@ai-ecoverse/slicc-kernel 1.178.0 → 1.178.2

package/dist/types/index.d.ts

@@ -45,7 +45,7 @@ export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js'
 export type { JsThread, JsThreadContext, JsThreadSpawnOptions } from './process/js/js-thread.js';
 export type { JsTermios, JsTty, JsTtySize } from './process/js/js-tty.js';
 export type { JsWebSocket, JsWebSocketClose, JsWebSocketMessage, JsWebSocketOptions, } from './process/js/js-websocket.js';
-export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoFile, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export { type FetchTransportOptions, fetchTransport, type HeaderList, type NetworkExit, type NetworkRedirectPolicy, type NetworkRequest, type NetworkResponse, type NetworkTraits, type NetworkTransport, type NetworkWebSocket, type NetworkWebSocketRequest, } from './transport.js';
 export type { Account, AddGroup, AddUser, Group, RemoveUser } from './users.js';
 export interface NetworkOptions {

package/dist/types/kernel/children.d.ts

@@ -65,9 +65,14 @@ export declare class SpawnError extends Error {
     readonly code: KernelErrno;
     constructor(code: KernelErrno);
 }
+export declare class ChangedError extends SpawnError {
+    readonly notice: string;
+    constructor(notice: string);
+}
 export interface SpawnGrant {
     cred: Cred;
     caller: Cred;
+    files?: Readonly<Record<string, string>>;
 }
 export type ChildSpawner = (req: ChildSpawnRequest, fds: FdTable, grant?: SpawnGrant) => Promise<ChildHandle>;
 export type ChildForker = (state: ForkState, fds: FdTable) => Promise<ChildHandle>;

package/dist/types/kernel/net/http-syscalls.d.ts

@@ -1,7 +1,7 @@
 import type { SyncFsResult } from '../../realm/sync-fs-wire.js';
 import type { SealedCaller } from '../sealed.js';
 import { type KernelLoopback } from './loopback-transport.js';
-import type { HeaderList, RealmTransport } from './transport.js';
+import { type HeaderList, type RealmTransport } from './transport.js';
 import { type WsSyscall } from './ws-syscalls.js';
 export interface HttpRequestBody {
     url: string;

package/dist/types/kernel/net/remote-transport.d.ts

@@ -1,5 +1,5 @@
 import type { SealedCaller } from '../sealed.js';
-import type { HeaderList, RealmRedirectHop, RealmRedirectPolicy, RealmTransport, RealmTransportRequest, RealmTransportResponse, RealmTransportTraits, RealmWebSocket, RealmWebSocketMessage, RealmWebSocketRequest } from './transport.js';
+import { FORBIDDEN_HEADER, type HeaderList, type RealmRedirectHop, type RealmRedirectPolicy, type RealmTransport, type RealmTransportRequest, type RealmTransportResponse, type RealmTransportTraits, type RealmWebSocket, type RealmWebSocketMessage, type RealmWebSocketRequest } from './transport.js';
 export type TransportCall = {
     net: 'fetch';
     nid: number;
@@ -74,7 +74,7 @@ export type TransportReply = {
     message: string;
     status?: number;
     code?: string;
-    detail?: 'transport';
+    detail?: 'transport' | typeof FORBIDDEN_HEADER;
 } | {
     net: 'ws-opened';
     nid: number;
@@ -99,7 +99,7 @@ export interface TransportPort {
 export declare class TransportError extends Error {
     readonly status: number | undefined;
     readonly code: string | undefined;
-    readonly detail: 'transport' | undefined;
+    readonly detail: 'transport' | typeof FORBIDDEN_HEADER | undefined;
     constructor(message: string, status?: number, code?: string, detail?: unknown);
 }
 export declare function unfollowed(redirect?: RealmRedirectPolicy): boolean;

package/dist/types/kernel/net/transport.d.ts

@@ -1,4 +1,5 @@
 import type { SealedCaller } from '../sealed.js';
+export declare const FORBIDDEN_HEADER = "forbidden-header";
 export type HeaderList = ReadonlyArray<readonly [name: string, value: string]>;
 export type RealmRedirectPolicy = 'follow' | 'manual' | 'error';
 export interface RealmTransportRequest {

package/dist/types/launcher.d.ts

@@ -335,6 +335,9 @@ export declare class Launcher {
     private interpreterChain;
     private commandFile;
     private trustedFiles;
+    private unchanged;
+    private pinOf;
+    private pinnedBytes;
     private grantedCwd;
     private binfmtManifests;
     private backing;

package/dist/types/node.d.ts

@@ -34,7 +34,7 @@ export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';
 export type { MountEntry, MountSpec } from './mount/mount-fs.js';
-export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoFile, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export type { NetworkRedirectPolicy } from './transport.js';
 export { fetchTransport, type NetworkTransport } from './transport.js';
 export { memoryRoot };

package/dist/types/realm/sync-fs-wire.d.ts

@@ -47,7 +47,7 @@ export type SyncFsResult = {
     message: string;
     direct?: true;
     dev?: string;
-    detail?: 'transport' | 'placeholder';
+    detail?: 'transport' | 'placeholder' | 'forbidden-header';
 };
 export declare const SYNC_FS_REQUEST_TIMEOUT_MS = 25000;
 export declare const SYNC_FS_READ_ONLY: ReadonlySet<string>;

package/dist/types/sudo.d.ts

@@ -6,6 +6,8 @@ export { SUDOERS, SUDOERS_D } from './sudoers.js';
 export declare const SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 export declare const DEFAULT_SUDOERS = "%sudo Cmnd *\n";
 export declare const SUDO_TIMEOUT_MS = 300000;
+export declare function changedText(file: string): string;
+export declare function changedFile(approved: Readonly<Record<string, string>>, now: Readonly<Record<string, string>>): string | undefined;
 export interface SudoRequest {
     id: string;
     kind: 'sudo';
@@ -24,9 +26,14 @@ export interface SudoRequest {
     always: boolean;
     stdin?: SudoStdin;
     rootOnly?: Record<string, boolean>;
+    userWritable?: SudoFile[];
     validate?: true;
     timestamp?: true;
 }
+export interface SudoFile {
+    path: string;
+    sha256: string;
+}
 export type SudoStdin = 'tty' | 'none' | 'pipe' | 'file';
 export type SudoAnswer = 'once' | 'always' | 'deny';
 export interface SudoDenial {
@@ -54,6 +61,7 @@ export interface SudoGrant {
     cwd: string;
     cred: Cred;
     caller: Cred;
+    files: Record<string, string>;
 }
 export type SudoResult = {
     error: string;
@@ -125,7 +133,10 @@ export declare class Sudo {
     private lookup;
     private canonical;
     reachable(cred: Cred, cwd: string): Promise<boolean>;
-    private untrusted;
+    real(file: string): Promise<string>;
+    digests(files: readonly string[]): Promise<Record<string, string>>;
+    private bound;
+    private writable;
     private locate;
     request(caller: SudoCaller, call: SudoCall, signal: AbortSignal): Promise<SudoResult>;
     private command;

package/dist/types/sudoers.d.ts

@@ -1,7 +1,7 @@
 export declare const SUDOERS = "/etc/sudoers";
 export declare const SUDOERS_D = "/etc/sudoers.d";
 export declare const NAME: RegExp;
-export declare const KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] Cmnd <command\u2026|*>";
+export declare const KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] [Sha256 <file>=<sha256>\u2026] Cmnd <command\u2026|*>";
 export declare const SUDOERS_SYNTAX = "<user|%group|ALL> ALL=[(<target>[,<target>\u2026])] [NOPASSWD:] <command\u2026|ALL>";
 export type Pattern = (string | null)[];
 export interface Command {
@@ -14,6 +14,7 @@ export interface Rule {
     target: string;
     cwd?: string;
     stdin?: 'none';
+    sha256?: Record<string, string>;
     cmnd: Command | '*';
 }
 export type TimestampType = 'tty' | 'ppid' | 'global';
@@ -45,6 +46,7 @@ export declare function splitWords(text: string): string[] | undefined;
 export declare function quoteWord(word: string): string;
 export declare function commandMatches(cmnd: Command | '*', argv: readonly string[]): boolean;
 export declare function commandText(cmnd: Command): string;
+export declare function sha256Text(files: Readonly<Record<string, string>>): string;
 export declare function resolveDefaults(entries: readonly DefaultsEntry[], applies: (who: string) => boolean): Resolved;
 export declare function defaultsText(entries: readonly DefaultsEntry[]): string[];
 export declare function parseLine(line: string, file?: string): PolicyLine;

package/dist/types/transport.d.ts

@@ -1,5 +1,5 @@
 import type { TransportCall, TransportReply } from './kernel/net/remote-transport.js';
-import type { HeaderList, RealmRedirectHop, RealmRedirectPolicy, RealmTransport, RealmTransportExit, RealmTransportRequest, RealmTransportResponse, RealmTransportTraits, RealmWebSocket, RealmWebSocketRequest } from './kernel/net/transport.js';
+import { type HeaderList, type RealmRedirectHop, type RealmRedirectPolicy, type RealmTransport, type RealmTransportExit, type RealmTransportRequest, type RealmTransportResponse, type RealmTransportTraits, type RealmWebSocket, type RealmWebSocketRequest } from './kernel/net/transport.js';
 import { type WebSocketConstructor } from './websocket-transport.js';
 export type { HeaderList, RealmRedirectHop as NetworkRedirectHop, RealmRedirectPolicy as NetworkRedirectPolicy, RealmTransport as NetworkTransport, RealmTransportExit as NetworkExit, RealmTransportRequest as NetworkRequest, RealmTransportResponse as NetworkResponse, RealmTransportTraits as NetworkTraits, RealmWebSocket as NetworkWebSocket, RealmWebSocketRequest as NetworkWebSocketRequest, };
 export interface FetchTransportOptions {
@@ -11,6 +11,7 @@ export interface FetchTransportOptions {
     webSocketHeaders?: boolean;
     redirect?: 'follow' | 'manual';
     streamingBodies?: boolean;
+    forbiddenHeaders?: 'send' | 'refuse';
 }
 export declare const SEND_BUFFER: number;
 export declare function fetchTransport(options?: FetchTransportOptions): RealmTransport;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.178.0",
+  "version": "1.178.2",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -70,9 +70,9 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.47.4",
+    "@ai-ecoverse/slicc-cdp": "1.47.5",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
-    "@ai-ecoverse/slicc-shared-web": "2.13.10",
+    "@ai-ecoverse/slicc-shared-web": "2.14.0",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",