@ai-ecoverse/slicc-kernel 1.72.0 → 1.73.0

package/dist/kernel-worker.js

@@ -361,7 +361,17 @@ async function chownAs(fs, cred, path, change) {
 }
 
 // src/fs/protect.ts
-var PROTECT_WRITER = "slicc-kernel: protect.writer needs the process tag (#405), which this kernel does not have yet";
+function protectInit(protection) {
+  const writers = [...writerTags(protection)];
+  return { paths: [...protection.paths], ...writers.length > 0 ? { writers } : {} };
+}
+function writerTags(protection) {
+  const writers = protection?.writers ?? [];
+  if (!Array.isArray(writers) || writers.some((tag) => typeof tag !== "string" || tag === "")) {
+    throw new TypeError("protect.writers must be a list of process tags");
+  }
+  return new Set(writers);
+}
 function protectedPrefixes(paths) {
   return [...new Set(paths.map((p) => normalizePath(p)))];
 }
@@ -873,6 +883,9 @@ var OpfsFs = class {
   protect(prefixes2) {
     this.guarded = prefixes2;
   }
+  unguarded() {
+    return Object.create(this, { guarded: { value: [] } });
+  }
   refuse(path, holding = false) {
     if (isProtected(this.guarded, path) || holding && holdsProtected(this.guarded, path)) {
       throw fsError("EROFS", path);
@@ -1042,15 +1055,15 @@ var OpfsFs = class {
   }
   dirTimes = /* @__PURE__ */ new Map();
   dirDirty = /* @__PURE__ */ new Set();
-  dirFlush;
+  flushing = {};
   touch(...dirs) {
     const now = Date.now();
     for (const dir of dirs) {
       this.dirTimes.set(dir, now);
       this.dirDirty.add(dir);
     }
-    this.dirFlush ??= Promise.resolve().then(() => this.flushDirTimes()).catch(() => void 0).finally(() => {
-      this.dirFlush = void 0;
+    this.flushing.dir ??= Promise.resolve().then(() => this.flushDirTimes()).catch(() => void 0).finally(() => {
+      this.flushing.dir = void 0;
     });
   }
   async flushDirTimes() {
@@ -3821,6 +3834,12 @@ var CLIENT_CHECKS = {
   readlink: (g, at) => searchable(g, "readlink", at(0), false),
   exists: (g, at) => searchable(g, "exists", at(0), true)
 };
+function clientFs(l, tag, self, req) {
+  if (!FS_METHODS.includes(req.method)) {
+    throw new Error(`unknown file system call ${req.method}`);
+  }
+  return fsCall(l.fsFor(tag), req.method, req.args, ownerFor(l, self), guardFor(l, self, tag));
+}
 async function fsCall(fs, method, args, owner, g) {
   const path = (i) => fs.resolvePath("/", String(args[i]));
   if (g) {
@@ -4108,10 +4127,7 @@ function serveClient(port, host) {
       case "ps":
         return { result: processes(l, self) };
       case "fs":
-        if (!FS_METHODS.includes(req.method)) {
-          throw new Error(`unknown file system call ${req.method}`);
-        }
-        return fsCall(l.processFs, req.method, req.args, ownerFor(l, self), guard2(l));
+        return clientFs(l, host.tag, self, req);
       case "watch":
       case "unwatch":
         return watchOp(l, req, watches, send, guard2(l));
@@ -15880,6 +15896,10 @@ var Launcher = class {
   fs;
   processFs;
   prefixes;
+  writerTags;
+  unguardedRoot;
+  writers;
+  unlinkOwnerOption;
   base;
   createWorker;
   modulesDir;
@@ -15997,7 +16017,7 @@ var Launcher = class {
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.nodes.keepsOnDisk = true;
     this.openFiles.add(this.nodes);
-    const holders = [this.held, [this.nodes]];
+    const holders = [this.held, this.openFiles];
     this.unlinked = new UnlinkedKeeper(
       fs,
       { [Symbol.iterator]: () => holders.flatMap((set2) => [...set2]).values() },
@@ -16010,7 +16030,12 @@ var Launcher = class {
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
-    if (options.protect?.writer) throw new Error(PROTECT_WRITER);
+    this.writerTags = writerTags(options.protect);
+    this.unlinkOwnerOption = options.unlinkOwner;
+    if (this.writerTags.size > 0 && options.fs.protect && !options.fs.unguarded) {
+      throw new TypeError("protect.writers needs a root file system with an unguarded view");
+    }
+    this.unguardedRoot = options.fs.unguarded?.() ?? options.fs;
     this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
     this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
     options.fs.protect?.(this.prefixes);
@@ -16334,6 +16359,7 @@ var Launcher = class {
       throw fsError("ESRCH", `no process group ${req.pgid}`);
     }
     const pid = this.nextPid++;
+    const stack = this.stackFor(req.tag);
     const terminal = req.fds.stdioTerminal();
     const decided = req.decided ?? Promise.resolve(true);
     const count = (byParent) => {
@@ -16364,8 +16390,8 @@ var Launcher = class {
       env: req.env,
       cwd: req.cwd,
       fds: req.fds,
-      fs: this.processFs,
-      ...this.prefixes.length > 0 ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
+      fs: stack.fs,
+      ...this.prefixes.length > 0 && !stack.writer ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
       createWorker: this.createWorker,
       onError: req.report,
       spawner: this.spawner(pid, req.report),
@@ -16380,9 +16406,9 @@ var Launcher = class {
       }),
       sudo: (call, signal) => this.sudo(pid, call, signal),
       openFiles: this.openFiles,
-      nodes: this.nodes,
+      nodes: stack.nodes,
       held: this.held,
-      unlinkGate: this.unlinked.gate,
+      unlinkGate: stack.unlinked.gate,
       statfs: (path) => this.mounts.statfs(path),
       mounts: () => this.mounts.list(),
       mount: (call, signal) => this.processMount(pid, call, signal),
@@ -16683,6 +16709,7 @@ var Launcher = class {
   released(path) {
     const at = normalizePath(path);
     this.unlinked.closed(at);
+    this.writers?.unlinked.closed(at);
     const open = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
     if (!open) void this.mounts.commit(at).catch(() => void 0);
   }
@@ -17001,13 +17028,49 @@ var Launcher = class {
       ...account.umask !== void 0 ? { umask: account.umask } : {}
     };
   }
+  fsFor(tag) {
+    return this.stackFor(tag).fs;
+  }
+  isWriter(tag) {
+    return tag !== void 0 && this.prefixes.length > 0 && this.writerTags.has(tag);
+  }
+  stackFor(tag) {
+    if (!this.isWriter(tag)) {
+      return { fs: this.processFs, nodes: this.nodes, unlinked: this.unlinked, writer: false };
+    }
+    this.writers ??= this.writerStack();
+    return this.writers;
+  }
+  writerStack() {
+    const fs = withCommandDirs(
+      this.watchers.wrap(this.mounts.wrap(this.unguardedRoot)),
+      async () => new Set((await this.commands()).keys()),
+      (dir) => this.userCommandDir(dir),
+      this.owners
+    );
+    const nodes = new VfsNodes(fs, (path) => this.released(path));
+    nodes.keepsOnDisk = true;
+    this.openFiles.add(nodes);
+    const unlinked = new UnlinkedKeeper(
+      fs,
+      { [Symbol.iterator]: () => [this.held, this.openFiles].flatMap((set2) => [...set2]).values() },
+      (path) => this.mountRoot(path),
+      {
+        locks: webLocks(),
+        busy: (path) => [...this.openFiles].some((open) => open.holds(path)),
+        owner: this.unlinkOwnerOption,
+        ...this.owners ? { dirOwner: { uid: 0, gid: 0, mode: 448 } } : {}
+      }
+    );
+    return { fs: unlinked.wrap(keepingOpen(fs, nodes)), nodes, unlinked, writer: true };
+  }
   async starting(argv, dir, account, tag) {
     this.resetCatalogs();
     const scope = account.uid === 0 ? "" : pnpmHomeOf(account, this.pnpmHome);
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
-    if (!await this.base.exists(cwd)) await this.processFs.mkdir(cwd, { recursive: true });
+    if (!await this.base.exists(cwd)) await this.stackFor(tag).fs.mkdir(cwd, { recursive: true });
     const planned = await this.plan(file, argv, cwd, scope);
     await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, planned);
     return { cwd, file, planned };
@@ -17270,7 +17333,7 @@ function hostOptions(req, port, sealed) {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
-    ...req.protect ? { protect: { paths: [...req.protect.paths] } } : {},
+    ...req.protect ? { protect: protectInit(req.protect) } : {},
     ...req.sealed ? { sealed } : {}
   };
 }