@ai-ecoverse/slicc-kernel 1.67.1 → 1.68.0

package/dist/process-worker.js

@@ -1983,10 +1983,28 @@ function ptyStat(path) {
     ctime: now
   };
 }
+function sealedStat() {
+  const now = /* @__PURE__ */ new Date();
+  return {
+    dev: 22,
+    ino: 1,
+    mode: 8630,
+    nlink: 1,
+    uid: 0,
+    gid: 0,
+    rdev: 10 << 8 | 250,
+    size: 0,
+    blksize: 4096,
+    blocks: 0,
+    atime: now,
+    mtime: now,
+    ctime: now
+  };
+}
 function nonblocking(stream) {
   return (stream.flags & O_NONBLOCK) !== 0 ? { nonblock: true } : void 0;
 }
-var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
+var POLLIN, POLLOUT, POLLERR, POLLHUP, POLLRDNORM, POLLWRNORM, TCSETSF, O_NONBLOCK, SOCKET_MODE, PTY_PATH, TTY_PATH, TTY_NAME, SEALED_PATH, O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC2, KILLED_BY_SIGPIPE, ProcessExit, SyscallError, KernelStreams;
 var init_kernel_streams = __esm({
   "src/process/kernel-streams.ts"() {
     "use strict";
@@ -2003,6 +2021,7 @@ var init_kernel_streams = __esm({
     PTY_PATH = /^\/dev\/(?:ptmx|pts\/(\d+))$/;
     TTY_PATH = /^\/dev\/tty\d+$/;
     TTY_NAME = /^tty\d+$/;
+    SEALED_PATH = "/dev/sealed";
     O_CREAT = 64;
     O_EXCL = 128;
     O_NOCTTY = 256;
@@ -2076,6 +2095,15 @@ var init_kernel_streams = __esm({
         if (typeof this.Fs.stat !== "function") return;
         stream.stream_ops = { ...stream.stream_ops, getattr: () => this.Fs.stat?.(name2) ?? {} };
       }
+      listSealed() {
+        const { analyzePath, mkdev, makedev } = this.Fs;
+        if (!this.sys.openSealed || !analyzePath || !mkdev || !makedev) return;
+        if (analyzePath.call(this.Fs, SEALED_PATH).exists) return;
+        try {
+          mkdev.call(this.Fs, SEALED_PATH, makedev.call(this.Fs, 10, 250));
+        } catch {
+        }
+      }
       creatingTerminal = false;
       useTerminalNodes() {
         const fs = this.Fs;
@@ -2168,13 +2196,14 @@ var init_kernel_streams = __esm({
         if (typeof this.Fs.open !== "function") return;
         this.usePtyPaths();
         this.useTerminalNodes();
+        this.listSealed();
         const open = this.Fs.open.bind(this.Fs);
         this.Fs.open = (path, flags, mode) => {
           const device2 = typeof path === "string" ? this.devicePath(path) : void 0;
           if (device2 !== void 0 && TTY_PATH.test(device2) && !this.terminalExists(device2)) {
             throw new this.Fs.ErrnoError(wasiErrno("ENOENT"));
           }
-          const pty = this.openPty(open, path, flags, mode);
+          const pty = this.openPty(open, path, flags, mode) ?? this.openSealed(open, path, flags, mode);
           if (pty) return pty;
           this.refuseExclusiveLink(path, flags);
           const stream = this.openRacing(open, path, flags, mode);
@@ -2232,15 +2261,24 @@ var init_kernel_streams = __esm({
         const kfd = this.call(
           () => pts ? openPts(Number(pts[1]), (flags & O_NOCTTY) !== 0) : openPty()
         );
+        return this.vessel(open, kfd, { path, flags, mode }, true);
+      }
+      openSealed(open, path, flags, mode) {
+        const { openSealed } = this.sys;
+        if (path !== SEALED_PATH || !openSealed) return void 0;
+        const kfd = this.call(() => openSealed.call(this.sys));
+        return this.vessel(open, kfd, { path, flags, mode }, false);
+      }
+      vessel(open, kfd, at, terminal) {
         let stream;
         try {
-          stream = open("/dev/null", flags & ~(O_CREAT | O_EXCL | O_TRUNC2), mode);
+          stream = open("/dev/null", at.flags & ~(O_CREAT | O_EXCL | O_TRUNC2), at.mode);
         } catch (e) {
           this.sys.close(kfd);
           throw e;
         }
-        this.attach(stream, kfd, true);
-        this.nameStream(stream, path);
+        this.attach(stream, kfd, terminal);
+        this.nameStream(stream, at.path);
         return stream;
       }
       usePtyPaths() {
@@ -2254,6 +2292,7 @@ var init_kernel_streams = __esm({
           const original = fs[name2];
           if (typeof original !== "function") continue;
           fs[name2] = (path, ...rest2) => {
+            if (path === SEALED_PATH && this.sys.openSealed) return sealedStat();
             const owned = this.ownedTty(path);
             if (owned && isPtyPath(path)) return this.owned(path, ptyStat(path));
             if (!isPtyPath(path)) {
@@ -4403,6 +4442,9 @@ function kernelSys(transport) {
     openPts(n, noctty) {
       return json2(call2({ op: "pty-slave-open", n, noctty }, `pty-slave-open ${n}`));
     },
+    openSealed() {
+      return json2(call2({ op: "fd-open-sealed" }, "fd-open-sealed"));
+    },
     ptyNumbers() {
       return json2(call2({ op: "pty-list" }, "pty-list"));
     },
@@ -5480,7 +5522,7 @@ function promoteRequest(fd, f, handed) {
     ...f.buffer.handle !== void 0 ? { handle: f.buffer.handle } : {}
   };
 }
-var SYNTHETIC_DIRS2, O_NONBLOCK2, O_WRONLY4, O_RDWR4, O_APPEND, DEVICES2, WasiFds, GEN;
+var SYNTHETIC_DIRS2, O_NONBLOCK2, O_WRONLY4, O_RDWR4, O_APPEND, DEVICES2, SEALED_PATH2, WasiFds, GEN;
 var init_wasi_fds = __esm({
   "src/process/wasi/wasi-fds.ts"() {
     "use strict";
@@ -5499,6 +5541,7 @@ var init_wasi_fds = __esm({
       "/dev/urandom": "urandom",
       "/dev/random": "urandom"
     };
+    SEALED_PATH2 = "/dev/sealed";
     WasiFds = class {
       table = /* @__PURE__ */ new Map();
       buffers = /* @__PURE__ */ new Map();
@@ -5963,16 +6006,30 @@ var init_wasi_fds = __esm({
         const joined2 = path.startsWith("/") ? path : `${this.dir(dirfd).path}/${path}`;
         return joined2.split("/").includes("..") ? physical(this.fs, joined2) : normalize(joined2);
       }
+      openKernelDevice(path, oflags, fdflags) {
+        const { openSealed, openTty } = this.kernel.sys;
+        const nonblock = (fdflags & FDFLAGS.NONBLOCK) !== 0;
+        let fd;
+        let kind;
+        if (path === SEALED_PATH2 && openSealed) {
+          if (oflags & OFLAGS.DIRECTORY) throw new WasiError("ENOTDIR");
+          if (oflags & OFLAGS.CREAT && oflags & OFLAGS.EXCL) throw new WasiError("EEXIST");
+          fd = openSealed.call(this.kernel.sys);
+          kind = "sealed";
+        } else if (path === "/dev/tty" || /^\/dev\/tty\d+$/.test(path)) {
+          fd = openTty?.call(this.kernel.sys, path === "/dev/tty" ? void 0 : path);
+          if (fd === void 0) throw new WasiError("ENXIO");
+          kind = "tty";
+        } else return void 0;
+        this.adopt(fd, kind, nonblock);
+        this.bump();
+        return fd;
+      }
       open(path, oflags, rights, fdflags) {
         const device2 = deviceOf(path);
         if (device2) return this.install({ type: "device", device: device2 });
-        if (path === "/dev/tty" || /^\/dev\/tty\d+$/.test(path)) {
-          const fd = this.kernel.sys.openTty?.(path === "/dev/tty" ? void 0 : path);
-          if (fd === void 0) throw new WasiError("ENXIO");
-          this.table.set(fd, { ...kernelEntry2(), kind: "tty" });
-          this.bump();
-          return fd;
-        }
+        const kernelDevice = this.openKernelDevice(path, oflags, fdflags);
+        if (kernelDevice !== void 0) return kernelDevice;
         const alias = stdioAlias(path);
         if (alias !== void 0) return this.reopen(alias);
         const exclusive = (oflags & OFLAGS.CREAT) !== 0 && (oflags & OFLAGS.EXCL) !== 0;
@@ -6413,6 +6470,7 @@ function filestatOf(path, s) {
 function kernelFiletype(kind) {
   switch (kind) {
     case "tty":
+    case "sealed":
       return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: false };
     case "device":
       return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: true };
@@ -6453,7 +6511,7 @@ function wrap(table) {
   }
   return out;
 }
-var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, WasiHost;
+var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, SEALED_MODE, WasiHost;
 var init_wasi_host = __esm({
   "src/process/wasi/wasi-host.ts"() {
     "use strict";
@@ -6483,6 +6541,7 @@ var init_wasi_host = __esm({
     MONOTONIC_BASE = BigInt(Math.round(performance.timeOrigin)) * NS_PER_MS;
     MAX_READ = 1024 * 1024;
     SIGPIPE_EXIT = 141;
+    SEALED_MODE = 8630;
     WasiHost = class {
       mem = new WasiMemory();
       fds;
@@ -6568,7 +6627,9 @@ var init_wasi_host = __esm({
         const fdOwned = (fd) => {
           const e = fds.get(fd);
           if (e.type === "device") return ROOT_IDS;
-          if (e.type === "kernel" && fds.kind(fd, e) !== "file") return void 0;
+          const kind = e.type === "kernel" ? fds.kind(fd, e) : "file";
+          if (kind === "sealed") return ROOT_IDS;
+          if (kind !== "file") return void 0;
           try {
             return this.o.fs.stat(pathOf(fd));
           } catch (err) {
@@ -6577,7 +6638,7 @@ var init_wasi_host = __esm({
           }
         };
         const pathOwned = (path, follow2) => {
-          if (deviceOf(path)) return ROOT_IDS;
+          if (this.synthetic(path)) return ROOT_IDS;
           return follow2 ? this.o.fs.stat(path) : this.o.fs.lstat(path);
         };
         return wrap({
@@ -6606,7 +6667,7 @@ var init_wasi_host = __esm({
           path_access: (dirfd, p, l, amode, flags) => {
             const path = at(dirfd, p, l);
             const nofollow = (flags & AT_SYMLINK_NOFOLLOW2) !== 0;
-            if (deviceOf(path)) {
+            if (this.synthetic(path)) {
               if (this.o.fs.owners && amode & 1) throw new WasiError("EACCES");
               return;
             }
@@ -6623,12 +6684,14 @@ var init_wasi_host = __esm({
           },
           fd_mode: (fd, out) => {
             const e = fds.get(fd);
-            const pipe = e.type === "kernel" && fds.kind(fd, e) === "stream";
-            const mode = pipe ? S_IFIFO | 384 : modeOf(this.o.fs.stat(pathOf(fd)));
+            const kind = e.type === "kernel" ? fds.kind(fd, e) : void 0;
+            const mode = kind === "stream" ? S_IFIFO | 384 : kind === "sealed" ? SEALED_MODE : modeOf(this.o.fs.stat(pathOf(fd)));
             mem.view().setUint32(out, mode, true);
           },
           path_mode: (dirfd, p, l, flags, out) => {
             const path = at(dirfd, p, l);
+            if (path === SEALED_PATH2 && this.o.kernel.sys.openSealed)
+              return void mem.view().setUint32(out, SEALED_MODE, true);
             const st = flags & AT_SYMLINK_NOFOLLOW2 ? this.o.fs.lstat(path) : this.o.fs.stat(path);
             mem.view().setUint32(out, modeOf(st), true);
           }
@@ -6816,7 +6879,7 @@ var init_wasi_host = __esm({
           path_open: (dirfd, _lookup, p, l, oflags, rights, _inheriting, fdflags, out) => {
             const path = at(dirfd, p, l);
             if (deviceOf(path)) this.interrupted?.();
-            const fresh = (oflags & OFLAGS.CREAT) !== 0 && !o.fs.exists(path);
+            const fresh = (oflags & OFLAGS.CREAT) !== 0 && !this.synthetic(path) && !o.fs.exists(path);
             mem.view().setUint32(out, fds.open(path, oflags, rights, fdflags), true);
             if (fresh) this.created(path, 438);
           },
@@ -7125,8 +7188,11 @@ var init_wasi_host = __esm({
         const out = this.sized(path, s, size);
         return gone ? { ...out, nlink: 0n } : out;
       }
+      synthetic(path) {
+        return deviceOf(path) !== void 0 || path === SEALED_PATH2 && !!this.o.kernel.sys.openSealed;
+      }
       pathFilestat(path, lookup) {
-        if (deviceOf(path)) {
+        if (this.synthetic(path)) {
           return this.local({
             filetype: FILETYPE.CHARACTER_DEVICE,
             size: 0n,