@ai-ecoverse/slicc-kernel 1.20.0 → 1.21.0

package/dist/kernel-worker.js

@@ -748,7 +748,7 @@ var KernelSocket = class _KernelSocket {
     const own = this.changes.wait(signal);
     if (this.state !== "connected" || !this.link) return own;
     const waits = [own, this.link.rx.changed(signal), this.link.tx.changed(signal)];
-    for (const wait of waits) wait.catch(() => void 0);
+    for (const wait2 of waits) wait2.catch(() => void 0);
     return pipeCall(() => Promise.race(waits));
   }
   bind(addr) {
@@ -3155,6 +3155,7 @@ var CA_PATH = "/etc/ssl/certs/slicc-kernel-ca.pem";
 var PROXY_URL = `http://127.0.0.1:${REALM_PROXY_PORT}`;
 var NO_PROXY = "localhost,.localhost,127.0.0.1,127.0.0.0/8";
 var CA_OWNER = "slicc-kernel";
+var CA_DB = "slicc-kernel-ca";
 function networkEnv() {
   return {
     http_proxy: PROXY_URL,
@@ -3188,8 +3189,8 @@ function memoryCaStore() {
     }
   };
 }
-function caStore(metadata) {
-  return metadata === false ? memoryCaStore() : indexedDbCaStore(`${metadata}-ca`);
+function caStore(name2) {
+  return name2 === false ? memoryCaStore() : indexedDbCaStore(name2);
 }
 function base64(bytes) {
   let text = "";
@@ -3222,12 +3223,27 @@ function kernelCa(store) {
 function kernelTlsEngine(load) {
   return () => loadTlsEngine(load);
 }
-async function writeCaFile(fs, ca) {
-  const { pem: pem2 } = await ca();
-  const current = await fs.exists(CA_PATH) ? await fs.readFile(CA_PATH) : void 0;
-  if (current === pem2) return;
+var CERTIFICATE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+var CA_BUNDLE_MAX = 16;
+var CA_FILE_LOCK = "slicc-kernel-ca-file";
+var CA_FILE_TRIES = 3;
+async function addToBundle(fs, own) {
+  const current = await fs.exists(CA_PATH) ? await fs.readFile(CA_PATH) : "";
+  const all = current.match(CERTIFICATE) ?? [];
+  const others = all.filter((cert) => cert !== own);
+  if (others.length < all.length) return true;
+  const bundle = [...others, own].slice(-CA_BUNDLE_MAX);
   await fs.mkdir(CA_PATH.slice(0, CA_PATH.lastIndexOf("/")), { recursive: true });
-  await fs.writeFile(CA_PATH, pem2);
+  await fs.writeFile(CA_PATH, `${bundle.join("\n")}
+`);
+  return false;
+}
+async function writeCaFile(fs, ca, locks = globalThis.navigator?.locks) {
+  const own = (await ca()).pem.trim();
+  const update = async () => {
+    for (let i = 0; i < CA_FILE_TRIES && !await addToBundle(fs, own); i++) ;
+  };
+  await (locks ? locks.request(CA_FILE_LOCK, update) : update());
 }
 function enableNetwork(net, options) {
   let proxy;
@@ -7185,10 +7201,164 @@ function removableMedium(onLost, open = (handle) => new OpfsFs(handle)) {
   };
 }
 
+// src/mount/syscall.ts
+var MS_RDONLY = 1;
+var MS_MGC_MSK = 4294901760;
+var MS_MGC_VAL = 3236757504;
+var IGNORED_FLAGS = 2 | 4 | 8 | 16 | 128 | 1024 | 2048 | 32768 | 1 << 21 | 1 << 24 | 1 << 25;
+var MNT_FORCE = 1;
+var MNT_DETACH = 2;
+var UMOUNT_NOFOLLOW = 8;
+var GENERIC = /* @__PURE__ */ new Set([
+  "defaults",
+  "async",
+  "sync",
+  "dirsync",
+  "atime",
+  "noatime",
+  "diratime",
+  "nodiratime",
+  "relatime",
+  "norelatime",
+  "strictatime",
+  "nostrictatime",
+  "lazytime",
+  "nolazytime",
+  "suid",
+  "nosuid",
+  "dev",
+  "nodev",
+  "exec",
+  "noexec",
+  "auto",
+  "noauto",
+  "user",
+  "nouser",
+  "users",
+  "nofail",
+  "_netdev",
+  "silent",
+  "loud"
+]);
+function parseMountOptions(data) {
+  const options = {};
+  for (const raw of data.split(",")) {
+    const item = raw.trim();
+    if (!item || GENERIC.has(item)) continue;
+    if (item === "rw") {
+      delete options.ro;
+      continue;
+    }
+    const eq = item.indexOf("=");
+    if (eq === 0) throw errnoError("EINVAL", `bad mount option ${item}`);
+    if (eq < 0) options[item] = "";
+    else options[item.slice(0, eq)] = item.slice(eq + 1);
+  }
+  if (options.maxfile !== void 0) parseSize(options.maxfile);
+  return options;
+}
+function refusedTarget(target) {
+  const at = normalizePath(target);
+  const kernel = at === "/" || [`/proc`, `/dev`].some((k) => at === k || at.startsWith(`${k}/`));
+  if (kernel) throw errnoError("EBUSY", `${at} belongs to the kernel`);
+}
+function absolute(target) {
+  if (!target) throw errnoError("ENOENT", "no mount point");
+  if (!target.startsWith("/")) throw errnoError("EINVAL", `not an absolute path: ${target}`);
+  return normalizePath(target);
+}
+function mountCall(call) {
+  let flags = call.flags >>> 0;
+  if ((flags & MS_MGC_MSK) >>> 0 === MS_MGC_VAL) flags &= ~MS_MGC_MSK;
+  if (flags & ~(MS_RDONLY | IGNORED_FLAGS)) {
+    throw errnoError("EINVAL", `unsupported mount flags ${flags.toString(16)}`);
+  }
+  if (!call.type) throw errnoError("EINVAL", "no file system type");
+  const target = absolute(call.target);
+  refusedTarget(target);
+  const options = parseMountOptions(call.data);
+  if (flags & MS_RDONLY) options.ro = "";
+  return { type: call.type, source: call.source || "none", target, options };
+}
+function umountCall(target, flags) {
+  const known = MNT_FORCE | MNT_DETACH | UMOUNT_NOFOLLOW;
+  if (flags >>> 0 & ~known) throw errnoError("EINVAL", `unsupported umount flags ${flags}`);
+  const at = absolute(target);
+  refusedTarget(at);
+  return { target: at, detach: (flags & (MNT_FORCE | MNT_DETACH)) !== 0 };
+}
+
+// src/mount/fstab.ts
+var FSTAB_PATH = "/etc/fstab";
+var FSTAB_RETRIES = [1e3, 4e3, 16e3];
+var FINAL = /* @__PURE__ */ new Set(["EINVAL", "EBUSY", "EPERM", "EACCES"]);
+function unescape(field) {
+  return field.replace(
+    /\\([0-7]{3})/g,
+    (_, octal) => String.fromCharCode(Number.parseInt(octal, 8))
+  );
+}
+function parseFstab(text) {
+  const lines = [];
+  text.split("\n").forEach((raw, index) => {
+    const content = raw.replace(/#.*$/, "").trim();
+    if (!content) return;
+    const [source, target, type, options = "defaults"] = content.split(/\s+/).map(unescape);
+    if (source === void 0 || target === void 0 || type === void 0) return;
+    if (options.split(",").includes("noauto")) return;
+    const spec = { source, target, type, options: {} };
+    try {
+      lines.push({ line: index + 1, spec: { ...spec, options: parseMountOptions(options) } });
+    } catch (err) {
+      lines.push({ line: index + 1, spec, invalid: err });
+    }
+  });
+  return lines;
+}
+function codeOf3(err) {
+  const code = err?.code;
+  return typeof code === "string" ? code : "EIO";
+}
+function wait(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const done4 = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done4);
+      resolve();
+    };
+    const timer = setTimeout(done4, ms);
+    signal.addEventListener("abort", done4, { once: true });
+  });
+}
+async function mountFstab(lines, mount, signal, retries = FSTAB_RETRIES, discard = () => {
+}) {
+  return Promise.all(
+    lines.map(async ({ line, spec, invalid }) => {
+      let failed = invalid;
+      for (let attempt = 0; !invalid && attempt <= retries.length && !signal.aborted; attempt++) {
+        try {
+          const entry = await mount(spec);
+          if (!signal.aborted) return { line, target: spec.target, entry };
+          discard(entry);
+          failed = Object.assign(new Error("the kernel stopped"), { code: "ECANCELED" });
+          break;
+        } catch (err) {
+          failed = err;
+          if (FINAL.has(codeOf3(err)) || attempt === retries.length) break;
+          await wait(retries[attempt], signal);
+        }
+      }
+      const code = codeOf3(failed);
+      return { line, target: spec.target, code, error: String(failed?.message ?? code) };
+    })
+  );
+}
+
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf3 = (err) => err?.code;
-var unreachable = (err) => codeOf3(err) === "ENOTCONN";
+var codeOf4 = (err) => err?.code;
+var unreachable = (err) => codeOf4(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -7323,7 +7493,7 @@ function hostfsHandlers(current) {
     try {
       return { opened: await opening(), restore: void 0 };
     } catch (err) {
-      if (!flags.write || codeOf3(err) !== "EACCES") throw err;
+      if (!flags.write || codeOf4(err) !== "EACCES") throw err;
       const mode = (await client.call("stat", { path: rel(path) })).mode ?? 0;
       if (mode & 128) throw err;
       const restore = { path: rel(path), mode };
@@ -7412,7 +7582,7 @@ function keepWatching(loop, signal) {
   const uncap = () => clearTimeout(capped);
   void ready2.promise.then(uncap);
   signal.addEventListener("abort", uncap, { once: true });
-  let wait = first;
+  let wait2 = first;
   let up = false;
   let current;
   async function session() {
@@ -7457,7 +7627,7 @@ function keepWatching(loop, signal) {
       const opened2 = await session();
       if (signal.aborted) return;
       if (opened2 && Date.now() - began >= first) {
-        wait = first;
+        wait2 = first;
         continue;
       }
       if (!opened2 && up) {
@@ -7465,8 +7635,8 @@ function keepWatching(loop, signal) {
         loop.down();
       }
       ready2.resolve();
-      await sleep(wait, signal);
-      wait = Math.min(wait * 2, most);
+      await sleep(wait2, signal);
+      wait2 = Math.min(wait2 * 2, most);
     }
   })();
   return { ready: ready2.promise, kick: () => current?.abort() };
@@ -7521,93 +7691,6 @@ async function openHostfs(spec, hook, fetch2, timing = {}) {
   };
 }
 
-// src/mount/syscall.ts
-var MS_RDONLY = 1;
-var MS_MGC_MSK = 4294901760;
-var MS_MGC_VAL = 3236757504;
-var IGNORED_FLAGS = 2 | 4 | 8 | 16 | 128 | 1024 | 2048 | 32768 | 1 << 21 | 1 << 24 | 1 << 25;
-var MNT_FORCE = 1;
-var MNT_DETACH = 2;
-var UMOUNT_NOFOLLOW = 8;
-var GENERIC = /* @__PURE__ */ new Set([
-  "defaults",
-  "async",
-  "sync",
-  "dirsync",
-  "atime",
-  "noatime",
-  "diratime",
-  "nodiratime",
-  "relatime",
-  "norelatime",
-  "strictatime",
-  "nostrictatime",
-  "lazytime",
-  "nolazytime",
-  "suid",
-  "nosuid",
-  "dev",
-  "nodev",
-  "exec",
-  "noexec",
-  "auto",
-  "noauto",
-  "user",
-  "nouser",
-  "users",
-  "nofail",
-  "_netdev",
-  "silent",
-  "loud"
-]);
-function parseMountOptions(data) {
-  const options = {};
-  for (const raw of data.split(",")) {
-    const item = raw.trim();
-    if (!item || GENERIC.has(item)) continue;
-    if (item === "rw") {
-      delete options.ro;
-      continue;
-    }
-    const eq = item.indexOf("=");
-    if (eq === 0) throw errnoError("EINVAL", `bad mount option ${item}`);
-    if (eq < 0) options[item] = "";
-    else options[item.slice(0, eq)] = item.slice(eq + 1);
-  }
-  if (options.maxfile !== void 0) parseSize(options.maxfile);
-  return options;
-}
-function refusedTarget(target) {
-  const at = normalizePath(target);
-  const kernel = at === "/" || [`/proc`, `/dev`].some((k) => at === k || at.startsWith(`${k}/`));
-  if (kernel) throw errnoError("EBUSY", `${at} belongs to the kernel`);
-}
-function absolute(target) {
-  if (!target) throw errnoError("ENOENT", "no mount point");
-  if (!target.startsWith("/")) throw errnoError("EINVAL", `not an absolute path: ${target}`);
-  return normalizePath(target);
-}
-function mountCall(call) {
-  let flags = call.flags >>> 0;
-  if ((flags & MS_MGC_MSK) >>> 0 === MS_MGC_VAL) flags &= ~MS_MGC_MSK;
-  if (flags & ~(MS_RDONLY | IGNORED_FLAGS)) {
-    throw errnoError("EINVAL", `unsupported mount flags ${flags.toString(16)}`);
-  }
-  if (!call.type) throw errnoError("EINVAL", "no file system type");
-  const target = absolute(call.target);
-  refusedTarget(target);
-  const options = parseMountOptions(call.data);
-  if (flags & MS_RDONLY) options.ro = "";
-  return { type: call.type, source: call.source || "none", target, options };
-}
-function umountCall(target, flags) {
-  const known = MNT_FORCE | MNT_DETACH | UMOUNT_NOFOLLOW;
-  if (flags >>> 0 & ~known) throw errnoError("EINVAL", `unsupported umount flags ${flags}`);
-  const at = absolute(target);
-  refusedTarget(at);
-  return { target: at, detach: (flags & (MNT_FORCE | MNT_DETACH)) !== 0 };
-}
-
 // src/mount/tmpfs.ts
 function tmpfs() {
   let inodes = 0;
@@ -8026,6 +8109,8 @@ var Launcher = class {
   openFiles = /* @__PURE__ */ new Set();
   held = /* @__PURE__ */ new Set();
   processMounts;
+  booting = new AbortController();
+  fstab = Promise.resolve([]);
   nextPid = 1e3;
   boot = Date.now();
   terminals = 0;
@@ -8433,6 +8518,7 @@ var Launcher = class {
     for (const holds of this.held) holds.revoke(at);
   }
   unmountAll() {
+    this.booting.abort();
     const targets = this.mounts.list().map((m) => m.target);
     for (const target of targets.sort((a, b) => b.length - a.length)) this.umount(target, true);
   }
@@ -8464,6 +8550,17 @@ var Launcher = class {
   async prepare() {
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     await writeCaFile(this.base, this.ca).catch(() => void 0);
+    this.fstab = this.mountFstab();
+  }
+  async mountFstab() {
+    const text = await this.base.readFile(FSTAB_PATH).catch(() => "");
+    return mountFstab(
+      parseFstab(text),
+      (spec) => this.mount(spec),
+      this.booting.signal,
+      FSTAB_RETRIES,
+      (entry) => this.umount(entry.target, true)
+    );
   }
   environment(cwd, extra) {
     return {
@@ -8565,6 +8662,14 @@ function act2(session, req) {
 function dirsChannel(name2) {
   return name2 === false ? void 0 : `slicc-kernel-dirs:${name2}`;
 }
+function caDb(req) {
+  const name2 = req.ca ?? (req.metadata ? `${req.metadata}-ca` : CA_DB);
+  const taken = [req.metadata ?? META_DB, req.media ?? `${req.metadata ?? META_DB}:media`];
+  if (name2 !== false && taken.includes(name2)) {
+    throw new Error(`the CA cannot share the IndexedDB database ${name2}`);
+  }
+  return name2;
+}
 async function stores(deps, name2, media) {
   const handles = media ?? (name2 === false ? false : `${name2}:media`);
   if (handles !== false && handles === name2) {
@@ -8647,7 +8752,7 @@ function serveKernel(port, deps) {
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
         ...mountPolicy(req.processMounts),
-        caStore: caStore(deps.metadata ? name2 : false)
+        caStore: caStore(deps.metadata ? caDb(req) : false)
       });
       await started.prepare();
       return started;