@ai-ecoverse/slicc-kernel 1.53.0 → 1.53.2

package/dist/node-process-worker.js

@@ -8061,8 +8061,11 @@ var init_procfs = __esm({
 });
 
 // src/process/realm-user.ts
-function ownByCaller(Fs, cred) {
-  const owner = { uid: cred?.euid ?? 0, gid: cred?.egid ?? 0 };
+function credAbi(glue) {
+  return CRED_ABI.test(glue);
+}
+function ownByCaller(Fs, cred, abi = true) {
+  const owner = abi ? { uid: cred?.euid ?? 0, gid: cred?.egid ?? 0 } : { ...LEGACY_OWNER };
   const { stat, fstat } = Fs;
   const owned = (attr2) => ({ ...attr2, uid: owner.uid, gid: owner.gid });
   if (typeof stat === "function") {
@@ -8071,9 +8074,12 @@ function ownByCaller(Fs, cred) {
   if (typeof fstat === "function") Fs.fstat = (fd) => owned(fstat.call(Fs, fd));
   return owner;
 }
+var LEGACY_OWNER, CRED_ABI;
 var init_realm_user = __esm({
   "src/process/realm-user.ts"() {
     "use strict";
+    LEGACY_OWNER = Object.freeze({ uid: 1e3, gid: 1e3 });
+    CRED_ABI = /\bslicc_cred_js\b/;
   }
 });
 
@@ -8442,7 +8448,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     describeFork: () => describeForFork(running.FS, sys, streams, livePath),
     inherit: (actions) => describeInherited(running.FS, sys, streams, livePath, actions),
     stdioPromoter: () => vfsPromoter(running.FS, sys, streams, livePath),
-    owner: ownByCaller(running.FS, init.cred)
+    owner: ownByCaller(running.FS, init.cred, credAbi(init.program.glue))
   });
   running.sliccKernel.http = createHttpKernel(transport);
   running.sliccKernel.hostname = hostnameOf(init.env);
@@ -11319,6 +11325,15 @@ var NODE_SLOTS = [
   "setImmediate",
   "clearImmediate"
 ];
+function zeroedBuffers(buffer) {
+  const alloc = buffer.alloc.bind(buffer);
+  const fixed = (value2) => ({ value: value2, writable: false, configurable: false });
+  Object.defineProperties(buffer, {
+    allocUnsafe: fixed((size) => alloc(size)),
+    allocUnsafeSlow: fixed((size) => alloc(size)),
+    poolSize: fixed(0)
+  });
+}
 function refused(specifier) {
   return Object.assign(new Error(`slicc-kernel: a JS program cannot import ${specifier}`), {
     code: "ERR_ACCESS_DENIED"
@@ -11335,6 +11350,7 @@ function refuseModules() {
   });
 }
 function nodeLockdown(scope2 = globalThis) {
+  zeroedBuffers(Buffer);
   lockdown(scope2);
   hide(scope2, NODE_GLOBALS);
   vacate(scope2, NODE_SLOTS);