@ai-ecoverse/slicc-kernel 1.176.1 → 1.177.0

package/dist/node.js

@@ -876,14 +876,21 @@ async function ownerOnly(g, op, path, follow2) {
   return walked;
 }
 async function chmodMode(g, path, mode) {
-  const perm = (await ownerOnly(g, "chmod", path, true)).perm;
-  if (!g.dac.enforcing || !perm || g.cred.euid === 0 || inGroup(g.cred, perm.gid)) return mode;
+  const walked = await need(g, "chmod", path, 0, { follow: true });
+  const perm = walked.perm;
+  const st = await g.fs.stat(walked.path).catch(() => void 0);
+  if (!st?.fat && perm && g.cred.euid !== 0 && perm.uid !== g.cred.euid) {
+    if (await present(g.fs, walked.path, false)) deny(g, "chmod", path, "EPERM");
+  }
+  if (!g.dac.enforcing || !perm || g.cred.euid === 0 || st?.fat || inGroup(g.cred, perm.gid)) {
+    return mode;
+  }
   return mode & ~S_ISGID2;
 }
 function heldChmodMode(g, path, st, mode) {
   const perm = permOf(st);
-  if (g.cred.euid !== 0 && perm.uid !== g.cred.euid) deny(g, "fchmod", path, "EPERM");
-  if (!g.dac.enforcing || g.cred.euid === 0 || inGroup(g.cred, perm.gid)) return mode;
+  if (!st.fat && g.cred.euid !== 0 && perm.uid !== g.cred.euid) deny(g, "fchmod", path, "EPERM");
+  if (!g.dac.enforcing || g.cred.euid === 0 || st.fat || inGroup(g.cred, perm.gid)) return mode;
   return mode & ~S_ISGID2;
 }
 function heldRetimable(g, path, st, now) {
@@ -3702,7 +3709,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.176.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.177.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9599,10 +9606,15 @@ var DriverConnection = class _DriverConnection {
 // src/mount/mount-fs.ts
 var S_ISGID3 = 1024;
 var ID = /^\d{1,10}$/;
+var MASK = /^0*[0-7]{1,4}$/;
 var MAX_ID2 = 4294967294;
 function idOption(value2) {
   return value2 === void 0 ? 0 : Number(value2);
 }
+function maskOption(value2) {
+  if (value2 === void 0) return void 0;
+  return Number.parseInt(value2, 8) & 511;
+}
 function checkIds(options) {
   for (const key of ["uid", "gid"]) {
     const value2 = options[key];
@@ -9610,6 +9622,27 @@ function checkIds(options) {
     if (!ID.test(value2) || Number(value2) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value2}`);
   }
 }
+function checkMasks(options) {
+  for (const key of ["umask", "fmask", "dmask"]) {
+    const value2 = options[key];
+    if (value2 === void 0) continue;
+    if (!MASK.test(value2) || Number.parseInt(value2, 8) > 511) {
+      throw errnoError("EINVAL", `${key}=${value2}`);
+    }
+  }
+}
+function modeOf(attr2, mount) {
+  const type = attr2.kind === "directory" ? 16384 : attr2.kind === "symlink" ? 40960 : attr2.kind === "fifo" ? 4096 : 32768;
+  const fallback = type | (attr2.kind === "directory" ? 493 : attr2.kind === "symlink" ? 511 : 420);
+  if (mount.caps.owners) return attr2.mode ?? fallback;
+  const umask = maskOption(mount.options.umask);
+  const fmask = maskOption(mount.options.fmask) ?? umask;
+  const dmask = maskOption(mount.options.dmask) ?? umask;
+  const mask = attr2.kind === "directory" ? dmask : fmask;
+  if (mask === void 0) return attr2.mode ?? fallback;
+  const base = attr2.kind === "directory" || attr2.kind === "symlink" ? 511 : 438;
+  return type | base & ~mask;
+}
 var MAX_LINKS5 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
@@ -9876,14 +9909,13 @@ function inodeless(mount, attr2) {
 }
 function statOf2(attr2, path, mount) {
   const mtime = new Date(attr2.mtime);
-  const fallback = attr2.kind === "directory" ? 16877 : attr2.kind === "symlink" ? 41471 : attr2.kind === "fifo" ? 4516 : 33188;
   return {
     isFile: attr2.kind === "file",
     isDirectory: attr2.kind === "directory",
     isSymbolicLink: attr2.kind === "symlink",
     ...attr2.kind === "fifo" ? { isFifo: true } : {},
     size: attr2.size,
-    mode: attr2.mode ?? fallback,
+    mode: modeOf(attr2, mount),
     mtime,
     atime: attr2.atime === void 0 ? mtime : new Date(attr2.atime),
     ctime: mtime,
@@ -9897,7 +9929,8 @@ function statOf2(attr2, path, mount) {
     ...attr2.etag !== void 0 ? { version: attr2.etag } : {},
     ...mount.owners ? {
       uid: (mount.caps.owners ? attr2.uid : void 0) ?? idOption(mount.options.uid),
-      gid: (mount.caps.owners ? attr2.gid : void 0) ?? idOption(mount.options.gid)
+      gid: (mount.caps.owners ? attr2.gid : void 0) ?? idOption(mount.options.gid),
+      ...!mount.caps.owners && !mount.caps.chmod && (mount.options.umask !== void 0 || mount.options.fmask !== void 0 || mount.options.dmask !== void 0) ? { fat: true } : {}
     } : {}
   };
 }
@@ -10004,6 +10037,7 @@ var MountTable = class {
     if (!st.isDirectory) throw errnoError("ENOTDIR", target);
     const options = { ...spec.options };
     if (this.deps.owners) checkIds(options);
+    checkMasks(options);
     const maxFile = options.maxfile !== void 0 ? parseSize(options.maxfile) : void 0;
     const opened2 = await this.deps.open(spec.type, { ...spec, target, options });
     let mounted;
@@ -14454,8 +14488,8 @@ var SCRUB_IDLE_MS = 50;
 var SCRUB_NONBLOCK_MAX = 64 * 1024;
 var encoder5 = new TextEncoder();
 function scrubberOf(secrets, sameLength = false) {
-  const usable2 = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
-  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
+  const usable3 = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
+  return usable3.length > 0 ? compile(usable3, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
 }
 async function writeAll(file, bytes) {
   const write = file.write;
@@ -15094,6 +15128,56 @@ var SealedBroker = class {
   }
 };
 
+// src/sudo-timestamp.ts
+var TIMESTAMPS_MAX = 64;
+var MINUTE_MS2 = 6e4;
+function timestampKey(owner, type) {
+  if (type === "global") return "global";
+  const { terminal, parent } = owner;
+  if (type === "tty" && terminal) {
+    return JSON.stringify(["tty", terminal.tty, terminal.sid, terminal.started]);
+  }
+  return parent ? JSON.stringify(["ppid", parent.pid, parent.started]) : void 0;
+}
+var Timestamps = class {
+  users = /* @__PURE__ */ new Map();
+  now;
+  constructor(now) {
+    this.now = now;
+  }
+  current(owner, policy) {
+    if (policy.minutes === 0) return false;
+    const key = timestampKey(owner, policy.type);
+    const at = key === void 0 ? void 0 : this.users.get(owner.uid)?.get(key);
+    if (at === void 0) return false;
+    const now = this.now();
+    return at <= now && (policy.minutes < 0 || now - at < policy.minutes * MINUTE_MS2);
+  }
+  stamp(owner, policy) {
+    const key = policy.minutes === 0 ? void 0 : timestampKey(owner, policy.type);
+    if (key === void 0) return false;
+    const now = this.now();
+    const records = this.users.get(owner.uid) ?? /* @__PURE__ */ new Map();
+    this.users.set(owner.uid, records);
+    records.delete(key);
+    records.set(key, now);
+    for (const [old, at] of records) {
+      const stale = policy.minutes > 0 && (at > now || now - at >= policy.minutes * MINUTE_MS2);
+      if (stale || records.size > TIMESTAMPS_MAX) records.delete(old);
+    }
+    return true;
+  }
+  invalidate(owner, type) {
+    const key = timestampKey(owner, type);
+    const records = this.users.get(owner.uid);
+    if (key !== void 0) records?.delete(key);
+    if (records?.size === 0) this.users.delete(owner.uid);
+  }
+  remove(uid) {
+    this.users.delete(uid);
+  }
+};
+
 // src/sudoers.ts
 var SUDOERS = "/etc/sudoers";
 var SUDOERS_D = "/etc/sudoers.d";
@@ -15113,6 +15197,8 @@ var SHOWN_MAX = 60;
 var KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] Cmnd <command\u2026|*>";
 var SUDOERS_SYNTAX = "<user|%group|ALL> ALL=[(<target>[,<target>\u2026])] [NOPASSWD:] <command\u2026|ALL>";
 var EXPECTED = `expected '${KERNEL_SYNTAX}' or '${SUDOERS_SYNTAX}'`;
+var TIMESTAMP_TIMEOUT = 5;
+var TIMESTAMP_TYPE = "tty";
 function hasControl(text) {
   return CONTROL.test(text);
 }
@@ -15395,9 +15481,6 @@ function directiveError(text) {
     return /^#-?\d+\s+\S+\s*=/.test(text) ? "a #uid isn't supported: name the user, %group or ALL" : null;
   }
   const first = /^\S+/.exec(text)?.[0] ?? "";
-  if (/^Defaults([:@>!]|$)/.test(first)) {
-    return "Defaults aren't supported: the kernel's sudo has no settings, so this changes nothing";
-  }
   if (/^[A-Z][A-Za-z]*_Alias$/.test(first)) {
     return "aliases aren't supported: name the users, targets and commands in each line";
   }
@@ -15423,9 +15506,90 @@ function kernelLine(m, line, file) {
     )
   };
 }
+var DEFAULTS = /^Defaults(?=[:@>!\s]|$)/;
+var DEFAULTS_ONLY = `Defaults aren't supported, except timestamp_timeout and timestamp_type for everyone, a user or a %group: this line changes nothing`;
+var PARAM = /^(!*)([A-Za-z_]+)(?:\s*([-+]?=)\s*(.*))?$/s;
+var MINUTES = /^[-+]?(?:\d+(?:\.\d*)?|\.\d+)$/;
+var TYPES = ["tty", "ppid", "global"];
+function defaultsValue(raw2) {
+  const quoted = /^"(.*)"$/s.exec(raw2);
+  return quoted ? quoted[1] : raw2;
+}
+function timeoutParam({ text, negated, op, value: value2 }) {
+  if (negated && op === void 0) return { timestampTimeout: 0 };
+  if (negated || op !== "=" || !MINUTES.test(value2) || !Number.isFinite(Number(value2))) {
+    return `timestamp_timeout takes minutes, such as =5 or =2.5 (0 always asks, below 0 never expires), not ${shown(text)}`;
+  }
+  return { timestampTimeout: Number(value2) };
+}
+function typeParam({ text, negated, op, value: value2 }) {
+  if (!negated && op === "=" && TYPES.includes(value2)) {
+    return { timestampType: value2 };
+  }
+  if (value2 === "kernel") return "timestamp_type=kernel isn't supported: use tty, ppid or global";
+  return `timestamp_type takes =tty, =ppid or =global, not ${shown(text)}`;
+}
+function defaultsParam(param) {
+  const m = PARAM.exec(param);
+  if (!m) return DEFAULTS_ONLY;
+  const [, bangs = "", name2, op, raw2 = ""] = m;
+  const read = { text: param, negated: bangs !== "", op, value: defaultsValue(raw2.trim()) };
+  const settings = name2 === "timestamp_timeout" ? timeoutParam(read) : name2 === "timestamp_type" ? typeParam(read) : DEFAULTS_ONLY;
+  if (typeof settings === "string") return settings;
+  const value2 = settings.timestampTimeout ?? settings.timestampType;
+  return { settings, text: `${name2}=${value2}` };
+}
+function defaultsWho(binding) {
+  if (binding === "") return null;
+  if (!binding.startsWith(":")) return DEFAULTS_ONLY;
+  const who = binding.slice(1).split(",");
+  for (const name2 of who) {
+    if (!validWho(name2))
+      return `expected users, %groups or ALL after Defaults:, not ${shown(name2)}`;
+  }
+  return who;
+}
+function defaultsLine(text) {
+  const m = /^Defaults(\S*)(?:\s+(.*))?$/s.exec(text);
+  const who = defaultsWho(m?.[1] ?? "");
+  if (typeof who === "string") return { error: who };
+  const list = (m?.[2] ?? "").trim();
+  if (list === "")
+    return {
+      error: "expected timestamp_timeout=<minutes> or timestamp_type=<type> after Defaults"
+    };
+  const settings = {};
+  const params = [];
+  for (const param of list.split(",")) {
+    const read = defaultsParam(param.trim());
+    if (typeof read === "string") return { error: read };
+    Object.assign(settings, read.settings);
+    params.push(read.text);
+  }
+  return { defaults: { who, settings, params } };
+}
+function resolveDefaults(entries, applies) {
+  const everyone = entries.filter((e) => e.who === null);
+  const mine = entries.filter((e) => e.who?.some(applies));
+  const matching = [...everyone, ...mine];
+  const settings = Object.assign({}, ...matching.map((e) => e.settings));
+  return {
+    timestampTimeout: settings.timestampTimeout ?? TIMESTAMP_TIMEOUT,
+    timestampType: settings.timestampType ?? TIMESTAMP_TYPE,
+    matching
+  };
+}
+function defaultsText(entries) {
+  const all = resolveDefaults(entries, () => false);
+  return [
+    `Defaults timestamp_timeout=${all.timestampTimeout}, timestamp_type=${all.timestampType}`,
+    ...entries.filter((e) => e.who !== null).map((e) => `Defaults:${e.who.join(",")} ${e.params.join(", ")}`)
+  ];
+}
 function parseLine(line, file) {
   const text = line.trim();
   if (text === "") return null;
+  if (DEFAULTS.test(text)) return defaultsLine(text);
   const directive = directiveError(text);
   if (directive !== void 0) return directive === null ? null : { error: directive };
   const kernel = KERNEL_FORM.exec(text);
@@ -15437,14 +15601,16 @@ function parseLine(line, file) {
 }
 function parsePolicy(text, file) {
   const rules = [];
+  const defaults2 = [];
   const errors = [];
   for (const [n, line] of text.split("\n").entries()) {
     const parsed2 = parseLine(line, file);
     if (parsed2 === null) continue;
     if ("error" in parsed2) errors.push({ line: n + 1, message: parsed2.error });
+    else if ("defaults" in parsed2) defaults2.push(parsed2.defaults);
     else rules.push(...parsed2.rules);
   }
-  return { rules, errors };
+  return { rules, defaults: defaults2, errors };
 }
 
 // src/users.ts
@@ -15829,7 +15995,14 @@ var SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 var DEFAULT_SUDOERS = "%sudo Cmnd *\n";
 var SUDO_TIMEOUT_MS = 3e5;
 var TERM = /^[A-Za-z0-9._+-]+$/;
-var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
+var USAGE = [
+  "usage: sudo -K | -k",
+  "       sudo -v [-kn] [-u user]",
+  "       sudo -l [-kn]",
+  "       sudo [-kn] [-u user] [--] command [args...]"
+].join("\n");
+var DONE = { done: true };
+var NOT_STAMPED = "sudo: approved, but the approver didn't say a person decided, so no timestamp was recorded";
 var DENIED2 = "sudo: approval denied";
 var DENIAL_MAX = 500;
 var ABORTED = /* @__PURE__ */ Symbol("aborted");
@@ -15903,6 +16076,17 @@ async function answerOf(approve, req, signal) {
     return cut === void 0 ? "deny" : await cut;
   }
 }
+function approvalOf(answer2) {
+  if (answer2 === "once" || answer2 === "always") return { answer: answer2, person: false };
+  if (typeof answer2 !== "object" || answer2 === null) return void 0;
+  try {
+    const { answer: kind, timestamp } = answer2;
+    if (kind !== "once" && kind !== "always" || timestamp !== true) return void 0;
+    return { answer: kind, person: true };
+  } catch {
+    return void 0;
+  }
+}
 function recordedCommand(argv) {
   const [path = "", ...args] = argv;
   return commandText({ path, args: args.map((a) => [a]) });
@@ -15912,6 +16096,9 @@ function flags(parsed2, arg, next3) {
     const flag = arg[j];
     if (flag === "n") parsed2.nonInteractive = true;
     else if (flag === "l") parsed2.list = true;
+    else if (flag === "v") parsed2.validate = true;
+    else if (flag === "k") parsed2.reset = true;
+    else if (flag === "K") parsed2.removeAll = true;
     else if (flag !== "u") return `sudo: invalid option -- '${flag}'
 ${USAGE}`;
     else {
@@ -15925,7 +16112,15 @@ ${USAGE}`;
   return 0;
 }
 function parseArgs(args) {
-  const parsed2 = { list: false, nonInteractive: false, user: "root", command: [] };
+  const parsed2 = {
+    list: false,
+    nonInteractive: false,
+    validate: false,
+    reset: false,
+    removeAll: false,
+    user: "root",
+    command: []
+  };
   let i = 0;
   for (; i < args.length; i++) {
     const arg = args[i];
@@ -15939,8 +16134,17 @@ function parseArgs(args) {
     i += used;
   }
   parsed2.command = args.slice(i);
-  if (parsed2.list ? parsed2.command.length > 0 : parsed2.command.length === 0) return USAGE;
-  return parsed2;
+  return usable(parsed2) ? parsed2 : USAGE;
+}
+function usable(parsed2) {
+  const command = parsed2.command.length > 0;
+  const modes = [parsed2.list, parsed2.validate, parsed2.removeAll].filter(Boolean).length;
+  if (modes > 1 || parsed2.removeAll && parsed2.reset) return false;
+  if (modes === 1) return !command;
+  return command || parsed2.reset;
+}
+function policyOf(settings) {
+  return { type: settings.timestampType, minutes: settings.timestampTimeout };
 }
 function described(rule) {
   const cmnd = rule.cmnd === "*" ? "ALL" : commandText(rule.cmnd);
@@ -15952,9 +16156,11 @@ var Sudo = class {
   o;
   warned = /* @__PURE__ */ new Set();
   pending = /* @__PURE__ */ new Set();
+  timestamps;
   next = 0;
   constructor(options) {
     this.o = options;
+    this.timestamps = new Timestamps(options.now ?? (() => performance.now()));
   }
   warn(message3) {
     if (this.warned.has(message3)) return;
@@ -16041,8 +16247,8 @@ var Sudo = class {
       const code = err.code;
       return skipped(`it can't be read (${typeof code === "string" ? code : "error"})`);
     }
-    const { rules, errors } = parsePolicy(text, path);
-    return { path, rules, problems: errors, ok: true };
+    const { rules, defaults: defaults2, errors } = parsePolicy(text, path);
+    return { path, rules, defaults: defaults2, problems: errors, ok: true };
   }
   async policy() {
     const files = [await this.policyFile(SUDOERS)];
@@ -16071,7 +16277,10 @@ var Sudo = class {
       }
     }
     if (!detailed && skipped > 0) await caller.report?.(skippedNotice(skipped));
-    return files.flatMap((f) => f.rules);
+    return {
+      rules: files.flatMap((f) => f.rules),
+      defaults: files.flatMap((f) => f.defaults ?? [])
+    };
   }
   async check(cred, call) {
     const lines2 = [];
@@ -16084,17 +16293,26 @@ var Sudo = class {
       if (read && problems.length === 0) lines2.push([1, `${path}: parsed OK`]);
       if (problems.length > 0) ok4 = false;
     };
+    const values = (defaults2) => {
+      for (const line of defaultsText(defaults2)) lines2.push([1, line]);
+    };
     if (call.files !== void 0) {
+      const defaults2 = [];
       for (const { name: name2, text } of call.files) {
-        report({ path: name2, rules: [], problems: parsePolicy(text).errors, ok: true });
+        const parsed2 = parsePolicy(text);
+        defaults2.push(...parsed2.defaults);
+        report({ path: name2, rules: [], problems: parsed2.errors, ok: true });
       }
+      if (defaults2.length > 0) values(defaults2);
       return { lines: lines2, ok: ok4 };
     }
     if (this.o.mode === "enforce" && cred.euid !== 0) {
       const hint = "check the policy as root (sudo visudo -c), or a file with visudo -c -f <file>";
       return { lines: [[2, `visudo: ${SUDOERS}: Permission denied: ${hint}`]], ok: false };
     }
-    for (const file of await this.policy()) report(file);
+    const files = await this.policy();
+    for (const file of files) report(file);
+    values(files.flatMap((f) => f.defaults ?? []));
     return { lines: lines2, ok: ok4 };
   }
   async groupIds() {
@@ -16103,9 +16321,9 @@ var Sudo = class {
   async applies(caller, cred) {
     const gids = await this.groupIds();
     const mine = /* @__PURE__ */ new Set([cred.rgid, cred.egid, ...cred.groups]);
-    return (rule) => {
-      if (rule.who === "ALL" || rule.who === caller.name) return true;
-      const gid = rule.who.startsWith("%") ? gids.get(rule.who.slice(1)) : void 0;
+    return (who) => {
+      if (who === "ALL" || who === caller.name) return true;
+      const gid = who.startsWith("%") ? gids.get(who.slice(1)) : void 0;
       return gid !== void 0 && mine.has(gid);
     };
   }
@@ -16150,18 +16368,40 @@ var Sudo = class {
       const mode = this.o.mode;
       if (parsed2.list) return { list: `sudo: users are '${mode}': commands run as the caller
 ` };
-      return { run: parsed2.command };
+      return parsed2.command.length > 0 ? { run: parsed2.command } : DONE;
     }
     const { cred } = caller;
     const policy = await this.policyRules(caller);
     const self = await this.o.users.lookup(cred.ruid);
     if (!self) return failed2("EPERM", `sudo: uid ${cred.ruid} is not in the passwd database`);
+    const owner = {
+      uid: cred.ruid,
+      terminal: caller.terminal,
+      parent: caller.parent
+    };
+    const applies = await this.applies(self, cred);
+    const settings = resolveDefaults(policy.defaults, applies);
+    if (parsed2.removeAll) {
+      this.timestamps.remove(owner.uid);
+      return DONE;
+    }
+    if (parsed2.reset && !parsed2.validate && !parsed2.list && parsed2.command.length === 0) {
+      this.timestamps.invalidate(owner, settings.timestampType);
+      return DONE;
+    }
     const target = await this.lookup(parsed2.user);
     if (!target) return failed2("ENOENT", `sudo: unknown user ${parsed2.user}`);
     const root = cred.euid === 0;
-    const rules = root ? [] : policy;
-    const applies = await this.applies(self, cred);
-    if (parsed2.list) return this.listed(self, root, rules.filter(applies));
+    const rules = root ? [] : policy.rules;
+    const mine = rules.filter((rule) => applies(rule.who));
+    if (parsed2.list) return this.listed(self, root, mine, settings.matching);
+    const session = { caller, self, target, owner, policy: policyOf(settings), parsed: parsed2, signal };
+    if (parsed2.validate) return this.validate(session, root, mine, call.cwd);
+    return this.command(session, root, mine, call);
+  }
+  async command(s, root, mine, call) {
+    const { caller, self, target, parsed: parsed2 } = s;
+    const { cred } = caller;
     const [word = "", ...args] = parsed2.command;
     const cwd = await this.canonical(call.cwd);
     if (cwd === void 0 || !await this.reachable(cred, cwd)) {
@@ -16175,8 +16415,8 @@ var Sudo = class {
     const untrusted2 = await this.untrusted(path, cwd, word);
     if (untrusted2) return untrusted2;
     const argv = [path, ...args];
-    const matching = rules.filter(
-      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && stdinMatches(rule, caller.stdin) && commandMatches(rule.cmnd, argv)
+    const matching = mine.filter(
+      (rule) => (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && stdinMatches(rule, caller.stdin) && commandMatches(rule.cmnd, argv)
     );
     const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
@@ -16187,23 +16427,67 @@ var Sudo = class {
         `sudo: ${self.name} is not allowed to run ${quoted} as ${target.name}`
       );
     }
+    if (!parsed2.reset && this.timestamps.current(s.owner, s.policy)) {
+      this.timestamps.stamp(s.owner, s.policy);
+      this.logged(s, cwd, argv);
+      return grant();
+    }
     if (parsed2.nonInteractive) return failed2("EPERM", "sudo: a password is required");
-    if (this.pending.has(cred.ruid)) return failed2("EBUSY", "sudo: another request is pending");
-    this.pending.add(cred.ruid);
-    try {
-      const answer2 = await this.ask(caller, self, target, parsed2.command, path, cwd, signal);
-      if (typeof answer2 !== "string") return answer2;
+    return this.pendingFor(cred.ruid, async () => {
+      const answer2 = await this.ask(s, { argv: parsed2.command, path, cwd });
+      if ("error" in answer2) return answer2;
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer2 === "once") return grant();
-      return await this.always(self, target, cwd, argv, recordable(cwd, parsed2.command), grant);
+      const result = answer2.answer === "once" ? grant() : await this.always(self, target, cwd, argv, recordable(cwd, parsed2.command), grant);
+      if (!("error" in result)) this.stamped(s, answer2);
+      return result;
+    });
+  }
+  async validate(s, root, mine, dir) {
+    const { self, parsed: parsed2 } = s;
+    if (root) return DONE;
+    if (mine.length === 0) {
+      return failed2("EPERM", `Sorry, user ${self.name} may not run sudo on ${this.o.hostname}.`);
+    }
+    if (mine.every((rule) => rule.nopasswd)) return DONE;
+    if (!parsed2.reset && this.timestamps.current(s.owner, s.policy)) {
+      this.timestamps.stamp(s.owner, s.policy);
+      return DONE;
+    }
+    if (parsed2.nonInteractive) return failed2("EPERM", "sudo: a password is required");
+    const cwd = await this.canonical(dir) ?? normalizePath(dir);
+    return this.pendingFor(s.caller.cred.ruid, async () => {
+      const answer2 = await this.ask(s, { argv: [], path: "", cwd, validate: true });
+      if ("error" in answer2) return answer2;
+      if (!answer2.person) await s.caller.report?.(NOT_STAMPED);
+      this.stamped(s, answer2);
+      return DONE;
+    });
+  }
+  async pendingFor(uid, work) {
+    if (this.pending.has(uid)) return failed2("EBUSY", "sudo: another request is pending");
+    this.pending.add(uid);
+    try {
+      return await work();
     } finally {
-      this.pending.delete(cred.ruid);
+      this.pending.delete(uid);
     }
   }
+  stamped(s, answer2) {
+    if (answer2.person && !s.parsed.reset) this.timestamps.stamp(s.owner, s.policy);
+  }
+  logged(s, cwd, argv) {
+    const { caller, self, target, owner, policy } = s;
+    const type = policy.type === "tty" && !owner.terminal ? "ppid" : policy.type;
+    const tty = owner.terminal?.tty ?? caller.tty ?? "unknown";
+    const command = argv.map(quoteWord).join(" ");
+    (this.o.warn ?? console.warn)(
+      `sudo: ${self.name} : TTY=${tty} ; PWD=${quoteWord(cwd)} ; USER=${target.name} ; TIMESTAMP=${type} ; COMMAND=${command}`
+    );
+  }
   async always(self, target, cwd, argv, shown2, grant) {
     if (!shown2 || !recordable(cwd, argv)) return { ...grant(), notice: RAN_ONCE };
     if (!await this.remember(self, target, cwd, argv)) {
@@ -16211,7 +16495,7 @@ var Sudo = class {
     }
     return grant();
   }
-  listed(self, root, rules) {
+  listed(self, root, rules, defaults2) {
     const host = this.o.hostname;
     if (root) {
       return {
@@ -16224,11 +16508,20 @@ var Sudo = class {
       return failed2("EPERM", `User ${self.name} is not allowed to run sudo on ${host}.`);
     }
     const lines2 = rules.map(described).join("\n");
-    return { list: `User ${self.name} may run the following commands on ${host}:
+    const params = defaults2.flatMap((d) => d.params).join(", ");
+    const matching = params === "" ? "" : `Matching Defaults entries for ${self.name} on ${host}:
+    ${params}
+
+`;
+    return {
+      list: `${matching}User ${self.name} may run the following commands on ${host}:
 ${lines2}
-` };
+`
+    };
   }
-  async ask(caller, self, target, argv, path, cwd, requester) {
+  async ask(s, asked) {
+    const { caller, self, target, signal: requester } = s;
+    const { argv, path, cwd } = asked;
     const { approve } = this.o;
     if (!approve || requester.aborted) return failed2("EACCES", DENIED2);
     const createdAt = Date.now();
@@ -16247,9 +16540,11 @@ ${lines2}
       ...caller.tty ? { tty: caller.tty } : {},
       createdAt,
       expiresAt: createdAt + timeout,
-      always: recordable(cwd, [path, ...argv]),
+      always: asked.validate ? false : recordable(cwd, [path, ...argv]),
       stdin: caller.stdin,
-      rootOnly: await this.rootOnly(cwd, argv.slice(1))
+      rootOnly: asked.validate ? {} : await this.rootOnly(cwd, argv.slice(1)),
+      ...asked.validate ? { validate: true } : {},
+      timestamp: true
     };
     const control = new AbortController();
     const timer = setTimeout(() => control.abort("expired"), timeout);
@@ -16259,9 +16554,8 @@ ${lines2}
     try {
       const answer2 = await answerOf(approve, req, control.signal);
       if (answer2 === ABORTED) return ended();
-      if (answer2 === "once" || answer2 === "always") {
-        return control.signal.aborted ? ended() : answer2;
-      }
+      const approved = approvalOf(answer2);
+      if (approved) return control.signal.aborted ? ended() : approved;
       return failed2("EACCES", denialText(answer2));
     } finally {
       clearTimeout(timer);
@@ -19818,7 +20112,7 @@ function replaced(text, values) {
   for (const [ph, value2] of Object.entries(values)) out = out.split(ph).join(binary(value2));
   return out;
 }
-function usable(values) {
+function usable2(values) {
   const out = {};
   for (const [ph, value2] of Object.entries(values ?? {}))
     if (encoder8.encode(value2).length >= MIN_VALUE) out[ph] = value2;
@@ -19833,7 +20127,7 @@ async function substituteHead(head, ask) {
   if (!request || !found || found.length !== 1) return void 0;
   const at = found[0];
   if (at.placeholders.length > SESSION_PLACEHOLDERS) return void 0;
-  const values = usable(
+  const values = usable2(
     await ask(`header:${at.name}`, at.placeholders, {
       method: request[1],
       path: request[2]
@@ -20143,7 +20437,7 @@ async function cleartext(message3, asks) {
   const placeholders = placeholdersIn(password);
   if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS)
     return { bytes: message3, done: true };
-  const values = usable(await asks.cleartext(placeholders));
+  const values = usable2(await asks.cleartext(placeholders));
   if (Object.keys(values).length === 0) return { bytes: message3, done: true };
   return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
 }
@@ -20208,7 +20502,7 @@ var PgClient = class {
     const x = got.exchange;
     const binding = this.header === END_POINT ? this.server.binding : void 0;
     const serverFinal = `c=${channelOf(this.header, binding)},r=${got.nonce}`;
-    const values = usable(
+    const values = usable2(
       await this.asks.scram({
         clientFirstBare: x.clientFirstBare,
         serverFirst: x.serverFirst,
@@ -20257,7 +20551,7 @@ function decoded(b642) {
 async function swapped(text, position, ask) {
   const placeholders = placeholdersIn(text);
   if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
-  const values = usable(await ask(position, placeholders));
+  const values = usable2(await ask(position, placeholders));
   if (Object.keys(values).length === 0) return void 0;
   return { text: replaced(text, values), values };
 }
@@ -20355,7 +20649,7 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-function modeOf(start2) {
+function modeOf2(start2) {
   const sniffs = [
     ["http1", sniffHttp1(start2)],
     ["smtp", sniffSmtp(start2)],
@@ -20464,7 +20758,7 @@ var SessionWriter = class {
     joined5.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined5;
-    if (this.mode === "sniff") this.mode = modeOf(latin12(joined5.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "sniff") this.mode = modeOf2(latin12(joined5.subarray(0, 8))) ?? "sniff";
     if (this.mode === "pg" && !this.sawPg) {
       this.sawPg = true;
       if (!this.s.verified) void this.proof("pg");
@@ -28904,8 +29198,8 @@ var OpfsFs = class {
     const [entry] = await this.meta.get([target]);
     if (entry?.fifo || entry?.socket) throw fsError("ENXIO", path);
     const kept = fresh3 ? cached : this.files.get(target);
-    const usable2 = kept && performance.now() - (this.found.get(kept) ?? -CHECK_MS) < CHECK_MS;
-    return [usable2 ? kept : void 0, target, true];
+    const usable3 = kept && performance.now() - (this.found.get(kept) ?? -CHECK_MS) < CHECK_MS;
+    return [usable3 ? kept : void 0, target, true];
   }
   async writeAt(handle, target, path, offset, bytes) {
     await this.counting(target);
@@ -31901,6 +32195,7 @@ var SUDO_SOURCE = [
   "    await say(1, answer.list);",
   "    return 0;",
   "  }",
+  "  if (answer.done === true) return 0;",
   "  if (answer.run !== undefined) {",
   "    try {",
   "      pid = (await ctx.spawn({ argv: answer.run, pgid: 0 })).pid;",
@@ -32536,6 +32831,7 @@ var Launcher = class {
       );
     }
     this.users = new UserDb(this.fs, this.owners);
+    const { sudoClock } = options;
     this.sudoer = new Sudo({
       fs: this.fs,
       users: this.users,
@@ -32545,7 +32841,8 @@ var Launcher = class {
       pnpmHome: this.pnpmHome,
       backing: (path, cwd) => this.backing(path, cwd),
       approve: options.approve,
-      timeoutMs: options.sudoTimeoutMs
+      timeoutMs: options.sudoTimeoutMs,
+      now: sudoClock ? () => sudoClock.now() : void 0
     });
     this.cron = this.cronService(options.cron);
     void this.unlinked.sweep("/");
@@ -33951,11 +34248,26 @@ var Launcher = class {
       pid: this.jobs.shown(pid),
       tags: this.tagsOf(pid),
       tty: this.described.get(pid)?.tty,
+      ...this.timestampOwner(pid),
       stdin,
       report
     };
     return this.sudoer.request(caller, call, signal);
   }
+  timestampOwner(pid) {
+    const sid = this.jobs.sidOf(pid);
+    const tty = this.jobs.controllingTerminal(pid)?.name;
+    const leader = sid === void 0 ? void 0 : this.startedOf(sid);
+    const host = this.jobs.shownParent(pid) ?? this.jobs.shown(pid);
+    const started = this.startedOf(host);
+    return {
+      ...tty && sid !== void 0 && leader !== void 0 ? { terminal: { tty, sid, started: leader } } : {},
+      ...started === void 0 ? {} : { parent: { pid: host, started } }
+    };
+  }
+  startedOf(shown2) {
+    return this.running(shown2) ? this.described.get(shown2)?.started : void 0;
+  }
   visudo(pid, call) {
     return this.sudoer.check(this.credOf(pid), call);
   }
@@ -37642,6 +37954,7 @@ async function createNodeKernel(options = {}) {
     ...options.clipboard ? { clipboard: options.clipboard } : {},
     ...options.requests ? { embedder: checkedRequests(options.requests) } : {},
     ...options.approve ? { approve: options.approve } : {},
+    ...options.sudo?.clock ? { sudoClock: options.sudo.clock } : {},
     ...options.wasmMemories ? { wasmMemories: options.wasmMemories } : {},
     cron: { lock: cronLock(root), ...options.cron?.clock ? { clock: options.cron.clock } : {} }
   });