@ai-ecoverse/slicc-kernel 1.72.0 → 1.73.1

package/dist/kernel-worker.js

@@ -361,7 +361,17 @@ async function chownAs(fs, cred, path, change) {
 }
 
 // src/fs/protect.ts
-var PROTECT_WRITER = "slicc-kernel: protect.writer needs the process tag (#405), which this kernel does not have yet";
+function protectInit(protection) {
+  const writers = [...writerTags(protection)];
+  return { paths: [...protection.paths], ...writers.length > 0 ? { writers } : {} };
+}
+function writerTags(protection) {
+  const writers = protection?.writers ?? [];
+  if (!Array.isArray(writers) || writers.some((tag) => typeof tag !== "string" || tag === "")) {
+    throw new TypeError("protect.writers must be a list of process tags");
+  }
+  return new Set(writers);
+}
 function protectedPrefixes(paths) {
   return [...new Set(paths.map((p) => normalizePath(p)))];
 }
@@ -873,6 +883,9 @@ var OpfsFs = class {
   protect(prefixes2) {
     this.guarded = prefixes2;
   }
+  unguarded() {
+    return Object.create(this, { guarded: { value: [] } });
+  }
   refuse(path, holding = false) {
     if (isProtected(this.guarded, path) || holding && holdsProtected(this.guarded, path)) {
       throw fsError("EROFS", path);
@@ -1042,15 +1055,15 @@ var OpfsFs = class {
   }
   dirTimes = /* @__PURE__ */ new Map();
   dirDirty = /* @__PURE__ */ new Set();
-  dirFlush;
+  flushing = {};
   touch(...dirs) {
     const now = Date.now();
     for (const dir of dirs) {
       this.dirTimes.set(dir, now);
       this.dirDirty.add(dir);
     }
-    this.dirFlush ??= Promise.resolve().then(() => this.flushDirTimes()).catch(() => void 0).finally(() => {
-      this.dirFlush = void 0;
+    this.flushing.dir ??= Promise.resolve().then(() => this.flushDirTimes()).catch(() => void 0).finally(() => {
+      this.flushing.dir = void 0;
     });
   }
   async flushDirTimes() {
@@ -1294,7 +1307,7 @@ var OpfsFs = class {
       const above = owner && {
         uid: owner.uid,
         gid: owner.gid,
-        ...mode ? { mode, parents: mode } : {}
+        ...mode !== void 0 ? { mode, parents: mode } : {}
       };
       await this.mkdir(parentOf3(path), { recursive: true, ...above ? { owner: above } : {} });
     }
@@ -3569,6 +3582,9 @@ var UserDb = class {
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
+  umaskFor(options) {
+    return (options.umask ?? this.umasks.get(options.name) ?? 18) & 511;
+  }
   async realDir(path) {
     const parts2 = path.split("/").filter(Boolean);
     for (let n = 1; n <= parts2.length; n++) {
@@ -3592,9 +3608,11 @@ var UserDb = class {
       group: parseGroup(await this.read(GROUP, DEFAULT_GROUP))
     };
   }
-  async provision(row) {
-    const owner = this.owners ? { uid: row.uid, gid: row.gid } : void 0;
-    const made2 = owner ? { recursive: true, owner } : { recursive: true };
+  async provision(row, umask, shared) {
+    const dirs = 511 & ~umask | (shared ? 1024 : 0);
+    const gid = shared?.gid ?? row.gid;
+    const owner = this.owners ? { uid: row.uid, gid } : void 0;
+    const made2 = owner ? { recursive: true, owner: { ...owner, mode: dirs, parents: dirs } } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
     if (!await this.fs.exists(pnpm)) {
       await this.fs.mkdir(pnpm, made2);
@@ -3603,7 +3621,7 @@ var UserDb = class {
     const config = `${row.home}/.config/pnpm/config.yaml`;
     if (!await this.fs.exists(config)) {
       await this.fs.mkdir(`${row.home}/.config/pnpm`, made2);
-      await this.fs.writeFile(config, PNPM_CONFIG, owner);
+      await this.fs.writeFile(config, PNPM_CONFIG, owner && { ...owner, mode: 438 & ~umask });
     }
   }
   async commit(passwd, group, then) {
@@ -3694,7 +3712,7 @@ var UserDb = class {
           throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
         }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
-          await this.provision(found);
+          await this.provision(found, this.umaskFor(options), shared);
           await this.stampHome(found, shared, homeMode);
         }
         if (joined(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
@@ -3712,7 +3730,7 @@ var UserDb = class {
       const fresh2 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
-        await this.provision(row);
+        await this.provision(row, this.umaskFor(options), shared);
         await this.stampHome(row, shared, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
@@ -3821,6 +3839,12 @@ var CLIENT_CHECKS = {
   readlink: (g, at) => searchable(g, "readlink", at(0), false),
   exists: (g, at) => searchable(g, "exists", at(0), true)
 };
+function clientFs(l, tag, self, req) {
+  if (!FS_METHODS.includes(req.method)) {
+    throw new Error(`unknown file system call ${req.method}`);
+  }
+  return fsCall(l.fsFor(tag), req.method, req.args, ownerFor(l, self), guardFor(l, self, tag));
+}
 async function fsCall(fs, method, args, owner, g) {
   const path = (i) => fs.resolvePath("/", String(args[i]));
   if (g) {
@@ -4108,10 +4132,7 @@ function serveClient(port, host) {
       case "ps":
         return { result: processes(l, self) };
       case "fs":
-        if (!FS_METHODS.includes(req.method)) {
-          throw new Error(`unknown file system call ${req.method}`);
-        }
-        return fsCall(l.processFs, req.method, req.args, ownerFor(l, self), guard2(l));
+        return clientFs(l, host.tag, self, req);
       case "watch":
       case "unwatch":
         return watchOp(l, req, watches, send, guard2(l));
@@ -7816,6 +7837,11 @@ var HeldPaths = class extends Map {
   keptFor(handle) {
     return this.keptHandles.get(handle);
   }
+  keeps(hidden) {
+    for (const file of this.uses.keys()) if (file.hidden === hidden) return true;
+    for (const file of this.unlinked.values()) if (file.hidden === hidden) return true;
+    return false;
+  }
   keep(path, file) {
     const fresh2 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
     for (const id2 of fresh2) this.keptHandles.set(id2, file);
@@ -8917,6 +8943,7 @@ function guardOf(entry) {
   return { fs: entry.fs, cred, pid: entry.pid ?? 0, dac: entry.dac };
 }
 var FOLLOWING = /* @__PURE__ */ new Set(["exists", "stat", "chown", "statfs"]);
+var LOOKS = /* @__PURE__ */ new Set(["exists", "stat", "lstat"]);
 var NOT_FOLLOWING = /* @__PURE__ */ new Set(["lstat", "readlink", "lchown"]);
 async function guard(g, path, req, cwd) {
   const { op } = req;
@@ -8986,6 +9013,7 @@ async function accessOp(entry, path, req) {
 async function guarded(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return void 0;
+  if (LOOKS.has(req.op) && await entry.holdsKept?.(path)) return void 0;
   try {
     await guard(g, path, req, entry.cwd);
     return void 0;
@@ -12529,6 +12557,13 @@ var WasmProcess = class {
     }
   }
   keptPath;
+  async holds(path) {
+    for (const fd of this.fds.numbers()) {
+      const { file } = this.fds.get(fd);
+      if ((await file.stat?.().catch(() => void 0))?.path === path) return true;
+    }
+    return false;
+  }
   keptHandle;
   async keptOr(path, handle) {
     const held = handle === void 0 ? void 0 : this.keptHandle?.(handle);
@@ -13172,7 +13207,8 @@ function spawnWasmProcess(opts) {
   const token = holdingToken(opts, holds, {
     cred: () => process.cred,
     umask: () => process.umask,
-    created: created3
+    created: created3,
+    holdsKept: async (path) => path.includes(`/${UNLINKED_DIR}/`) && (holds.keeps(path) || await process.holds(path))
   });
   process.keptPath = (path) => holds.keptAt(path)?.hidden;
   process.keptHandle = (handle2) => holds.keptFor(handle2)?.hidden;
@@ -15534,9 +15570,14 @@ var Sudo = class {
     if (walked.denied !== void 0 || walked.missing) return false;
     return (await this.o.fs.stat(cwd).catch(() => void 0))?.isDirectory === true;
   }
-  async untrusted(path, cwd) {
-    const files = await this.o.backing?.(path, cwd) ?? [];
-    for (const file of [path, ...files]) if (!await this.trusted(file)) return file;
+  async untrusted(path, cwd, word) {
+    const files = this.o.backing ? await this.o.backing(path, cwd) : [];
+    if (!files) return failed2("ENOENT", `sudo: ${word}: command not found`);
+    for (const file of [path, ...files]) {
+      if (!await this.trusted(file)) {
+        return failed2("EPERM", `sudo: ${file} must be root's, and writable by root only`);
+      }
+    }
     return void 0;
   }
   async locate(word, cwd) {
@@ -15577,10 +15618,8 @@ var Sudo = class {
     }
     const path = await this.locate(word, cwd);
     if (!path) return failed2("ENOENT", `sudo: ${word}: command not found`);
-    const untrusted = await this.untrusted(path, cwd);
-    if (untrusted) {
-      return failed2("EPERM", `sudo: ${untrusted} must be root's, and writable by root only`);
-    }
+    const untrusted = await this.untrusted(path, cwd, word);
+    if (untrusted) return untrusted;
     const argv = [path, ...args];
     const matching = rules.filter(
       (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
@@ -15603,10 +15642,8 @@ var Sudo = class {
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
-      const changed = await this.untrusted(path, cwd);
-      if (changed) {
-        return failed2("EPERM", `sudo: ${changed} must be root's, and writable by root only`);
-      }
+      const changed = await this.untrusted(path, cwd, word);
+      if (changed) return changed;
       if (answer === "always" && !await this.remember(self, target, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
@@ -15880,6 +15917,10 @@ var Launcher = class {
   fs;
   processFs;
   prefixes;
+  writerTags;
+  unguardedRoot;
+  writers;
+  unlinkOwnerOption;
   base;
   createWorker;
   modulesDir;
@@ -15997,7 +16038,7 @@ var Launcher = class {
     this.nodes = new VfsNodes(fs, (path) => this.released(path));
     this.nodes.keepsOnDisk = true;
     this.openFiles.add(this.nodes);
-    const holders = [this.held, [this.nodes]];
+    const holders = [this.held, this.openFiles];
     this.unlinked = new UnlinkedKeeper(
       fs,
       { [Symbol.iterator]: () => holders.flatMap((set2) => [...set2]).values() },
@@ -16010,7 +16051,12 @@ var Launcher = class {
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
-    if (options.protect?.writer) throw new Error(PROTECT_WRITER);
+    this.writerTags = writerTags(options.protect);
+    this.unlinkOwnerOption = options.unlinkOwner;
+    if (this.writerTags.size > 0 && options.fs.protect && !options.fs.unguarded) {
+      throw new TypeError("protect.writers needs a root file system with an unguarded view");
+    }
+    this.unguardedRoot = options.fs.unguarded?.() ?? options.fs;
     this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
     this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
     options.fs.protect?.(this.prefixes);
@@ -16227,7 +16273,7 @@ var Launcher = class {
   }
   async backing(file, cwd) {
     const planned = await this.plan(file, [file], cwd, "");
-    if (!planned) return [];
+    if (!planned) return void 0;
     const { glue, wasm, imports } = planned.target;
     const files = [glue, wasm, ...imports ? [imports] : []];
     const scripts = [];
@@ -16334,6 +16380,7 @@ var Launcher = class {
       throw fsError("ESRCH", `no process group ${req.pgid}`);
     }
     const pid = this.nextPid++;
+    const stack = this.stackFor(req.tag);
     const terminal = req.fds.stdioTerminal();
     const decided = req.decided ?? Promise.resolve(true);
     const count = (byParent) => {
@@ -16364,8 +16411,8 @@ var Launcher = class {
       env: req.env,
       cwd: req.cwd,
       fds: req.fds,
-      fs: this.processFs,
-      ...this.prefixes.length > 0 ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
+      fs: stack.fs,
+      ...this.prefixes.length > 0 && !stack.writer ? { readonlyAt: (path) => isProtected(this.prefixes, path) } : {},
       createWorker: this.createWorker,
       onError: req.report,
       spawner: this.spawner(pid, req.report),
@@ -16380,9 +16427,9 @@ var Launcher = class {
       }),
       sudo: (call, signal) => this.sudo(pid, call, signal),
       openFiles: this.openFiles,
-      nodes: this.nodes,
+      nodes: stack.nodes,
       held: this.held,
-      unlinkGate: this.unlinked.gate,
+      unlinkGate: stack.unlinked.gate,
       statfs: (path) => this.mounts.statfs(path),
       mounts: () => this.mounts.list(),
       mount: (call, signal) => this.processMount(pid, call, signal),
@@ -16683,6 +16730,7 @@ var Launcher = class {
   released(path) {
     const at = normalizePath(path);
     this.unlinked.closed(at);
+    this.writers?.unlinked.closed(at);
     const open = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
     if (!open) void this.mounts.commit(at).catch(() => void 0);
   }
@@ -16833,6 +16881,27 @@ var Launcher = class {
       await this.provisionPnpmHome();
     return entry;
   }
+  async ownTmp() {
+    const real = await this.realLayoutPath("/tmp");
+    const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
+    if (real !== void 0 && st?.isDirectory && this.base.hasOwner && !await this.base.hasOwner(real)) {
+      let removed = 0;
+      for (const name2 of await this.base.readdir(real).catch(() => [])) {
+        const path = joinName(real, name2);
+        if (await this.base.hasOwner(path) || this.inUse(path)) continue;
+        const failed3 = await this.base.rm(path, { recursive: true, force: true }).catch(String);
+        if (failed3 === void 0) removed++;
+      }
+      if (removed > 0) {
+        console.warn(`slicc-kernel users: removed ${removed} entries from /tmp that had no owner`);
+      }
+      await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
+    }
+    if (st?.isDirectory) await this.base.chmod(real, 1023);
+  }
+  inUse(path) {
+    return [...this.openFiles].some((nodes) => nodes.holds(path)) || heldUnder(this.held, path);
+  }
   async stampLayout() {
     const layout = [
       ...LAYOUT,
@@ -16952,7 +17021,7 @@ var Launcher = class {
   async prepare() {
     await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
-    if (this.owners) await this.base.chmod("/tmp", 1023);
+    if (this.owners) await this.ownTmp();
     await this.provisionPnpmHome();
     await this.users.ensure();
     if (this.owners) await this.stampLayout();
@@ -17001,13 +17070,49 @@ var Launcher = class {
       ...account.umask !== void 0 ? { umask: account.umask } : {}
     };
   }
+  fsFor(tag) {
+    return this.stackFor(tag).fs;
+  }
+  isWriter(tag) {
+    return tag !== void 0 && this.prefixes.length > 0 && this.writerTags.has(tag);
+  }
+  stackFor(tag) {
+    if (!this.isWriter(tag)) {
+      return { fs: this.processFs, nodes: this.nodes, unlinked: this.unlinked, writer: false };
+    }
+    this.writers ??= this.writerStack();
+    return this.writers;
+  }
+  writerStack() {
+    const fs = withCommandDirs(
+      this.watchers.wrap(this.mounts.wrap(this.unguardedRoot)),
+      async () => new Set((await this.commands()).keys()),
+      (dir) => this.userCommandDir(dir),
+      this.owners
+    );
+    const nodes = new VfsNodes(fs, (path) => this.released(path));
+    nodes.keepsOnDisk = true;
+    this.openFiles.add(nodes);
+    const unlinked = new UnlinkedKeeper(
+      fs,
+      { [Symbol.iterator]: () => [this.held, this.openFiles].flatMap((set2) => [...set2]).values() },
+      (path) => this.mountRoot(path),
+      {
+        locks: webLocks(),
+        busy: (path) => [...this.openFiles].some((open) => open.holds(path)),
+        owner: this.unlinkOwnerOption,
+        ...this.owners ? { dirOwner: { uid: 0, gid: 0, mode: 448 } } : {}
+      }
+    );
+    return { fs: unlinked.wrap(keepingOpen(fs, nodes)), nodes, unlinked, writer: true };
+  }
   async starting(argv, dir, account, tag) {
     this.resetCatalogs();
     const scope = account.uid === 0 ? "" : pnpmHomeOf(account, this.pnpmHome);
     const start2 = dir ?? "/";
     const cwd = await physicalPathAsync(this.base, start2.startsWith("/") ? start2 : `/${start2}`);
     const [file = ""] = argv;
-    if (!await this.base.exists(cwd)) await this.processFs.mkdir(cwd, { recursive: true });
+    if (!await this.base.exists(cwd)) await this.stackFor(tag).fs.mkdir(cwd, { recursive: true });
     const planned = await this.plan(file, argv, cwd, scope);
     await this.mayExec(credOf(account), { file, cwd, pid: 0, tag }, planned);
     return { cwd, file, planned };
@@ -17270,7 +17375,7 @@ function hostOptions(req, port, sealed) {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
-    ...req.protect ? { protect: { paths: [...req.protect.paths] } } : {},
+    ...req.protect ? { protect: protectInit(req.protect) } : {},
     ...req.sealed ? { sealed } : {}
   };
 }