@ai-ecoverse/slicc-kernel 1.56.1 → 1.57.0

package/dist/node-process-worker.js

@@ -493,6 +493,35 @@ function normalize(path) {
   }
   return `/${out.join("/")}`;
 }
+function physical(fs, path) {
+  let done = [];
+  let todo = path.split("/").filter((part) => part !== "" && part !== ".");
+  let hops = 0;
+  while (todo.length > 0) {
+    const part = todo.shift();
+    if (part === "..") {
+      done.pop();
+      continue;
+    }
+    if (!todo.includes("..")) {
+      done.push(part);
+      continue;
+    }
+    const at = `/${[...done, part].join("/")}`;
+    const st = fs.lstat(at);
+    if (st.isSymbolicLink) {
+      if (++hops > MAX_LINKS) throw new WasiError("ELOOP");
+      const target = fs.readlink(at);
+      if (target.startsWith("/")) done = [];
+      todo = [...target.split("/").filter((p) => p !== "" && p !== "."), ...todo];
+    } else if (!st.isDirectory) {
+      throw new WasiError("ENOTDIR");
+    } else {
+      done.push(part);
+    }
+  }
+  return `/${done.join("/")}`;
+}
 function resolveUnder(dir, path) {
   return normalize(path.startsWith("/") ? path : `${dir}/${path}`);
 }
@@ -588,7 +617,7 @@ function pinnedIo(bridge, handle, mutating) {
     truncate: (p, size) => mutating(() => truncate(p, size))
   };
 }
-var WasiError, FileBuffer, LocalFile, MISS_TTL_MS;
+var WasiError, FileBuffer, LocalFile, MAX_LINKS, MISS_TTL_MS;
 var init_wasi_files = __esm({
   "src/process/wasi/wasi-files.ts"() {
     "use strict";
@@ -776,6 +805,7 @@ var init_wasi_files = __esm({
         this.buffer.flush();
       }
     };
+    MAX_LINKS = 40;
     MISS_TTL_MS = 20;
   }
 });
@@ -1429,8 +1459,8 @@ var init_wasi_fds = __esm({
         }
       }
       resolve(dirfd, path) {
-        if (path.startsWith("/")) return normalize(path);
-        return resolveUnder(this.dir(dirfd).path, path);
+        const joined2 = path.startsWith("/") ? path : `${this.dir(dirfd).path}/${path}`;
+        return joined2.split("/").includes("..") ? physical(this.fs, joined2) : normalize(joined2);
       }
       open(path, oflags, rights, fdflags) {
         const device2 = deviceOf(path);
@@ -3154,7 +3184,9 @@ function parseSyncFsStat(json) {
     ...s.readonly === true ? { readonly: true } : {},
     ...typeof s.maxFile === "number" ? { maxFile: s.maxFile } : {},
     ...s.ranged === true ? { ranged: true } : {},
-    ...typeof s.version === "string" ? { version: s.version } : {}
+    ...typeof s.version === "string" ? { version: s.version } : {},
+    ...typeof s.uid === "number" ? { uid: s.uid } : {},
+    ...typeof s.gid === "number" ? { gid: s.gid } : {}
   };
 }
 var SYNC_FS_OPS, SYNC_FS_REQUEST_TIMEOUT_MS;
@@ -3185,7 +3217,9 @@ var init_sync_fs_wire = __esm({
       "kept",
       "pread",
       "pwrite",
-      "truncate"
+      "truncate",
+      "chown",
+      "lchown"
     ];
     SYNC_FS_REQUEST_TIMEOUT_MS = 25e3;
   }
@@ -4177,8 +4211,8 @@ function createSyncFsSabBridge(transport, opts = {}) {
       if (typeof v !== "boolean") throw errnoError("EIO", path);
       return v;
     },
-    mkdir: (path) => {
-      run({ op: "mkdir", path }, path);
+    mkdir: (path, mode) => {
+      run({ op: "mkdir", path, ...mode !== void 0 ? { mode } : {} }, path);
     },
     rm: (path) => {
       run({ op: "rm", path }, path);
@@ -4209,9 +4243,14 @@ function createSyncFsSabBridge(transport, opts = {}) {
     lutimes: (path, atimeMs, mtimeMs) => {
       run({ op: "lutimes", path, atimeMs, mtimeMs }, path);
     },
-    create: (path) => {
-      run({ op: "create", path }, path);
+    create: (path, mode) => {
+      run({ op: "create", path, ...mode !== void 0 ? { mode } : {} }, path);
+    },
+    chown: (path, uid, gid) => {
+      const ids = { ...uid !== void 0 ? { uid } : {}, ...gid !== void 0 ? { gid } : {} };
+      run({ op: "lchown", path, ...ids }, path);
     },
+    ...opts.owners ? { owners: true } : {},
     hold: (path, held, open, handle) => {
       const mode = (held ? 1 : 0) | (open ? 2 : 0);
       if (mode === 3) return json({ op: "hold", path, mode }, path);
@@ -5417,6 +5456,7 @@ function createNodeOps(h) {
   return {
     getattr(node) {
       const st = statOf(node);
+      const owned = bridgeOf(node).owners === true;
       const s = node.live;
       const size = Fs.isDir(node.mode) ? 4096 : s.ranged?.size() ?? (s.loaded ? s.len : st.size);
       const mtime = new Date(st.mtimeMs ?? 0);
@@ -5425,8 +5465,8 @@ function createNodeOps(h) {
         ino: st.ino ?? inodeOf(liveNodePath(node)),
         mode: node.mode,
         nlink: 1,
-        uid: 0,
-        gid: 0,
+        uid: owned ? st.uid ?? 0 : 0,
+        gid: owned ? st.gid ?? 0 : 0,
         rdev: 0,
         size,
         atime: new Date(st.atimeMs ?? mtime.getTime()),
@@ -5469,14 +5509,17 @@ function createNodeOps(h) {
     mknod(parent, name2, mode) {
       parent.live.listed = void 0;
       const path = childPath(parent, name2);
-      if (Fs.isDir(mode)) {
-        call2(() => bridgeOf(parent).mkdir(path));
-        const perm = mode & PERM_MASK & ~UMASK;
-        if (perm !== DEFAULT_DIR_PERM) metadataCall(() => bridgeOf(parent).chmod(path, perm));
+      const bridge = bridgeOf(parent);
+      const perm = bridge.owners ? mode & PERM_MASK : void 0;
+      if (Fs.isDir(mode) && perm !== void 0) {
+        call2(() => bridge.mkdir(path, perm));
+      } else if (Fs.isDir(mode)) {
+        call2(() => bridge.mkdir(path));
+        const masked = mode & PERM_MASK & ~UMASK;
+        if (masked !== DEFAULT_DIR_PERM) metadataCall(() => bridge.chmod(path, masked));
       } else if (Fs.isFile(mode)) {
-        const bridge = bridgeOf(parent);
         call2(
-          () => bridge.create ? bridge.create(path) : bridge.writeFile(path, new Uint8Array(0))
+          () => bridge.create ? bridge.create(path, perm) : bridge.writeFile(path, new Uint8Array(0))
         );
       } else {
         throw new Fs.ErrnoError(wasiErrno("EPERM"));
@@ -5879,6 +5922,32 @@ function guardRenames(Fs) {
     rename(from, to);
   };
 }
+function idOf(value2) {
+  return value2 === -1 || value2 === 4294967295 ? void 0 : value2 >>> 0;
+}
+function useLiveChown(Fs) {
+  const chown = Fs.chown?.bind(Fs);
+  if (!chown) return;
+  Fs.chown = (path, uid, gid, dontFollow) => {
+    const node = typeof path === "string" ? Fs.lookupPath(path, { follow: !dontFollow }).node : path;
+    if (!node.live || node.live.orphan) return chown(path, uid, gid, dontFollow);
+    try {
+      node.mount.opts.bridge.chown?.(liveNodePath(node), idOf(uid), idOf(gid));
+    } catch (err) {
+      throw toErrno(Fs, err);
+    }
+    node.live.stat = void 0;
+    if (node.parent?.live) node.parent.live.listed = void 0;
+  };
+  const { getStreamChecked } = Fs;
+  if (!Fs.fchown || !getStreamChecked) return;
+  Fs.fchown = (fd, uid, gid) => {
+    const stream = getStreamChecked.call(Fs, fd);
+    const live = stream.node.live !== void 0;
+    const target = live || stream.path === void 0 ? stream.node : stream.path;
+    Fs.chown(target, uid, gid);
+  };
+}
 var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
@@ -5923,6 +5992,7 @@ function mountVfsIntoEmscripten(Fs, deps) {
   const dirs = topLevelDirs(bridge, warn);
   const { plugin, mounted } = mountLiveVfsDirs(Fs, bridge, dirs ?? [], warn);
   if (dirs) liveRoot(Fs, bridge);
+  if (bridge.owners && Fs.lookupPath) useLiveChown(Fs);
   try {
     Fs.chdir(deps.cwd);
   } catch (err) {
@@ -8328,6 +8398,9 @@ function reportGrowth(imports, publish) {
     return grown;
   };
 }
+function callerOwner(Fs, init) {
+  return init.owners ? {} : { owner: ownByCaller(Fs, init.cred, credAbi(init.program.glue)) };
+}
 async function runWasmProcess(init, port3, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port3, {
@@ -8438,7 +8511,7 @@ async function runWasmProcess(init, port3, deps = {}) {
   const running = module;
   if (!hasStreams(running)) return runStdioOnly(running, init);
   const vfs = mountVfsIntoEmscripten(running.FS, {
-    bridge: createSyncFsSabBridge(transport),
+    bridge: createSyncFsSabBridge(transport, init.owners ? { owners: true } : {}),
     cwd: init.cwd,
     warn: deps.warn ?? say(2)
   });
@@ -8480,7 +8553,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     describeFork: () => describeForFork(running.FS, sys, streams, livePath),
     inherit: (actions) => describeInherited(running.FS, sys, streams, livePath, actions),
     stdioPromoter: () => vfsPromoter(running.FS, sys, streams, livePath),
-    owner: ownByCaller(running.FS, init.cred, credAbi(init.program.glue))
+    ...callerOwner(running.FS, init)
   });
   running.sliccKernel.http = createHttpKernel(transport);
   running.sliccKernel.hostname = hostnameOf(init.env);
@@ -8805,9 +8878,9 @@ function procfsBridge(fs, tree) {
     }
   };
   const readOnly = (paths, run) => {
-    const physical = shadowing();
+    const physical2 = shadowing();
     for (const [p, follow2] of paths) {
-      if (inProc(p) || physical && toProc(p, follow2) !== void 0) throw syncError("EROFS", p);
+      if (inProc(p) || physical2 && toProc(p, follow2) !== void 0) throw syncError("EROFS", p);
     }
     return run();
   };