@ai-ecoverse/slicc-kernel 1.164.0 → 1.164.1

package/README.md

@@ -538,7 +538,7 @@ The module's default export (or its `main` export) is called with a context and
       - A connection's `tls` is `{ path: 'kernel', protocol, cipher ({ name, standardName, version }, as a client's; [#1500](https://github.com/ai-ecoverse/slicc-kernel/issues/1500)), alpnProtocol, servername (the SNI the client sent, or ''), authorized (whether a client certificate verified), authorizationError?, peerCertificates (the client's chain) }`.
       - On a `listen({ tls })` listener, the kernel handshakes accepted connections concurrently, from the first `accept` on, and `accept` (and `for await`) yields each as its handshake finishes, so a client that connects and stays silent doesn't hold up the next. It holds at most `backlog` (up to 64) connections in a handshake or handshaken but not yet taken; beyond that it stops accepting, leaving the rest in the kernel's backlog, until one finishes or is taken. A connection whose handshake fails is closed and never yielded. `secure()` rejects instead.
       - `handshakeTimeout` (milliseconds, 120000 by default, as Node's) ends a handshake that hasn't finished with `ERR_TLS_HANDSHAKE_TIMEOUT`. A listener closes that connection. After `secure()` rejects, the connection stays open and is the program's to answer or close, as with Node's `tlsClientError` ([#1504](https://github.com/ai-ecoverse/slicc-kernel/issues/1504)).
-      - A client that sends a plain HTTP request instead of a ClientHello fails the handshake with `ERR_SSL_HTTP_REQUEST`, as in Node. A client that resets during the handshake fails it with `ECONNRESET` and `read ECONNRESET`, as Node's server reports it, and one that closes with `ECONNRESET` and `the client closed the connection during the TLS handshake` ([#1578](https://github.com/ai-ecoverse/slicc-kernel/issues/1578)). A loopback TLS client whose server resets before or during the handshake fails the same way, with `read ECONNRESET`, not `EPIPE` ([#1611](https://github.com/ai-ecoverse/slicc-kernel/issues/1611)). A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.
+      - A client that sends a plain HTTP request instead of a ClientHello fails the handshake with `ERR_SSL_HTTP_REQUEST`, as in Node. A client that resets during the handshake fails it with `ECONNRESET` and `read ECONNRESET`, as Node's server reports it, and one that closes with `ECONNRESET` and `the client closed the connection during the TLS handshake` ([#1578](https://github.com/ai-ecoverse/slicc-kernel/issues/1578)). A loopback TLS client whose server resets before its ClientHello goes out fails with `ECONNRESET` and `connect ECONNRESET <host>:<port>` (only while nothing has been read from the server), and one reset on or after its ClientHello with `read ECONNRESET`, as Node 22 tells them apart, not `EPIPE` ([#1611](https://github.com/ai-ecoverse/slicc-kernel/issues/1611), [#1624](https://github.com/ai-ecoverse/slicc-kernel/issues/1624)). A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.
       - **Choosing per connection** ([#1501](https://github.com/ai-ecoverse/slicc-kernel/issues/1501), [#1502](https://github.com/ai-ecoverse/slicc-kernel/issues/1502), tls-engine 4.2.0-9's `TLS_SERVER_SELECT`), for Node's `SNICallback`, `addContext` and `ALPNCallback`: `tls.select({ servername, protocols })` on `listen` or `secure` is called once the client's ClientHello is in, with the SNI (or `''`) and the protocols the client offers. It returns (or resolves with) `{ context, alpn }` or `{ refuse }`:
         - `context` is a certificate from `net.tlsContext({ cert, key, passphrase })` (or its `fd`); without it the listener's own `cert` serves, and with `select` that one is optional. `alpn` is one of `protocols`, or none; another is `EINVAL` and refuses the handshake. `select` and a fixed `alpn` list together are `EINVAL` (`ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS`), as in Node.
         - `refuse` sends a fatal alert and ends the handshake: `'unrecognized_name'` (112), `'no_application_protocol'` (120), `'handshake_failure'` (40), `'access_denied'` (49) or `'internal_error'` (80), or the number. A `select` that throws refuses with 40, and one that doesn't answer within `handshakeTimeout` times the handshake out. On a listener the connection is dropped and the listener keeps accepting; `secure()` rejects with the error.

package/dist/kernel-worker.js

@@ -6458,6 +6458,10 @@ var KernelSocket = class _KernelSocket {
     if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
+  connectReset() {
+    const at = this.peer?.family === "inet" ? ` ${this.peer.host}:${this.peer.port}` : "";
+    return `connect ECONNRESET${at}`;
+  }
   drained(rx) {
     if (this.refused && rx.buffered === 0) throw this.refused;
   }
@@ -6641,6 +6645,7 @@ var KernelSocket = class _KernelSocket {
     signal.throwIfAborted();
     this.served = true;
     let handshaking = true;
+    let heard = false;
     const view2 = {
       localAddr: "",
       remoteAddr: "",
@@ -6648,10 +6653,12 @@ var KernelSocket = class _KernelSocket {
         const bytes = await raw2.rx.read(SERVE_CHUNK, handshaking ? signal : void 0).catch(() => EMPTY);
         if (bytes.length === 0 && this.refused)
           throw new KernelError("ECONNRESET", "read ECONNRESET");
+        heard ||= bytes.length > 0;
         return bytes.length > 0 ? bytes : null;
       },
       write: (bytes) => raw2.tx.write(bytes).catch((err) => {
-        throw this.refused ? new KernelError("ECONNRESET", "read ECONNRESET") : err;
+        if (!this.refused) throw err;
+        throw new KernelError("ECONNRESET", heard ? "read ECONNRESET" : this.connectReset());
       }),
       closeWrite: () => raw2.tx.closeWrite(),
       close: () => {
@@ -8437,7 +8444,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.164.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.164.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC