@ai-ecoverse/slicc-kernel 1.64.0 → 1.64.2

package/dist/node-process-worker.js

@@ -82,9 +82,21 @@ var init_lockdown = __esm({
       "SharedWorker",
       "BroadcastChannel",
       "postMessage",
-      "close"
+      "close",
+      "webkitRequestFileSystem",
+      "webkitRequestFileSystemSync",
+      "webkitResolveLocalFileSystemURL",
+      "webkitResolveLocalFileSystemSyncURL"
+    ];
+    BLOCKED_NAVIGATOR = [
+      "storage",
+      "storageBuckets",
+      "locks",
+      "serviceWorker",
+      "usb",
+      "hid",
+      "serial"
     ];
-    BLOCKED_NAVIGATOR = ["storage", "locks", "serviceWorker"];
     OPEN_SLOTS = ["fetch", "WebSocket"];
   }
 });
@@ -6895,12 +6907,27 @@ var init_kernel_streams = __esm({
           const original = fs[name2];
           if (typeof original !== "function") continue;
           fs[name2] = (path, ...rest2) => {
-            if (!isPtyPath(path)) return original.call(fs, path, ...rest2);
+            const owned = this.ownedTty(path);
+            if (owned && isPtyPath(path)) return this.owned(path, ptyStat(path));
+            if (!isPtyPath(path)) {
+              const st = original.call(fs, path, ...rest2);
+              return owned && TTY_PATH.test(path) ? this.owned(path, st) : st;
+            }
             this.existingPty(path);
             return ptyStat(path);
           };
         }
       }
+      ownedTty(path) {
+        return this.options.owners === true && this.sys.ttyOwner !== void 0 && path !== "/dev/ptmx";
+      }
+      owned(path, st) {
+        const ask = this.sys.ttyOwner;
+        const owner = this.call(() => ask.call(this.sys, path));
+        if (!owner) return st;
+        const mode = st.mode & ~4095 | (owner.mode ?? 400);
+        return { ...st, uid: owner.uid, gid: owner.gid, mode };
+      }
       existingPty(path) {
         const n = PTY_PATH.exec(path)?.[1];
         const exists = n === void 0 ? this.sys.openPty !== void 0 : this.sys.ptyNumbers?.().includes(Number(n)) ?? false;
@@ -7582,7 +7609,7 @@ function useDevFd(Fs) {
   };
 }
 function mountTable(mounts = []) {
-  const root = globalThis.navigator?.storage ? "opfs" : "memory";
+  const root = pinnedRoot ?? rootKind();
   const lines = [`${root} / ${root} rw 0 0`, "devfs /dev devfs rw 0 0", "proc /proc proc rw 0 0"];
   for (const m of mounts) {
     const options = Object.entries(m.options).map(([k, v]) => v === "" ? k : `${k}=${v}`);
@@ -7688,7 +7715,7 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW2, EMSCRIPTEN_EPERM, O_PATH, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY4, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, NAME, AT_FDCWD, AT_EACCESS2, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW2, EMSCRIPTEN_EPERM, O_PATH, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY4, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS2, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
@@ -7730,6 +7757,7 @@ var init_process_fds = __esm({
     O_ACCMODE2 = 3;
     O_CREAT2 = 64;
     field = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
+    rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
     NAME = /^[a-z_][a-z0-9_-]*$/i;
     AT_FDCWD = -100;
     AT_EACCESS2 = 512;
@@ -8980,6 +9008,9 @@ function kernelSys(transport) {
     ttyNames() {
       return json(call2({ op: "fd-tty-names" }, "fd-tty-names"));
     },
+    ttyOwner(name2) {
+      return json(call2({ op: "fd-tty-owner", name: name2 }, `fd-tty-owner ${name2}`));
+    },
     openTty(name2) {
       const req = name2 === void 0 ? { op: "fd-open-tty" } : { op: "fd-open-tty", name: name2 };
       return json(call2(req, `fd-open-tty ${name2 ?? ""}`));
@@ -9224,7 +9255,8 @@ async function runWasmProcess(init, port3, deps = {}) {
   early = () => signals.quiet(() => vfs.flushDirty());
   const sigpipe = () => running.sliccSigpipe?.() === 1;
   const restartable = () => signals.restartable();
-  const streams = new KernelStreams(running.FS, sys, { sigpipe, restartable });
+  const owners = init.owners ? { owners: true } : {};
+  const streams = new KernelStreams(running.FS, sys, { sigpipe, restartable, ...owners });
   trackCloseOnExec(running.FS);
   quietQuit(running.FS);
   useMounts(running.FS, init.env, true);
@@ -12472,6 +12504,7 @@ init_protocol();
 init_process_runtime();
 var loadWasi = () => Promise.resolve().then(() => (init_wasi_runtime(), wasi_runtime_exports));
 var loadJs = () => Promise.resolve().then(() => (init_js_runtime(), js_runtime_exports));
+var NOT_RUNNABLE2 = 126;
 function started(init, port3, run, wasi, js) {
   if (init.program?.abi === "js") {
     const jsInit = init;
@@ -12481,18 +12514,35 @@ function started(init, port3, run, wasi, js) {
   if (wasmInit.program?.abi === "wasi") return wasi().then((m) => m.runWasiProcess(wasmInit, port3));
   return run(wasmInit, port3);
 }
-function processEntry(port3, run = runWasmProcess, wasi = loadWasi, js = loadJs) {
-  const failed5 = (err) => port3.postMessage({
+function processEntry(port3, run = runWasmProcess, wasi = loadWasi, js = loadJs, seal = () => {
+}) {
+  const failed5 = (err, code2) => port3.postMessage({
     type: WASM_PROCESS_ERROR,
-    message: err instanceof Error ? err.stack ?? err.message : String(err)
+    message: err instanceof Error ? err.stack ?? err.message : String(err),
+    ...code2 === void 0 ? {} : { code: code2 }
   });
+  let refused2;
+  const sealOnce = () => {
+    if (refused2 === void 0) {
+      try {
+        seal();
+        refused2 = null;
+      } catch (error) {
+        refused2 = { error };
+      }
+    }
+    return refused2;
+  };
   return (data) => {
     const type = data?.type;
+    if (type !== WASM_THREAD_INIT && type !== WASM_PROCESS_INIT) return;
+    const refusal2 = sealOnce();
     if (type === WASM_THREAD_INIT) {
+      if (refusal2) return failed5(refusal2.error);
       wasi().then((m) => m.runWasiThread(data, port3)).catch(failed5);
       return;
     }
-    if (type !== WASM_PROCESS_INIT) return;
+    if (refusal2) return failed5(refusal2.error, NOT_RUNNABLE2);
     started(data, port3, run, wasi, js).then(
       (code2) => port3.postMessage({ type: WASM_PROCESS_EXIT, code: code2 }),
       failed5