@ai-ecoverse/slicc-kernel 1.175.0 → 1.176.0

package/dist/node-process-worker.cjs

@@ -7514,7 +7514,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.175.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node-process-worker.js

@@ -7513,7 +7513,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.175.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node.js

@@ -3702,7 +3702,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.175.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9064,6 +9064,7 @@ var EmbedderBroker = class {
   budget;
   open = /* @__PURE__ */ new Map();
   tagsOf;
+  denied;
   constructor(users, lookup4, tagsOf2 = () => void 0, budget = EMBEDDER_BUDGET) {
     this.users = users;
     this.tagsOf = tagsOf2;
@@ -9081,7 +9082,8 @@ var EmbedderBroker = class {
     return this.hooks.get(client);
   }
   async allowed(policy, caller) {
-    if (caller.euid === 0 || caller.euid === caller.sessionUid) return true;
+    if (caller.euid === 0) return true;
+    if (policy.session !== false && caller.euid === caller.sessionUid) return true;
     if (policy.group !== void 0) {
       const gid = await this.lookup.groupId(policy.group);
       if (gid !== void 0 && (caller.egid === gid || caller.groups.includes(gid))) return true;
@@ -9097,9 +9099,22 @@ var EmbedderBroker = class {
     if (!hook) throw new KernelError("ENOTSUP", "no page answers requests for this session");
     const policy = Object.hasOwn(hook.kinds, kind) ? hook.kinds[kind] : void 0;
     if (!policy) throw new KernelError("ENOTSUP", `this embedder does not answer ${kind}`);
-    if (this.users !== "off" && !await this.allowed(policy, caller))
-      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
     const tags = caller.tags;
+    if (this.users !== "off" && !await this.allowed(policy, caller)) {
+      try {
+        this.denied?.({
+          pid: caller.pid,
+          uid: caller.euid,
+          op: "embedder",
+          path: EMBEDDER_PATH,
+          errno: "EACCES",
+          kind,
+          ...tags?.length ? { tag: tags[0] } : {}
+        });
+      } catch {
+      }
+      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
+    }
     return {
       pid: caller.shownPid,
       uid: caller.euid,
@@ -9142,7 +9157,8 @@ function kindsOf(hook) {
       kind,
       {
         ...policy?.group !== void 0 ? { group: String(policy.group) } : {},
-        ...policy?.users ? { users: [...policy.users] } : {}
+        ...policy?.users ? { users: [...policy.users] } : {},
+        ...policy?.session === false ? { session: false } : {}
       }
     ])
   );
@@ -15429,11 +15445,12 @@ function parsePolicy(text, file) {
 var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
-var DEFAULT_GROUP = "root:x:0:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
+var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
 var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
+var MAX_GID = 4294967294;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
@@ -15729,6 +15746,26 @@ var UserDb = class {
     const { group } = await this.tables();
     return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
   }
+  addGroup(name2, gid) {
+    return this.serial(async () => {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+        throw fsError("EINVAL", `not a group name: ${String(name2)}`);
+      }
+      if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
+        throw fsError("EINVAL", `not a group id: ${String(gid)}`);
+      }
+      const { group } = await this.tables();
+      const rows = parsed(group);
+      const found = rows.find((g) => g.name === name2);
+      if (found) return { name: found.name, gid: found.gid, members: [...found.members] };
+      const taken = rows.find((g) => g.gid === gid);
+      if (taken) throw fsError("EEXIST", `group id ${gid} is group ${taken.name}`);
+      group.push({ name: name2, gid, members: [] });
+      await this.fs.mkdir("/etc", { recursive: true });
+      await this.fs.writeFile(GROUP, formatGroup(group));
+      return { name: name2, gid, members: [] };
+    });
+  }
   addMember(group, user) {
     return this.member(group, user, true);
   }
@@ -28304,8 +28341,10 @@ var OpfsFs = class {
     for (let at = from; at < parts2.length; at++) {
       this.calls++;
       dir = await dir.getDirectoryHandle(parts2[at]);
-      this.dirs.set(`/${parts2.slice(0, at + 1).join("/")}`, dir);
+      const path = `/${parts2.slice(0, at + 1).join("/")}`;
+      this.dirs.set(path, dir);
       this.checked.set(dir, performance.now());
+      this.absent.delete(path);
     }
     return dir;
   }
@@ -28387,6 +28426,7 @@ var OpfsFs = class {
       if (looked) {
         this.dirs.set(path, handle);
         this.checked.set(handle, performance.now());
+        this.absent.delete(path);
       }
       return handle;
     }
@@ -29037,7 +29077,8 @@ var OpfsFs = class {
     }
     const [entry] = await this.meta.get([path]);
     const wanted = entry?.link === void 0 ? path : resolvePath(parentOf9(path), entry.link);
-    return [resolvePath((await this.locate(parentOf9(wanted), true)).path, baseOf3(wanted)), false];
+    const parent = await this.exactly(() => this.locate(parentOf9(wanted), true));
+    return [resolvePath(parent.path, baseOf3(wanted)), false];
   }
   async fileFor(path, create = true) {
     const [target, existed] = await this.writeTarget(path);
@@ -29144,10 +29185,12 @@ var OpfsFs = class {
     await this.mkdir(parentOf9(path), { recursive: true, ...above ? { owner: above } : {} });
     const parent = await this.locate(parentOf9(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
-    this.refuse(resolvePath(parent.path, baseOf3(path)));
-    await this.io(parent.handle.getDirectoryHandle(baseOf3(path), { create: true }));
+    const made2 = resolvePath(parent.path, baseOf3(path));
+    this.forget(made2);
+    this.refuse(made2);
+    const handle = await this.io(parent.handle.getDirectoryHandle(baseOf3(path), { create: true }));
+    this.remember(made2, handle, true);
     const now = Date.now();
-    const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf3(path)}`;
     await this.stampNew(made2, owner, true);
     this.touch(now, parent.path, made2);
   }
@@ -32354,6 +32397,7 @@ var Launcher = class {
       (pid) => this.tagsOf(pid)
     );
     this.embedder = this.embedderBroker(options.embedder);
+    this.embedder.denied = options.onDenial;
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -37680,6 +37724,7 @@ async function createNodeKernel(options = {}) {
     },
     groups: {
       list: () => guard2(() => launcher.users.groups()),
+      add: (name2, options2) => guard2(() => launcher.users.addGroup(name2, options2?.gid)),
       addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
       removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
     },