@ai-ecoverse/slicc-kernel 1.173.1 → 1.173.3

package/dist/kernel-worker.js

@@ -8740,7 +8740,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.173.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.173.3" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -31749,10 +31749,66 @@ var RULE = new RegExp(
 );
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN3 = /^[A-Za-z0-9_@%+=:,./-]+$/;
+var CONTROL = /[\0-\x1f\x7f]/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
+var DENIED2 = "sudo: approval denied";
+var DENIAL_MAX = 500;
+var ABORTED = /* @__PURE__ */ Symbol("aborted");
+function hasControl(text) {
+  return CONTROL.test(text);
+}
+function withoutControl(text) {
+  return text.replace(CONTROL, (ch) => {
+    const n = ch.charCodeAt(0);
+    if (n === 9) return "\\t";
+    if (n === 10) return "\\n";
+    if (n === 13) return "\\r";
+    return `\\x${n.toString(16).padStart(2, "0")}`;
+  });
+}
 function failed3(errno3, error) {
   return { error, errno: errno3 };
 }
+function denialText(answer2) {
+  try {
+    if (typeof answer2 !== "object" || answer2 === null) return DENIED2;
+    const { answer: kind, message: message3 } = answer2;
+    if (kind !== "deny" || typeof message3 !== "string") return DENIED2;
+    const chars = [
+      ...message3.replace(/[\t\n\v\f\r\u0085\u2028\u2029]+/g, " ").replace(/\p{Cc}/gu, "").trimEnd()
+    ];
+    const text = chars.length > DENIAL_MAX ? `${chars.slice(0, DENIAL_MAX - 1).join("")}\u2026` : chars.join("");
+    return text.startsWith("sudo: ") && text.slice(6).trim() !== "" ? text : DENIED2;
+  } catch {
+    return DENIED2;
+  }
+}
+async function answerOf2(approve, req, signal) {
+  let reply;
+  let cut;
+  const snapshot = () => reply === void 0 ? Promise.resolve(ABORTED) : Promise.race([reply, Promise.resolve(ABORTED)]).catch(() => "deny");
+  const aborted3 = new Promise(
+    (resolve2) => signal.addEventListener(
+      "abort",
+      () => {
+        cut = snapshot();
+        resolve2();
+      },
+      { once: true }
+    )
+  );
+  try {
+    reply = Promise.resolve(approve(req, { signal }));
+  } catch {
+    reply = Promise.resolve("deny");
+  }
+  try {
+    const answer2 = await Promise.race([reply, aborted3]);
+    return cut === void 0 ? answer2 : await cut;
+  } catch {
+    return cut === void 0 ? "deny" : await cut;
+  }
+}
 function unescaped(double) {
   return double.replace(/\\(["\\$`])/g, "$1");
 }
@@ -31775,7 +31831,8 @@ function splitWords(text) {
   return words2;
 }
 function quoteWord(word) {
-  return PLAIN3.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
+  const text = hasControl(word) ? withoutControl(word) : word;
+  return PLAIN3.test(text) ? text : `'${text.replaceAll("'", `'\\''`)}'`;
 }
 function addPart(word, part) {
   const last = word.length - 1;
@@ -31911,7 +31968,7 @@ function recordedBare(line, file, rule) {
   const head = `NOPASSWD ${rule.who} (${rule.target}) `;
   const cmnd = `Cmnd ${quoteWord(rule.cmnd.path)}`;
   const cwd = rule.cwd === void 0 ? "" : `Cwd ${quoteWord(rule.cwd)} `;
-  return line === `${head}${cwd}${cmnd}`;
+  return line.trimEnd() === `${head}${cwd}${cmnd}`;
 }
 function flags(parsed2, arg, next3) {
   for (let j = 1; j < arg.length; j++) {
@@ -32142,7 +32199,7 @@ ${lines2}
   }
   async ask(caller, self, target, argv, path, cwd, requester) {
     const { approve } = this.o;
-    if (!approve || requester.aborted) return failed3("EACCES", "sudo: approval denied");
+    if (!approve || requester.aborted) return failed3("EACCES", DENIED2);
     const createdAt = Date.now();
     const timeout = this.o.timeoutMs ?? SUDO_TIMEOUT_MS;
     const req = {
@@ -32165,16 +32222,14 @@ ${lines2}
     const timer = setTimeout(() => control.abort("expired"), timeout);
     const withdraw = () => control.abort("withdrawn");
     requester.addEventListener("abort", withdraw, { once: true });
-    const aborted3 = new Promise(
-      (resolve2) => control.signal.addEventListener("abort", () => resolve2("aborted"), { once: true })
-    );
+    const ended = () => control.signal.reason === "expired" ? failed3("ETIMEDOUT", "sudo: the request expired") : failed3("EINTR", "sudo: the request was withdrawn");
     try {
-      const answered2 = Promise.resolve().then(() => approve(req, { signal: control.signal })).catch(() => "deny");
-      const answer2 = await Promise.race([answered2, aborted3]);
-      if (answer2 === "aborted" || control.signal.aborted) {
-        return control.signal.reason === "expired" ? failed3("ETIMEDOUT", "sudo: the request expired") : failed3("EINTR", "sudo: the request was withdrawn");
+      const answer2 = await answerOf2(approve, req, control.signal);
+      if (answer2 === ABORTED) return ended();
+      if (answer2 === "once" || answer2 === "always") {
+        return control.signal.aborted ? ended() : answer2;
       }
-      return answer2 === "once" || answer2 === "always" ? answer2 : failed3("EACCES", "sudo: approval denied");
+      return failed3("EACCES", denialText(answer2));
     } finally {
       clearTimeout(timer);
       requester.removeEventListener("abort", withdraw);
@@ -32184,6 +32239,7 @@ ${lines2}
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
     if (!NAME3.test(self.name)) return false;
+    if (hasControl(cwd) || argv.some(hasControl)) return false;
     try {
       await this.provision();
       if (!await this.trusted(SUDOERS_D)) return false;