@ai-ecoverse/slicc-kernel 1.162.1 → 1.163.0

package/README.md

@@ -422,6 +422,11 @@ The module's default export (or its `main` export) is called with a context and
 - `asyncContext` (the Node entry only; absent in a browser, so a runtime feature-detects it; #1350, slicc-jsh#375) is `{ run(store, fn, ...args), getStore(), enterWith(store) }`, backed by one host `AsyncLocalStorage` the process worker makes for each program, since a program can't import `node:async_hooks` and the realm has no promise hooks of its own. A store follows the program's native `await` continuations and promise jobs, as an `AsyncLocalStorage` does in Node, so Next.js, OpenTelemetry and request-context loggers keep their context. Each process and each thread has its own. Only these three frozen functions on a frozen null-prototype object reach the program: they hold the host storage in a closure, `run` calls the program's function with its own arguments, and nothing they return or expose is a host object.
 - `sync.runScript(source, { filename })` (#1541, slicc-jsh#977) runs `source` as a classic script in the program's own global scope, synchronously, as Node's `vm.runInThisContext` does: `let`, `const` and `class` land in the global lexical scope, `var` (in strict code too) on the global object, and stack frames are named `filename` (default `[eval]`). On the Node entry it returns `{ value, completion: true }` with the completion value, and an error the script throws is thrown as it is. In a browser, where process workers are module workers with no synchronous classic-script path, it returns `undefined`, so a runtime feature-detects it with `ctx.sync.runScript('1') !== undefined`. A non-string `source` or `filename` is a `TypeError` everywhere. The script sees exactly the globals the program sees, `import()` inside it is refused, and a `var`, function or `let` declaration can't replace a global the program can't assign: a non-configurable one stays as it is, and the only configurable, non-assignable ones (`crypto`, `navigator`) are ones the program can already redefine with `Object.defineProperty`.
 - `sync.promiseState(promise)` (#1531, slicc-jsh#974) tells a native promise's state synchronously, as Node's `util.inspect` does: `{ state: 'pending' | 'fulfilled' | 'rejected', value }`. `value` is the very fulfillment value or rejection reason (`undefined` while pending), and probing doesn't handle a rejection. On the Node entry it reads the promise through an inspector session the process worker opens on first use, one per process and per thread; the probe runs no program code. Anything that isn't a native promise (a thenable, a proxy) is a `TypeError`. It answers `undefined` in a browser, where a worker has no inspector, on a Node built without one, once a program has changed `Object.prototype` or put a `toJSON` on a built-in prototype, and when the global object can't take a new property (`Object.preventExtensions(globalThis)`, or a frozen global).
+- `sync.setStackFormatter(fn | null)` (#1612, slicc-jsh#1091) is Node only, so check it with `typeof ctx.sync.setStackFormatter === 'function'`. It returns the previous formatter, and `null` removes it.
+  - **When `fn` runs:** it formats an error's `.stack` the way V8's prepare-stack-trace callback does, as `fn(error, callSites)` returning the string. It runs only when no own `Error.prepareStackTrace` function is set, as in Node, so `Error.prepareStackTrace` stays an ordinary property: after `delete` it's `undefined`, `Object.getPrototypeOf(Error)` stays `Function.prototype`, and an assignment to a frozen subclass throws in strict mode.
+  - **What `fn` gets:** a fresh array of V8 CallSites holding only the program's own frames (its modules, `data:` imports, `sync.runScript` scripts and code they `eval`), `node:` frames and native frames. Kernel frames are dropped by script identity, so a script named like a kernel file doesn't let them through, and so are host files. A program's strict frames give `getFunction()` and `getThis()` as `undefined`.
+  - **Fallback:** if `fn` throws or returns a non-string, or an error is formatted while `fn` runs, the default stack is used.
+  - **How it works:** process workers start with `--expose-internals`, so the worker can install the formatter before the lockdown. Host flags a worker refuses are dropped. If the worker still can't start with the flag, the method is absent. Every `internal/*` and `node:internal/*` module stays refused to programs, as do `node:module` and `node:worker_threads`.
 - **Kernel frames in a program's stacks** (#1583): on the Node entry, the process worker's bundle names itself `slicc-kernel:/node-process-worker.js` (a `sourceURL`), so the kernel's own frames in an error a program sees (its own errors, a failed `ctx` call, `runScript`) show that name and not the host directory the kernel is installed in. The same holds in `CallSite.toString()` and `getScriptNameOrSourceURL()`, which a program's own `Error.prepareStackTrace` gets; `getFileName()` still returns the bundle's file URL. Line and column numbers are unchanged, so they still point into `dist/node-process-worker.js`. Don't run an embedder with `--enable-source-maps` if program-visible paths matter: Node then maps the kernel's frames back to the absolute paths of its sources. In a browser the frames keep the bundle's URL, because Chrome ignores `sourceURL` in a module worker loaded by URL.
 - `module` (#1598, slicc-jsh#566) is a frozen `{ path }` with the command module's own path in the kernel's file system (e.g. `/usr/lib/node_modules/jsh/dist/jsh.mjs`), so a program can read its package's other files through `ctx.fs` on first use. It's the path the kernel found the package under, with symlinks left as they are (a pnpm-style `node_modules/<name>` link stays in it), and reads the same files through `ctx.fs`. It's a kernel path, never a host one, and a thread gets the same. It's absent for the kernel's built-in programs (`sudo`, `crontab`) and for a program run from inline source with no file.
 - `memory()`, synchronous and without a kernel call, measures the calling isolate: each `thread` answers for its own (#1240, slicc-jsh#397). It returns a fresh plain object of numbers in bytes, each field only where it's measured: `heapUsed`, `heapTotal`, `heapLimit` (V8's heap size limit), `external`, `arrayBuffers` and `rss`. On the Node entry they come from V8's heap statistics and Node's memory usage, through functions the worker captured before its lockdown, so nothing reachable from the program leads back to `process` or `v8`. `rss` is the host process's resident set size, as a Node worker thread reports it in `process.memoryUsage().rss`: it isn't per process, but shared by every process and thread of the kernel, and by any other kernel in that host process (#1563, slicc-jsh#539). In a browser `memory()` answers `{}` for now, with no `rss`.

package/dist/kernel-worker.js

@@ -8437,7 +8437,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.162.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.163.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC

package/dist/node-driver-worker.js

@@ -1420,6 +1420,123 @@ async function hostDriver(start, load) {
 import { isBuiltin, registerHooks } from "node:module";
 import { types } from "node:util";
 
+// src/node-stack.ts
+import { createRequire } from "node:module";
+var apply = Reflect.apply;
+var push = Array.prototype.push;
+var startsWith = String.prototype.startsWith;
+var slice = String.prototype.slice;
+var lastIndexOf = String.prototype.lastIndexOf;
+var indexOf2 = String.prototype.indexOf;
+var setHas = Set.prototype.has;
+var setAdd = Set.prototype.add;
+function internals() {
+  try {
+    const load = createRequire(import.meta.url);
+    const errors = load("internal/errors");
+    const set = errors.setInternalPrepareStackTrace;
+    let fallback = errors.defaultPrepareStackTrace;
+    if (process.sourceMapsEnabled) {
+      fallback = load("internal/source_map/prepare_stack_trace").prepareStackTraceWithSourceMaps;
+    }
+    if (typeof set !== "function" || typeof fallback !== "function") return void 0;
+    return {
+      setInternalPrepareStackTrace: set,
+      fallback
+    };
+  } catch {
+    return void 0;
+  }
+}
+function ownSite() {
+  const saved = Object.getOwnPropertyDescriptor(Error, "prepareStackTrace");
+  try {
+    Object.defineProperty(Error, "prepareStackTrace", {
+      value: (_, sites) => sites[0],
+      configurable: true,
+      writable: true
+    });
+    return new Error().stack;
+  } finally {
+    delete Error.prepareStackTrace;
+    Object.defineProperties(Error, saved ? { prepareStackTrace: saved } : {});
+  }
+}
+var self = ownSite();
+var proto = Object.getPrototypeOf(self);
+var fileOf = proto.getFileName;
+var hashOf = proto.getScriptHash;
+var isEval = proto.isEval;
+var originOf = proto.getEvalOrigin;
+var ownHash = apply(hashOf, self, []);
+var programHashes = /* @__PURE__ */ new Set();
+var programNames = /* @__PURE__ */ new Set();
+function programName(name) {
+  return apply(startsWith, name, ["data:"]) === true || apply(setHas, programNames, [name]) === true;
+}
+function rootOrigin(origin) {
+  let at = origin;
+  while (apply(startsWith, at, ["eval at "]) === true) {
+    const open = apply(indexOf2, at, [" ("]);
+    if (open < 0) return "";
+    let depth = 1;
+    let i = open + 2;
+    for (; i < at.length && depth > 0; i++) {
+      const c = at[i];
+      if (c === "(") depth++;
+      else if (c === ")") depth--;
+    }
+    if (depth !== 0) return "";
+    at = apply(slice, at, [open + 2, i - 1]);
+  }
+  let end = at.length;
+  for (let n = 0; n < 2; n++) {
+    const colon = apply(lastIndexOf, at, [":", end - 1]);
+    if (colon <= 0) break;
+    end = colon;
+  }
+  return apply(slice, at, [0, end]);
+}
+function keptFrame(site) {
+  const hash = apply(hashOf, site, []);
+  if (hash === ownHash) return false;
+  if (apply(isEval, site, []) === true) {
+    const origin = apply(originOf, site, []);
+    return typeof origin === "string" && programName(rootOrigin(origin));
+  }
+  const file = apply(fileOf, site, []);
+  if (typeof file !== "string") return true;
+  if (apply(setHas, programHashes, [hash]) === true) return true;
+  return apply(startsWith, file, ["node:"]) === true || programName(file);
+}
+function keptFrames(trace) {
+  const out = [];
+  for (let i = 0; i < trace.length; i++) {
+    const site = trace[i];
+    if (keptFrame(site)) apply(push, out, [site]);
+  }
+  return out;
+}
+var formatter = null;
+var formatting = false;
+function stackDispatcher(fallback) {
+  return (error, trace) => {
+    const fn = formatter;
+    if (fn === null || formatting) return apply(fallback, void 0, [error, trace]);
+    formatting = true;
+    try {
+      const out = apply(fn, void 0, [error, keptFrames(trace)]);
+      if (typeof out === "string") return out;
+    } catch {
+    } finally {
+      formatting = false;
+    }
+    return apply(fallback, void 0, [error, trace]);
+  };
+}
+var found = internals();
+if (found) found.setInternalPrepareStackTrace(stackDispatcher(found.fallback));
+
 // src/process/js/lockdown.ts
 var BLOCKED_GLOBALS = [
   "XMLHttpRequest",