@ai-ecoverse/slicc-kernel 1.176.2 → 1.178.0

package/dist/types/index.d.ts

@@ -30,6 +30,7 @@ export type { RouteTable } from './kernel/net/routes.js';
 export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { NetworkUplink, ResolveAnswer, ResolveFamily, UplinkTraits, } from './kernel/net/uplink.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, SealedRequester, } from './kernel/sealed.js';
+export type { SealedOAuthConfig, SealedOAuthError, SealedOAuthIdentity, SealedOAuthReply, SealedOAuthRequest, SealedOAuthState, SealedOAuthStatus, } from './kernel/sealed-oauth.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';
@@ -44,7 +45,7 @@ export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js'
 export type { JsThread, JsThreadContext, JsThreadSpawnOptions } from './process/js/js-thread.js';
 export type { JsTermios, JsTty, JsTtySize } from './process/js/js-tty.js';
 export type { JsWebSocket, JsWebSocketClose, JsWebSocketMessage, JsWebSocketOptions, } from './process/js/js-websocket.js';
-export type { ApproveHook, SudoAnswer, SudoDenial, SudoRequest, SudoStdin } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export { type FetchTransportOptions, fetchTransport, type HeaderList, type NetworkExit, type NetworkRedirectPolicy, type NetworkRequest, type NetworkResponse, type NetworkTraits, type NetworkTransport, type NetworkWebSocket, type NetworkWebSocketRequest, } from './transport.js';
 export type { Account, AddGroup, AddUser, Group, RemoveUser } from './users.js';
 export interface NetworkOptions {

package/dist/types/kernel/sealed-oauth.d.ts

@@ -0,0 +1,74 @@
+export declare const SEALED_OAUTH_TIMEOUT_MS = 45000;
+export declare const SEALED_OAUTH_OPS: ReadonlySet<string>;
+export interface SealedOAuthIdentity {
+    name: string;
+    provider: string;
+    account: string;
+}
+export interface SealedOAuthConfig {
+    tokenUrl: string;
+    clientId: string;
+    authMethod: 'none';
+    scope?: string;
+    resource?: string;
+}
+export type SealedOAuthRequest = {
+    v: 1;
+} & ({
+    op: 'capabilities';
+} | (SealedOAuthIdentity & {
+    op: 'oauthGrant';
+    accessToken: string;
+    refreshToken?: string;
+    tokenType?: string;
+    expiresAt?: number;
+    oauth: SealedOAuthConfig;
+}) | (SealedOAuthIdentity & {
+    op: 'oauthStatus' | 'oauthRefresh' | 'oauthRemove';
+}));
+export type SealedOAuthState = 'ready' | 'refreshing' | 'expired' | 'reauth-required' | 'removed' | 'locked';
+export interface SealedOAuthStatus {
+    v: 1;
+    placeholder: string;
+    state: SealedOAuthState;
+    expiresAt: number | null;
+    refreshable: boolean;
+}
+declare const MESSAGES: {
+    readonly EINVAL: 'Invalid OAuth request';
+    readonly ENOENT: 'OAuth credential not found';
+    readonly EEXIST: 'OAuth credential identity conflicts';
+    readonly EACCES: 'OAuth operation refused';
+    readonly EAGAIN: 'OAuth credential changed; try again';
+    readonly ENOTSUP: 'OAuth operation is not supported';
+    readonly ENOTCONN: 'Vault is unavailable';
+    readonly ETIMEDOUT: 'Vault request timed out';
+    readonly EIO: 'Invalid vault reply';
+};
+declare const CAUSES: {
+    readonly 'vault-locked': 'Vault is locked';
+    readonly 'oauth-reauth-required': 'OAuth sign-in is required';
+    readonly 'oauth-refresh-failed': 'OAuth refresh failed';
+};
+export interface SealedOAuthError {
+    v: 1;
+    error: {
+        code: keyof typeof MESSAGES;
+        cause?: keyof typeof CAUSES;
+        message: string;
+    };
+}
+export type SealedOAuthReply = SealedOAuthStatus | {
+    v: 1;
+    removed: true;
+} | {
+    v: 1;
+    capabilities: {
+        kernelOAuth?: 1;
+    };
+} | SealedOAuthError;
+export declare function sealedOAuthOperation(op: string): boolean;
+export declare function validateSealedOAuth(req: Record<string, unknown>): void;
+export declare function sealedOAuthError(code?: keyof typeof MESSAGES, cause?: keyof typeof CAUSES): SealedOAuthError;
+export declare function sealedOAuthReply(op: string, value: unknown): SealedOAuthReply;
+export {};

package/dist/types/kernel/sealed.d.ts

@@ -89,6 +89,7 @@ export declare class SealedBroker {
     readonly tickets: TicketBook;
     readonly sessions: SessionScrubs;
     askTimeoutMs: number;
+    oauthTimeoutMs: number;
     userOf: (uid: number) => Promise<string | undefined>;
     factsOf: (pid: number) => Promise<SealedProcessFacts | undefined>;
     constructor(hook: SealedHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => readonly string[] | undefined);

package/dist/types/launcher.d.ts

@@ -76,6 +76,9 @@ export interface LauncherOptions {
     embedder?: EmbedderHook;
     approve?: ApproveHook;
     sudoTimeoutMs?: number;
+    sudoClock?: {
+        now(): number;
+    };
     protect?: Protection;
     cron?: CronOptions;
     moduleUrl?: ModuleUrlMaker;
@@ -395,6 +398,8 @@ export declare class Launcher {
     private threadsOf;
     private crontab;
     private sudo;
+    private timestampOwner;
+    private startedOf;
     private visudo;
     private spawner;
     private childGroup;

package/dist/types/node.d.ts

@@ -29,11 +29,12 @@ export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
 export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
 export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, SealedRequester, } from './kernel/sealed.js';
+export type { SealedOAuthConfig, SealedOAuthError, SealedOAuthIdentity, SealedOAuthReply, SealedOAuthRequest, SealedOAuthState, SealedOAuthStatus, } from './kernel/sealed-oauth.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';
 export type { MountEntry, MountSpec } from './mount/mount-fs.js';
-export type { ApproveHook, SudoAnswer, SudoDenial, SudoRequest, SudoStdin } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export type { NetworkRedirectPolicy } from './transport.js';
 export { fetchTransport, type NetworkTransport } from './transport.js';
 export { memoryRoot };
@@ -70,6 +71,11 @@ export interface NodeKernelOptions {
     cron?: {
         clock?: CronClock;
     };
+    sudo?: {
+        clock?: {
+            now(): number;
+        };
+    };
     compileCache?: string | false;
     warmWorker?: boolean;
     warmWorkers?: number;

package/dist/types/process/js/js-context.d.ts

@@ -177,6 +177,8 @@ export type JsSudoAnswer = {
     list: string;
 } | {
     run: string[];
+} | {
+    done: true;
 } | {
     pid: number;
 };

package/dist/types/sudo-timestamp.d.ts

@@ -0,0 +1,28 @@
+import type { TimestampType } from './sudoers.js';
+export declare const TIMESTAMPS_MAX = 64;
+export interface TimestampOwner {
+    uid: number;
+    terminal?: {
+        tty: string;
+        sid: number;
+        started: number;
+    } | undefined;
+    parent?: {
+        pid: number;
+        started: number;
+    } | undefined;
+}
+export interface TimestampPolicy {
+    type: TimestampType;
+    minutes: number;
+}
+export declare function timestampKey(owner: TimestampOwner, type: TimestampType): string | undefined;
+export declare class Timestamps {
+    private readonly users;
+    private readonly now;
+    constructor(now: () => number);
+    current(owner: TimestampOwner, policy: TimestampPolicy): boolean;
+    stamp(owner: TimestampOwner, policy: TimestampPolicy): boolean;
+    invalidate(owner: TimestampOwner, type: TimestampType): void;
+    remove(uid: number): void;
+}

package/dist/types/sudo.d.ts

@@ -1,5 +1,6 @@
 import type { KernelFs, UsersMode } from './fs/types.js';
 import type { Cred } from './kernel/cred.js';
+import { type TimestampOwner } from './sudo-timestamp.js';
 import { type UserDb } from './users.js';
 export { SUDOERS, SUDOERS_D } from './sudoers.js';
 export declare const SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
@@ -23,6 +24,8 @@ export interface SudoRequest {
     always: boolean;
     stdin?: SudoStdin;
     rootOnly?: Record<string, boolean>;
+    validate?: true;
+    timestamp?: true;
 }
 export type SudoStdin = 'tty' | 'none' | 'pipe' | 'file';
 export type SudoAnswer = 'once' | 'always' | 'deny';
@@ -30,9 +33,14 @@ export interface SudoDenial {
     answer: 'deny';
     message: string;
 }
+export interface SudoApproval {
+    answer: 'once' | 'always';
+    timestamp: true;
+}
+export type SudoReply = SudoAnswer | SudoDenial | SudoApproval;
 export type ApproveHook = (req: SudoRequest, options: {
     signal: AbortSignal;
-}) => SudoAnswer | SudoDenial | Promise<SudoAnswer | SudoDenial>;
+}) => SudoReply | Promise<SudoReply>;
 export interface SudoCall {
     op: 'proc-sudo';
     args: string[];
@@ -54,6 +62,8 @@ export type SudoResult = {
     list: string;
 } | {
     run: string[];
+} | {
+    done: true;
 } | {
     grant: SudoGrant;
     notice?: string;
@@ -63,6 +73,8 @@ export interface SudoCaller {
     pid: number;
     tags?: readonly string[] | undefined;
     tty?: string | null | undefined;
+    terminal?: TimestampOwner['terminal'];
+    parent?: TimestampOwner['parent'];
     stdin: SudoStdin;
     report?: ((line: string) => Promise<void>) | undefined;
 }
@@ -89,11 +101,13 @@ export interface SudoOptions {
     approve?: ApproveHook | undefined;
     timeoutMs?: number | undefined;
     warn?: (message: string) => void;
+    now?: (() => number) | undefined;
 }
 export declare class Sudo {
     private readonly o;
     private readonly warned;
     private readonly pending;
+    private readonly timestamps;
     private next;
     constructor(options: SudoOptions);
     private warn;
@@ -114,6 +128,11 @@ export declare class Sudo {
     private untrusted;
     private locate;
     request(caller: SudoCaller, call: SudoCall, signal: AbortSignal): Promise<SudoResult>;
+    private command;
+    private validate;
+    private pendingFor;
+    private stamped;
+    private logged;
     private always;
     private listed;
     private ask;

package/dist/types/sudoers.d.ts

@@ -16,8 +16,27 @@ export interface Rule {
     stdin?: 'none';
     cmnd: Command | '*';
 }
+export type TimestampType = 'tty' | 'ppid' | 'global';
+export interface Settings {
+    timestampTimeout?: number;
+    timestampType?: TimestampType;
+}
+export interface DefaultsEntry {
+    who: string[] | null;
+    settings: Settings;
+    params: string[];
+}
+export interface Resolved {
+    timestampTimeout: number;
+    timestampType: TimestampType;
+    matching: DefaultsEntry[];
+}
+export declare const TIMESTAMP_TIMEOUT = 5;
+export declare const TIMESTAMP_TYPE: TimestampType;
 export type PolicyLine = {
     rules: Rule[];
+} | {
+    defaults: DefaultsEntry;
 } | {
     error: string;
 } | null;
@@ -26,12 +45,16 @@ export declare function splitWords(text: string): string[] | undefined;
 export declare function quoteWord(word: string): string;
 export declare function commandMatches(cmnd: Command | '*', argv: readonly string[]): boolean;
 export declare function commandText(cmnd: Command): string;
+export declare function resolveDefaults(entries: readonly DefaultsEntry[], applies: (who: string) => boolean): Resolved;
+export declare function defaultsText(entries: readonly DefaultsEntry[]): string[];
 export declare function parseLine(line: string, file?: string): PolicyLine;
 export interface PolicyError {
     line: number;
     message: string;
 }
-export declare function parsePolicy(text: string, file?: string): {
+export interface Policy {
     rules: Rule[];
+    defaults: DefaultsEntry[];
     errors: PolicyError[];
-};
+}
+export declare function parsePolicy(text: string, file?: string): Policy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.176.2",
+  "version": "1.178.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.47.2",
+    "@ai-ecoverse/slicc-cdp": "1.47.4",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",
@@ -78,7 +78,7 @@
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
     "@ai-ecoverse/wasi-rustc": "1.98.1-10",
     "@ai-ecoverse/wasi-zig": "0.16.0-20",
-    "@ai-ecoverse/wasix-python": "3.15.0-7",
+    "@ai-ecoverse/wasix-python": "3.15.0-8",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-15",
     "@ai-ecoverse/wasm-curl": "8.22.0-10",