@ai-ecoverse/slicc-kernel 1.174.2 → 1.175.0

package/dist/process-worker.js

@@ -3118,7 +3118,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.174.2" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.175.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/types/index.d.ts

@@ -29,7 +29,7 @@ export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest,
 export type { RouteTable } from './kernel/net/routes.js';
 export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { NetworkUplink, ResolveAnswer, ResolveFamily, UplinkTraits, } from './kernel/net/uplink.js';
-export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, } from './kernel/sealed.js';
+export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, SealedRequester, } from './kernel/sealed.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';

package/dist/types/kernel/process.d.ts

@@ -542,6 +542,7 @@ export declare class WasmProcess {
     private stampClipboards;
     connectorStamp(): Promise<SealedCaller>;
     private sealedCaller;
+    private sealedRequester;
     private guarded;
     private ttyOwner;
     private terminalByName;

package/dist/types/kernel/sealed.d.ts

@@ -1,4 +1,5 @@
 import type { UsersMode } from '../fs/types.js';
+import type { SudoStdin } from '../sudo.js';
 import type { Cred } from './cred.js';
 import { TicketBook } from './exec-ticket.js';
 import { type OpenAccess, OpenFile, type PollState } from './fd-table.js';
@@ -8,6 +9,10 @@ import { type SessionAnchorFields, type SessionFields } from './sealed-session.j
 export declare const SEALED_PATH = "/dev/sealed";
 export declare const SEALED_MAX_BYTES: number;
 export declare const SEALED_TIMEOUT_MS = 10000;
+export declare const SEALED_ASK_TIMEOUT_MS = 305000;
+export declare const SEALED_NAME: RegExp;
+export declare const SEALED_NAME_MAX = 128;
+export declare const SEALED_PROMPT_MAX = 200;
 export declare const SEALED_OPS: ReadonlySet<string>;
 export interface SealedCaller {
     pid: number;
@@ -32,7 +37,17 @@ export type SealedRequest = {
 export type SealedHook = (req: SealedRequest, options: {
     signal: AbortSignal;
 }) => Promise<object>;
-export type SealedAbortReason = 'replaced' | 'timeout' | 'withdrawn';
+export type SealedAbortReason = 'expired' | 'replaced' | 'timeout' | 'withdrawn';
+export interface SealedProcessFacts {
+    exe: string;
+    argv: string[];
+    cwd: string;
+    tty: string | null;
+}
+export interface SealedRequester extends SealedProcessFacts {
+    stdin: SudoStdin;
+}
+export type SealedRequesterOf = () => Promise<SealedRequester | undefined>;
 export declare function parseSealed(bytes: Uint8Array): Record<string, unknown>;
 declare class SealedChannel {
     private reply;
@@ -41,7 +56,9 @@ declare class SealedChannel {
     private readonly broker;
     readonly access: OpenAccess;
     constructor(broker: SealedBroker, access: OpenAccess);
-    send(bytes: Uint8Array, caller: SealedCaller, gone: AbortSignal): number;
+    send(bytes: Uint8Array, caller: SealedCaller, gone: AbortSignal, requester?: SealedRequesterOf): number;
+    private asking;
+    private stopped;
     private answer;
     private drop;
     read(max: number, signal?: AbortSignal): Promise<Uint8Array>;
@@ -71,7 +88,9 @@ export declare class SealedBroker {
     readonly tagOf: (pid: number) => readonly string[] | undefined;
     readonly tickets: TicketBook;
     readonly sessions: SessionScrubs;
+    askTimeoutMs: number;
     userOf: (uid: number) => Promise<string | undefined>;
+    factsOf: (pid: number) => Promise<SealedProcessFacts | undefined>;
     constructor(hook: SealedHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => readonly string[] | undefined);
     stamp(ids: {
         pid: number;

package/dist/types/launcher.d.ts

@@ -143,6 +143,7 @@ export interface RunResult {
 }
 interface Target {
     abi: Abi;
+    command?: string;
     glue: string;
     wasm: string;
     argv0: string;
@@ -198,6 +199,8 @@ export declare class Launcher {
     private readonly orphans;
     private readonly described;
     private readonly creds;
+    private readonly programs;
+    private readonly cwdPaths;
     private readonly tags;
     private readonly sessions;
     private readonly tagBases;
@@ -404,6 +407,7 @@ export declare class Launcher {
     private running;
     private decide;
     private heldFor;
+    private processFacts;
     private chdirHeld;
     private forker;
     private keySignal;

package/dist/types/node.d.ts

@@ -28,7 +28,7 @@ export type { ConnectOptions, Ended, KernelGroups, KernelIntegrity, KernelSealed
 export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
 export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
 export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
-export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, } from './kernel/sealed.js';
+export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, SealedRequester, } from './kernel/sealed.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';

package/dist/types/sealed-command.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from './commands.js';
+export declare const SEALED_BIN = "/usr/bin/sealed";
+export declare const SEALED_COMMAND: Command;
+export declare const SEALED_SOURCE = "export default async function sealed(ctx) {\n  const USAGE = \"usage: sealed ask NAME [--prompt TEXT] [--reveal] [--replace]\\n       sealed placeholder NAME\\n       sealed list [--json]\\n\";\n  const NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;\n  const EXIT = { EINVAL: 2, EACCES: 3, EAGAIN: 4, ETIMEDOUT: 124 };\n  const say = (fd, text) => ctx.write(fd, text).catch(() => undefined);\n  const fail = async (status, text) => {\n    await say(2, \"sealed: \" + text + \"\\n\");\n    return status;\n  };\n  const usage = async (text) => {\n    if (text !== undefined) await say(2, \"sealed: \" + text + \"\\n\");\n    await say(2, USAGE);\n    return 2;\n  };\n  const [action, ...args] = ctx.argv.slice(1);\n  if (action === undefined || action === \"-h\" || action === \"--help\") return usage();\n  let name;\n  let prompt;\n  let reveal = false;\n  let replace = false;\n  let asJson = false;\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (action === \"ask\" && arg === \"--prompt\") {\n      prompt = args[++i];\n      if (prompt === undefined) return usage(\"--prompt needs a text\");\n    } else if (action === \"ask\" && arg.startsWith(\"--prompt=\")) prompt = arg.slice(9);\n    else if (action === \"ask\" && arg === \"--reveal\") reveal = true;\n    else if (action === \"ask\" && arg === \"--replace\") replace = true;\n    else if (action === \"list\" && arg === \"--json\") asJson = true;\n    else if (action !== \"list\" && name === undefined && !arg.startsWith(\"-\")) name = arg;\n    else return usage(\"unexpected argument \" + JSON.stringify(arg));\n  }\n  let request;\n  if (action === \"ask\" || action === \"placeholder\") {\n    if (name === undefined) return usage(\"a NAME is needed\");\n    if (name.length > 128 || !NAME.test(name)) return fail(2, JSON.stringify(name) + \" is not a valid name\");\n    if (prompt !== undefined && [...prompt].length > 200) return fail(2, \"the prompt is longer than 200 characters\");\n    request = action === \"ask\"\n      ? { v: 1, op: \"ask\", name, ...(prompt !== undefined ? { prompt } : {}), reveal, replace }\n      : { v: 1, op: \"placeholder\", name };\n  } else if (action === \"list\") request = { v: 1, op: \"list\" };\n  else return usage(\"unknown command \" + JSON.stringify(action));\n  let reply;\n  try {\n    reply = await exchange(request);\n  } catch (err) {\n    const code = err && err.code ? err.code : String(err);\n    return fail(EXIT[code] ?? 1, \"/dev/sealed: \" + code);\n  }\n  if (reply.error !== undefined) {\n    const code = String(reply.error && reply.error.code);\n    const message = reply.error && reply.error.message ? reply.error.message : code;\n    return fail(EXIT[code] ?? 1, (name !== undefined ? name + \": \" : \"\") + message);\n  }\n  const newline = (await ctx.isatty(1).catch(() => false)) ? \"\\n\" : \"\";\n  if (action === \"list\") {\n    const secrets = Array.isArray(reply.secrets) ? reply.secrets : [];\n    if (asJson) {\n      await say(1, JSON.stringify(secrets) + \"\\n\");\n      return 0;\n    }\n    await say(1, secrets.map((s) => s.name + \"\\t\" + s.placeholder + \"\\t\" + s.state + \"\\n\").join(\"\"));\n    return 0;\n  }\n  if (action === \"placeholder\") {\n    if (typeof reply.placeholder !== \"string\") return fail(1, name + \": the vault gave no placeholder\");\n    await say(1, reply.placeholder + newline);\n    return 0;\n  }\n  if (reply.state === \"cancelled\") return fail(1, name + \": cancelled\");\n  if (reply.state === \"expired\") return fail(124, name + \": the request expired\");\n  if (reply.state !== \"done\") return fail(1, name + \": the vault gave no answer\");\n  const out = reveal ? reply.value : reply.placeholder;\n  if (typeof out !== \"string\") return fail(1, name + \": the vault gave no \" + (reveal ? \"value\" : \"placeholder\"));\n  await say(1, out + newline);\n  return 0;\n\n  async function exchange(req) {\n    const file = await ctx.open(\"/dev/sealed\", { read: true, write: true });\n    try {\n      await ctx.write(file.fd, JSON.stringify(req));\n      const parts = [];\n      for (;;) {\n        const chunk = await ctx.read(file.fd, 65536);\n        if (chunk.length === 0) break;\n        parts.push(chunk);\n      }\n      const bytes = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));\n      let at = 0;\n      for (const part of parts) {\n        bytes.set(part, at);\n        at += part.length;\n        part.fill(0);\n      }\n      const text = new TextDecoder().decode(bytes);\n      bytes.fill(0);\n      const parsed = JSON.parse(text);\n      if (typeof parsed !== \"object\" || parsed === null) throw Object.assign(new Error(\"EIO\"), { code: \"EIO\" });\n      return parsed;\n    } finally {\n      await file.close().catch(() => undefined);\n    }\n  }\n}\n";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.174.2",
+  "version": "1.175.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.46.2",
+    "@ai-ecoverse/slicc-cdp": "1.46.4",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",