@ai-ecoverse/slicc-kernel 1.135.1 → 1.135.2

package/README.md

@@ -967,7 +967,7 @@ With `users: 'enforce'` the kernel checks every file call that reaches it agains
 - **The layout:** with `users: 'report'` or `'enforce'`, the kernel gives its own paths an owner and a mode when they have no owner record yet: on a fresh root, and once on a root from before owners. These are `/` `0755`, `/root` `0700`, `/home` `0755`, `/etc` `0755`, `/etc/passwd` and `/etc/group` `0644`, `/usr` and `/usr/local` `0755`, `/node_modules` (or the `modules` option) and the system `PNPM_HOME` `0755`, all root's. A path that has a record keeps it, so an admin's `chmod 711 /home` or `chown cone /node_modules` lasts across restarts; a mounted path is left to its mount, and a path below a symlinked directory is stamped where it really is. Only a root that records owners is stamped: the OPFS root with its sidecar, which the page and the Node entry (in memory) both use; a custom root file system without owner records is left as it is. The directory for files removed while open, `/.slicc-unlinked`, is made root's `0700`. `/tmp` is the exception: it is set to `1777` at every start, and the first time owners are on for a root from before owners (and at every start after that until it has listed `/tmp` and succeeded for every entry), what is in it without an owner of its own is removed (as a boot empties `/tmp` on Linux; a file that is open is kept, a symlinked `/tmp` is left alone, and one `console.warn` line says how many entries went), since it would otherwise be root's, and a program that made it for its user, such as pnpm's lock directories, would find it isn't its own. Emscripten programs see `/` at `0755`, `/dev` at `0755`, `null`, `zero`, `full`, `random`, `urandom` and `tty` at `0666`, and `/dev/shm` at `1777`. With `users: 'off'` nothing is stamped. Paths the embedder makes (bios's `/opt` and `/var/lib/slicc`) are the embedder's to set. `/etc/sudoers` and `/etc/sudoers.d` are written when missing (see [Sudo](#sudo)).
 - **Terminals:** a terminal from `openTerminal` belongs to its session's user, with group `tty` when `/etc/group` has one (the user's own group otherwise), mode `0620`; a pseudo-terminal's slave `/dev/pts/N` belongs to the uid and gid that opened `/dev/ptmx`, mode `0620`. Opening one by name (`/dev/ttyN`, `/dev/pts/N`, from every runtime) needs both `r` and `w`, so only its owner and root open it: the kernel's terminal descriptor always reads and writes, so the group's `w` bit (`write`, `wall` on Linux) does not let a group member open it. `/dev/tty` is the opener's own controlling terminal and is not checked, and descriptors a process inherited (across `sudo` or a `setresuid` too) keep working. Emscripten programs' `stat` of `/dev/ttyN` and `/dev/pts/N` shows the owner and mode. With `users: 'off'` terminals have no owner, as before.
 - **A client's `fs`:** checked as the client's user; a page's client (root) passes.
-- **Removed files still open:** a process that holds a removed file may look it up (`stat`, `lstat`) under the hidden name the kernel gave it in `/.slicc-unlinked`, which is root's `0700`; every other process is refused there, so the kernel's own bookkeeping of held files raises no denials for their holders.
+- **Removed files still open:** a process that holds a removed file may look it up (`stat`, `lstat`) under the hidden name the kernel gave it in `/.slicc-unlinked`, which is root's `0700`; every other process is refused there, so the kernel's own bookkeeping of held files raises no denials for their holders. If the kernel can't move a held file into `/.slicc-unlinked` (OPFS refuses the move and the copy twice), the removal fails with `EBUSY` and the file stays where it was, so the holder keeps reading it ([#1218](https://github.com/ai-ecoverse/slicc-kernel/issues/1218)). Files of the same removal already moved aside are moved back. If one of those moves back fails too, that file stays in `/.slicc-unlinked`: its holder still reads it, but its name is gone although the removal reported `EBUSY`. That's a double failure, and rare.
 
 `users: 'enforce'` is the default of `createKernel` and `createNodeKernel`; pass `'report'` to find what a program would be refused without refusing it, or `'off'` for kernels without owners. A `Launcher` made directly (see [What is in here](#what-is-in-here)) still defaults to `'off'`.
 

package/dist/kernel-worker.js

@@ -7098,7 +7098,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.135.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.135.2" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -8166,12 +8166,20 @@ var UnlinkedKeeper = class {
           const holders = now.get(path);
           held.set(path, holders);
           for (const holder of holders) moved2.push(holder.moving?.(path) ?? (() => void 0));
-          const at = await this.hide(path);
-          if (at !== void 0) hidden.set(path, at);
+          const at = await this.keepAside(path);
+          if (at === void 0) continue;
+          hidden.set(path, at);
         }
       }
     } catch (err) {
+      for (const [path, at] of hidden) {
+        await this.serial(async () => {
+          await Promise.allSettled([this.fs.rename(at, path)]);
+          this.unlinkedName(at);
+        });
+      }
       for (const settle3 of moved2) settle3();
+      for (const release of releases) release();
       throw err;
     }
     sealed();
@@ -8205,6 +8213,17 @@ var UnlinkedKeeper = class {
       }
     };
   }
+  async keepAside(path) {
+    const at = await this.hide(path) ?? await this.hide(path);
+    if (at !== void 0 || !await this.present(path)) return at;
+    throw fsError("EBUSY", `${path}: open, and it could not be kept aside`);
+  }
+  present(path) {
+    return this.fs.lstat(path).then(
+      () => true,
+      (err) => err?.code !== "ENOENT" && err?.code !== "ENOTDIR"
+    );
+  }
   keptFile(hidden, entry) {
     return {
       hidden,