@ai-ecoverse/slicc-kernel 1.26.6 → 1.27.0

package/dist/kernel-worker.js

@@ -883,7 +883,7 @@ function portCdpHook(ask, gone) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 5];
+var PROTOCOL = [1, 6];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -2086,6 +2086,7 @@ function serveClient(port, host) {
 
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
+var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
 var PAGE_LOOPBACK = "kernel.localhost";
 var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
 function toHostLoopback(href) {
@@ -3569,6 +3570,51 @@ var RemoteTransport = class {
   }
 };
 
+// src/kernel/net/uplink.ts
+function answerOf(result) {
+  const answer = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  return {
+    addresses,
+    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+  };
+}
+var RemoteUplink = class {
+  traits;
+  routes;
+  port;
+  waiting = /* @__PURE__ */ new Map();
+  nextId = 0;
+  constructor(port, traits, routes) {
+    this.port = port;
+    this.traits = traits;
+    this.routes = routes;
+  }
+  receive(reply) {
+    const waiter = this.waiting.get(reply.uid);
+    if (!waiter) return;
+    this.waiting.delete(reply.uid);
+    if (reply.uplink === "error") {
+      waiter.reject(Object.assign(new Error(reply.message), { code: reply.code }));
+    } else waiter.resolve(answerOf(reply));
+  }
+  resolve(name2, family, signal) {
+    const uid = ++this.nextId;
+    const waiter = Promise.withResolvers();
+    this.waiting.set(uid, waiter);
+    const abort = () => {
+      this.waiting.delete(uid);
+      this.port.postMessage({ uplink: "cancel", uid });
+      waiter.reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    const settled = () => signal?.removeEventListener("abort", abort);
+    waiter.promise.then(settled, settled);
+    this.port.postMessage({ uplink: "resolve", uid, name: name2, family });
+    return waiter.promise;
+  }
+};
+
 // src/cdp/types.ts
 var CDP_PORT = 9222;
 var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
@@ -5897,6 +5943,204 @@ var HttpHandles = class {
   }
 };
 
+// src/kernel/net/routes.ts
+var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+function ipv4Bytes(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
+}
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
+  } catch {
+    return void 0;
+  }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+}
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
+}
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
+}
+function parsePrefix(text) {
+  const parts = text.trim().split("/");
+  if (parts.length > 2) return void 0;
+  const [address = "", size] = parts;
+  const parsed = addressBits(address);
+  if (!parsed) return void 0;
+  const max = parsed.v6 ? 128 : 32;
+  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length2 < 0 || length2 > max) return void 0;
+  return { ...parsed, length: length2 };
+}
+function within3(prefix, addr) {
+  if (prefix.v6 !== addr.v6) return false;
+  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
+  return addr.bits >> shift === prefix.bits >> shift;
+}
+var RESERVED = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::ffff:0:0/96",
+  "fe80::/10",
+  "ff00::/8"
+].map((p) => parsePrefix(p));
+var Routes = class {
+  table = [];
+  exit = false;
+  ipv6;
+  constructor(ipv62 = false) {
+    this.ipv6 = ipv62;
+  }
+  set(table) {
+    const parsed = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed[i]);
+    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
+    this.table = parsed;
+    this.exit = table.exit === true;
+  }
+  classify(host) {
+    const name2 = host.toLowerCase().replace(/\.$/, "");
+    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
+      return "loopback";
+    }
+    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
+    const addr = addressBits(name2);
+    if (!addr) return "unreachable";
+    if (addr.v6 && addr.bits === 1n) return "loopback";
+    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
+    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
+    return "unreachable";
+  }
+};
+
+// src/kernel/net/resolver.ts
+var RESOLVE_TTL_MAX = 60;
+var RESOLVE_TIMEOUT_MS = 1e4;
+var RESOLVE_CACHE_MAX = 256;
+var LOOPBACK_NAMES2 = /* @__PURE__ */ new Set(["localhost", "localhost.localdomain", "ip6-localhost", "::1"]);
+function hostsEntry(name2) {
+  if (LOOPBACK_NAMES2.has(name2) || name2.endsWith(".localhost")) return "127.0.0.1";
+  if (name2 === HOST_LOOPBACK) return HOST_LOOPBACK_ADDRESS.join(".");
+  return ipv4Bytes(name2) ? name2 : void 0;
+}
+var Resolver = class {
+  uplink;
+  routes;
+  now;
+  timeoutMs;
+  log;
+  cache = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.uplink = options.uplink;
+    this.routes = options.routes;
+    this.now = options.now ?? Date.now;
+    this.timeoutMs = options.timeoutMs ?? RESOLVE_TIMEOUT_MS;
+    this.log = options.log ?? ((message2) => console.warn(message2));
+  }
+  async resolve(name2, family, blocking) {
+    const key = name2.toLowerCase().replace(/\.$/, "");
+    const local = hostsEntry(key);
+    if (ipv6Groups(key)) {
+      const v4 = family !== 6 && local ? [local] : [];
+      return family === 4 ? v4 : [...v4, key];
+    }
+    if (local) {
+      const six = LOOPBACK_NAMES2.has(key) || key.endsWith(".localhost") ? ["::1"] : [];
+      return family === 6 ? six : family === 4 ? [local] : [local, ...six];
+    }
+    if (!this.uplink || key === "") return [];
+    const asked = this.uplink.traits.ipv6 ? family : 4;
+    if (family === 6 && asked !== 6) return [];
+    const id = `${asked}:${key}`;
+    const hit = this.cache.get(id);
+    if (hit && hit.expires > this.now()) return hit.addresses;
+    const signal = blocking?.();
+    if (signal?.aborted) throw new KernelError("EINTR");
+    let lookup = this.pending.get(id);
+    if (!lookup) {
+      const abort = new AbortController();
+      lookup = { work: this.lookup(key, asked, id, abort.signal), abort, waiters: 0 };
+      this.pending.set(id, lookup);
+      void lookup.work.then(() => this.pending.delete(id));
+    }
+    return waitFor(lookup, signal);
+  }
+  async lookup(name2, family, id, abandoned) {
+    const uplink = this.uplink;
+    const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
+    let answer;
+    try {
+      answer = answerOf(
+        await Promise.race([
+          uplink.resolve(name2, family, timeout),
+          new Promise(
+            (_, reject) => timeout.addEventListener("abort", () => reject(timeout.reason), { once: true })
+          )
+        ])
+      );
+    } catch {
+      return [];
+    }
+    const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
+    if (addresses.length > 0) this.remember(id, addresses, answer.ttl);
+    return addresses;
+  }
+  usable(name2, address, family) {
+    const v4 = ipv4Bytes(address) !== void 0;
+    if (!v4 && (family === 4 || !ipv6Groups(address))) return false;
+    if (v4 && family === 6) return false;
+    const kind = this.routes.classify(address);
+    if (kind !== "loopback" && kind !== "host" && kind !== "reserved") return true;
+    this.log(`slicc-kernel: dropped the uplink's answer ${address} for ${name2}: it is ${kind}`);
+    return false;
+  }
+  remember(id, addresses, ttl) {
+    const seconds = Math.min(ttl ?? RESOLVE_TTL_MAX, RESOLVE_TTL_MAX);
+    if (seconds <= 0) return;
+    this.cache.delete(id);
+    this.cache.set(id, { addresses, expires: this.now() + seconds * 1e3 });
+    if (this.cache.size > RESOLVE_CACHE_MAX) {
+      this.cache.delete(this.cache.keys().next().value);
+    }
+  }
+};
+function waitFor(lookup, signal) {
+  lookup.waiters++;
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      reject(new KernelError("EINTR"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    void lookup.work.then((value) => {
+      if (signal?.aborted) return;
+      lookup.waiters--;
+      signal?.removeEventListener("abort", abort);
+      resolve(value);
+    });
+  });
+}
+
 // src/kernel/tty.ts
 var ICRNL = 256;
 var IUTF8 = 16384;
@@ -6400,7 +6644,8 @@ var SOCKET_OPS = [
   "sock-shutdown",
   "sock-name",
   "sock-getopt",
-  "sock-setopt"
+  "sock-setopt",
+  "sock-resolve"
 ];
 function socketAt(fds, fd) {
   const file = fds.get(fd).file;
@@ -6449,6 +6694,11 @@ async function socketSyscall(req, proc) {
     case "sock-setopt":
       socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
       return ok();
+    case "sock-resolve": {
+      const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
+      if (addresses.length === 0) throw new KernelError("ENOENT");
+      return ok(addresses);
+    }
   }
 }
 function unnamed(domain) {
@@ -6700,7 +6950,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within3(path, root) {
+function within4(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -6908,7 +7158,7 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within3(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
     return false;
   }
   closed(node) {
@@ -6916,24 +7166,24 @@ var VfsNodes = class {
     if (node.opens === 0 && this.byPath.get(node.path) === node) this.byPath.delete(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within3(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within3(path, prefix)) continue;
+      if (!within4(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -6942,8 +7192,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within3(p, from)) moved2.push(node);
-      else if (within3(p, to)) {
+      if (within4(p, from)) moved2.push(node);
+      else if (within4(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -7197,6 +7447,7 @@ function isWasmSyscall(req) {
   return typeof op === "string" && SYSCALL_OPS.has(op);
 }
 var MAX_READ = 1024 * 1024;
+var HOSTS_ONLY = new Resolver({ routes: new Routes() });
 var WasmProcess = class {
   exited = false;
   children;
@@ -7588,10 +7839,12 @@ var WasmProcess = class {
   }
   socketSyscall(req) {
     this.net ??= this.options.net ?? new LoopbackNet();
+    const resolver = this.options.resolver ?? HOSTS_ONLY;
     return socketSyscall(req, {
       fds: this.fds,
       net: this.net,
-      blocking: () => this.blockingSignal()
+      blocking: () => this.blockingSignal(),
+      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking)
     });
   }
   tty(fd) {
@@ -7786,6 +8039,7 @@ function spawnWasmProcess(opts) {
     http: opts.http,
     locks: opts.locks,
     onReap: opts.onReap,
+    resolver: opts.resolver,
     onPending: (sig) => void Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig)),
     onTimer: (which) => void Atomics.or(header2, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header2, SAB_I_SIGNALS) !== 0 || Atomics.load(header2, SAB_I_TIMERS) !== 0,
@@ -9325,6 +9579,9 @@ var Launcher = class {
   cdp;
   ca;
   transport;
+  uplink;
+  routes;
+  resolver;
   watchers = new FsWatchers();
   pnpmHome;
   mounts;
@@ -9364,6 +9621,10 @@ var Launcher = class {
     this.env = { ...networkEnv(), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = options.transport ?? missingTransport();
+    this.uplink = options.uplink;
+    this.routes = new Routes(options.uplink?.traits.ipv6 === true);
+    if (options.uplink?.routes) this.routes.set(options.uplink.routes);
+    this.resolver = new Resolver({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
       engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
@@ -9378,6 +9639,9 @@ var Launcher = class {
       this.catalog = void 0;
     });
   }
+  setRoutes(table) {
+    this.routes.set(table);
+  }
   commands() {
     this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
     return this.catalog;
@@ -9557,6 +9821,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport),
       locks: this.locks,
+      resolver: this.resolver,
       onReap: (child) => this.reaped(child),
       ...req.fork ? { fork: req.fork } : {},
       ...this.shownIds(req)
@@ -9959,9 +10224,22 @@ function cdpOption(req, port) {
     )
   };
 }
+function remotes(port, req) {
+  return {
+    ...req.transport ? { transport: new RemoteTransport(port, req.transport) } : {},
+    ...req.uplink ? { uplink: new RemoteUplink(port, req.uplink.traits, req.uplink.routes) } : {}
+  };
+}
+function answered(data, remote, uplink) {
+  if (data.net !== void 0) remote?.receive(data);
+  else if (typeof data.uplink === "string") uplink?.receive(data);
+  else return false;
+  return true;
+}
 function serveKernel(port, deps) {
   let launcher;
   let remote;
+  let uplink;
   const terminals = /* @__PURE__ */ new Map();
   const reply = (id, body, transfer) => port.postMessage({ id, ...body }, transfer);
   const clients = /* @__PURE__ */ new Set();
@@ -10017,7 +10295,8 @@ function serveKernel(port, deps) {
     launcher = (req.root ? Promise.resolve(req.root) : deps.storage()).then(async (root) => {
       const name2 = req.metadata ?? META_DB;
       const { meta, media } = await stores(deps, name2, req.media);
-      remote = req.transport ? new RemoteTransport(port, req.transport) : void 0;
+      const net = remotes(port, req);
+      ({ transport: remote, uplink } = net);
       const ranged2 = await inOpfs(deps, root);
       const fs = new OpfsFs(root, meta, dirsChannel(name2), { ranged: ranged2 });
       await fs.reconcile();
@@ -10027,7 +10306,7 @@ function serveKernel(port, deps) {
         ...deps.createDriverWorker ? { createDriverWorker: deps.createDriverWorker } : {},
         ...req.modules ? { modules: req.modules } : {},
         ...req.env ? { env: req.env } : {},
-        ...remote ? { transport: remote } : {},
+        ...net,
         ...media ? { media } : {},
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
@@ -10052,6 +10331,10 @@ function serveKernel(port, deps) {
     if (req.op === "init") return init(req);
     if (req.op === "open-terminal") return terminal(req);
     if (req.op === "connect") return connect();
+    if (req.op === "routes") {
+      (await ready2()).setRoutes(req.routes);
+      return true;
+    }
     if (req.op === "dial") return dial(req);
     if (req.op === "mount" || req.op === "umount" || req.op === "mounts" || req.op === "insert")
       return mountOp(req);
@@ -10100,10 +10383,7 @@ function serveKernel(port, deps) {
       policies.delete(answer.id);
       return;
     }
-    if (event.data.net !== void 0) {
-      remote?.receive(event.data);
-      return;
-    }
+    if (answered(event.data, remote, uplink)) return;
     const req = event.data;
     handle(req).then(
       (result) => reply(req.id, { result }, result instanceof MessagePort ? [result] : void 0),