@ai-ecoverse/slicc-kernel 1.59.0 → 1.60.0

package/dist/node.js

@@ -1323,6 +1323,11 @@ function blockedReason(url, e) {
   }
   return `${url}: ${e instanceof Error ? e.message : String(e)}`;
 }
+function unopened(url, code) {
+  return Object.assign(new Error(`${url}: the WebSocket closed (${code}) before it opened`), {
+    status: 502
+  });
+}
 function openWebSocket(Socket, request, withHeaders) {
   const { url, protocols, signal } = request;
   signal.throwIfAborted();
@@ -1336,13 +1341,22 @@ function openWebSocket(Socket, request, withHeaders) {
   const queue = new MessageQueue(() => socket.close(1e3, "too many waiting messages"));
   return new Promise((resolve, reject) => {
     let open = false;
+    let settled = false;
+    const fail3 = (error) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", abort);
+      reject(error);
+    };
     const abort = () => {
       socket.close(1e3, "aborted");
-      reject(signal.reason);
+      fail3(signal.reason);
     };
     signal.addEventListener("abort", abort, { once: true });
     socket.addEventListener("open", () => {
+      if (settled) return;
       open = true;
+      settled = true;
       signal.removeEventListener("abort", abort);
       resolve({
         protocol: socket.protocol,
@@ -1358,15 +1372,19 @@ function openWebSocket(Socket, request, withHeaders) {
     socket.addEventListener("message", (event) => {
       queue.push(typeof event.data === "string" ? event.data : new Uint8Array(event.data));
     });
+    socket.addEventListener("error", () => {
+      if (open || settled) return;
+      try {
+        socket.close();
+      } catch {
+      }
+      queue.end({ code: 1006, reason: "" });
+      fail3(unopened(url, 1006));
+    });
     socket.addEventListener("close", (event) => {
       queue.end({ code: event.code, reason: event.reason });
       if (open) return;
-      signal.removeEventListener("abort", abort);
-      reject(
-        Object.assign(new Error(`${url}: the WebSocket closed (${event.code}) before it opened`), {
-          status: 502
-        })
-      );
+      fail3(unopened(url, event.code));
     });
   });
 }
@@ -1756,6 +1774,29 @@ function userEnv(account, system) {
     PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
   };
 }
+function groupsOf(groups, names) {
+  return names.map((g) => {
+    const row = groups.find((r) => r.name === g);
+    if (!row) throw fsError("ENOENT", `no group ${g}`);
+    return row;
+  });
+}
+function homeModeOf(mode) {
+  if (mode === void 0) return void 0;
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
+    throw fsError("EINVAL", `not a mode: ${String(mode)}`);
+  }
+  return mode;
+}
+function joined(name2, rows) {
+  let changed = false;
+  for (const g of rows) {
+    if (g.members.includes(name2)) continue;
+    g.members.push(name2);
+    changed = true;
+  }
+  return changed;
+}
 function homeGroupOf(groups, name2) {
   if (name2 === void 0) return void 0;
   const found = groups.find((g) => g.name === name2);
@@ -1771,14 +1812,14 @@ var UserDb = class {
     this.fs = fs;
     this.owners = owners;
   }
-  async stampHome(row, shared) {
+  async stampHome(row, shared, homeMode) {
     const home = this.fs.resolvePath("/", row.home);
     if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
     if (!await this.realDir(home)) return;
     const gid = shared?.gid ?? row.gid;
     await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
     const scoop = row.name.startsWith("scoop-");
-    await this.fs.chmod(home, shared ? 1512 : scoop ? 488 : 448);
+    await this.fs.chmod(home, homeMode ?? (shared ? 1512 : scoop ? 488 : 448));
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
@@ -1892,31 +1933,33 @@ var UserDb = class {
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
       const shared = homeGroupOf(groups, options.homeGroup);
+      const homeMode = homeModeOf(options.homeMode);
       if (found) {
+        const more = groupsOf(groups, options.groups ?? []);
+        if (more.some((g) => g.gid === found.gid)) {
+          throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
+        }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
           await this.provision(found);
-          await this.stampHome(found, shared);
+          await this.stampHome(found, shared, homeMode);
         }
+        if (joined(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
         remember();
         return this.account(found, groups);
       }
       const home = homeOf(options.home ?? `/home/${name2}`);
-      const extra = [USERS_GROUP, ...options.groups ?? []].map((g) => {
-        const row2 = groups.find((r) => r.name === g);
-        if (!row2) throw fsError("ENOENT", `no group ${g}`);
-        return row2;
-      });
+      const extra = groupsOf(groups, [USERS_GROUP, ...options.groups ?? []]);
       if (groups.some((r) => r.name === name2)) throw fsError("EEXIST", `group ${name2} exists`);
       const uid = freeId(users, groups);
       const row = { name: name2, uid, gid: uid, gecos: name2, home, shell: "/bin/bash" };
-      for (const g of extra) if (!g.members.includes(name2)) g.members.push(name2);
+      joined(name2, extra);
       group.push({ name: name2, gid: uid, members: [] });
       passwd.push(row);
       const fresh = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
         await this.provision(row);
-        await this.stampHome(row, shared);
+        await this.stampHome(row, shared, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -1927,6 +1970,31 @@ var UserDb = class {
       return this.account(row, parsed(group));
     });
   }
+  async groups() {
+    const { group } = await this.tables();
+    return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
+  }
+  addMember(group, user) {
+    return this.member(group, user, true);
+  }
+  removeMember(group, user) {
+    return this.member(group, user, false);
+  }
+  member(name2, user, on) {
+    return this.serial(async () => {
+      const { passwd, group } = await this.tables();
+      const row = parsed(group).find((g) => g.name === name2);
+      if (!row) throw fsError("ENOENT", `no group ${String(name2)}`);
+      const who = parsed(passwd).find((u) => u.name === user);
+      if (!who) throw fsError("ENOENT", `no user ${String(user)}`);
+      if (who.gid === row.gid) throw fsError("EINVAL", `${name2} is the own group of ${user}`);
+      if (row.members.includes(user) !== on) {
+        row.members = on ? [...row.members, user] : row.members.filter((m) => m !== user);
+        await this.fs.writeFile(GROUP, formatGroup(group));
+      }
+      return { name: row.name, gid: row.gid, members: [...row.members] };
+    });
+  }
   remove(name2, options = {}) {
     return this.serial(async () => {
       const { passwd, group } = await this.tables();
@@ -8399,7 +8467,7 @@ function enableNetwork(net, options) {
   let proxy;
   const transport = options.transport ?? missingTransport();
   net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, () => {
-    const tls = new TlsTerminator({
+    const tls2 = new TlsTerminator({
       ca: options.ca,
       engine: options.engine,
       ...options.now ? { now: options.now } : {}
@@ -8407,7 +8475,7 @@ function enableNetwork(net, options) {
     const started = new RealmProxy({
       net,
       transport,
-      tunnel: tls.handler,
+      tunnel: tls2.handler,
       tunnelReady: async () => {
         await options.engine();
       }
@@ -8415,7 +8483,7 @@ function enableNetwork(net, options) {
     proxy = started;
     void started.closed.then(async () => {
       if (proxy === started) proxy = void 0;
-      await tls.close();
+      await tls2.close();
     });
   });
   return () => proxy;
@@ -8434,6 +8502,11 @@ var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 function message(e) {
   return e instanceof Error ? e.message : String(e);
 }
+var ERRNO = /^E[A-Z]+$|^EAI_[A-Z]+$/;
+function errnoOf(e) {
+  const code = e?.code;
+  return typeof code === "string" && ERRNO.test(code) ? code : "ECONNREFUSED";
+}
 function fail(errno, text) {
   return { ok: false, errno, message: text };
 }
@@ -8477,13 +8550,13 @@ var WsHandles = class {
     let socket;
     try {
       socket = await transport.websocket({
-        url: req.url,
+        url: toHostLoopback(req.url),
         protocols: req.protocols,
         headers: req.headers,
         signal: entry.abort.signal
       });
     } catch (e) {
-      return fail("ECONNREFUSED", message(e));
+      return fail(errnoOf(e), message(e));
     }
     if (!this.open.has(handle)) {
       socket.close(1001, "the program went away");
@@ -8838,14 +8911,14 @@ var Resolver = class {
     if (hit && hit.expires > this.now()) return hit.addresses;
     const signal = blocking?.();
     if (signal?.aborted) throw new KernelError("EINTR");
-    let lookup = this.pending.get(id2);
-    if (!lookup) {
+    let lookup2 = this.pending.get(id2);
+    if (!lookup2) {
       const abort = new AbortController();
-      lookup = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
-      this.pending.set(id2, lookup);
-      void lookup.work.then(() => this.pending.delete(id2));
+      lookup2 = { work: this.lookup(key, asked, id2, abort.signal), abort, waiters: 0 };
+      this.pending.set(id2, lookup2);
+      void lookup2.work.then(() => this.pending.delete(id2));
     }
-    return waitFor(lookup, signal);
+    return waitFor(lookup2, signal);
   }
   async lookup(name2, family, id2, abandoned) {
     const uplink = this.uplink;
@@ -8886,17 +8959,17 @@ var Resolver = class {
     }
   }
 };
-function waitFor(lookup, signal) {
-  lookup.waiters++;
+function waitFor(lookup2, signal) {
+  lookup2.waiters++;
   return new Promise((resolve, reject) => {
     const abort = () => {
-      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      if (--lookup2.waiters === 0) lookup2.abort.abort(new KernelError("EINTR"));
       reject(new KernelError("EINTR"));
     };
     signal?.addEventListener("abort", abort, { once: true });
-    void lookup.work.then((value) => {
+    void lookup2.work.then((value) => {
       if (signal?.aborted) return;
-      lookup.waiters--;
+      lookup2.waiters--;
       signal?.removeEventListener("abort", abort);
       resolve(value);
     });
@@ -14490,6 +14563,62 @@ function isMemoryRoot(handle) {
   return handle instanceof MemoryDirectory;
 }
 
+// src/node/ws-diagnose.ts
+import { lookup } from "node:dns/promises";
+import { isIP, connect as tcp } from "node:net";
+import { connect as tls } from "node:tls";
+var PROBE_MS = 3e3;
+var PASSED = /* @__PURE__ */ new Set(["ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ETIMEDOUT", "ECONNRESET"]);
+var NO_NAME = /* @__PURE__ */ new Set(["ENOTFOUND", "EAI_AGAIN", "EAI_NONAME", "EAI_FAIL", "ENODATA"]);
+function codeOf5(e) {
+  const code = e?.code;
+  return typeof code === "string" ? code : void 0;
+}
+function probe(secure, host, port, ms) {
+  return new Promise((resolve) => {
+    const socket = secure ? tls({ host, port, ...isIP(host) ? {} : { servername: host } }) : tcp({ host, port });
+    const done4 = (code) => {
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(code);
+    };
+    const timer = setTimeout(() => done4("ETIMEDOUT"), ms);
+    socket.once(secure ? "secureConnect" : "connect", () => done4("EPROTO"));
+    socket.once("error", (e) => {
+      const code = codeOf5(e) ?? "";
+      done4(PASSED.has(code) ? code : "EPROTO");
+    });
+  });
+}
+async function diagnose(url, ms = PROBE_MS) {
+  const at = new URL(url);
+  const host = at.hostname.replace(/^\[(.*)\]$/, "$1");
+  const secure = at.protocol === "wss:";
+  const port = Number(at.port) || (secure ? 443 : 80);
+  try {
+    await lookup(host);
+  } catch (e) {
+    return NO_NAME.has(codeOf5(e) ?? "") ? "EAI_NONAME" : void 0;
+  }
+  return probe(secure, host, port, ms);
+}
+function diagnosing(transport, check = diagnose) {
+  const open = transport.websocket;
+  if (!open) return transport;
+  return {
+    ...transport,
+    websocket: async (request) => {
+      try {
+        return await open(request);
+      } catch (e) {
+        if (request.signal.aborted || !(e instanceof Error) || codeOf5(e)) throw e;
+        const code = await check(request.url).catch(() => void 0);
+        throw code ? Object.assign(e, { code }) : e;
+      }
+    }
+  };
+}
+
 // src/kernel/net/remote-transport.ts
 var TransportError = class extends Error {
   status;
@@ -14752,10 +14881,10 @@ var ByteSource = class {
   async more() {
     const { done: done4, value } = await this.reader.read();
     if (done4) return false;
-    const joined = new Uint8Array(this.buffered.length + value.length);
-    joined.set(this.buffered);
-    joined.set(value, this.buffered.length);
-    this.buffered = joined;
+    const joined2 = new Uint8Array(this.buffered.length + value.length);
+    joined2.set(this.buffered);
+    joined2.set(value, this.buffered.length);
+    this.buffered = joined2;
     return true;
   }
   async until(marker) {
@@ -15284,7 +15413,7 @@ function hostfsFetchOf(options) {
 }
 function nodeTransport() {
   const transport = fetchTransport({ webSocket: true, webSocketHeaders: true, redirect: "manual" });
-  return { ...transport, traits: { ...transport.traits, crossOrigin: "any" } };
+  return diagnosing({ ...transport, traits: { ...transport.traits, crossOrigin: "any" } });
 }
 var TERMINATED = "the kernel is terminated";
 var EXIT_GRACE_MS = 50;
@@ -15443,6 +15572,11 @@ async function createNodeKernel(options = {}) {
       remove: (name2, options2) => guard(() => launcher.users.remove(name2, options2)),
       list: () => guard(() => launcher.users.list())
     },
+    groups: {
+      list: () => guard(() => launcher.users.groups()),
+      addMember: (group, user) => guard(() => launcher.users.addMember(group, user)),
+      removeMember: (group, user) => guard(() => launcher.users.removeMember(group, user))
+    },
     async connect({ user } = {}) {
       if (terminated) throw new Error(TERMINATED);
       if (user !== void 0 && !await launcher.users.lookup(user)) {