@ai-ecoverse/slicc-kernel 1.170.2 → 1.170.4

package/dist/node.js

@@ -3695,7 +3695,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.170.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.170.4" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -3964,9 +3964,19 @@ function replacesOf(manifest) {
   if (!Array.isArray(replaces)) return [];
   return replaces.every((name2) => typeof name2 === "string" && PACKAGE_NAME.test(name2)) ? replaces : [];
 }
-async function tierPackages(fs, physical, roots, bins, kernel) {
+async function directInstalls(fs, root) {
+  try {
+    const project = root.slice(0, root.lastIndexOf("/"));
+    const { dependencies } = JSON.parse(await fs.readFile(`${project}/package.json`));
+    return new Set(Object.keys(dependencies ?? {}));
+  } catch {
+    return void 0;
+  }
+}
+async function tierPackages(fs, physical, roots, bins, kernel, global) {
   const out = [];
   for (const root of roots) {
+    const direct = global.has(root) ? await directInstalls(fs, root) : void 0;
     for (const pkg of await packages(fs, root)) {
       let manifest;
       try {
@@ -3978,12 +3988,15 @@ async function tierPackages(fs, physical, roots, bins, kernel) {
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
       const refused3 = engineRefusal(manifest, kernel);
-      const commands = [...own, ...extra];
+      const name2 = pkg.slice(root.length + 1);
+      const dependency = direct?.has(name2) === false;
+      const marks = { ...refused3 ? { refused: refused3 } : {}, ...dependency ? { dependency } : {} };
       out.push({
-        name: pkg.slice(root.length + 1),
+        name: name2,
         pkg,
         replaces: replacesOf(manifest),
-        commands: refused3 ? commands.map((command) => ({ ...command, refused: refused3 })) : commands
+        commands: [...own, ...extra].map((command) => ({ ...command, ...marks })),
+        dependency
       });
     }
   }
@@ -4009,19 +4022,25 @@ function winners(tier) {
   }
   return out;
 }
-async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused3) {
+async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused3, global = /* @__PURE__ */ new Set()) {
   const found = /* @__PURE__ */ new Map();
   const physical = physicalResolver(fs);
   const tiers = (typeof modules === "string" ? [modules] : modules).map(
     (tier) => typeof tier === "string" ? [tier] : tier
   );
-  for (const [index, roots] of tiers.entries()) {
-    const tier = await tierPackages(fs, physical, roots, index >= binsFrom, kernel);
-    if (refused3) refused3.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
+  const take = async (tier) => {
     for (const [name2, { pkg, command }] of winners(tier)) {
       if (!found.has(name2)) found.set(name2, await withPackagePaths(fs, pkg, command));
     }
+  };
+  const dependencies = [];
+  for (const [index, roots] of tiers.entries()) {
+    const tier = await tierPackages(fs, physical, roots, index >= binsFrom, kernel, global);
+    if (refused3) refused3.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
+    await take(tier.filter((entry) => !entry.dependency));
+    dependencies.push(tier.filter((entry) => entry.dependency));
   }
+  for (const tier of dependencies) await take(tier);
   if (!found.has("sh") && found.has("bash")) {
     found.set("sh", { ...found.get("bash"), name: "sh", argv0: "sh" });
   }
@@ -5583,6 +5602,78 @@ var CronService = class {
   }
 };
 
+// src/kernel/net/placeholder-floor.ts
+var PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/;
+var ESCAPE = /%([0-9a-f]{2})/gi;
+var BASIC = /\bbasic\b(.*)/is;
+var PERCENT_LAYERS = 8;
+var BASE64_GROUP = 4;
+var PLACEHOLDER_REFUSED = "refused: this request has a sealed placeholder in its URL, a header or a Basic credential, and nothing fills it, so it was not sent";
+var PlaceholderRefused = class extends Error {
+  status = 403;
+  code = "EACCES";
+  constructor() {
+    super(PLACEHOLDER_REFUSED);
+  }
+};
+function carries(text) {
+  let layer = text;
+  for (let i = 0; i < PERCENT_LAYERS; i++) {
+    if (PLACEHOLDER.test(layer)) return true;
+    const next3 = layer.replace(
+      ESCAPE,
+      (_, hex4) => String.fromCharCode(Number.parseInt(hex4, 16))
+    );
+    if (next3 === layer) return false;
+    layer = next3;
+  }
+  return PLACEHOLDER.test(layer);
+}
+function basicCarries(value2) {
+  const credential = BASIC.exec(value2)?.[1];
+  if (credential === void 0) return false;
+  const letters = credential.replace(/[^A-Za-z0-9+/_-]/g, "").replaceAll("-", "+").replaceAll("_", "/");
+  for (let shift = 0; shift < BASE64_GROUP; shift++) {
+    const part = letters.slice(shift);
+    const whole = part.length % BASE64_GROUP === 1 ? part.slice(0, -1) : part;
+    if (carries(atob(whole))) return true;
+  }
+  return false;
+}
+function headersCarry(headers) {
+  return headers.some(
+    ([name2, value2]) => carries(name2.toLowerCase()) || carries(value2) || basicCarries(value2)
+  );
+}
+function urlCarries(url) {
+  return carries(url) || URL.canParse(url) && carries(new URL(url).href);
+}
+function refuse(request) {
+  if (urlCarries(request.url) || headersCarry(request.headers)) throw new PlaceholderRefused();
+}
+function refuseSocket(request) {
+  refuse(request);
+  if (request.protocols.some(carries)) throw new PlaceholderRefused();
+}
+function placeholderFloor(inner) {
+  const open = inner.websocket?.bind(inner);
+  return {
+    get traits() {
+      return inner.traits;
+    },
+    ...open ? {
+      websocket: async (request) => {
+        refuseSocket(request);
+        return open(request);
+      }
+    } : {},
+    async fetch(request, owner) {
+      refuse(request);
+      return inner.fetch(request, owner);
+    }
+  };
+}
+
 // src/kernel/net/ws-queue.ts
 var INBOUND_LIMIT = 16 * 1024 * 1024;
 var MESSAGE_LIMIT = 64 * 1024 * 1024;
@@ -6157,7 +6248,8 @@ var RealmProxy = class {
       });
     } catch (e) {
       waiting.abort();
-      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+      const status = e instanceof PlaceholderRefused ? e.status : 502;
+      throw new HttpError(status, e instanceof Error ? e.message : String(e));
     }
     ctx.idle.ms = Number.POSITIVE_INFINITY;
     try {
@@ -6371,7 +6463,7 @@ async function relay(socket, conn) {
 // src/fs/attest.ts
 var ATTEST_MAX = 1024 * 1024;
 var UNOWNED = 1e3;
-function refuse(code, path, why) {
+function refuse2(code, path, why) {
   throw Object.assign(new Error(`attest ${path}: ${why}`), { code });
 }
 function chainOf(path) {
@@ -6413,11 +6505,11 @@ async function trustedParents(fs, path, o) {
   const parents = [];
   for (const dir of chainOf(path).slice(0, -1)) {
     const st = await fs.lstat(dir);
-    if (st.isSymbolicLink) refuse("EACCES", path, `${dir} is a symlink`);
-    if (!st.isDirectory) refuse("ENOTDIR", path, `${dir} is not a directory`);
+    if (st.isSymbolicLink) refuse2("EACCES", path, `${dir} is a symlink`);
+    if (!st.isDirectory) refuse2("ENOTDIR", path, `${dir} is not a directory`);
     const perm = owned(dir, st);
     if (o.users !== "off" && (perm.uid !== 0 || (perm.mode & 18) !== 0)) {
-      refuse("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
+      refuse2("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
     }
     parents.push(perm);
   }
@@ -6425,27 +6517,27 @@ async function trustedParents(fs, path, o) {
 }
 async function attest(fs, asked, o) {
   if (typeof asked !== "string" || !asked.startsWith("/")) {
-    refuse("EINVAL", String(asked), "not an absolute path");
+    refuse2("EINVAL", String(asked), "not an absolute path");
   }
   const path = normalizePath(asked);
   const mount = o.mounts.find((target) => {
     const at = normalizePath(target);
     return at === "/" || under(path, at);
   });
-  if (mount !== void 0) refuse("EACCES", path, `under the mount ${mount}`);
+  if (mount !== void 0) refuse2("EACCES", path, `under the mount ${mount}`);
   const parents = await trustedParents(fs, path, o);
   for (let tries = 0; ; tries++) {
     const before = await fs.lstat(path);
-    if (before.isSymbolicLink) refuse("EACCES", path, "is a symlink");
+    if (before.isSymbolicLink) refuse2("EACCES", path, "is a symlink");
     if (!before.isFile)
-      refuse(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
-    if (before.size > ATTEST_MAX) refuse("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
+      refuse2(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
+    if (before.size > ATTEST_MAX) refuse2("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
       return attested(path, after, bytes, await sha256(bytes), o, parents);
     }
-    if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
+    if (tries >= 1) refuse2("EAGAIN", path, "changed while it was read");
   }
 }
 var WATCH_DEBOUNCE_MS = 50;
@@ -11683,7 +11775,7 @@ function encodeSabResult(result) {
           message: result.message,
           ...result.direct ? { direct: true } : {},
           ...result.dev !== void 0 ? { dev: result.dev } : {},
-          ...result.detail === "transport" ? { detail: result.detail } : {}
+          ...result.detail ? { detail: result.detail } : {}
         })
       )
     };
@@ -15097,23 +15189,29 @@ var HttpHandles = class {
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
       entry.upload?.cancel();
-      const text = message2(e);
-      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
-      const status = e.status;
-      if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
-        const code = codeOf2(e);
-        const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
-        const failed3 = e.detail === "transport";
-        return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
-      }
-      entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
-      return this.headOf(handle, req.url, {
-        status,
-        statusText: "",
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      });
+      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: message2(e) };
+      return this.failure(handle, req, e, entry);
     }
   }
+  failure(handle, req, e, entry) {
+    const text = message2(e);
+    if (e instanceof PlaceholderRefused) {
+      return { ok: false, errno: e.code, message: text, detail: "placeholder" };
+    }
+    const status = e.status;
+    if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
+      const code = codeOf2(e);
+      const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
+      const failed3 = e.detail === "transport";
+      return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
+    }
+    entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
+    return this.headOf(handle, req.url, {
+      status,
+      statusText: "",
+      headers: [["content-type", "text/plain; charset=utf-8"]]
+    });
+  }
   headOf(handle, url, response) {
     const { status, statusText, headers } = response;
     return { ok: true, kind: "json", json: { handle, status, statusText, url, headers } };
@@ -18211,7 +18309,7 @@ var HEAD_MAX = 16 * 1024;
 var ANY_PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/g;
 var REQUEST_LINE2 = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.[01]$/;
 var HEADER_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*?)[ \t]*$/;
-var BASIC = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
+var BASIC2 = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
 var encoder8 = new TextEncoder();
 function binary(text) {
   let out = "";
@@ -18227,7 +18325,7 @@ function sniffHttp1(start2) {
   return "no";
 }
 function basicOf(value2) {
-  const m = BASIC.exec(value2);
+  const m = BASIC2.exec(value2);
   if (!m) return void 0;
   try {
     return { scheme: m[1], decoded: atob(m[2]) };
@@ -25235,7 +25333,8 @@ function replayingHops(inner, heldMs = HELD_MS) {
       return { ...inner.traits, manualRedirects: true };
     },
     ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
-    async fetch(request, owner = KERNEL) {
+    async fetch(request, caller) {
+      const owner = caller ?? KERNEL;
       const key = keyOf3(owner, request.method, request.url);
       const waiting = held.get(key);
       if (waiting && waiting.fingerprint === fingerprint(request.headers)) {
@@ -25244,7 +25343,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
         return replay(waiting);
       }
       if (waiting) drop(key);
-      const response = await inner.fetch(request);
+      const response = await inner.fetch(request, caller);
       if (!response.redirects?.length) return response;
       return replay({
         owner,
@@ -30971,7 +31070,7 @@ var Launcher = class {
       ...options.env
     };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
-    this.transport = replayingHops(options.transport ?? missingTransport());
+    this.transport = placeholderFloor(replayingHops(options.transport ?? missingTransport()));
     this.announcedTraits = JSON.stringify(this.transport.traits);
     this.uplink = options.uplink;
     this.routes = new Routes(options.uplink?.traits.ipv6 === true);
@@ -31132,7 +31231,8 @@ var Launcher = class {
           tiers,
           tiers.length - appended2.length,
           void 0,
-          refused3
+          refused3,
+          await this.globalRoots(scope)
         );
         this.refusedOf.set(commands, refused3.map(refusing));
         return commands;
@@ -31157,11 +31257,31 @@ var Launcher = class {
   ownCommands(scope) {
     let found = this.ownCatalogs.get(scope);
     if (!found) {
-      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => new Set(commands.keys()));
+      found = this.ownCatalog(scope);
       this.ownCatalogs.set(scope, found);
     }
     return found;
   }
+  async ownCatalog(scope) {
+    const roots = await pnpmGlobalRoots(this.base, scope);
+    const own = await scanCommands(
+      this.scanned,
+      roots,
+      void 0,
+      void 0,
+      void 0,
+      new Set(roots)
+    );
+    const system = await this.commands();
+    return new Set(
+      [...own.values()].filter((command) => !command.dependency || !system.has(command.name)).map((command) => command.name)
+    );
+  }
+  async globalRoots(scope) {
+    const homes = scope ? [scope, this.pnpmHome] : [this.pnpmHome];
+    const roots = await Promise.all(homes.map((home) => pnpmGlobalRoots(this.base, home)));
+    return new Set(roots.flat());
+  }
   interpreters(scope = "") {
     let found = this.binfmts.get(scope);
     if (!found) {