@ai-ecoverse/slicc-kernel 1.52.0 → 1.53.0

package/README.md

@@ -234,7 +234,7 @@ The module's default export (or its `main` export) is called with a context and
 
 A program that throws, or leaves an error or a rejected promise unhandled with no listener for it, ends with status 1 and the message on stderr; one whose module cannot be loaded, or exports no function, ends with 126. A write to a pipe whose reader is gone ends the program with 141, unless it ignores or catches `SIGPIPE` (an ignore inherited from its parent counts), in which case the write fails with `EPIPE`. Errors carry a POSIX `code`. Reads and writes of pipes, terminals and sockets go through the kernel's asynchronous operations, so a program blocked reading stdin can still write and handle signals; other calls of one process are made one at a time. A JS program cannot `fork`, and threads it starts itself are not the kernel's.
 
-The module has the trust of an Emscripten program's glue or a WASI program's imports module: it comes from a package that was installed, and it runs in the worker of its own process. The kernel withholds the worker's own ways out before it loads the module: `fetch`, `XMLHttpRequest`, `WebSocket`, `WebTransport`, `EventSource`, `importScripts`, `indexedDB`, `caches`, `cookieStore`, `Worker`, `SharedWorker`, `BroadcastChannel`, `postMessage`, `close`, and `navigator.storage`, `navigator.locks` and `navigator.serviceWorker` are `undefined`, and a worker where one of them cannot be removed refuses to run the program (126). A program's files are the kernel's, through the context; it reaches the kernel only through its own process's system calls, as the context makes them, and no other process's. This is a guard against programs going around the kernel, not a sandbox: `import()` of a URL is a request the kernel cannot withhold.
+The module has the trust of an Emscripten program's glue or a WASI program's imports module: it comes from a package that was installed, and it runs in the worker of its own process. The kernel withholds the worker's own ways out before it loads the module: `XMLHttpRequest`, `WebSocketStream`, `WebTransport`, `EventSource`, `importScripts`, `indexedDB`, `caches`, `cookieStore`, `Worker`, `SharedWorker`, `BroadcastChannel`, `postMessage`, `close`, and `navigator.storage`, `navigator.locks` and `navigator.serviceWorker` are `undefined`, and a worker where one of them cannot be removed refuses to run the program (126). `fetch` and `WebSocket` are `undefined` too, but stay writable and configurable, so a program can install its own over `ctx.fetch` and `ctx.websocket` (as slicc-jsh does). A program's files are the kernel's, through the context; it reaches the kernel only through its own process's system calls, as the context makes them, and no other process's. This is a guard against programs going around the kernel, not a sandbox: `import()` of a URL is a request the kernel cannot withhold.
 
 Under the Node entry, the kernel also withholds the host's Node from the program before its module loads ([#297](https://github.com/ai-ecoverse/slicc-kernel/issues/297)). `require`, `module`, `exports`, `__filename`, `__dirname`, `localStorage` and `sessionStorage` are `undefined` for good. `process`, `global`, `setImmediate` and `clearImmediate` are `undefined` too, but stay writable, so a program can install its own (as slicc-jsh does). `Buffer` stays Node's own, since Node's `Response`, `Request`, `Blob` and stream bodies read it when they run; it reaches nothing outside the program, and a program can replace it. Imports of Node's builtin modules (`node:fs`, `fs`, `node:worker_threads`, …) and of anything but a `data:` URL, `file:` included, fail with `ERR_ACCESS_DENIED`, whether static, dynamic or through `import.meta.resolve`. A process worker that exits or crashes on its own ends its process with 70. This is the same guard, not a sandbox: a host that runs code it does not trust, such as an agent's, needs its own isolation around the Node process as well.
 

package/dist/node-process-worker.js

@@ -42,19 +42,35 @@ function hide(target, names) {
     }
   }
 }
+function vacate(target, names) {
+  for (const name2 of names) {
+    for (let at = target; at && at !== Object.prototype; ) {
+      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
+      at = Object.getPrototypeOf(at);
+    }
+    Reflect.defineProperty(target, name2, {
+      value: void 0,
+      writable: true,
+      enumerable: false,
+      configurable: true
+    });
+    if (Reflect.get(target, name2) !== void 0) {
+      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
+    }
+  }
+}
 function lockdown(scope2 = globalThis) {
   hide(scope2, BLOCKED_GLOBALS);
+  vacate(scope2, OPEN_SLOTS);
   const navigator = scope2.navigator;
   if (navigator && typeof navigator === "object") hide(navigator, BLOCKED_NAVIGATOR);
 }
-var BLOCKED_GLOBALS, BLOCKED_NAVIGATOR;
+var BLOCKED_GLOBALS, BLOCKED_NAVIGATOR, OPEN_SLOTS;
 var init_lockdown = __esm({
   "src/process/js/lockdown.ts"() {
     "use strict";
     BLOCKED_GLOBALS = [
-      "fetch",
       "XMLHttpRequest",
-      "WebSocket",
       "WebSocketStream",
       "WebTransport",
       "EventSource",
@@ -69,6 +85,7 @@ var init_lockdown = __esm({
       "close"
     ];
     BLOCKED_NAVIGATOR = ["storage", "locks", "serviceWorker"];
+    OPEN_SLOTS = ["fetch", "WebSocket"];
   }
 });
 
@@ -11302,23 +11319,6 @@ var NODE_SLOTS = [
   "setImmediate",
   "clearImmediate"
 ];
-function vacate(target, names) {
-  for (const name2 of names) {
-    for (let at = target; at && at !== Object.prototype; ) {
-      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
-      at = Object.getPrototypeOf(at);
-    }
-    Reflect.defineProperty(target, name2, {
-      value: void 0,
-      writable: true,
-      enumerable: false,
-      configurable: true
-    });
-    if (Reflect.get(target, name2) !== void 0) {
-      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
-    }
-  }
-}
 function refused(specifier) {
   return Object.assign(new Error(`slicc-kernel: a JS program cannot import ${specifier}`), {
     code: "ERR_ACCESS_DENIED"