@ai-ecoverse/slicc-kernel 1.136.2 → 1.136.4

package/dist/node-process-worker.js

@@ -6699,7 +6699,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.136.2" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.136.4" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node.js

@@ -7486,7 +7486,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.136.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.136.4" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -18412,6 +18412,66 @@ async function anchorFor(engine, chain2, host, found) {
   return void 0;
 }
 
+// src/kernel/net/sealed-binding.ts
+var HASH_OF_SIGNATURE = {
+  "1.2.840.113549.1.1.4": "SHA-256",
+  "1.2.840.113549.1.1.5": "SHA-256",
+  "1.2.840.10045.4.1": "SHA-256",
+  "1.2.840.10040.4.3": "SHA-256",
+  "1.2.840.113549.1.1.11": "SHA-256",
+  "1.2.840.10045.4.3.2": "SHA-256",
+  "1.2.840.113549.1.1.12": "SHA-384",
+  "1.2.840.10045.4.3.3": "SHA-384",
+  "1.2.840.113549.1.1.13": "SHA-512",
+  "1.2.840.10045.4.3.4": "SHA-512"
+};
+function tlv3(der2, at) {
+  const tag = der2[at];
+  let len = der2[at + 1];
+  if (tag === void 0 || len === void 0) return void 0;
+  let start2 = at + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 4) return void 0;
+    len = 0;
+    for (let i = 0; i < n; i++) len = len * 256 + (der2[start2 + i] ?? 0);
+    start2 += n;
+  }
+  const end = start2 + len;
+  return end <= der2.length ? { tag, start: start2, end } : void 0;
+}
+function oidText(bytes) {
+  const first = bytes[0] ?? 0;
+  const parts2 = [Math.floor(first / 40), first % 40];
+  let value2 = 0;
+  for (const b of bytes.subarray(1)) {
+    value2 = value2 * 128 + (b & 127);
+    if ((b & 128) === 0) {
+      parts2.push(value2);
+      value2 = 0;
+    }
+  }
+  return parts2.join(".");
+}
+function signatureOid(cert) {
+  const outer = tlv3(cert, 0);
+  if (outer?.tag !== 48) return void 0;
+  const tbs = tlv3(cert, outer.start);
+  if (tbs?.tag !== 48) return void 0;
+  const algorithm = tlv3(cert, tbs.end);
+  if (algorithm?.tag !== 48) return void 0;
+  const oid2 = tlv3(cert, algorithm.start);
+  if (oid2?.tag !== 6) return void 0;
+  return oidText(cert.subarray(oid2.start, oid2.end));
+}
+async function endPointBinding(cert) {
+  if (!cert) return void 0;
+  const oid2 = signatureOid(cert);
+  const hash = oid2 === void 0 ? void 0 : HASH_OF_SIGNATURE[oid2];
+  if (!hash) return void 0;
+  return new Uint8Array(await crypto.subtle.digest(hash, cert));
+}
+
 // node_modules/@ai-ecoverse/slicc-scrub/dist/index.js
 var FRAGMENT = 16;
 var MIN_VALUE = 8;
@@ -19147,25 +19207,35 @@ function base64Of(bytes) {
   for (const b of bytes) bin += String.fromCharCode(b);
   return btoa(bin);
 }
-function clientFirstBare(message3) {
-  const m = /^n,,(n=[^,]*,r=[^,]+)$/.exec(message3);
-  return m ? m[1] : void 0;
+function clientFirstOf(message3) {
+  const m = /^((?:n|y|p=[A-Za-z0-9.-]+),,)(n=[^,]*,r=[^,]+)$/.exec(message3);
+  return m ? { header: m[1], bare: m[2] } : void 0;
+}
+var latinBytes = (text) => Uint8Array.from(text, (c) => c.charCodeAt(0));
+function channelOf(header4, binding) {
+  const head = latinBytes(header4);
+  const all = new Uint8Array(head.length + (binding?.length ?? 0));
+  all.set(head);
+  if (binding) all.set(binding, head.length);
+  return base64Of(all);
 }
 var SERVER_FIRST = /^r=([^,]+),s=([^,]+),i=(\d{1,6})$/;
-var CLIENT_FINAL = /^(c=biws,r=([^,]+)),p=([^,]+)$/;
+var CLIENT_FINAL = /^(c=([A-Za-z0-9+/]+={0,2}),r=([^,]+)),p=([^,]+)$/;
 var SCRAM_MAX = 1024;
 function exchangeOf(clientFirst, serverFirst, clientFinal) {
-  const bare = clientFirstBare(clientFirst);
+  const first = clientFirstOf(clientFirst);
+  const bare = first?.bare;
   const sf = SERVER_FIRST.exec(serverFirst);
   const fin = CLIENT_FINAL.exec(clientFinal);
   if (!bare || !sf || !fin || [bare, serverFirst, clientFinal].some((t) => t.length > SCRAM_MAX))
     return void 0;
+  const channel = base64Bytes(fin[2]);
   const cnonce = bare.slice(bare.indexOf(",r=") + 3);
   const nonce = sf[1];
   const salt = base64Bytes(sf[2]);
   const iterations = Number(sf[3]);
-  const proof = base64Bytes(fin[3]);
-  const ok4 = fin[2] === nonce && nonce.startsWith(cnonce) && iterations >= 1 && iterations <= 1e5 && salt !== void 0 && proof?.length === 32;
+  const proof = base64Bytes(fin[4]);
+  const ok4 = channel !== void 0 && latin(channel).startsWith(first.header) && fin[3] === nonce && nonce.startsWith(cnonce) && iterations >= 1 && iterations <= 1e5 && salt !== void 0 && proof?.length === 32;
   if (!ok4) return void 0;
   return {
     exchange: {
@@ -19175,9 +19245,16 @@ function exchangeOf(clientFirst, serverFirst, clientFinal) {
       salt,
       iterations
     },
-    proof
+    proof,
+    channel,
+    nonce
   };
 }
+function latin(bytes) {
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
 async function hmac(key, data) {
   const k = await crypto.subtle.importKey(
     "raw",
@@ -19244,16 +19321,23 @@ function sniffPg(start2) {
   const length2 = int32(bytes, 0);
   return length2 >= 8 && length2 <= PG_MESSAGE_MAX && int32(bytes, 4) === PROTOCOL_3 ? "yes" : "no";
 }
+var PLAIN = "SCRAM-SHA-256";
 var PLUS = "SCRAM-SHA-256-PLUS";
+var END_POINT = "p=tls-server-end-point,,";
 var SASL = 10;
 var SASL_CONTINUE = 11;
 var SASL_FINAL = 12;
-function latin(bytes) {
+function latin2(bytes) {
   let out = "";
   for (const b of bytes) out += String.fromCharCode(b);
   return out;
 }
 var PgServer = class {
+  binding;
+  plus = false;
+  constructor(binding) {
+    this.binding = binding;
+  }
   buffer = new Uint8Array(0);
   skip = 0;
   cleartext = false;
@@ -19267,20 +19351,22 @@ var PgServer = class {
     if (this.expect && code !== SASL_FINAL) this.failed = true;
     this.cleartext = message3.length === 9 && code === CLEARTEXT;
     if (code === SASL) return this.mechanisms(message3);
-    else if (code === SASL_CONTINUE) this.serverFirst = latin(message3.subarray(9));
+    else if (code === SASL_CONTINUE) this.serverFirst = latin2(message3.subarray(9));
     else if (code === SASL_FINAL) this.final(message3);
     return message3;
   }
   mechanisms(message3) {
     this.sasl = true;
-    const names2 = latin(message3.subarray(9)).split("\0").filter((n) => n !== "" && n !== PLUS);
-    return frame3(82, `${latin(message3.subarray(5, 9))}${names2.map((n) => `${n}\0`).join("")}\0`);
+    const offered = latin2(message3.subarray(9)).split("\0").filter((n) => n !== "");
+    this.plus = offered.includes(PLUS);
+    const names2 = offered.filter((n) => n !== PLUS || this.binding !== void 0);
+    return frame3(82, `${latin2(message3.subarray(5, 9))}${names2.map((n) => `${n}\0`).join("")}\0`);
   }
   final(message3) {
     const expect = this.expect;
     if (!expect) return;
     this.expect = void 0;
-    const data = latin(message3.subarray(9));
+    const data = latin2(message3.subarray(9));
     if (data !== expect.real || expect.fake.length !== expect.real.length) {
       this.failed = true;
       return;
@@ -19355,9 +19441,9 @@ function pgLength(bytes, started) {
   const length2 = int32(bytes, started ? 1 : 0);
   return started ? 1 + length2 : length2;
 }
-var MECHANISMS = /* @__PURE__ */ new Set(["SCRAM-SHA-256"]);
+var MECHANISMS = /* @__PURE__ */ new Set([PLAIN, PLUS]);
 async function cleartext(message3, asks) {
-  const body = latin(message3.subarray(5));
+  const body = latin2(message3.subarray(5));
   if (!body.endsWith("\0") || body.indexOf("\0") !== body.length - 1)
     return { bytes: message3, done: true };
   const password = body.slice(0, -1);
@@ -19369,14 +19455,30 @@ async function cleartext(message3, asks) {
   return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
 }
 function initial(message3) {
-  const body = latin(message3.subarray(5));
+  const body = latin2(message3.subarray(5));
   const nul = body.indexOf("\0");
-  if (nul < 0 || !MECHANISMS.has(body.slice(0, nul)) || body.length < nul + 5) return void 0;
+  const mechanism = body.slice(0, nul);
+  if (nul < 0 || !MECHANISMS.has(mechanism) || body.length < nul + 5) return void 0;
   const data = message3.subarray(5 + nul + 5);
-  return int32(message3, 5 + nul + 1) === data.length ? latin(data) : void 0;
+  return int32(message3, 5 + nul + 1) === data.length ? { mechanism, data: latin2(data) } : void 0;
+}
+function int32Text(n) {
+  return String.fromCharCode(n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255);
+}
+function serverHeader(header4, server) {
+  if (header4 === "n,,") return header4;
+  if (header4 === "y,," && !server.plus) return header4;
+  if (header4 === END_POINT && server.binding) return header4;
+  return server.plus && server.binding ? END_POINT : "n,,";
+}
+function rewritten(first, header4) {
+  const parsed2 = clientFirstOf(first.data);
+  if (!parsed2 || parsed2.header === header4) return first;
+  return { mechanism: header4 === END_POINT ? PLUS : PLAIN, data: `${header4}${parsed2.bare}` };
 }
 var PgClient = class {
   clientFirst;
+  header = "n,,";
   server;
   asks;
   constructor(server, asks) {
@@ -19391,17 +19493,28 @@ var PgClient = class {
       return cleartext(message3, this.asks);
     }
     if (server.sasl && this.clientFirst === void 0) {
-      this.clientFirst = initial(message3);
-      return { bytes: message3, done: this.clientFirst === void 0 };
+      const first = initial(message3);
+      const parsed2 = first && clientFirstOf(first.data);
+      if (!first || !parsed2) return { bytes: message3, done: true };
+      this.clientFirst = first.data;
+      this.header = serverHeader(parsed2.header, server);
+      const sent = rewritten(first, this.header);
+      if (sent === first) return { bytes: message3, done: false };
+      return {
+        bytes: frame3(112, `${sent.mechanism}\0${int32Text(sent.data.length)}${sent.data}`),
+        done: false
+      };
     }
     if (this.clientFirst !== void 0 && server.serverFirst !== void 0)
       return this.final(message3, this.clientFirst, server.serverFirst);
     return { bytes: message3, done: true };
   }
   async final(message3, first, serverFirst) {
-    const got = exchangeOf(first, serverFirst, latin(message3.subarray(5)));
+    const got = exchangeOf(first, serverFirst, latin2(message3.subarray(5)));
     if (!got) return { bytes: message3, done: true };
     const x = got.exchange;
+    const binding = this.header === END_POINT ? this.server.binding : void 0;
+    const serverFinal = `c=${channelOf(this.header, binding)},r=${got.nonce}`;
     const values = usable(
       await this.asks.scram({
         clientFirstBare: x.clientFirstBare,
@@ -19411,16 +19524,19 @@ var PgClient = class {
       })
     );
     const [entry, ...more] = Object.entries(values);
-    if (!entry || more.length > 0) return { bytes: message3, done: true };
+    const own = { bytes: frame3(112, `${serverFinal},p=${base64Of(got.proof)}`), done: true };
+    if (!entry || more.length > 0)
+      return serverFinal === x.clientFinalBare ? { bytes: message3, done: true } : own;
     const [placeholder, value2] = entry;
     const fake = await scramKeys(placeholder, x);
-    if (!sameBytes(fake.proof, got.proof)) return { bytes: message3, done: true };
-    const real = await scramKeys(saslprep(value2), x);
+    if (!sameBytes(fake.proof, got.proof))
+      return serverFinal === x.clientFinalBare ? { bytes: message3, done: true } : own;
+    const real = await scramKeys(saslprep(value2), { ...x, clientFinalBare: serverFinal });
     this.server.expect = {
       real: `v=${base64Of(real.serverSignature)}`,
       fake: `v=${base64Of(fake.serverSignature)}`
     };
-    const bytes = frame3(112, `${x.clientFinalBare},p=${base64Of(real.proof)}`);
+    const bytes = frame3(112, `${serverFinal},p=${base64Of(real.proof)}`);
     for (const k of [real.proof, real.serverSignature, fake.proof, fake.serverSignature]) k.fill(0);
     return { bytes, values, done: true };
   }
@@ -19819,7 +19935,7 @@ function idle() {
   return new Promise((resolve2) => setTimeout(() => resolve2(IDLE2), SCRUB_IDLE_MS));
 }
 function sealedConn(conn, s) {
-  const pg = new PgServer();
+  const pg = new PgServer(s.binding);
   const scope = s.broker.sessions.scope(s.pid, s.host);
   const writer = substitutes(s) ? new SessionWriter(conn, s, pg, scope) : void 0;
   const observed = {
@@ -20110,6 +20226,8 @@ function secure(prepared, seal) {
       const session = sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
       if (!session) return made2;
       made2.info.substitutes = substitutes(session);
+      if (made2.info.substitutes && session.verified)
+        session.binding = await endPointBinding(made2.info.peerCertificates[0]);
       return { conn: sealedConn(made2.conn, session), info: made2.info };
     } finally {
       prepared.own?.release();
@@ -22143,6 +22261,18 @@ var WasmProcess = class {
       throw err;
     }
   }
+  async complain(line) {
+    const stderr = this.fds.has(2) ? this.fds.get(2).file : void 0;
+    if (!stderr?.write || stderr.sealed || stderr.clipboard) return false;
+    const bytes = new TextEncoder().encode(`${line}
+`);
+    const timeout = new Promise((r) => setTimeout(() => r(0), 1e3));
+    const sent = await Promise.race([stderr.write(bytes, AbortSignal.timeout(1e3)), timeout]).then(
+      (n) => n,
+      () => 0
+    );
+    return sent > 0;
+  }
   async clipboardComplaint(err) {
     const name2 = this.options.clipboardName;
     if (name2 === void 0 || !(err instanceof KernelError) || err.detail === void 0) return;
@@ -23618,6 +23748,29 @@ function outOfMemory(opts, data) {
   }
   return true;
 }
+function workerError(event) {
+  return String(event.message ?? "worker error");
+}
+var CrashSlot = class {
+  status;
+  reported = false;
+  report;
+  constructor(report) {
+    this.report = report;
+  }
+  take(status, message3, finish) {
+    if (this.status) return;
+    this.status = status;
+    const done4 = () => {
+      this.reported = true;
+      finish(...status);
+    };
+    void this.report(message3).then(done4, done4);
+  }
+};
+async function crashReport(process2, onError, message3) {
+  if (!await process2.complain(message3)) onError?.(message3);
+}
 function spawnWasmProcess(opts) {
   const { promise: ready2, resolve: started } = readiness(opts.program.abi);
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
@@ -23668,9 +23821,11 @@ function spawnWasmProcess(opts) {
   const jsThreads = jsThreadsOf(opts, process2, token, dispatch2, clocks, header4);
   const { promise: exited, resolve: settle } = Promise.withResolvers();
   let done4 = false;
+  const crash = new CrashSlot((message3) => crashReport(process2, opts.onError, message3));
   let endedBy;
   const finish = (code, sig) => {
     if (done4) return;
+    if (crash.status && !crash.reported) return;
     done4 = true;
     started(true);
     clocks.freeze();
@@ -23699,8 +23854,9 @@ function spawnWasmProcess(opts) {
     } else if (data?.type === WASM_PROCESS_EXIT) {
       finish(...dying.status(data.code));
     } else if (data?.type === WASM_PROCESS_ERROR) {
-      if (!dying.ending) opts.onError?.(String(data.message));
-      finish(...dying.status(data.code));
+      const status = dying.status(data.code);
+      if (dying.ending) finish(...status);
+      else crash.take(status, String(data.message), finish);
     } else if (data?.type === WASM_THREAD_SPAWN && data.thread) {
       spawnThread(data.thread);
     } else if (data?.type === JS_THREAD_SPAWN && jsThreads) {
@@ -23710,8 +23866,7 @@ function spawnWasmProcess(opts) {
   const onMessage = (event) => handle(event.data);
   const onError = (event) => {
     event.preventDefault();
-    opts.onError?.(String(event.message ?? "worker error"));
-    finish(CRASHED);
+    crash.take([CRASHED], workerError(event), finish);
   };
   worker.addEventListener("message", onMessage);
   worker.addEventListener("error", onError);
@@ -26621,7 +26776,7 @@ var RULE = new RegExp(
   String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?(?:Cwd\s+(${WORD})\s+)?Cmnd(?:\s+(.*))?$`
 );
 var TERM = /^[A-Za-z0-9._+-]+$/;
-var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
+var PLAIN2 = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
 function failed2(errno3, error) {
   return { error, errno: errno3 };
@@ -26648,7 +26803,7 @@ function splitWords(text) {
   return words2;
 }
 function quoteWord(word) {
-  return PLAIN.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
+  return PLAIN2.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
 }
 function validWho(who) {
   if (who === "ALL") return true;