@ai-ecoverse/slicc-kernel 1.178.1 → 1.178.3

package/dist/process-worker.js

@@ -3180,7 +3180,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.178.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.178.3" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/types/index.d.ts

@@ -45,7 +45,7 @@ export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js'
 export type { JsThread, JsThreadContext, JsThreadSpawnOptions } from './process/js/js-thread.js';
 export type { JsTermios, JsTty, JsTtySize } from './process/js/js-tty.js';
 export type { JsWebSocket, JsWebSocketClose, JsWebSocketMessage, JsWebSocketOptions, } from './process/js/js-websocket.js';
-export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoFile, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export { type FetchTransportOptions, fetchTransport, type HeaderList, type NetworkExit, type NetworkRedirectPolicy, type NetworkRequest, type NetworkResponse, type NetworkTraits, type NetworkTransport, type NetworkWebSocket, type NetworkWebSocketRequest, } from './transport.js';
 export type { Account, AddGroup, AddUser, Group, RemoveUser } from './users.js';
 export interface NetworkOptions {

package/dist/types/kernel/children.d.ts

@@ -65,9 +65,14 @@ export declare class SpawnError extends Error {
     readonly code: KernelErrno;
     constructor(code: KernelErrno);
 }
+export declare class ChangedError extends SpawnError {
+    readonly notice: string;
+    constructor(notice: string);
+}
 export interface SpawnGrant {
     cred: Cred;
     caller: Cred;
+    files?: Readonly<Record<string, string>>;
 }
 export type ChildSpawner = (req: ChildSpawnRequest, fds: FdTable, grant?: SpawnGrant) => Promise<ChildHandle>;
 export type ChildForker = (state: ForkState, fds: FdTable) => Promise<ChildHandle>;

package/dist/types/launcher.d.ts

@@ -335,6 +335,9 @@ export declare class Launcher {
     private interpreterChain;
     private commandFile;
     private trustedFiles;
+    private unchanged;
+    private pinOf;
+    private pinnedBytes;
     private grantedCwd;
     private binfmtManifests;
     private backing;

package/dist/types/node.d.ts

@@ -34,7 +34,7 @@ export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';
 export type { MountEntry, MountSpec } from './mount/mount-fs.js';
-export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
+export type { ApproveHook, SudoAnswer, SudoApproval, SudoDenial, SudoFile, SudoReply, SudoRequest, SudoStdin, } from './sudo.js';
 export type { NetworkRedirectPolicy } from './transport.js';
 export { fetchTransport, type NetworkTransport } from './transport.js';
 export { memoryRoot };

package/dist/types/sudo-timestamp.d.ts

@@ -16,13 +16,15 @@ export interface TimestampPolicy {
     type: TimestampType;
     minutes: number;
 }
+export type BoundHashes = Readonly<Record<string, string>>;
 export declare function timestampKey(owner: TimestampOwner, type: TimestampType): string | undefined;
 export declare class Timestamps {
     private readonly users;
     private readonly now;
     constructor(now: () => number);
-    current(owner: TimestampOwner, policy: TimestampPolicy): boolean;
-    stamp(owner: TimestampOwner, policy: TimestampPolicy): boolean;
+    current(owner: TimestampOwner, policy: TimestampPolicy, bound?: BoundHashes): boolean;
+    stamp(owner: TimestampOwner, policy: TimestampPolicy, bound?: BoundHashes): boolean;
     invalidate(owner: TimestampOwner, type: TimestampType): void;
     remove(uid: number): void;
+    private drop;
 }

package/dist/types/sudo.d.ts

@@ -6,6 +6,8 @@ export { SUDOERS, SUDOERS_D } from './sudoers.js';
 export declare const SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 export declare const DEFAULT_SUDOERS = "%sudo Cmnd *\n";
 export declare const SUDO_TIMEOUT_MS = 300000;
+export declare function changedText(file: string): string;
+export declare function changedFile(approved: Readonly<Record<string, string>>, now: Readonly<Record<string, string>>): string | undefined;
 export interface SudoRequest {
     id: string;
     kind: 'sudo';
@@ -24,9 +26,14 @@ export interface SudoRequest {
     always: boolean;
     stdin?: SudoStdin;
     rootOnly?: Record<string, boolean>;
+    userWritable?: SudoFile[];
     validate?: true;
     timestamp?: true;
 }
+export interface SudoFile {
+    path: string;
+    sha256: string;
+}
 export type SudoStdin = 'tty' | 'none' | 'pipe' | 'file';
 export type SudoAnswer = 'once' | 'always' | 'deny';
 export interface SudoDenial {
@@ -54,6 +61,7 @@ export interface SudoGrant {
     cwd: string;
     cred: Cred;
     caller: Cred;
+    files: Record<string, string>;
 }
 export type SudoResult = {
     error: string;
@@ -125,7 +133,10 @@ export declare class Sudo {
     private lookup;
     private canonical;
     reachable(cred: Cred, cwd: string): Promise<boolean>;
-    private untrusted;
+    real(file: string): Promise<string>;
+    digests(files: readonly string[]): Promise<Record<string, string>>;
+    private bound;
+    private writable;
     private locate;
     request(caller: SudoCaller, call: SudoCall, signal: AbortSignal): Promise<SudoResult>;
     private command;

package/dist/types/sudoers.d.ts

@@ -1,7 +1,7 @@
 export declare const SUDOERS = "/etc/sudoers";
 export declare const SUDOERS_D = "/etc/sudoers.d";
 export declare const NAME: RegExp;
-export declare const KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] Cmnd <command\u2026|*>";
+export declare const KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] [Sha256 <file>=<sha256>\u2026] Cmnd <command\u2026|*>";
 export declare const SUDOERS_SYNTAX = "<user|%group|ALL> ALL=[(<target>[,<target>\u2026])] [NOPASSWD:] <command\u2026|ALL>";
 export type Pattern = (string | null)[];
 export interface Command {
@@ -14,6 +14,7 @@ export interface Rule {
     target: string;
     cwd?: string;
     stdin?: 'none';
+    sha256?: Record<string, string>;
     cmnd: Command | '*';
 }
 export type TimestampType = 'tty' | 'ppid' | 'global';
@@ -45,6 +46,7 @@ export declare function splitWords(text: string): string[] | undefined;
 export declare function quoteWord(word: string): string;
 export declare function commandMatches(cmnd: Command | '*', argv: readonly string[]): boolean;
 export declare function commandText(cmnd: Command): string;
+export declare function sha256Text(files: Readonly<Record<string, string>>): string;
 export declare function resolveDefaults(entries: readonly DefaultsEntry[], applies: (who: string) => boolean): Resolved;
 export declare function defaultsText(entries: readonly DefaultsEntry[]): string[];
 export declare function parseLine(line: string, file?: string): PolicyLine;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.178.1",
+  "version": "1.178.3",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -70,9 +70,9 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.47.4",
+    "@ai-ecoverse/slicc-cdp": "1.47.5",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
-    "@ai-ecoverse/slicc-shared-web": "2.13.10",
+    "@ai-ecoverse/slicc-shared-web": "2.14.2",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",