@ai-ecoverse/slicc-kernel 1.176.1 → 1.177.0

package/dist/types/fs/types.d.ts

@@ -20,6 +20,7 @@ export interface FsStat {
     version?: string;
     uid?: number;
     gid?: number;
+    fat?: true;
 }
 export type UsersMode = 'off' | 'report' | 'enforce';
 export declare const DEFAULT_USERS: UsersMode;

package/dist/types/index.d.ts

@@ -44,7 +44,7 @@ export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js'
 export type { JsThread, JsThreadContext, JsThreadSpawnOptions } from './process/js/js-thread.js';
 export type { JsTermios, JsTty, JsTtySize } from './process/js/js-tty.js';
 export type { JsWebSocket, JsWebSocketClose, JsWebSocketMessage, JsWebSocketOptions, } from './process/js/js-websocket.js';
-export type { ApproveHook, SudoAnswer, SudoDenial, SudoRequest, SudoStdin } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export { type FetchTransportOptions, fetchTransport, type HeaderList, type NetworkExit, type NetworkRedirectPolicy, type NetworkRequest, type NetworkResponse, type NetworkTraits, type NetworkTransport, type NetworkWebSocket, type NetworkWebSocketRequest, } from './transport.js';
 export type { Account, AddGroup, AddUser, Group, RemoveUser } from './users.js';
 export interface NetworkOptions {

package/dist/types/launcher.d.ts

@@ -76,6 +76,9 @@ export interface LauncherOptions {
     embedder?: EmbedderHook;
     approve?: ApproveHook;
     sudoTimeoutMs?: number;
+    sudoClock?: {
+        now(): number;
+    };
     protect?: Protection;
     cron?: CronOptions;
     moduleUrl?: ModuleUrlMaker;
@@ -395,6 +398,8 @@ export declare class Launcher {
     private threadsOf;
     private crontab;
     private sudo;
+    private timestampOwner;
+    private startedOf;
     private visudo;
     private spawner;
     private childGroup;

package/dist/types/node.d.ts

@@ -33,7 +33,7 @@ export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';
 export type { MountEntry, MountSpec } from './mount/mount-fs.js';
-export type { ApproveHook, SudoAnswer, SudoDenial, SudoRequest, SudoStdin } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export type { NetworkRedirectPolicy } from './transport.js';
 export { fetchTransport, type NetworkTransport } from './transport.js';
 export { memoryRoot };
@@ -70,6 +70,11 @@ export interface NodeKernelOptions {
     cron?: {
         clock?: CronClock;
     };
+    sudo?: {
+        clock?: {
+            now(): number;
+        };
+    };
     compileCache?: string | false;
     warmWorker?: boolean;
     warmWorkers?: number;

package/dist/types/process/js/js-context.d.ts

@@ -177,6 +177,8 @@ export type JsSudoAnswer = {
     list: string;
 } | {
     run: string[];
+} | {
+    done: true;
 } | {
     pid: number;
 };

package/dist/types/sudo-timestamp.d.ts

@@ -0,0 +1,28 @@
+import type { TimestampType } from './sudoers.js';
+export declare const TIMESTAMPS_MAX = 64;
+export interface TimestampOwner {
+    uid: number;
+    terminal?: {
+        tty: string;
+        sid: number;
+        started: number;
+    } | undefined;
+    parent?: {
+        pid: number;
+        started: number;
+    } | undefined;
+}
+export interface TimestampPolicy {
+    type: TimestampType;
+    minutes: number;
+}
+export declare function timestampKey(owner: TimestampOwner, type: TimestampType): string | undefined;
+export declare class Timestamps {
+    private readonly users;
+    private readonly now;
+    constructor(now: () => number);
+    current(owner: TimestampOwner, policy: TimestampPolicy): boolean;
+    stamp(owner: TimestampOwner, policy: TimestampPolicy): boolean;
+    invalidate(owner: TimestampOwner, type: TimestampType): void;
+    remove(uid: number): void;
+}

package/dist/types/sudo.d.ts

@@ -1,5 +1,6 @@
 import type { KernelFs, UsersMode } from './fs/types.js';
 import type { Cred } from './kernel/cred.js';
+import { type TimestampOwner } from './sudo-timestamp.js';
 import { type UserDb } from './users.js';
 export { SUDOERS, SUDOERS_D } from './sudoers.js';
 export declare const SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
@@ -23,6 +24,8 @@ export interface SudoRequest {
     always: boolean;
     stdin?: SudoStdin;
     rootOnly?: Record<string, boolean>;
+    validate?: true;
+    timestamp?: true;
 }
 export type SudoStdin = 'tty' | 'none' | 'pipe' | 'file';
 export type SudoAnswer = 'once' | 'always' | 'deny';
@@ -30,9 +33,14 @@ export interface SudoDenial {
     answer: 'deny';
     message: string;
 }
+export interface SudoApproval {
+    answer: 'once' | 'always';
+    timestamp: true;
+}
+export type SudoReply = SudoAnswer | SudoDenial | SudoApproval;
 export type ApproveHook = (req: SudoRequest, options: {
     signal: AbortSignal;
-}) => SudoAnswer | SudoDenial | Promise<SudoAnswer | SudoDenial>;
+}) => SudoReply | Promise<SudoReply>;
 export interface SudoCall {
     op: 'proc-sudo';
     args: string[];
@@ -54,6 +62,8 @@ export type SudoResult = {
     list: string;
 } | {
     run: string[];
+} | {
+    done: true;
 } | {
     grant: SudoGrant;
     notice?: string;
@@ -63,6 +73,8 @@ export interface SudoCaller {
     pid: number;
     tags?: readonly string[] | undefined;
     tty?: string | null | undefined;
+    terminal?: TimestampOwner['terminal'];
+    parent?: TimestampOwner['parent'];
     stdin: SudoStdin;
     report?: ((line: string) => Promise<void>) | undefined;
 }
@@ -89,11 +101,13 @@ export interface SudoOptions {
     approve?: ApproveHook | undefined;
     timeoutMs?: number | undefined;
     warn?: (message: string) => void;
+    now?: (() => number) | undefined;
 }
 export declare class Sudo {
     private readonly o;
     private readonly warned;
     private readonly pending;
+    private readonly timestamps;
     private next;
     constructor(options: SudoOptions);
     private warn;
@@ -114,6 +128,11 @@ export declare class Sudo {
     private untrusted;
     private locate;
     request(caller: SudoCaller, call: SudoCall, signal: AbortSignal): Promise<SudoResult>;
+    private command;
+    private validate;
+    private pendingFor;
+    private stamped;
+    private logged;
     private always;
     private listed;
     private ask;

package/dist/types/sudoers.d.ts

@@ -16,8 +16,27 @@ export interface Rule {
     stdin?: 'none';
     cmnd: Command | '*';
 }
+export type TimestampType = 'tty' | 'ppid' | 'global';
+export interface Settings {
+    timestampTimeout?: number;
+    timestampType?: TimestampType;
+}
+export interface DefaultsEntry {
+    who: string[] | null;
+    settings: Settings;
+    params: string[];
+}
+export interface Resolved {
+    timestampTimeout: number;
+    timestampType: TimestampType;
+    matching: DefaultsEntry[];
+}
+export declare const TIMESTAMP_TIMEOUT = 5;
+export declare const TIMESTAMP_TYPE: TimestampType;
 export type PolicyLine = {
     rules: Rule[];
+} | {
+    defaults: DefaultsEntry;
 } | {
     error: string;
 } | null;
@@ -26,12 +45,16 @@ export declare function splitWords(text: string): string[] | undefined;
 export declare function quoteWord(word: string): string;
 export declare function commandMatches(cmnd: Command | '*', argv: readonly string[]): boolean;
 export declare function commandText(cmnd: Command): string;
+export declare function resolveDefaults(entries: readonly DefaultsEntry[], applies: (who: string) => boolean): Resolved;
+export declare function defaultsText(entries: readonly DefaultsEntry[]): string[];
 export declare function parseLine(line: string, file?: string): PolicyLine;
 export interface PolicyError {
     line: number;
     message: string;
 }
-export declare function parsePolicy(text: string, file?: string): {
+export interface Policy {
     rules: Rule[];
+    defaults: DefaultsEntry[];
     errors: PolicyError[];
-};
+}
+export declare function parsePolicy(text: string, file?: string): Policy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.176.1",
+  "version": "1.177.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.46.7",
+    "@ai-ecoverse/slicc-cdp": "1.47.2",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",
@@ -78,7 +78,7 @@
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
     "@ai-ecoverse/wasi-rustc": "1.98.1-10",
     "@ai-ecoverse/wasi-zig": "0.16.0-20",
-    "@ai-ecoverse/wasix-python": "3.15.0-7",
+    "@ai-ecoverse/wasix-python": "3.15.0-8",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-15",
     "@ai-ecoverse/wasm-curl": "8.22.0-10",