@ai-ecoverse/slicc-kernel 1.175.1 → 1.176.1

package/dist/node.js

@@ -3702,7 +3702,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.175.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.176.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9064,6 +9064,7 @@ var EmbedderBroker = class {
   budget;
   open = /* @__PURE__ */ new Map();
   tagsOf;
+  denied;
   constructor(users, lookup4, tagsOf2 = () => void 0, budget = EMBEDDER_BUDGET) {
     this.users = users;
     this.tagsOf = tagsOf2;
@@ -9081,7 +9082,8 @@ var EmbedderBroker = class {
     return this.hooks.get(client);
   }
   async allowed(policy, caller) {
-    if (caller.euid === 0 || caller.euid === caller.sessionUid) return true;
+    if (caller.euid === 0) return true;
+    if (policy.session !== false && caller.euid === caller.sessionUid) return true;
     if (policy.group !== void 0) {
       const gid = await this.lookup.groupId(policy.group);
       if (gid !== void 0 && (caller.egid === gid || caller.groups.includes(gid))) return true;
@@ -9097,9 +9099,22 @@ var EmbedderBroker = class {
     if (!hook) throw new KernelError("ENOTSUP", "no page answers requests for this session");
     const policy = Object.hasOwn(hook.kinds, kind) ? hook.kinds[kind] : void 0;
     if (!policy) throw new KernelError("ENOTSUP", `this embedder does not answer ${kind}`);
-    if (this.users !== "off" && !await this.allowed(policy, caller))
-      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
     const tags = caller.tags;
+    if (this.users !== "off" && !await this.allowed(policy, caller)) {
+      try {
+        this.denied?.({
+          pid: caller.pid,
+          uid: caller.euid,
+          op: "embedder",
+          path: EMBEDDER_PATH,
+          errno: "EACCES",
+          kind,
+          ...tags?.length ? { tag: tags[0] } : {}
+        });
+      } catch {
+      }
+      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
+    }
     return {
       pid: caller.shownPid,
       uid: caller.euid,
@@ -9142,7 +9157,8 @@ function kindsOf(hook) {
       kind,
       {
         ...policy?.group !== void 0 ? { group: String(policy.group) } : {},
-        ...policy?.users ? { users: [...policy.users] } : {}
+        ...policy?.users ? { users: [...policy.users] } : {},
+        ...policy?.session === false ? { session: false } : {}
       }
     ])
   );
@@ -12482,6 +12498,10 @@ var lengthOf = getter("length");
 
 // src/realm/live-vfs-fs.ts
 var EARLY_WHOLE_FILE = 64 * 1024;
+var createParentRefresh = 0;
+function createParentRefreshCount() {
+  return createParentRefresh;
+}
 
 // src/process/process-fds.ts
 var REFUSED = /* @__PURE__ */ new Set([wasiErrno("EACCES"), wasiErrno("EPERM")]);
@@ -12524,6 +12544,8 @@ var SYS_TREE = {
     slicc_opfs_calls: (listing) => `${listing.opfsCalls ?? 0}
 `,
     slicc_opfs_ops: (listing) => `${listing.opfsOps ?? 0}
+`,
+    slicc_create_parent_refresh: (_listing) => `${createParentRefreshCount()}
 `,
     slicc_meta_transactions: ({ meta }) => `${meta?.reads ?? 0} ${meta?.writes ?? 0}
 `,
@@ -15429,11 +15451,12 @@ function parsePolicy(text, file) {
 var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
-var DEFAULT_GROUP = "root:x:0:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
+var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
 var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
+var MAX_GID = 4294967294;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
@@ -15729,6 +15752,26 @@ var UserDb = class {
     const { group } = await this.tables();
     return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
   }
+  addGroup(name2, gid) {
+    return this.serial(async () => {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+        throw fsError("EINVAL", `not a group name: ${String(name2)}`);
+      }
+      if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
+        throw fsError("EINVAL", `not a group id: ${String(gid)}`);
+      }
+      const { group } = await this.tables();
+      const rows = parsed(group);
+      const found = rows.find((g) => g.name === name2);
+      if (found) return { name: found.name, gid: found.gid, members: [...found.members] };
+      const taken = rows.find((g) => g.gid === gid);
+      if (taken) throw fsError("EEXIST", `group id ${gid} is group ${taken.name}`);
+      group.push({ name: name2, gid, members: [] });
+      await this.fs.mkdir("/etc", { recursive: true });
+      await this.fs.writeFile(GROUP, formatGroup(group));
+      return { name: name2, gid, members: [] };
+    });
+  }
   addMember(group, user) {
     return this.member(group, user, true);
   }
@@ -29159,7 +29202,7 @@ var OpfsFs = class {
   }
   async mkdirExcl(path, owner) {
     if (normalizePath(path) === "/") throw fsError("EEXIST", path);
-    const parent = await this.locate(parentOf9(path), true);
+    const parent = await this.exactly(() => this.locate(parentOf9(path), true));
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const dir = parent.handle;
     const name2 = baseOf3(path);
@@ -29181,7 +29224,7 @@ var OpfsFs = class {
   }
   async createExclusive(path, owner) {
     if (normalizePath(path) === "/") throw fsError("EEXIST", path);
-    const parent = await this.locate(parentOf9(path), true);
+    const parent = await this.exactly(() => this.locate(parentOf9(path), true));
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const dir = parent.handle;
     const name2 = baseOf3(path);
@@ -29930,7 +29973,7 @@ var OpfsFs = class {
     }
   }
   async symlink(target, path, owner) {
-    const parent = await this.locate(parentOf9(path), true);
+    const parent = await this.exactly(() => this.locate(parentOf9(path), true));
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
     const at = resolvePath(parent.path, baseOf3(path));
     this.refuse(at);
@@ -32360,6 +32403,7 @@ var Launcher = class {
       (pid) => this.tagsOf(pid)
     );
     this.embedder = this.embedderBroker(options.embedder);
+    this.embedder.denied = options.onDenial;
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -37686,6 +37730,7 @@ async function createNodeKernel(options = {}) {
     },
     groups: {
       list: () => guard2(() => launcher.users.groups()),
+      add: (name2, options2) => guard2(() => launcher.users.addGroup(name2, options2?.gid)),
       addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
       removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
     },