@ai-ecoverse/slicc-kernel 1.49.1 → 1.51.0

package/dist/node.js

@@ -715,6 +715,8 @@ var KernelSocket = class _KernelSocket {
   reset = false;
   local;
   peer;
+  peerCred;
+  listenerCred;
   link;
   readShut = false;
   writeShut = false;
@@ -790,7 +792,7 @@ var KernelSocket = class _KernelSocket {
     this.local = this.net.bind(this, addr);
     this.boundAt = this.local;
   }
-  listen(backlog) {
+  listen(backlog, cred) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
     if (!this.local) {
@@ -799,6 +801,7 @@ var KernelSocket = class _KernelSocket {
     }
     this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
     this.state = "listening";
+    this.listenerCred ??= cred;
   }
   async accept(signal, nonblock = false) {
     for (; ; ) {
@@ -815,7 +818,7 @@ var KernelSocket = class _KernelSocket {
     this.changes.wake();
     return true;
   }
-  connect(addr, viaUplink = true) {
+  connect(addr, viaUplink = true, cred) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
@@ -833,7 +836,9 @@ var KernelSocket = class _KernelSocket {
     const server = new _KernelSocket(this.net, this.domain);
     server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
     server.peer = this.local;
+    server.peerCred = cred;
     this.peer = server.local;
+    this.peerCred = target.listenerCred;
     link(this, server);
     if (!target.offer(server)) {
       this.unlink();
@@ -952,9 +957,10 @@ var KernelSocket = class _KernelSocket {
     this.boundAt = void 0;
     this.changes.wake();
   }
-  static pair(net, domain) {
+  static pair(net, domain, cred) {
     const a = new _KernelSocket(net, domain);
     const b = new _KernelSocket(net, domain);
+    a.peerCred = b.peerCred = cred;
     const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
     a.local = b.local = a.peer = b.peer = name2;
     link(a, b);
@@ -1366,9 +1372,10 @@ function fetchTransport(options = {}) {
   const send = options.fetch ?? globalThis.fetch.bind(globalThis);
   const Socket = options.webSocket === true ? globalThis.WebSocket : options.webSocket || void 0;
   const headers = options.webSocketHeaders === true;
+  const redirect = options.redirect ?? "follow";
   return {
     traits: {
-      manualRedirects: false,
+      manualRedirects: redirect === "manual",
       encodedBodies: false,
       maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,
       crossOrigin: "cors",
@@ -1383,7 +1390,7 @@ function fetchTransport(options = {}) {
           headers: joinHeaders(request.headers),
           ...request.body ? { body: request.body } : {},
           signal: request.signal,
-          redirect: "follow",
+          redirect,
           credentials: "omit",
           mode: "cors"
         });
@@ -1449,6 +1456,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         net: "head",
         nid: call.nid,
         ...response.redirected ? { url: response.url, redirected: true } : {},
+        ...response.redirects ? { redirects: response.redirects } : {},
         status: response.status,
         statusText: response.statusText,
         headers: response.headers
@@ -5712,9 +5720,9 @@ var SAB_I_KILLED = 13;
 var SAB_I_ASYNC = 14;
 var SAB_I_STOP = 15;
 var U32 = 2 ** 32;
-function storeU53(header3, lo, hi, value) {
-  Atomics.store(header3, hi, Math.floor(value / U32));
-  Atomics.store(header3, lo, value % U32 | 0);
+function storeU53(header4, lo, hi, value) {
+  Atomics.store(header4, hi, Math.floor(value / U32));
+  Atomics.store(header4, lo, value % U32 | 0);
 }
 var SAB_STATE_READY = 2;
 var SAB_STATUS_BYTES = 1;
@@ -5757,7 +5765,7 @@ function sabViews(sab) {
 var PENDING_TTL_MS = SYNC_FS_REQUEST_TIMEOUT_MS + 5e3;
 function attachSyncSabResponder(port, sab, token, opts) {
   const views = sabViews(sab);
-  const { header: header3, window } = views;
+  const { header: header4, window } = views;
   const pending = /* @__PURE__ */ new Map();
   let disposed = false;
   const { dispatch: dispatch2 } = opts;
@@ -5768,20 +5776,20 @@ function attachSyncSabResponder(port, sab, token, opts) {
     pending.delete(id2);
   }
   function publish(id2, entry, offset) {
-    if (Atomics.load(header3, SAB_I_REQ) !== id2) {
+    if (Atomics.load(header4, SAB_I_REQ) !== id2) {
       drop(id2);
       return;
     }
     const chunk2 = Math.min(window.byteLength, entry.payload.byteLength - offset);
     if (chunk2 > 0) window.set(entry.payload.subarray(offset, offset + chunk2));
-    Atomics.store(header3, SAB_I_STATUS, entry.status);
-    storeU53(header3, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
-    Atomics.store(header3, SAB_I_CHUNK, chunk2);
-    storeU53(header3, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
-    Atomics.store(header3, SAB_I_SEQ, id2);
-    Atomics.store(header3, SAB_I_STATE, SAB_STATE_READY);
-    Atomics.add(header3, SAB_I_PUB, 1);
-    Atomics.notify(header3, SAB_I_PUB);
+    Atomics.store(header4, SAB_I_STATUS, entry.status);
+    storeU53(header4, SAB_I_TOTAL, SAB_I_TOTAL_HI, entry.payload.byteLength);
+    Atomics.store(header4, SAB_I_CHUNK, chunk2);
+    storeU53(header4, SAB_I_OFFSET, SAB_I_OFFSET_HI, offset);
+    Atomics.store(header4, SAB_I_SEQ, id2);
+    Atomics.store(header4, SAB_I_STATE, SAB_STATE_READY);
+    Atomics.add(header4, SAB_I_PUB, 1);
+    Atomics.notify(header4, SAB_I_PUB);
     if (offset + chunk2 >= entry.payload.byteLength) drop(id2);
   }
   function settle(id2, result) {
@@ -6378,7 +6386,7 @@ var RealmProxy = class {
         const waiting = new AbortController();
         void watchHangup(ctx.socket, abort, waiting.signal);
         try {
-          response = await this.upstream(req, url, body, abort.signal);
+          response = await this.upstream(req, url, body, abort.signal, ctx.socket.peerCred?.pid);
         } finally {
           waiting.abort();
         }
@@ -6404,15 +6412,18 @@ var RealmProxy = class {
       await conn.write(latin1Bytes("HTTP/1.1 100 Continue\r\n\r\n"), this.stop.signal);
     }
   }
-  async upstream(req, url, body, signal) {
+  async upstream(req, url, body, signal, owner) {
     try {
-      const fetching = this.options.transport.fetch({
-        url: toHostLoopback(url),
-        method: req.method.toUpperCase(),
-        headers: forwardRequestHeaders(req.headers),
-        body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
-        signal
-      });
+      const fetching = this.options.transport.fetch(
+        {
+          url: toHostLoopback(url),
+          method: req.method.toUpperCase(),
+          headers: forwardRequestHeaders(req.headers),
+          body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
+          signal
+        },
+        owner
+      );
       return await untilAborted(fetching, signal);
     } catch (e) {
       if (signal.aborted) throw e;
@@ -6424,13 +6435,13 @@ var RealmProxy = class {
   }
   async relay(conn, method, minor, response, keepAlive) {
     const status = response.status;
-    const bodiless = method === "HEAD" || status === 204 || status === 304 || status < 200;
+    const bodiless2 = method === "HEAD" || status === 204 || status === 304 || status < 200;
     const headers = forwardResponseHeaders(response.headers, {
       encodedBodies: this.options.transport.traits.encodedBodies,
-      bodiless
+      bodiless: bodiless2
     });
-    const chunked2 = !bodiless && minor >= 1;
-    const keep = keepAlive && (bodiless || chunked2);
+    const chunked2 = !bodiless2 && minor >= 1;
+    const keep = keepAlive && (bodiless2 || chunked2);
     headers.push(["Connection", keep ? "keep-alive" : "close"]);
     if (chunked2) headers.push(["Transfer-Encoding", "chunked"]);
     const signal = this.stop.signal;
@@ -6438,7 +6449,7 @@ var RealmProxy = class {
       responseHead(status, response.statusText || REASON[status] || "", headers),
       signal
     );
-    if (bodiless) {
+    if (bodiless2) {
       await response.cancel();
       return keep;
     }
@@ -7401,8 +7412,10 @@ var HttpHandles = class {
   open = /* @__PURE__ */ new Map();
   nextHandle = 0;
   ws;
-  constructor(transport) {
+  owner;
+  constructor(transport, owner) {
     this.transport = transport;
+    this.owner = owner;
     this.ws = new WsHandles(transport, () => ++this.nextHandle);
   }
   syscall(req) {
@@ -7446,13 +7459,16 @@ var HttpHandles = class {
   }
   async respond(handle, req, entry) {
     try {
-      const response = await this.transport.fetch({
-        url: req.url,
-        method: req.method,
-        headers: req.headers,
-        ...req.body ? { body: req.body } : {},
-        signal: entry.abort.signal
-      });
+      const response = await this.transport.fetch(
+        {
+          url: req.url,
+          method: req.method,
+          headers: req.headers,
+          ...req.body ? { body: req.body } : {},
+          signal: entry.abort.signal
+        },
+        this.owner
+      );
       entry.body = response.body[Symbol.asyncIterator]();
       entry.cancel = () => response.cancel();
       if (!this.open.has(handle)) await entry.cancel().catch(() => void 0);
@@ -8278,7 +8294,7 @@ async function socketSyscall(req, proc) {
     case "sock-open":
       return ok(fds.install(new OpenFile(net.socket(req.domain)), 3));
     case "sock-pair": {
-      const [a, b] = KernelSocket.pair(net, req.domain);
+      const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
       try {
         return ok([first, fds.install(new OpenFile(b), 3)]);
@@ -8291,12 +8307,12 @@ async function socketSyscall(req, proc) {
       socketAt(fds, req.fd).bind(req.addr);
       return ok();
     case "sock-listen":
-      socketAt(fds, req.fd).listen(req.backlog);
+      socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
       return ok();
     case "sock-accept":
       return ok(await accept(proc, req.fd, req.nonblock));
     case "sock-connect": {
-      const dialing = socketAt(fds, req.fd).connect(req.addr);
+      const dialing = socketAt(fds, req.fd).connect(req.addr, true, proc.cred?.());
       if (req.nonblock) {
         dialing?.catch(() => void 0);
         throw new KernelError("EINPROGRESS");
@@ -9712,7 +9728,8 @@ var WasmProcess = class {
       fds: this.fds,
       net: this.net,
       blocking: () => this.blockingSignal(cancelled),
-      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking)
+      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
+      cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid })
     });
   }
   tty(fd) {
@@ -9928,12 +9945,12 @@ var Dying = class {
   timer;
   busy = 0;
   finish;
-  start(code, sig, header3, process2, finish) {
+  start(code, sig, header4, process2, finish) {
     if (this.ending) return;
     this.ending = { code, sig };
     this.finish = finish;
     this.arm();
-    Atomics.store(header3, SAB_I_KILLED, code);
+    Atomics.store(header4, SAB_I_KILLED, code);
     process2.die();
   }
   async serving(work) {
@@ -9970,22 +9987,22 @@ function killThread(thread, caught, sig) {
 function threadCancel(thread) {
   return Atomics.load(thread.header, SAB_I_SIGNALS) !== 0 ? AbortSignal.abort() : thread.interrupt.signal;
 }
-function notifiers(header3) {
+function notifiers(header4) {
   return {
     onPending(sig) {
-      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
-      Atomics.notify(header3, SAB_I_SIGNALS);
+      Atomics.or(header4, SAB_I_SIGNALS, sigbit(sig));
+      Atomics.notify(header4, SAB_I_SIGNALS);
     },
     onAsync() {
-      Atomics.add(header3, SAB_I_ASYNC, 1);
-      Atomics.notify(header3, SAB_I_ASYNC);
+      Atomics.add(header4, SAB_I_ASYNC, 1);
+      Atomics.notify(header4, SAB_I_ASYNC);
     }
   };
 }
-function publishStops(process2, header3) {
+function publishStops(process2, header4) {
   process2.onState((state) => {
-    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
-    Atomics.notify(header3, SAB_I_STOP);
+    Atomics.store(header4, SAB_I_STOP, state === "stopped" ? 1 : 0);
+    Atomics.notify(header4, SAB_I_STOP);
   });
 }
 function transferOf(opts, lane) {
@@ -10053,7 +10070,7 @@ function holdingToken(opts, holds) {
     renamed: (from, to) => holds.renamed(from, to)
   });
 }
-function processOptions(opts, header3, hooks) {
+function processOptions(opts, header4, hooks) {
   return {
     ...inherited(opts),
     ...opts.identity ? { identity: opts.identity } : {},
@@ -10077,27 +10094,27 @@ function processOptions(opts, header3, hooks) {
     locks: opts.locks,
     onReap: opts.onReap,
     resolver: opts.resolver,
-    ...notifiers(header3),
-    onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
-    hasPending: () => Atomics.load(header3, SAB_I_SIGNALS) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
+    ...notifiers(header4),
+    onTimer: (which) => void Atomics.or(header4, SAB_I_TIMERS, 1 << which),
+    hasPending: () => Atomics.load(header4, SAB_I_SIGNALS) !== 0 || Atomics.load(header4, SAB_I_TIMERS) !== 0,
     raise: hooks.raise,
     threadKill: hooks.threadKill,
-    ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header3, SAB_I_SIGNALS) } : {}
+    ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header4, SAB_I_SIGNALS) } : {}
   };
 }
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
-  const header3 = new Int32Array(sab, 0, SAB_HEADER_I32);
+  const header4 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const threadSignals = /* @__PURE__ */ new Map();
   const process2 = new WasmProcess(
     opts.pid,
     opts.fds,
-    processOptions(opts, header3, {
+    processOptions(opts, header4, {
       raise: (sig) => signal(sig),
       threadKill: (tid, sig) => killThread(threadSignals.get(tid), process2.signalMasks().caught, sig)
     })
   );
-  publishStops(process2, header3);
+  publishStops(process2, header4);
   const holds = new HeldPaths();
   opts.held?.add(holds);
   const token = holdingToken(opts, holds);
@@ -10209,7 +10226,7 @@ function spawnWasmProcess(opts) {
     if (process2.signal(sig) !== "terminate") return;
     const code = sig === SIG.KILL ? 137 : 128 + sig;
     if (opts.program.abi !== "wasi" || done4) finish(code, sig);
-    else dying.start(code, sig, header3, process2, () => finish(code, sig));
+    else dying.start(code, sig, header4, process2, () => finish(code, sig));
   };
   const kill = (code = 137) => finish(code, code > 128 && code < 160 ? code - 128 : void 0);
   return {
@@ -10219,7 +10236,7 @@ function spawnWasmProcess(opts) {
     signal,
     termsig: () => endedBy,
     onState: (listener) => process2.onState(listener),
-    memory: () => Atomics.load(header3, SAB_I_MEMORY) * 65536,
+    memory: () => Atomics.load(header4, SAB_I_MEMORY) * 65536,
     ignoredSignals: (fork) => process2.inheritable(fork),
     signalMasks: () => process2.signalMasks(),
     umask: () => process2.umask,
@@ -10414,6 +10431,89 @@ var JobTable = class {
   }
 };
 
+// src/kernel/net/redirect-hops.ts
+var HELD_MS = 3e4;
+var HELD_MAX = 64;
+var HELD_PER_OWNER = 8;
+var MATCHED = ["range", "if-none-match", "if-modified-since", "if-range", "accept-encoding"];
+var KERNEL = -1;
+function header2(headers, name2) {
+  const values = headers.filter(([n]) => n.toLowerCase() === name2).map(([, v]) => v);
+  return values.length > 0 ? values.join(", ") : void 0;
+}
+function fingerprint(headers) {
+  const fields = MATCHED.map((name2) => header2(headers, name2) ?? "");
+  return JSON.stringify([...fields, header2(headers, "authorization") !== void 0]);
+}
+function followedWith(status, method) {
+  if (status === 303 && method !== "GET" && method !== "HEAD") return "GET";
+  if ((status === 301 || status === 302) && method === "POST") return "GET";
+  return method;
+}
+function bodiless(hop) {
+  return {
+    url: hop.url,
+    status: hop.status,
+    statusText: "",
+    headers: hop.headers,
+    body: (async function* () {
+    })(),
+    cancel: async () => void 0
+  };
+}
+function replayingHops(inner, heldMs = HELD_MS) {
+  if (!inner.traits.redirectHops || inner.traits.manualRedirects) return inner;
+  const held = /* @__PURE__ */ new Map();
+  const drop = (key) => {
+    const entry = held.get(key);
+    if (!entry) return;
+    held.delete(key);
+    clearTimeout(entry.timer);
+    void entry.final.cancel().catch(() => void 0);
+  };
+  const keyOf2 = (owner, method, url) => `${owner} ${method} ${url}`;
+  const hold = (key, chain) => {
+    drop(key);
+    const mine = [...held.keys()].filter((k) => held.get(k)?.owner === chain.owner);
+    if (mine.length >= HELD_PER_OWNER) drop(mine[0]);
+    if (held.size >= HELD_MAX) drop(held.keys().next().value);
+    const timer = setTimeout(() => drop(key), heldMs);
+    timer.unref?.();
+    held.set(key, { ...chain, timer });
+  };
+  const replay = (chain) => {
+    const [hop, ...rest2] = chain.hops;
+    const location = hop && header2(hop.headers, "location");
+    if (!hop || location === void 0) return chain.final;
+    const next2 = new URL(location, hop.url).href;
+    const method = followedWith(hop.status, chain.method);
+    hold(keyOf2(chain.owner, method, next2), { ...chain, method, hops: rest2 });
+    return bodiless(hop);
+  };
+  return {
+    traits: { ...inner.traits, manualRedirects: true },
+    ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
+    async fetch(request, owner = KERNEL) {
+      const key = keyOf2(owner, request.method, request.url);
+      const waiting = held.get(key);
+      if (waiting && waiting.fingerprint === fingerprint(request.headers)) {
+        held.delete(key);
+        clearTimeout(waiting.timer);
+        return replay(waiting);
+      }
+      const response = await inner.fetch(request);
+      if (!response.redirects?.length) return response;
+      return replay({
+        owner,
+        method: request.method,
+        fingerprint: fingerprint(request.headers),
+        hops: response.redirects,
+        final: response
+      });
+    }
+  };
+}
+
 // src/kernel/settling.ts
 var SETUP_OPS = /* @__PURE__ */ new Set([
   "proc-list",
@@ -11839,7 +11939,7 @@ var Launcher = class {
     this.hostname = hostname;
     this.env = { ...networkEnv(hostname), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
-    this.transport = options.transport ?? missingTransport();
+    this.transport = replayingHops(options.transport ?? missingTransport());
     this.uplink = options.uplink;
     this.routes = new Routes(options.uplink?.traits.ipv6 === true);
     if (options.uplink?.routes) this.routes.set(options.uplink.routes);
@@ -12096,7 +12196,7 @@ var Launcher = class {
       jobs: this.jobs,
       ptys: this.ptys,
       net: this.net,
-      http: new HttpHandles(this.transport),
+      http: new HttpHandles(this.transport, pid),
       locks: this.locks,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child),
@@ -12866,7 +12966,7 @@ var RemoteTransport = class {
       finish();
       throw e;
     }
-    const { status, statusText, headers, url, redirected } = head;
+    const { status, statusText, headers, url, redirected, redirects } = head;
     const read = async () => {
       if (finished) return void 0;
       const reply = await this.ask({ net: "read", nid }).catch((e) => {
@@ -12884,6 +12984,7 @@ var RemoteTransport = class {
     };
     return {
       ...redirected ? { url, redirected } : {},
+      ...redirects ? { redirects } : {},
       status,
       statusText,
       headers,
@@ -13083,7 +13184,7 @@ function parseHead(bytes) {
   }
   return { status: Number(match[1]), statusText: match[2] ?? "", headers };
 }
-function header2(head, name2) {
+function header3(head, name2) {
   return head.headers.find(([key]) => key.toLowerCase() === name2)?.[1];
 }
 async function* chunked(source) {
@@ -13112,8 +13213,8 @@ async function* untilClose(source) {
 }
 function bodyOf(source, head, method) {
   if (method === "HEAD" || head.status === 204 || head.status === 304) return void 0;
-  if (header2(head, "transfer-encoding")?.toLowerCase().includes("chunked")) return chunked(source);
-  const length2 = header2(head, "content-length");
+  if (header3(head, "transfer-encoding")?.toLowerCase().includes("chunked")) return chunked(source);
+  const length2 = header3(head, "content-length");
   if (length2 === void 0) return untilClose(source);
   const size = Number(length2);
   if (!/^\d+$/.test(length2.trim()) || !Number.isSafeInteger(size)) {
@@ -13567,7 +13668,7 @@ function hostfsFetchOf(options) {
   };
 }
 function nodeTransport() {
-  const transport = fetchTransport({ webSocket: true, webSocketHeaders: true });
+  const transport = fetchTransport({ webSocket: true, webSocketHeaders: true, redirect: "manual" });
   return { ...transport, traits: { ...transport.traits, crossOrigin: "any" } };
 }
 var TERMINATED = "the kernel is terminated";