@ai-ecoverse/slicc-kernel 1.158.0 → 1.159.0

package/dist/node.js

@@ -991,6 +991,9 @@ var KernelPipe = class {
   readers = 0;
   writers = 0;
   waiters = [];
+  pushed = 0;
+  taken = 0;
+  marks = [];
   capacity;
   constructor(capacity = PIPE_CAPACITY) {
     this.capacity = capacity;
@@ -1021,6 +1024,7 @@ var KernelPipe = class {
     if (this.readers === 0) {
       this.chunks = [];
       this.size = 0;
+      this.dropMarks(() => true);
     }
     this.wake();
   }
@@ -1033,10 +1037,59 @@ var KernelPipe = class {
       if (this.writers === 0) return new Uint8Array(0);
       await this.changed(signal);
     }
-    const out = this.take(Math.min(max, this.size));
+    const out = this.take(this.bounded(Math.min(max, this.size)));
+    this.dropMarks((mark) => mark.at < this.taken);
     this.wake();
     return out;
   }
+  get inFlight() {
+    return this.marks.reduce((sum, mark) => sum + mark.count, 0);
+  }
+  async receive(max, nonblock, signal) {
+    while (this.size === 0) {
+      if (this.writers === 0) return { bytes: new Uint8Array(0), marks: [] };
+      if (nonblock) throw new PipeError("EAGAIN");
+      await this.changed(signal);
+    }
+    const marks = this.marks.filter((mark) => mark.at === this.taken);
+    this.marks = this.marks.filter((mark) => mark.at !== this.taken);
+    const bytes = this.take(this.bounded(Math.min(max, this.size)));
+    this.dropMarks((mark) => mark.at < this.taken);
+    this.wake();
+    return { bytes, marks };
+  }
+  async writeMarked(bytes, mark, nonblock, signal) {
+    while (this.readers > 0 && this.size >= this.capacity) {
+      if (nonblock) throw new PipeError("EAGAIN");
+      await this.changed(signal);
+    }
+    if (this.readers === 0) throw new PipeError("EPIPE");
+    const before = this.pushed;
+    const made2 = mark(before);
+    this.marks.push(made2);
+    try {
+      const n = await this.write(bytes, signal);
+      this.orphan(made2, before);
+      return n;
+    } catch (err) {
+      this.orphan(made2, before);
+      throw err;
+    }
+  }
+  orphan(made2, before) {
+    if (this.pushed !== before) return;
+    this.dropMarks((mark) => mark === made2);
+  }
+  bounded(n) {
+    const next3 = this.marks.find((mark) => mark.at > this.taken);
+    return next3 ? Math.min(n, next3.at - this.taken) : n;
+  }
+  dropMarks(gone) {
+    const dropped2 = this.marks.filter(gone);
+    if (dropped2.length === 0) return;
+    this.marks = this.marks.filter((mark) => !gone(mark));
+    for (const mark of dropped2) mark.drop();
+  }
   async peek(max, signal) {
     while (this.size === 0) {
       if (this.writers === 0) return new Uint8Array(0);
@@ -1069,6 +1122,7 @@ var KernelPipe = class {
       const n = Math.min(room, bytes.length - offset);
       this.chunks.push(bytes.slice(offset, offset + n));
       this.size += n;
+      this.pushed += n;
       offset += n;
       this.wake();
     }
@@ -1086,6 +1140,7 @@ var KernelPipe = class {
       else this.chunks[0] = head.subarray(count2);
     }
     this.size -= n;
+    this.taken += n;
     return out;
   }
   changed(signal) {
@@ -1962,6 +2017,30 @@ var KernelSocket = class _KernelSocket {
     if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
+  rightsLink() {
+    const link2 = this.connection();
+    if (this.domain !== "unix" || this.switch || this.served) throw new KernelError("EOPNOTSUPP");
+    if (this.refused) throw this.refused;
+    return link2;
+  }
+  sendRights(bytes, mark, nonblock, signal) {
+    const { tx } = this.rightsLink();
+    if (this.writeShut) throw new KernelError("EPIPE");
+    return pipeCall(() => tx.writeMarked(bytes, (at) => mark(at, tx.inFlight), nonblock, signal));
+  }
+  async receiveRights(max, nonblock, signal) {
+    const { rx } = this.rightsLink();
+    if (this.readShut || max <= 0) return { bytes: EMPTY, marks: [] };
+    const got = await pipeCall(() => rx.receive(max, nonblock, signal));
+    if (this.refused) {
+      for (const mark of got.marks) mark.drop();
+      throw this.refused;
+    }
+    return got;
+  }
+  get secured() {
+    return this.served || this.tlsDial || this.serving !== void 0 || !!this.switch?.upgraded;
+  }
   async write(bytes, signal) {
     const { tx } = this.connection();
     if (this.refused) throw this.refused;
@@ -2103,11 +2182,13 @@ var KernelSocket = class _KernelSocket {
   switch;
   connectSecure(addr, route2, secure2) {
     if (this.state !== "open") throw new KernelError("EISCONN");
+    this.tlsDial = true;
     return this.dial(addr, route2, secure2);
   }
   serving;
   pending;
   served = false;
+  tlsDial = false;
   get loopbackLinked() {
     return this.state === "connected" && !this.switch;
   }
@@ -3588,7 +3669,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.158.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.159.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -8068,6 +8149,7 @@ function replyStream(reply) {
     }
   });
 }
+var HELD_MAX = 16;
 var Throttle = class {
   window = 0;
   count = 0;
@@ -8083,7 +8165,8 @@ var Throttle = class {
 var EmbedderChannel = class {
   access;
   owner;
-  caller;
+  current;
+  held = [];
   broker;
   header = new Uint8Array(0);
   body;
@@ -8099,12 +8182,24 @@ var EmbedderChannel = class {
   constructor(broker, access2, caller) {
     this.broker = broker;
     this.access = access2;
-    this.caller = caller;
+    this.current = caller;
     this.owner = caller.pid;
   }
   get dispatched() {
     return this.body !== void 0;
   }
+  get caller() {
+    return this.current;
+  }
+  set caller(caller) {
+    this.current = caller;
+    const held = this.held;
+    this.held = [];
+    for (const line of held) this.tell(line);
+  }
+  tell(line) {
+    if (!this.current.progress(line) && this.held.length < HELD_MAX) this.held.push(line);
+  }
   fail(err) {
     this.failure ??= embedderFailure(err);
     return this.failure;
@@ -8121,7 +8216,7 @@ var EmbedderChannel = class {
     this.body = body;
     const prefix = this.caller.name;
     const progress = (line) => {
-      if (this.throttle.allow(Date.now())) this.caller.progress(`${prefix}: ${lineOf2(line)}`);
+      if (this.throttle.allow(Date.now())) this.tell(`${prefix}: ${lineOf2(line)}`);
     };
     const asked = Promise.resolve().then(
       () => hook.handle({
@@ -10724,8 +10819,8 @@ async function guarded(entry, path, req) {
     const paths = await guard(g, path, req, entry.cwd);
     return { paths };
   } catch (err) {
-    const refusal2 = err.code === "EACCES";
-    const refused3 = req.op === "exists" && refusal2 ? json2(false) : toErrno(err);
+    const refusal3 = err.code === "EACCES";
+    const refused3 = req.op === "exists" && refusal3 ? json2(false) : toErrno(err);
     return { refused: refused3 };
   }
 }
@@ -17502,19 +17597,6 @@ var KernelDgram = class {
   }
 };
 
-// src/kernel/net/datagram-wire.ts
-function encodeReceived(got) {
-  const host = new TextEncoder().encode(got.host);
-  const out = new Uint8Array(4 + host.length + got.bytes.length);
-  const view2 = new DataView(out.buffer);
-  view2.setUint8(0, (got.truncated ? 1 : 0) | (got.unix ? 2 : 0));
-  view2.setUint16(1, got.port);
-  view2.setUint8(3, host.length);
-  out.set(host, 4);
-  out.set(got.bytes, 4 + host.length);
-  return out;
-}
-
 // src/kernel/net/sealed-binding.ts
 var HASH_OF_SIGNATURE = {
   "1.2.840.113549.1.1.4": "SHA-256",
@@ -19234,6 +19316,120 @@ function isDatagram(file) {
   return file instanceof KernelDgram || file instanceof UnixDgram;
 }
 
+// src/kernel/fd-rights.ts
+var RIGHTS_MAX = 253;
+var RIGHTS_IN_FLIGHT = 1024;
+var RECEIVE_MAX = 1024 * 1024;
+var CTRUNC = 1;
+var RightsMark = class {
+  at;
+  passed;
+  constructor(at, passed) {
+    this.at = at;
+    this.passed = passed;
+  }
+  get count() {
+    return this.passed.length;
+  }
+  drop() {
+    for (const { file } of this.passed) void Promise.resolve(file.release()).catch(() => void 0);
+  }
+};
+function refusal(file) {
+  if (file instanceof KernelSocket) {
+    if (file.domain === "unix") return "EOPNOTSUPP";
+    return file.secured ? "EPERM" : void 0;
+  }
+  if (file instanceof UnixDgram) return "EOPNOTSUPP";
+  if (file instanceof EpollFile || file instanceof TlsContext) return "EPERM";
+  return file.sealed || file.clipboard || file.embedder ? "EPERM" : void 0;
+}
+function carrierAt(fds, fd) {
+  const file = fds.get(fd).file;
+  if (!(file instanceof KernelSocket)) {
+    throw new KernelError(file instanceof UnixDgram ? "EOPNOTSUPP" : "ENOTSOCK");
+  }
+  return file;
+}
+async function sendRights(fds, req, signal) {
+  const carrier = carrierAt(fds, req.fd);
+  if (req.nonblock && !carrier.poll().writable) throw new KernelError("EAGAIN");
+  if (req.nonblock) signal = AbortSignal.abort();
+  if (req.fds.length === 0) return carrier.write(req.body, signal);
+  if (req.fds.length > RIGHTS_MAX || req.body.length === 0) throw new KernelError("EINVAL");
+  const passed = req.fds.map((fd) => ({ file: fds.get(fd), status: fds.statusFlags(fd) }));
+  for (const { file } of passed) {
+    const errno3 = refusal(file.file);
+    if (errno3) throw new KernelError(errno3, "this descriptor cannot be passed");
+  }
+  for (const { file } of passed) file.retain();
+  let handed2 = false;
+  const mark = (at, inFlight) => {
+    if (inFlight + passed.length > RIGHTS_IN_FLIGHT) {
+      throw new KernelError("EMFILE", "too many descriptors in flight");
+    }
+    handed2 = true;
+    return new RightsMark(at, passed);
+  };
+  try {
+    return await carrier.sendRights(req.body, mark, req.nonblock, signal);
+  } catch (err) {
+    if (!handed2) new RightsMark(0, passed).drop();
+    throw err;
+  }
+}
+function installed(fds, passed, cloexec) {
+  let fd;
+  try {
+    fd = fds.install(passed.file);
+  } catch {
+    return void 0;
+  }
+  if (passed.status !== void 0) fds.setStatusFlags(fd, passed.status);
+  if (cloexec) fds.setCloseOnExec(fd);
+  return fd;
+}
+function encodeRights(bytes, got, truncated2) {
+  const out = new Uint8Array(8 + got.length * 4 + bytes.length);
+  const view2 = new DataView(out.buffer);
+  view2.setUint32(0, got.length, true);
+  view2.setUint32(4, truncated2 ? CTRUNC : 0, true);
+  for (const [i, fd] of got.entries()) view2.setUint32(8 + i * 4, fd, true);
+  out.set(bytes, 8 + got.length * 4);
+  return out;
+}
+async function receiveRights(fds, req, signal) {
+  const carrier = carrierAt(fds, req.fd);
+  const { bytes, marks } = await carrier.receiveRights(
+    Math.min(req.max, RECEIVE_MAX),
+    req.nonblock,
+    signal
+  );
+  const got = [];
+  let truncated2 = false;
+  for (const mark of marks) {
+    for (const passed of mark.passed) {
+      const fd = installed(fds, passed, req.cloexec);
+      if (fd === void 0) truncated2 = true;
+      else got.push(fd);
+    }
+  }
+  return encodeRights(bytes, got, truncated2);
+}
+
+// src/kernel/net/datagram-wire.ts
+function encodeReceived(got) {
+  const host = new TextEncoder().encode(got.host);
+  const out = new Uint8Array(4 + host.length + got.bytes.length);
+  const view2 = new DataView(out.buffer);
+  view2.setUint8(0, (got.truncated ? 1 : 0) | (got.unix ? 2 : 0));
+  view2.setUint16(1, got.port);
+  view2.setUint8(3, host.length);
+  out.set(host, 4);
+  out.set(got.bytes, 4 + host.length);
+  return out;
+}
+
 // src/kernel/socket-syscalls.ts
 var SOCKET_OPS = [
   "sock-open",
@@ -19244,6 +19440,8 @@ var SOCKET_OPS = [
   "sock-connect",
   "sock-shutdown",
   "sock-reset",
+  "sock-sendmsg",
+  "sock-recvmsg",
   "sock-name",
   "sock-getopt",
   "sock-setopt",
@@ -19314,6 +19512,10 @@ async function socketSyscall(req, proc) {
     case "sock-reset":
       socketAt(fds, req.fd).resetOnClose();
       return ok3();
+    case "sock-sendmsg":
+      return ok3(await sendRights(fds, req, proc.blocking()));
+    case "sock-recvmsg":
+      return { ok: true, kind: "bytes", bytes: await receiveRights(fds, req, proc.blocking()) };
     case "sock-name": {
       const socket = anySocketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;
@@ -21193,7 +21395,11 @@ var WasmProcess = class {
       client: session.client,
       tags: this.options.embedder?.tagsOf(this.pid),
       name: name2,
-      progress: (line) => void this.complainLine(line),
+      progress: (line) => {
+        if (!this.fds.has(2)) return false;
+        void this.complainLine(line);
+        return true;
+      },
       closing: () => AbortSignal.any([this.interrupt.signal, this.gone.signal])
     };
   }
@@ -24168,7 +24374,7 @@ function enableDnsStub(net, stub) {
 
 // src/kernel/net/redirect-hops.ts
 var HELD_MS = 3e4;
-var HELD_MAX = 64;
+var HELD_MAX2 = 64;
 var HELD_PER_OWNER = 8;
 var MATCHED = ["range", "if-none-match", "if-modified-since", "if-range", "accept-encoding"];
 var KERNEL = -1;
@@ -24214,7 +24420,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
     drop(key);
     const mine = [...held.keys()].filter((k) => held.get(k)?.owner === chain2.owner);
     if (mine.length >= HELD_PER_OWNER) drop(mine[0]);
-    if (held.size >= HELD_MAX) drop(held.keys().next().value);
+    if (held.size >= HELD_MAX2) drop(held.keys().next().value);
     const timer = setTimeout(() => drop(key), heldMs);
     timer.unref?.();
     held.set(key, { ...chain2, timer });
@@ -33106,7 +33312,7 @@ function allows(policy, port) {
   if (Array.isArray(policy)) return policy.includes(port);
   return policy === true && !DEVTOOLS_PORTS.includes(port);
 }
-function refusal(url, address, place) {
+function refusal2(url, address, place) {
   const where = `${address}:${portOf(url)}`;
   const why = place === "link-local" ? `nodeTransport refuses link-local ${where}` : `nodeTransport refuses the host's loopback ${where} (see nodeTransport({ hostLoopback }))`;
   return Object.assign(new Error(why), { status: 403, code: "EACCES" });
@@ -33128,7 +33334,7 @@ async function checkDestination(target, policy, resolve2 = resolveHost) {
     const place = placeOf(address);
     if (!place) continue;
     if (place === "loopback" && allows(policy, portOf(url))) continue;
-    throw refusal(url, address, place);
+    throw refusal2(url, address, place);
   }
 }
 function guarded2(check, signal) {