@ai-ecoverse/slicc-kernel 1.145.1 → 1.146.0

package/README.md

@@ -448,7 +448,7 @@ The module's default export (or its `main` export) is called with a context and
 - `wait(pid, { untraced })` resolves with `{ status }` once a child ends, or `{ status: 128 + signal, signal }` when a signal ended it, without blocking the program; with `untraced: true` it also resolves when the child stops, with `{ status: 128 + signal, signal, stopped: true }`, as `waitpid` with `WUNTRACED` (a child's `wait({ untraced })` is the same), and options that aren't an object are `EINVAL`; `kill(pid, signal)` signals any process, by number or as `'SIGTERM'` (the default);
 - `sudo(args)`, what the [`sudo`](#sudo) command calls: `args` are its arguments after `sudo`, and it resolves with `{ pid }`, the command the kernel started as the program's child, to `wait` for; `{ run }`, an argv to run as the caller (with `users: 'off'`); `{ list }`, the text of `sudo -l`; or `{ error, errno }`, the message to print;
 - `crontab({ action, user?, text? })`, what the [`crontab`](#cron) command calls: `action` is `'list'`, `'remove'` or `'install'` (with the table as `text`), on the caller's own table or, for an effective uid of 0, on `user`'s. It resolves with `{ text }` (the table for `list`, `''` otherwise) or `{ error }`, the message to print. A malformed call is `EINVAL`;
-- `net`: `listen({ port, host, backlog })` and `connect({ host, port, signal })` (`host` defaults to `127.0.0.1`) on the kernel's loopback, the same sockets WASIX programs use, so a JS server is reached by other processes, by the page as `<port>.kernel.localhost` (`loopbackFetch`, `dial`) and by attached clients. A listener has its `port` (as bound, so port `0` picks a free one), `accept({ signal })`, `close()` and `for await` over its connections. A connection has `local` and `remote` addresses, `readable` and `writable` web streams (closing the writable shuts down the sending side, so the peer reads the end), and `close()`. The loopback is IPv4 (`127.0.0.1` by default, or `0.0.0.0`), so an IPv6 host such as `::1` fails with `EADDRNOTAVAIL` for both `listen` and `connect`, and binding and connecting fail as they would for a WASIX program (`EADDRINUSE`, `ECONNREFUSED`, `EADDRNOTAVAIL`). A blocked accept, read or write waits without holding anything in the kernel, so aborting it or closing the socket leaves nothing behind. A write to a connection the peer closed fails with `EPIPE` and no `SIGPIPE`;
+- `net`: `listen({ port, host, backlog })` and `connect({ host, port, signal })` (`host` defaults to `127.0.0.1`) on the kernel's loopback, the same sockets WASIX programs use, so a JS server is reached by other processes, by the page as `<port>.kernel.localhost` (`loopbackFetch`, `dial`) and by attached clients. A listener has its `port` (as bound, so port `0` picks a free one), `accept({ signal })`, `close()` and `for await` over its connections. A connection has `local` and `remote` addresses, `readable` and `writable` web streams (closing the writable shuts down the sending side, so the peer reads the end), and `close()`. The loopback is IPv4 (`127.0.0.1` by default, or `0.0.0.0`), so an IPv6 host such as `::1` fails with `EADDRNOTAVAIL` for both `listen` and `connect`, and binding and connecting fail as they would for a WASIX program (`EADDRINUSE`, `ECONNREFUSED`, `EADDRNOTAVAIL`). `sync.net.listen` takes the same options and gives the same listener, bound and listening when it returns, so its `port` is known at once, as Node's `listen()` needs ([#1398](https://github.com/ai-ecoverse/slicc-kernel/issues/1398)); it needs the sync lane. A blocked accept, read or write waits without holding anything in the kernel, so aborting it or closing the socket leaves nothing behind. A write to a connection the peer closed fails with `EPIPE` and no `SIGPIPE`;
 - `net.connect({ host, port, tls: { servername, alpn, rejectUnauthorized, ca, path, cert, key, passphrase, sni, checkHostname } })` takes one of two paths. By default it's **A1, TLS through the transport** ([#914](https://github.com/ai-ecoverse/slicc-kernel/issues/914)), described first below. For a destination the uplink routes it can also be **A2, a TLS handshake in the kernel** ([#922](https://github.com/ai-ecoverse/slicc-kernel/issues/922)), described after it. `conn.tls.path` (`'transport'` or `'kernel'`) and `conn.tls.substitutes` say which one was taken.
   - **What it does:** there's no handshake in the kernel. The connection carries plain HTTP/1.1 (and WebSocket upgrades) to the realm proxy's HTTP path for the origin `https://<servername or host>[:port]`, exactly as a `CONNECT` through `127.0.0.1:3128` does after the kernel terminates its TLS. The transport (the page's `fetch` or WebSocket, or the uplink's) makes the real TLS connection and verifies it. So `https.request` over a socket, keep-alive agents, `agent-base` and `wss://` clients work with the transport's semantics. That includes sealed placeholders in headers, which reach the transport exactly as from `ctx.fetch`.
   - **The `tls` property:** the connection's `tls` is `{ path: 'transport', substitutes: true, protocol: 'transport', alpnProtocol: 'http/1.1', authorized: true, servername }`. `authorized` means the transport verified the server. There's no peer certificate chain and no TLS version of the kernel's own, so don't read it as a real handshake's result.

package/dist/kernel-worker.js

@@ -7728,7 +7728,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.145.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.146.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC

package/dist/node-process-worker.js

@@ -6800,7 +6800,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.145.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.146.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -7715,7 +7715,7 @@ function port(n) {
   if (!Number.isInteger(n) || n < 0 || n > 65535) throw new JsCallError("EINVAL", `port ${n}`);
   return n;
 }
-function netOps(kernel, io) {
+function netOps(kernel, io, sync) {
   const name2 = async (fd, peer) => addressOf(await kernel.json({ op: "sock-name", fd, peer }));
   const connection = async (fd) => {
     const [local3, remote] = [await name2(fd, false), await name2(fd, true)];
@@ -7830,14 +7830,29 @@ function netOps(kernel, io) {
     });
     return [...r.ok && r.kind === "json" ? r.json : []];
   };
+  const inetAt = (options) => ({
+    family: "inet",
+    host: options.host ?? "127.0.0.1",
+    port: port(options.port ?? 0)
+  });
+  const listenSync = (options = {}) => {
+    const lane = sync;
+    const addr = inetAt(options);
+    const fd = lane.json({ op: "sock-open", domain: "inet" });
+    try {
+      lane.call({ op: "sock-bind", fd, addr });
+      lane.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
+      return listener(fd, addressOf(lane.json({ op: "sock-name", fd, peer: false })));
+    } catch (err) {
+      lane.raw({ op: "fd-close", fd });
+      throw err;
+    }
+  };
   return {
+    sync: { listen: listenSync },
     resolve: lookup2,
     listen: (options = {}) => opened2(async (fd) => {
-      const addr = {
-        family: "inet",
-        host: options.host ?? "127.0.0.1",
-        port: port(options.port ?? 0)
-      };
+      const addr = inetAt(options);
       await kernel.call({ op: "sock-bind", fd, addr });
       await kernel.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
       return listener(fd, await name2(fd, false));
@@ -15393,6 +15408,14 @@ async function vfsOpen(kernel, abs, options, statOf, io, whole) {
   handles.set(fd, handle.invalidate);
   return handle.file;
 }
+function setcredOn(syncKernel) {
+  return (change) => {
+    if (typeof change !== "object" || change === null || Array.isArray(change)) {
+      throw new JsCallError("EINVAL", "setcred");
+    }
+    return syncKernel.json({ op: "proc-setcred", change: { ...change } });
+  };
+}
 function watchingSyncOps(kernel, syncKernel, shared) {
   const ops = syncOps(syncKernel, shared);
   const watch = (path, options, listener) => {
@@ -15537,6 +15560,7 @@ function createContext(o) {
     run: (options) => runSync(syncKernel, { env: o.env, cwd: o.cwd, resolve: resolve2, signal: signalNumber }, options),
     spawn: (options) => spawnSync(options),
     wasi: { create: wasi.create },
+    net: { listen: (options) => syncNet.listen(options) },
     exit: (status2 = 0) => {
       exiting ??= status2 & 255;
       wasi.closeAll();
@@ -15545,16 +15569,12 @@ function createContext(o) {
     kill: killer({ self: o.pid, kernel, syncKernel, lane, writes, modes: terminal.modes }),
     cred: () => syncKernel.json({ op: "proc-cred" }),
     umask: (mask) => syncKernel.json(umaskRequest(mask)),
-    setcred(change) {
-      if (typeof change !== "object" || change === null || Array.isArray(change)) {
-        throw new JsCallError("EINVAL", "setcred");
-      }
-      return syncKernel.json({ op: "proc-setcred", change: { ...change } });
-    }
+    setcred: setcredOn(syncKernel)
   };
   const io = { read: read2, send: writeAll, close: (fd) => ctx.close(fd) };
   const defaults = { env: o.env, cwd: o.cwd, signal: signalNumber };
   const { spawnSync, ...children } = childOps(kernel, io, defaults, syncKernel);
+  const { sync: syncNet, ...net } = netOps(kernel, io, syncKernel);
   const strays = o.strays ?? { exception: /* @__PURE__ */ new Set(), rejection: /* @__PURE__ */ new Set() };
   const ctx = {
     kernel: KERNEL_INFO,
@@ -15602,7 +15622,7 @@ function createContext(o) {
     }),
     crontab: async (call2) => await kernel.json({ ...call2, op: "proc-crontab" }),
     ...children,
-    net: netOps(kernel, io),
+    net,
     websocket: websocketOp(kernel),
     tty: terminal.tty,
     exit,