
+];
+function hasBytes(hay, needle) {
+  for (let i = 0; i + needle.length <= hay.length; i++) {
+    if (needle.every((b, j) => hay[i + j] === b)) return true;
+  }
+  return false;
+}
+function encryptedKey(key) {
+  if (key[0] === 48) return PBE_OIDS.some((oid2) => hasBytes(key, oid2));
+  return new TextDecoder().decode(key).includes("ENCRYPTED");
+}
+var KEY_PARSE_RANGES = [
+  [-16383, -14336],
+  [-5375, -4096],
+  [-28671, -24576],
+  [-127, -96]
+];
+var keyParse = (code) => code !== -15360 && KEY_PARSE_RANGES.some(([lo, hi]) => code >= lo && code <= hi);
+function keyRefused(err, locked) {
+  const raw2 = err instanceof TlsError ? err.code : 0;
+  const code = locked && keyParse(raw2) ? -15232 : raw2;
   const name2 = KEY_ERRORS.find(([n]) => n === code)?.[1] ?? "ERR_OSSL_UNSUPPORTED";
-  const text = code === -3 ? "the key does not match the certificate" : err.message;
+  const text = code === -3 ? "the key does not match the certificate" : code === raw2 ? err.message : "bad decrypt";
   return new KernelError("EPROTO", `${name2}: ${text}`);
 }
 function takeCert(req) {
@@ -19375,7 +19398,7 @@ function withCert(session, cert) {
   try {
     session.ownCert(cert.chain, cert.key, cert.pass);
   } catch (err) {
-    throw keyRefused(err);
+    throw keyRefused(err, cert.pass.length > 0 && encryptedKey(cert.key));
   }
 }
 function wipe(cert) {