@ai-ecoverse/slicc-kernel 1.49.1 → 1.50.0

package/dist/kernel-worker.js

@@ -1574,6 +1574,8 @@ var KernelSocket = class _KernelSocket {
   reset = false;
   local;
   peer;
+  peerCred;
+  listenerCred;
   link;
   readShut = false;
   writeShut = false;
@@ -1649,7 +1651,7 @@ var KernelSocket = class _KernelSocket {
     this.local = this.net.bind(this, addr);
     this.boundAt = this.local;
   }
-  listen(backlog) {
+  listen(backlog, cred) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
     if (!this.local) {
@@ -1658,6 +1660,7 @@ var KernelSocket = class _KernelSocket {
     }
     this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
     this.state = "listening";
+    this.listenerCred ??= cred;
   }
   async accept(signal, nonblock = false) {
     for (; ; ) {
@@ -1674,7 +1677,7 @@ var KernelSocket = class _KernelSocket {
     this.changes.wake();
     return true;
   }
-  connect(addr, viaUplink = true) {
+  connect(addr, viaUplink = true, cred) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
@@ -1692,7 +1695,9 @@ var KernelSocket = class _KernelSocket {
     const server = new _KernelSocket(this.net, this.domain);
     server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
     server.peer = this.local;
+    server.peerCred = cred;
     this.peer = server.local;
+    this.peerCred = target.listenerCred;
     link(this, server);
     if (!target.offer(server)) {
       this.unlink();
@@ -1811,9 +1816,10 @@ var KernelSocket = class _KernelSocket {
     this.boundAt = void 0;
     this.changes.wake();
   }
-  static pair(net, domain) {
+  static pair(net, domain, cred) {
     const a = new _KernelSocket(net, domain);
     const b = new _KernelSocket(net, domain);
+    a.peerCred = b.peerCred = cred;
     const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
     a.local = b.local = a.peer = b.peer = name2;
     link(a, b);
@@ -2142,6 +2148,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         net: "head",
         nid: call.nid,
         ...response.redirected ? { url: response.url, redirected: true } : {},
+        ...response.redirects ? { redirects: response.redirects } : {},
         status: response.status,
         statusText: response.statusText,
         headers: response.headers
@@ -3698,7 +3705,7 @@ var RealmProxy = class {
         const waiting = new AbortController();
         void watchHangup(ctx.socket, abort, waiting.signal);
         try {
-          response = await this.upstream(req, url, body, abort.signal);
+          response = await this.upstream(req, url, body, abort.signal, ctx.socket.peerCred?.pid);
         } finally {
           waiting.abort();
         }
@@ -3724,15 +3731,18 @@ var RealmProxy = class {
       await conn.write(latin1Bytes("HTTP/1.1 100 Continue\r\n\r\n"), this.stop.signal);
     }
   }
-  async upstream(req, url, body, signal) {
+  async upstream(req, url, body, signal, owner) {
     try {
-      const fetching = this.options.transport.fetch({
-        url: toHostLoopback(url),
-        method: req.method.toUpperCase(),
-        headers: forwardRequestHeaders(req.headers),
-        body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
-        signal
-      });
+      const fetching = this.options.transport.fetch(
+        {
+          url: toHostLoopback(url),
+          method: req.method.toUpperCase(),
+          headers: forwardRequestHeaders(req.headers),
+          body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
+          signal
+        },
+        owner
+      );
       return await untilAborted(fetching, signal);
     } catch (e) {
       if (signal.aborted) throw e;
@@ -3744,13 +3754,13 @@ var RealmProxy = class {
   }
   async relay(conn, method, minor, response, keepAlive) {
     const status = response.status;
-    const bodiless = method === "HEAD" || status === 204 || status === 304 || status < 200;
+    const bodiless2 = method === "HEAD" || status === 204 || status === 304 || status < 200;
     const headers = forwardResponseHeaders(response.headers, {
       encodedBodies: this.options.transport.traits.encodedBodies,
-      bodiless
+      bodiless: bodiless2
     });
-    const chunked = !bodiless && minor >= 1;
-    const keep = keepAlive && (bodiless || chunked);
+    const chunked = !bodiless2 && minor >= 1;
+    const keep = keepAlive && (bodiless2 || chunked);
     headers.push(["Connection", keep ? "keep-alive" : "close"]);
     if (chunked) headers.push(["Transfer-Encoding", "chunked"]);
     const signal = this.stop.signal;
@@ -3758,7 +3768,7 @@ var RealmProxy = class {
       responseHead(status, response.statusText || REASON[status] || "", headers),
       signal
     );
-    if (bodiless) {
+    if (bodiless2) {
       await response.cancel();
       return keep;
     }
@@ -4720,7 +4730,7 @@ var RemoteTransport = class {
       finish();
       throw e;
     }
-    const { status, statusText, headers, url, redirected } = head;
+    const { status, statusText, headers, url, redirected, redirects } = head;
     const read = async () => {
       if (finished) return void 0;
       const reply = await this.ask({ net: "read", nid }).catch((e) => {
@@ -4738,6 +4748,7 @@ var RemoteTransport = class {
     };
     return {
       ...redirected ? { url, redirected } : {},
+      ...redirects ? { redirects } : {},
       status,
       statusText,
       headers,
@@ -7302,9 +7313,9 @@ var SAB_I_KILLED = 13;
 var SAB_I_ASYNC = 14;
 var SAB_I_STOP = 15;
 var U32 = 2 ** 32;
-function storeU53(header2, lo, hi, value) {
-  Atomics.store(header2, hi, Math.floor(value / U32));
-  Atomics.store(header2, lo, value % U32 | 0);
+function storeU53(header3, lo, hi, value) {
+  Atomics.store(header3, hi, Math.floor(value / U32));
+  Atomics.store(header3, lo, value % U32 | 0);
 }
 var SAB_STATE_READY = 2;
 var SAB_STATUS_BYTES = 1;
@@ -7347,7 +7358,7 @@ function sabViews(sab) {
 var PENDING_TTL_MS = SYNC_FS_REQUEST_TIMEOUT_MS + 5e3;
 function attachSyncSabResponder(port, sab, token, opts) {
   const views = sabViews(sab);
-  const { header: header2, window } = views;
+  const { header: header3, window } = views;
   const pending = /* @__PURE__ */ new Map();
   let disposed = false;
   const { dispatch: dispatch2 } = opts;
@@ -7358,20 +7369,20 @@ function attachSyncSabResponder(port, sab, token, opts) {
     pending.delete(id2);
   }
   function publish(id2, entry, offset) {
-    if (Atomics.load(header2, SAB_I_REQ) !== id2) {
+    if (Atomics.load(header3, SAB_I_REQ) !== id2) {
       drop(id2);
       return;
     }
     const chunk2 = Math.min(window.byteLength, entry.payload.byteLength - offset);
     if (chunk2 > 0) window.set(entry.payload.subarray(offset, offset + chunk2));
-    Atomics.store(header2, SAB_I_STATUS, entry.status);
-    storeU53(header2, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
-    Atomics.store(header2, SAB_I_CHUNK, chunk2);
-    storeU53(header2, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
-    Atomics.store(header2, SAB_I_SEQ, id2);
-    Atomics.store(header2, SAB_I_STATE, SAB_STATE_READY);
-    Atomics.add(header2, SAB_I_PUB, 1);
-    Atomics.notify(header2, SAB_I_PUB);
+    Atomics.store(header3, SAB_I_STATUS, entry.status);
+    storeU53(header3, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
+    Atomics.store(header3, SAB_I_CHUNK, chunk2);
+    storeU53(header3, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
+    Atomics.store(header3, SAB_I_SEQ, id2);
+    Atomics.store(header3, SAB_I_STATE, SAB_STATE_READY);
+    Atomics.add(header3, SAB_I_PUB, 1);
+    Atomics.notify(header3, SAB_I_PUB);
     if (offset + chunk2 >= entry.payload.byteLength) drop(id2);
   }
   function settle3(id2, result) {
@@ -7746,8 +7757,10 @@ var HttpHandles = class {
   open = /* @__PURE__ */ new Map();
   nextHandle = 0;
   ws;
-  constructor(transport) {
+  owner;
+  constructor(transport, owner) {
     this.transport = transport;
+    this.owner = owner;
     this.ws = new WsHandles(transport, () => ++this.nextHandle);
   }
   syscall(req) {
@@ -7791,13 +7804,16 @@ var HttpHandles = class {
   }
   async respond(handle, req, entry) {
     try {
-      const response = await this.transport.fetch({
-        url: req.url,
-        method: req.method,
-        headers: req.headers,
-        ...req.body ? { body: req.body } : {},
-        signal: entry.abort.signal
-      });
+      const response = await this.transport.fetch(
+        {
+          url: req.url,
+          method: req.method,
+          headers: req.headers,
+          ...req.body ? { body: req.body } : {},
+          signal: entry.abort.signal
+        },
+        this.owner
+      );
       entry.body = response.body[Symbol.asyncIterator]();
       entry.cancel = () => response.cancel();
       if (!this.open.has(handle)) await entry.cancel().catch(() => void 0);
@@ -8523,7 +8539,7 @@ async function socketSyscall(req, proc) {
     case "sock-open":
       return ok(fds.install(new OpenFile(net.socket(req.domain)), 3));
     case "sock-pair": {
-      const [a, b] = KernelSocket.pair(net, req.domain);
+      const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
       try {
         return ok([first, fds.install(new OpenFile(b), 3)]);
@@ -8536,12 +8552,12 @@ async function socketSyscall(req, proc) {
       socketAt(fds, req.fd).bind(req.addr);
       return ok();
     case "sock-listen":
-      socketAt(fds, req.fd).listen(req.backlog);
+      socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
       return ok();
     case "sock-accept":
       return ok(await accept(proc, req.fd, req.nonblock));
     case "sock-connect": {
-      const dialing = socketAt(fds, req.fd).connect(req.addr);
+      const dialing = socketAt(fds, req.fd).connect(req.addr, true, proc.cred?.());
       if (req.nonblock) {
         dialing?.catch(() => void 0);
         throw new KernelError("EINPROGRESS");
@@ -9957,7 +9973,8 @@ var WasmProcess = class {
       fds: this.fds,
       net: this.net,
       blocking: () => this.blockingSignal(cancelled),
-      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking)
+      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
+      cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid })
     });
   }
   tty(fd) {
@@ -10173,12 +10190,12 @@ var Dying = class {
   timer;
   busy = 0;
   finish;
-  start(code, sig, header2, process, finish) {
+  start(code, sig, header3, process, finish) {
     if (this.ending) return;
     this.ending = { code, sig };
     this.finish = finish;
     this.arm();
-    Atomics.store(header2, SAB_I_KILLED, code);
+    Atomics.store(header3, SAB_I_KILLED, code);
     process.die();
   }
   async serving(work) {
@@ -10215,22 +10232,22 @@ function killThread(thread, caught, sig) {
 function threadCancel(thread) {
   return Atomics.load(thread.header, SAB_I_SIGNALS) !== 0 ? AbortSignal.abort() : thread.interrupt.signal;
 }
-function notifiers(header2) {
+function notifiers(header3) {
   return {
     onPending(sig) {
-      Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig));
-      Atomics.notify(header2, SAB_I_SIGNALS);
+      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
+      Atomics.notify(header3, SAB_I_SIGNALS);
     },
     onAsync() {
-      Atomics.add(header2, SAB_I_ASYNC, 1);
-      Atomics.notify(header2, SAB_I_ASYNC);
+      Atomics.add(header3, SAB_I_ASYNC, 1);
+      Atomics.notify(header3, SAB_I_ASYNC);
     }
   };
 }
-function publishStops(process, header2) {
+function publishStops(process, header3) {
   process.onState((state) => {
-    Atomics.store(header2, SAB_I_STOP, state === "stopped" ? 1 : 0);
-    Atomics.notify(header2, SAB_I_STOP);
+    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
+    Atomics.notify(header3, SAB_I_STOP);
   });
 }
 function transferOf(opts, lane) {
@@ -10298,7 +10315,7 @@ function holdingToken(opts, holds) {
     renamed: (from, to) => holds.renamed(from, to)
   });
 }
-function processOptions(opts, header2, hooks) {
+function processOptions(opts, header3, hooks) {
   return {
     ...inherited(opts),
     ...opts.identity ? { identity: opts.identity } : {},
@@ -10322,27 +10339,27 @@ function processOptions(opts, header2, hooks) {
     locks: opts.locks,
     onReap: opts.onReap,
     resolver: opts.resolver,
-    ...notifiers(header2),
-    onTimer: (which) => void Atomics.or(header2, SAB_I_TIMERS, 1 << which),
-    hasPending: () => Atomics.load(header2, SAB_I_SIGNALS) !== 0 || Atomics.load(header2, SAB_I_TIMERS) !== 0,
+    ...notifiers(header3),
+    onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
+    hasPending: () => Atomics.load(header3, SAB_I_SIGNALS) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
     raise: hooks.raise,
     threadKill: hooks.threadKill,
-    ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header2, SAB_I_SIGNALS) } : {}
+    ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header3, SAB_I_SIGNALS) } : {}
   };
 }
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
-  const header2 = new Int32Array(sab, 0, SAB_HEADER_I32);
+  const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const threadSignals = /* @__PURE__ */ new Map();
   const process = new WasmProcess(
     opts.pid,
     opts.fds,
-    processOptions(opts, header2, {
+    processOptions(opts, header3, {
       raise: (sig) => signal(sig),
       threadKill: (tid, sig) => killThread(threadSignals.get(tid), process.signalMasks().caught, sig)
     })
   );
-  publishStops(process, header2);
+  publishStops(process, header3);
   const holds = new HeldPaths();
   opts.held?.add(holds);
   const token = holdingToken(opts, holds);
@@ -10454,7 +10471,7 @@ function spawnWasmProcess(opts) {
     if (process.signal(sig) !== "terminate") return;
     const code = sig === SIG.KILL ? 137 : 128 + sig;
     if (opts.program.abi !== "wasi" || done4) finish(code, sig);
-    else dying.start(code, sig, header2, process, () => finish(code, sig));
+    else dying.start(code, sig, header3, process, () => finish(code, sig));
   };
   const kill = (code = 137) => finish(code, code > 128 && code < 160 ? code - 128 : void 0);
   return {
@@ -10464,7 +10481,7 @@ function spawnWasmProcess(opts) {
     signal,
     termsig: () => endedBy,
     onState: (listener) => process.onState(listener),
-    memory: () => Atomics.load(header2, SAB_I_MEMORY) * 65536,
+    memory: () => Atomics.load(header3, SAB_I_MEMORY) * 65536,
     ignoredSignals: (fork) => process.inheritable(fork),
     signalMasks: () => process.signalMasks(),
     umask: () => process.umask,
@@ -10659,6 +10676,89 @@ var JobTable = class {
   }
 };
 
+// src/kernel/net/redirect-hops.ts
+var HELD_MS = 3e4;
+var HELD_MAX = 64;
+var HELD_PER_OWNER = 8;
+var MATCHED = ["range", "if-none-match", "if-modified-since", "if-range", "accept-encoding"];
+var KERNEL = -1;
+function header2(headers, name2) {
+  const values = headers.filter(([n]) => n.toLowerCase() === name2).map(([, v]) => v);
+  return values.length > 0 ? values.join(", ") : void 0;
+}
+function fingerprint(headers) {
+  const fields = MATCHED.map((name2) => header2(headers, name2) ?? "");
+  return JSON.stringify([...fields, header2(headers, "authorization") !== void 0]);
+}
+function followedWith(status, method) {
+  if (status === 303 && method !== "GET" && method !== "HEAD") return "GET";
+  if ((status === 301 || status === 302) && method === "POST") return "GET";
+  return method;
+}
+function bodiless(hop) {
+  return {
+    url: hop.url,
+    status: hop.status,
+    statusText: "",
+    headers: hop.headers,
+    body: (async function* () {
+    })(),
+    cancel: async () => void 0
+  };
+}
+function replayingHops(inner, heldMs = HELD_MS) {
+  if (!inner.traits.redirectHops || inner.traits.manualRedirects) return inner;
+  const held = /* @__PURE__ */ new Map();
+  const drop = (key) => {
+    const entry = held.get(key);
+    if (!entry) return;
+    held.delete(key);
+    clearTimeout(entry.timer);
+    void entry.final.cancel().catch(() => void 0);
+  };
+  const keyOf2 = (owner, method, url) => `${owner} ${method} ${url}`;
+  const hold = (key, chain) => {
+    drop(key);
+    const mine = [...held.keys()].filter((k) => held.get(k)?.owner === chain.owner);
+    if (mine.length >= HELD_PER_OWNER) drop(mine[0]);
+    if (held.size >= HELD_MAX) drop(held.keys().next().value);
+    const timer = setTimeout(() => drop(key), heldMs);
+    timer.unref?.();
+    held.set(key, { ...chain, timer });
+  };
+  const replay = (chain) => {
+    const [hop, ...rest2] = chain.hops;
+    const location = hop && header2(hop.headers, "location");
+    if (!hop || location === void 0) return chain.final;
+    const next2 = new URL(location, hop.url).href;
+    const method = followedWith(hop.status, chain.method);
+    hold(keyOf2(chain.owner, method, next2), { ...chain, method, hops: rest2 });
+    return bodiless(hop);
+  };
+  return {
+    traits: { ...inner.traits, manualRedirects: true },
+    ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
+    async fetch(request2, owner = KERNEL) {
+      const key = keyOf2(owner, request2.method, request2.url);
+      const waiting = held.get(key);
+      if (waiting && waiting.fingerprint === fingerprint(request2.headers)) {
+        held.delete(key);
+        clearTimeout(waiting.timer);
+        return replay(waiting);
+      }
+      const response = await inner.fetch(request2);
+      if (!response.redirects?.length) return response;
+      return replay({
+        owner,
+        method: request2.method,
+        fingerprint: fingerprint(request2.headers),
+        hops: response.redirects,
+        final: response
+      });
+    }
+  };
+}
+
 // src/kernel/settling.ts
 var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-list",
@@ -12075,7 +12175,7 @@ var Launcher = class {
     this.hostname = hostname;
     this.env = { ...networkEnv(hostname), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
-    this.transport = options.transport ?? missingTransport();
+    this.transport = replayingHops(options.transport ?? missingTransport());
     this.uplink = options.uplink;
     this.routes = new Routes(options.uplink?.traits.ipv6 === true);
     if (options.uplink?.routes) this.routes.set(options.uplink.routes);
@@ -12332,7 +12432,7 @@ var Launcher = class {
       jobs: this.jobs,
       ptys: this.ptys,
       net: this.net,
-      http: new HttpHandles(this.transport),
+      http: new HttpHandles(this.transport, pid),
       locks: this.locks,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child),