@ai-ecoverse/slicc-kernel 1.143.6 → 1.144.1

package/dist/types/client/attach.d.ts

@@ -27,6 +27,7 @@ export interface SpawnOptions {
     stdin?: string | Uint8Array;
     group?: 'new';
     pgid?: number;
+    tag?: string;
     onStdout?: (bytes: Uint8Array) => void;
     onStderr?: (bytes: Uint8Array) => void;
 }
@@ -46,6 +47,7 @@ export interface ClientRunOptions {
     user?: string | number;
     env?: Record<string, string>;
     stdin?: string | Uint8Array;
+    tag?: string;
     onStdout?: (text: string) => void;
     onStderr?: (text: string) => void;
 }
@@ -62,6 +64,7 @@ export interface ClientTerminalOptions {
     env?: Record<string, string>;
     cols?: number;
     rows?: number;
+    tag?: string;
     onData?: (bytes: Uint8Array) => void;
 }
 export interface ClientTerminal {

package/dist/types/client/protocol.d.ts

@@ -21,6 +21,7 @@ export interface SpawnRequestOptions {
     env?: Record<string, string>;
     stdin?: Uint8Array;
     pgid?: number;
+    tag?: string;
 }
 export interface TerminalRequestOptions {
     cwd?: string;
@@ -28,6 +29,7 @@ export interface TerminalRequestOptions {
     env?: Record<string, string>;
     cols?: number;
     rows?: number;
+    tag?: string;
 }
 export type TerminalAction = {
     action: 'write';
@@ -139,6 +141,7 @@ export interface ProcessEntry {
     uid?: number;
     gid?: number;
     tag?: string;
+    tags?: string[];
 }
 export interface MessagePortLike {
     postMessage(message: unknown, transfer?: Transferable[]): void;

package/dist/types/client/serve-client.d.ts

@@ -1,5 +1,5 @@
 import type { RealmTransport } from '../kernel/net/transport.js';
-import type { Launcher } from '../launcher.js';
+import { type Launcher } from '../launcher.js';
 import { type LockManagerLike, type MessagePortLike } from './protocol.js';
 export interface ClientHost {
     scope?: 'transport';

package/dist/types/cron/crontab.d.ts

@@ -2,6 +2,17 @@ import type { KernelFs } from '../fs/types.js';
 import type { Cred } from '../kernel/cred.js';
 import type { Account } from '../users.js';
 export declare const CRONTAB_MAX: number;
+export declare const TAGS_PATH = "/var/spool/cron/tags";
+export interface JobTags {
+    tags: string[];
+    base: number;
+}
+export interface CrontabCaller {
+    tags?: readonly string[] | undefined;
+    base?: number | undefined;
+}
+export type TableTags = Record<string, Record<string, JobTags>>;
+export declare function readTags(fs: KernelFs): Promise<TableTags>;
 export interface CrontabCall {
     op: 'proc-crontab';
     action: 'list' | 'remove' | 'install';
@@ -22,6 +33,7 @@ export declare function crontabCall(req: Partial<CrontabCall>): CrontabCall | un
 export declare class Crontabs {
     private readonly o;
     constructor(options: CrontabsOptions);
-    request(cred: Readonly<Cred>, call: CrontabCall): Promise<CrontabResult>;
+    request(cred: Readonly<Cred>, call: CrontabCall, caller?: CrontabCaller): Promise<CrontabResult>;
+    private retag;
     private install;
 }

package/dist/types/cron/service.d.ts

@@ -21,6 +21,8 @@ export interface CronRun {
     cwd: string;
     env: Record<string, string>;
     output: (bytes: Uint8Array) => void;
+    tags?: readonly string[];
+    tagBase?: number;
 }
 export interface CronHost {
     fs: KernelFs;

package/dist/types/fs/dac.d.ts

@@ -20,8 +20,10 @@ export declare class Dac {
     private readonly seen;
     private suppressed;
     tagOf: (pid: number) => string | undefined;
+    fenced: (pid: number, path: string) => boolean;
     constructor(mode: 'report' | 'enforce', hook?: DenialHook, log?: (line: string) => void);
     get enforcing(): boolean;
+    fence(denial: Denial): never;
     denied(given: Denial): void;
     private note;
 }

package/dist/types/kernel/clipboard.d.ts

@@ -10,6 +10,7 @@ export interface ClipboardStamp {
     gid: number;
     users: UsersMode;
     tag?: string;
+    tags?: string[];
 }
 export interface ClipboardHook {
     read(stamp: ClipboardStamp): Promise<string>;
@@ -41,8 +42,8 @@ export declare class ClipboardBroker {
     readonly hook: ClipboardHook | undefined;
     readonly users: UsersMode;
     readonly timeoutMs: number;
-    readonly tagOf: (pid: number) => string | undefined;
-    constructor(hook: ClipboardHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => string | undefined);
+    readonly tagOf: (pid: number) => readonly string[] | undefined;
+    constructor(hook: ClipboardHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => readonly string[] | undefined);
     ask<T>(work: (hook: ClipboardHook) => Promise<T>): Promise<T>;
     open(access: OpenAccess, stamp: ClipboardStamp): OpenFile;
 }

package/dist/types/kernel/proc-info.d.ts

@@ -26,6 +26,7 @@ export interface ProcessInfo {
     sigCgt?: number;
     sigBlk?: number;
     tag?: string;
+    tags?: string[];
 }
 export interface MountLine {
     type: string;

package/dist/types/kernel/process.d.ts

@@ -23,7 +23,7 @@ import type { MountLine, ProcessListing } from './proc-info.js';
 import type { DlState, ForkState } from './protocol.js';
 import { type PtySyscall, type PtyTable } from './pty.js';
 import { type RunRequest } from './run-child.js';
-import type { SealedBroker, SealedCaller } from './sealed.js';
+import { type SealedBroker, type SealedCaller } from './sealed.js';
 import { type SemSyscall, type SemTable } from './sem.js';
 import { type DefaultAction, type SigInfo } from './signals.js';
 import { LoopbackNet } from './socket.js';

package/dist/types/kernel/sealed.d.ts

@@ -18,7 +18,12 @@ export interface SealedCaller {
     groups: number[];
     users: UsersMode;
     tag?: string;
+    tags?: string[];
 }
+export declare function tagFields(tags: readonly string[] | undefined): {
+    tag?: string;
+    tags?: string[];
+};
 export type SealedRequest = {
     v: 1;
     op: string;
@@ -63,15 +68,15 @@ export declare class SealedBroker {
     readonly hook: SealedHook | undefined;
     readonly users: UsersMode;
     readonly timeoutMs: number;
-    readonly tagOf: (pid: number) => string | undefined;
+    readonly tagOf: (pid: number) => readonly string[] | undefined;
     readonly tickets: TicketBook;
     readonly sessions: SessionScrubs;
     userOf: (uid: number) => Promise<string | undefined>;
-    constructor(hook: SealedHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => string | undefined);
+    constructor(hook: SealedHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => readonly string[] | undefined);
     stamp(ids: {
         pid: number;
         ppid: number;
-    }, cred: Readonly<Cred>, tag: string | undefined): Promise<SealedCaller>;
+    }, cred: Readonly<Cred>, tags: readonly string[] | undefined): Promise<SealedCaller>;
     consume(fields: ConsumeFields): Promise<Swap | undefined>;
     sessionMaterialize(fields: SessionFields, now?: number): Promise<Record<string, string> | undefined>;
     sessionAnchors(fields: SessionAnchorFields): Promise<Anchors | undefined>;

package/dist/types/launcher.d.ts

@@ -98,6 +98,8 @@ export interface RunOptions {
     pgid?: number;
     user?: string | number | Account;
     tag?: string;
+    tags?: readonly string[];
+    tagBase?: number;
     login?: boolean;
 }
 export interface TerminalOptions {
@@ -107,6 +109,8 @@ export interface TerminalOptions {
     rows?: number;
     user?: string | number | Account;
     tag?: string;
+    tags?: readonly string[];
+    tagBase?: number;
     onData: (bytes: Uint8Array) => void;
 }
 export interface TerminalSession {
@@ -140,6 +144,8 @@ interface Target {
     copy?: string;
 }
 export declare function tagOption(tag: unknown): void;
+export declare function withTag(tags: readonly string[] | undefined, tag: string | undefined): readonly string[] | undefined;
+export declare function cronPath(path: string): boolean;
 export declare function expandDefaults(defaults: Readonly<Record<string, string>> | undefined, env: Readonly<Record<string, string>>): Record<string, string>;
 export declare class Launcher {
     readonly fs: KernelFs;
@@ -179,6 +185,7 @@ export declare class Launcher {
     private readonly described;
     private readonly creds;
     private readonly tags;
+    private readonly tagBases;
     private readonly links;
     private readonly freshModules;
     private readonly granted;
@@ -363,6 +370,8 @@ export declare class Launcher {
     private imageOf;
     credOf(pid: number): Cred;
     tagOf(pid: number): string | undefined;
+    tagsOf(pid: number): readonly string[] | undefined;
+    private wireDac;
     private released;
     private signalMasksOf;
     private controlsJobs;
@@ -404,7 +413,7 @@ export declare class Launcher {
     private terminalAccount;
     private identity;
     fsFor(tag: string | undefined): KernelFs;
-    isWriter(tag: string | undefined): boolean;
+    isWriter(tags: readonly string[] | undefined, base?: number): boolean;
     private stackFor;
     private flushingPeers;
     private rewritten;

package/dist/types/process/wasi/wasi-fds.d.ts

@@ -130,7 +130,9 @@ export declare class WasiFds {
     private joined;
     private openKernelDevice;
     private openCharDevice;
-    open(path: string, oflags: number, rights: bigint, fdflags: number, mode?: number): number;
+    open(path: string, oflags: number, rights: bigint, fdflags: number, mode?: number, nofollow?: boolean): number;
+    private nofollow;
+    private openSpecial;
     private escaped;
     private regular;
     private kernelHolds;

package/dist/types/realm/sync-fs-wire.d.ts

@@ -111,6 +111,7 @@ export interface SyncFsPosixBridge {
     lutimes(path: string, atimeMs: number, mtimeMs: number, now?: boolean): void;
     hold?(path: string, held: boolean, open?: boolean, handle?: number, want?: number, seen?: {
         gen?: number;
+        nofollow?: boolean;
     }): number | undefined;
     access?(path: string, mode: number, kind?: AccessKind, nofollow?: boolean): void;
     create?(path: string, mode?: number, opening?: boolean): SyncFsCreated | undefined | void;

package/dist/types/sudo.d.ts

@@ -17,6 +17,7 @@ export interface SudoRequest {
     cwd: string;
     pid: number;
     tag?: string;
+    tags?: string[];
     tty?: string;
     createdAt: number;
     expiresAt: number;
@@ -53,7 +54,7 @@ export type SudoResult = {
 export interface SudoCaller {
     cred: Cred;
     pid: number;
-    tag?: string | undefined;
+    tags?: readonly string[] | undefined;
     tty?: string | null | undefined;
 }
 interface Rule {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.143.6",
+  "version": "1.144.1",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,9 +66,9 @@
     "@ai-ecoverse/py-numpy": "2.5.4-4",
     "@ai-ecoverse/slicc-node": "2.5.2",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
-    "@ai-ecoverse/slicc-shared-web": "1.30.2",
+    "@ai-ecoverse/slicc-shared-web": "1.30.6",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",
-    "@ai-ecoverse/wasi-pnpm": "12.9.1-20",
+    "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
     "@ai-ecoverse/wasi-rustc": "1.98.1-10",
     "@ai-ecoverse/wasi-zig": "0.16.0-20",
@@ -80,10 +80,10 @@
     "@ai-ecoverse/wasm-gmake": "4.4.1-9",
     "@ai-ecoverse/wasm-procps": "4.0.7-4",
     "@ai-ecoverse/wasm-sqlite3": "3.54.0-7",
-    "@ai-ecoverse/wasm-tar": "1.35.0-8",
+    "@ai-ecoverse/wasm-tar": "1.35.0-9",
     "@ai-ecoverse/wasm-tls-engine": "4.2.0-7",
     "@ai-ecoverse/wasm-tree": "2.3.2-7",
-    "@ai-ecoverse/wasm-util-linux": "2.42.4-5",
+    "@ai-ecoverse/wasm-util-linux": "2.42.4-6",
     "@biomejs/biome": "2.5.15",
     "@types/node": "24.19.2",
     "esbuild": "0.28.2",