@ai-ecoverse/slicc-kernel 1.140.1 → 1.140.3

package/dist/node-process-worker.js

@@ -3691,6 +3691,8 @@ var init_wasi_fds = __esm({
         if (kernelDevice !== void 0) return kernelDevice;
         const alias = stdioAlias(path);
         if (alias !== void 0) return this.reopen(alias);
+        const outside = this.escaped(path, oflags, rights);
+        if (outside !== void 0) return this.open(outside, oflags, rights, fdflags, mode);
         if (exclusive && !(oflags & OFLAGS.DIRECTORY) && this.madeAtOnce(path, mode)) {
           return this.regular(path, void 0, oflags, rights, fdflags, mode, true);
         }
@@ -3709,6 +3711,12 @@ var init_wasi_fds = __esm({
         refuseWrite(s, oflags, rights);
         return this.regular(path, s, oflags, rights, fdflags, mode);
       }
+      escaped(path, oflags, rights) {
+        const outside = this.fs.escape?.(path);
+        if (outside === void 0) return void 0;
+        refuseWrite({ readonly: true }, oflags | (oflags & OFLAGS.CREAT ? OFLAGS.TRUNC : 0), rights);
+        return outside;
+      }
       regular(path, s, oflags, rights, fdflags, mode, created = false) {
         if (s?.isFifo) return this.kernelFifo(path, s, oflags, rights, fdflags);
         if (s?.isSocket) throw new WasiError("ENXIO");
@@ -4439,6 +4447,9 @@ function isHostname(name2) {
 function hostnameOf(env) {
   return isHostname(env.HOSTNAME) ? env.HOSTNAME : DEFAULT_HOSTNAME;
 }
+function initHostname(init) {
+  return isHostname(init.hostname) ? init.hostname : hostnameOf(init.env);
+}
 function ownNames(hostname) {
   return [.../* @__PURE__ */ new Set([hostname.toLowerCase(), ...LIBC_HOSTNAMES])];
 }
@@ -6710,7 +6721,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.140.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.140.3" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -10987,10 +10998,12 @@ function directMiss(err, path) {
   if (err?.direct !== true) return false;
   return !path.split("/").some((part) => part === "." || part === "..");
 }
-function procfsBridge(fs, tree) {
-  const toProc = (path, follow3) => procPath(fs, path, follow3);
-  const shadowing = physicalProc(fs);
-  const via = (p, proc, own, follow3 = true) => {
+function routing(tree, toProc, shadowing) {
+  return (p, inner, own, follow3 = true, outside) => {
+    const proc = (q) => {
+      const target = outside ? tree.escape(q) : void 0;
+      return target === void 0 ? inner(q) : outside(target);
+    };
     if (inProc(p)) return proc(p);
     if (shadowing()) {
       const real = toProc(p, follow3);
@@ -11005,6 +11018,11 @@ function procfsBridge(fs, tree) {
       return proc(real);
     }
   };
+}
+function procfsBridge(fs, tree) {
+  const toProc = (path, follow3) => procPath(fs, path, follow3);
+  const shadowing = physicalProc(fs);
+  const via = routing(tree, toProc, shadowing);
   const readOnly2 = (paths, run) => {
     const physical2 = shadowing();
     for (const [p, follow3] of paths) {
@@ -11027,12 +11045,16 @@ function procfsBridge(fs, tree) {
     readFile: (p) => via(
       p,
       (q) => tree.read(q),
-      () => fs.readFile(p)
+      () => fs.readFile(p),
+      true,
+      (t) => fs.readFile(t)
     ),
     stat: (p) => via(
       p,
       (q) => tree.stat(q),
-      () => fs.stat(p)
+      () => fs.stat(p),
+      true,
+      (t) => fs.stat(t)
     ),
     lstat: (p) => via(
       p,
@@ -11111,6 +11133,7 @@ function procfsBridge(fs, tree) {
       return via(p, snapshot, () => fs.hold?.(p, held2, open, void 0, want, seen) ?? late(p));
     },
     kept: (handle) => snapshots.has(handle) || fs.kept?.(handle) === true,
+    escape: (p) => inProc(p) ? tree.escape(p) : void 0,
     pinned: (handle) => {
       const bytes = snapshots.get(handle);
       return bytes ? frozen(bytes) : fs.pinned?.(handle) ?? fs;
@@ -11291,6 +11314,12 @@ var init_wasi_procfs = __esm({
         if (node.kind !== "dir") throw syncError("ENOTDIR", path);
         return node.names();
       }
+      escape(path) {
+        const node = this.node(this.parts(path, true));
+        if (node?.kind !== "link" || !node.target.startsWith("/")) return void 0;
+        if (node.denied) throw syncError("EACCES", path);
+        return node.target;
+      }
       readlink(path) {
         const node = this.find(path, false);
         if (node.kind !== "link") throw syncError("EINVAL", path);
@@ -13971,7 +14000,7 @@ function kernelWrappers(imports, module, deps) {
   goneCwdGetcwd(imports, fsOf, kernelGlue);
   kernelLink(imports, fsOf, memory, kernelGlue);
   devCreations(imports, fsOf, memory, kernelGlue);
-  kernelUname(imports, hostnameOf(init.env), memory, kernelGlue);
+  kernelUname(imports, initHostname(init), memory, kernelGlue);
   wrapImport(
     imports,
     "flock",
@@ -14144,7 +14173,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     streams2.quitting = on;
   });
   atExit = () => streams2.exiting();
-  useMounts(running.FS, init.env, true);
+  useMounts(running.FS, { ...init.env, HOSTNAME: initHostname(init) }, true);
   useZeroDevices(running.FS);
   useProcfs(running.FS, sys, init.pid);
   if (init.fork) restoreForkedStreams(running.FS, streams2, init.fork.streams ?? []);
@@ -14182,7 +14211,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     ...callerOwner(running.FS, init)
   });
   running.sliccKernel.http = createHttpKernel(transport);
-  running.sliccKernel.hostname = hostnameOf(init.env);
+  running.sliccKernel.hostname = initHostname(init);
   running.sliccKernel.net = createSocketKernel({
     transport,
     Fs: running.FS,