@ai-ecoverse/slicc-kernel 1.76.0 → 1.77.1

package/dist/kernel-worker.js

@@ -373,6 +373,9 @@ function writerTags(protection) {
   return new Set(writers);
 }
 function protectedPrefixes(paths) {
+  if (!Array.isArray(paths) || paths.some((p) => typeof p !== "string" || !p.startsWith("/"))) {
+    throw new TypeError("protect.paths must be a list of absolute paths");
+  }
   return [...new Set(paths.map((p) => normalizePath(p)))];
 }
 function within(path, prefix) {
@@ -476,6 +479,9 @@ var ProtectedFs = class {
         await check(path, true);
         return fs.utimes(path, atime, mtime);
       },
+      async mayChange(path, follow2) {
+        await check(path, follow2);
+      },
       async stat(path) {
         return marked(path, await fs.stat(path));
       },
@@ -1155,6 +1161,10 @@ var OpfsFs = class {
     };
   }
   async describe(found) {
+    const stat = await this.described(found);
+    return isProtected(this.guarded, found.path) ? { ...stat, readonly: true } : stat;
+  }
+  async described(found) {
     if (found.link) return this.owned(this.linkStat(found.link), found.path, found.link);
     const touched = this.timesOf(found.path);
     if (!this.owners) {
@@ -7318,6 +7328,83 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   };
 }
 
+// src/fs/fresh-modules.ts
+var MAGIC = [0, 97, 115, 109];
+var MAX_FRESH = 65536;
+function isModule(bytes) {
+  return MAGIC.every((b, i) => bytes[i] === b);
+}
+var FreshModules = class {
+  fresh = /* @__PURE__ */ new Map();
+  add(path, umask, pid) {
+    const key = normalizePath(path);
+    this.fresh.delete(key);
+    const oldest = this.fresh.size >= MAX_FRESH ? this.fresh.keys().next().value : void 0;
+    if (oldest !== void 0) this.fresh.delete(oldest);
+    this.fresh.set(key, { umask: umask & 511, pid, added: 0 });
+  }
+  forget(pid) {
+    for (const [path, fresh2] of this.fresh) if (fresh2.pid === pid) this.fresh.delete(path);
+  }
+  wrap(fs) {
+    const decide = async (given, bytes) => {
+      const path = normalizePath(given);
+      const fresh2 = this.fresh.get(path);
+      if (!fresh2 || typeof bytes === "string" || bytes.length < MAGIC.length) return;
+      const want = isModule(bytes) ? 73 & ~fresh2.umask : 0;
+      if (want === fresh2.added) return;
+      const mode = (await fs.stat(path)).mode & 4095;
+      await fs.chmod(path, mode & ~fresh2.added | want);
+      fresh2.added = want;
+    };
+    const overrides = {
+      writeFile: async (path, content, owner) => {
+        await fs.writeFile(path, content, owner);
+        await decide(path, content);
+      },
+      chmod: async (path, mode) => {
+        const fresh2 = this.fresh.get(normalizePath(path));
+        const creating = fresh2?.added === 0 && (mode & 4095) === (438 & ~fresh2.umask);
+        if (!creating) this.fresh.delete(normalizePath(path));
+        await fs.chmod(path, mode);
+      },
+      rm: async (path, options) => {
+        this.fresh.delete(normalizePath(path));
+        await fs.rm(path, options);
+      },
+      rename: async (from, to) => {
+        await fs.rename(from, to);
+        const fresh2 = this.fresh.get(normalizePath(from));
+        this.fresh.delete(normalizePath(from));
+        this.fresh.delete(normalizePath(to));
+        if (fresh2) this.fresh.set(normalizePath(to), fresh2);
+      }
+    };
+    const ranged2 = rangedOps(fs);
+    if (ranged2) {
+      overrides.pwrite = async (path, at, bytes, transfer) => {
+        const head = at === 0 && this.fresh.has(normalizePath(path)) ? bytes.slice(0, 4) : void 0;
+        await ranged2.pwrite(path, at, bytes, transfer);
+        if (head) await decide(path, head);
+      };
+    }
+    const bound = /* @__PURE__ */ new WeakMap();
+    return new Proxy(fs, {
+      get(target, key, receiver) {
+        if (Object.hasOwn(overrides, key)) return overrides[key];
+        const value = Reflect.get(target, key, receiver);
+        if (typeof value !== "function") return value;
+        let method = bound.get(value);
+        if (method === void 0) {
+          method = value.bind(target);
+          bound.set(value, method);
+        }
+        return method;
+      }
+    });
+  }
+};
+
 // src/fs/physical-path.ts
 var MAX_HOPS = 40;
 function start(path) {
@@ -9194,6 +9281,7 @@ async function run(entry, path, req) {
     case "create":
       await createExclusive(fs, path, ownerFor2(entry, req.mode ?? 438));
       entry.created?.add(path);
+      entry.fresh?.(path);
       return done;
     case "readlink":
       return json2(await fs.readlink(path));
@@ -9292,11 +9380,39 @@ async function accessOp(entry, path, req) {
   await need({ ...g, cred }, open ? "open" : "access", path, req.mode ?? 0, options);
   return done;
 }
+var CHANGING = /* @__PURE__ */ new Set([
+  "mkdir",
+  "create",
+  "symlink",
+  "unlink",
+  "rmdir",
+  "rm",
+  "rename",
+  "link",
+  "utimes",
+  "lutimes",
+  "chmod",
+  "chown",
+  "lchown"
+]);
+var CONTENT = /* @__PURE__ */ new Set(["write", "pwrite", "truncate"]);
+async function mayChange(entry, path, req) {
+  const { mayChange: mayChange2 } = entry.fs;
+  if (!mayChange2) return;
+  const { op } = req;
+  if (CONTENT.has(op) && req.handle === void 0) return mayChange2.call(entry.fs, path, true);
+  if (!CHANGING.has(op)) return;
+  await mayChange2.call(entry.fs, path, op === "utimes" || op === "chmod" || op === "chown");
+  if (op === "rename" || op === "link") {
+    await mayChange2.call(entry.fs, entry.fs.resolvePath(entry.cwd, req.arg2 ?? ""), false);
+  }
+}
 async function guarded(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return void 0;
   if (LOOKS.has(req.op) && await entry.holdsKept?.(path)) return void 0;
   try {
+    await mayChange(entry, path, req);
     await guard(g, path, req, entry.cwd);
     return void 0;
   } catch (err) {
@@ -9575,6 +9691,7 @@ var IDLE_OPS = /* @__PURE__ */ new Set([
 ]);
 var SYS_CAP_US = 2e4;
 var LOCAL = SAB_CLOCK_OFFSET;
+var BLOCKED = 0;
 var IDLE = 1;
 function epochMicros() {
   return Math.floor((performance.timeOrigin + performance.now()) * 1e3);
@@ -9649,6 +9766,7 @@ var CpuClock = class {
     const busy = this.kind === "sys" ? Math.min(spent, SYS_CAP_US) : 0;
     this.sys += busy;
     this.idle += spent - busy;
+    Atomics.store(slots(this.sab), BLOCKED, BigInt(this.idle));
   }
 };
 var ProcessClocks = class {
@@ -9993,8 +10111,8 @@ function pidStat(info, boot) {
     0,
     ticks(info.utime ?? 0),
     ticks(info.stime ?? 0),
-    0,
-    0,
+    ticks(info.cutime ?? 0),
+    ticks(info.cstime ?? 0),
     20,
     0,
     1,
@@ -10018,8 +10136,9 @@ function pidStat(info, boot) {
 `;
 }
 var sigMask = (mask = 0) => (mask >>> 1).toString(16).padStart(16, "0");
+var STATES = { S: "S (sleeping)", T: "T (stopped)", Z: "Z (zombie)" };
 function pidStatus(info) {
-  const state = info.state === "Z" ? "Z (zombie)" : "S (sleeping)";
+  const state = STATES[info.state];
   const c = info.cred ?? ROOT;
   const ids = (r, e, s) => `${r}	${e}	${s}	${e}`;
   return [
@@ -12308,6 +12427,16 @@ function words(value) {
   }
   return [...value];
 }
+var ESCAPES = { "	": "\\t", "\n": "\\n", "\r": "\\r" };
+function clipboardLine(text) {
+  let out = "";
+  for (const c of text) {
+    const code = c.charCodeAt(0);
+    const control = code < 32 || code === 127;
+    out += control ? ESCAPES[c] ?? `\\x${code.toString(16).padStart(2, "0")}` : c;
+  }
+  return out.length > 200 ? `${out.slice(0, 200)}\u2026` : out;
+}
 var DYING = { ok: false, errno: "EINTR", message: "the process is being killed" };
 var HOSTS_ONLY = new Resolver({ routes: new Routes() });
 var WasmProcess = class {
@@ -12560,7 +12689,22 @@ var WasmProcess = class {
     if (req.max <= 0) return new Uint8Array(0);
     if (channel.unread) channel.stamp = await this.clipboardStamp();
     const signal = channel.settled ? this.interrupt.signal : this.blockingSignal(cancelled);
-    return channel.read(Math.min(req.max, MAX_READ), signal);
+    try {
+      return await channel.read(Math.min(req.max, MAX_READ), signal);
+    } catch (err) {
+      await this.clipboardComplaint(err);
+      throw err;
+    }
+  }
+  async clipboardComplaint(err) {
+    const name2 = this.options.clipboardName;
+    if (name2 === void 0 || !(err instanceof KernelError) || err.detail === void 0) return;
+    if (err.code !== "EACCES" && err.code !== "EIO") return;
+    const stderr = this.fds.has(2) ? this.fds.get(2).file : void 0;
+    if (!stderr?.write || stderr.clipboard) return;
+    const line = `${name2}: /dev/clipboard: ${clipboardLine(err.detail)}
+`;
+    await stderr.write(new TextEncoder().encode(line), AbortSignal.timeout(1e3)).catch(() => 0);
   }
   async write(fd, body, nonblock = false, cancelled) {
     const file = this.fds.get(fd).file;
@@ -12585,6 +12729,7 @@ var WasmProcess = class {
       throw Object.assign(new Error(alias.refused), { code: alias.refused });
     if (alias !== void 0) return this.openProc(req, alias);
     await refuseReadonly(this.options.fs, req.path, req.flags, req);
+    if (this.writesAt(req)) await this.options.fs.mayChange?.(req.path, !req.exclusive);
     await this.mayOpen(req);
     const fd = this.fds.install(heldFile(), 3);
     try {
@@ -12773,7 +12918,10 @@ var WasmProcess = class {
         this.options.locks?.closed(this.pid, req.fd);
         const channel = this.fds.get(req.fd).file.clipboard;
         if (channel) channel.stamp = await this.clipboardStamp();
-        await Promise.resolve(this.fds.close(req.fd));
+        await Promise.resolve(this.fds.close(req.fd)).catch(async (err) => {
+          if (channel) await this.clipboardComplaint(err);
+          throw err;
+        });
         return { ok: true, kind: "void" };
       }
       case "fd-pipe": {
@@ -13452,6 +13600,7 @@ function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
     ...opts.owners ? caller : {},
     ...opts.dac ? { dac: opts.dac, pid: opts.pid, created: caller.created } : {},
+    ...opts.fresh ? { fresh: (path) => opts.fresh?.(path, caller.umask()) } : {},
     fs: opts.fs,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
@@ -13464,12 +13613,15 @@ function holdingToken(opts, holds, caller) {
     renamed: (from, to) => holds.renamed(from, to)
   });
 }
+function clipboardName(opts) {
+  return opts.program.abi === "js" ? {} : { clipboardName: opts.argv0 };
+}
 function processOptions(opts, header3, hooks, created3) {
   return {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
-    ...opts.clipboard ? { clipboard: opts.clipboard } : {},
+    ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
     ...opts.identity ? { identity: opts.identity } : {},
@@ -16258,6 +16410,10 @@ function concat5(chunks) {
   }
   return out;
 }
+function addTimes(into, pid, t) {
+  const at = into.get(pid) ?? { utime: 0, stime: 0 };
+  into.set(pid, { utime: at.utime + t.utime, stime: at.stime + t.stime });
+}
 var Launcher = class {
   fs;
   processFs;
@@ -16283,6 +16439,7 @@ var Launcher = class {
   described = /* @__PURE__ */ new Map();
   creds = /* @__PURE__ */ new Map();
   tags = /* @__PURE__ */ new Map();
+  freshModules = new FreshModules();
   granted = /* @__PURE__ */ new Map();
   users;
   sudoer;
@@ -16353,7 +16510,8 @@ var Launcher = class {
       changed: this.watchers.changed.bind(this.watchers),
       owners: this.owners
     });
-    this.base = this.watchers.wrap(this.mounts.wrap(options.fs));
+    const watched = this.watchers.wrap(this.mounts.wrap(options.fs));
+    this.base = this.owners ? this.freshModules.wrap(watched) : watched;
     this.createWorker = options.createWorker;
     this.createDriverWorker = options.createDriverWorker;
     this.media = options.media ?? memoryMedia();
@@ -16756,6 +16914,7 @@ var Launcher = class {
       ...req.ignored ? { ignored: req.ignored } : {},
       ...req.umask !== void 0 ? { umask: req.umask } : {},
       cred: req.cred,
+      ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
       clipboard: this.clipboard,
@@ -16795,7 +16954,7 @@ var Launcher = class {
       http: new HttpHandles(this.transport, pid),
       locks: this.locks,
       resolver: this.resolver,
-      onReap: (child) => this.reaped(child),
+      onReap: (child) => this.reaped(child, pid),
       ...req.fork ? { fork: req.fork } : {},
       ...this.shownIds(req)
     });
@@ -16814,9 +16973,15 @@ var Launcher = class {
       tty: terminal?.name ?? null,
       started: Date.now()
     });
+    handle.onState(
+      (state) => state === "stopped" ? this.stopped.add(pid) : this.stopped.delete(pid)
+    );
     void handle.exited.then(() => {
+      this.freshModules.forget(pid);
       const spent = handle.times?.();
       if (spent) this.spent.set(pid, spent);
+      if (spent) addTimes(this.imageTimes, this.jobs.shown(pid), spent);
+      this.stopped.delete(pid);
       this.processes.delete(pid);
       if (this.processes.size === 0) {
         clearInterval(this.sampler);
@@ -16844,11 +17009,20 @@ var Launcher = class {
       this.reapedTimes.stime += spent.stime;
     }
     this.spent.delete(pid);
+    this.imageTimes.delete(pid);
+    this.childTimes.delete(pid);
     this.creds.delete(pid);
     this.tags.delete(pid);
     this.granted.delete(pid);
   }
-  reaped(pid) {
+  reaped(pid, parent) {
+    const own = this.imageTimes.get(pid);
+    const theirs = this.childTimes.get(pid);
+    const into = this.jobs.shown(parent);
+    if (own) addTimes(this.childTimes, into, own);
+    if (theirs) addTimes(this.childTimes, into, theirs);
+    this.imageTimes.delete(pid);
+    this.childTimes.delete(pid);
     if (this.zombies.delete(pid)) this.forget(pid);
     else this.orphans.add(pid);
   }
@@ -16900,6 +17074,17 @@ var Launcher = class {
     this.sampler.unref?.();
   }
   spent = /* @__PURE__ */ new Map();
+  imageTimes = /* @__PURE__ */ new Map();
+  childTimes = /* @__PURE__ */ new Map();
+  stopped = /* @__PURE__ */ new Set();
+  stateOf(pid) {
+    if (!this.processes.has(pid)) return "Z";
+    return this.stopped.has(pid) ? "T" : "S";
+  }
+  childrenOf(pid) {
+    const t = this.childTimes.get(pid);
+    return t ? { cutime: t.utime, cstime: t.stime } : {};
+  }
   timesAt(pid) {
     return this.processes.get(pid)?.times?.() ?? this.spent.get(pid);
   }
@@ -16945,9 +17130,10 @@ var Launcher = class {
         sid: member.sid,
         ...described2,
         started: (this.described.get(root.pid) ?? described2).started,
-        state: this.processes.has(member.pid) ? "S" : "Z",
+        state: this.stateOf(member.pid),
         memory: this.processes.get(member.pid)?.memory() ?? 0,
         ...this.timesOf(member, members),
+        ...this.childrenOf(root.pid),
         umask: this.umaskOf(member.pid),
         cred,
         ...this.signalMasksOf(member.pid)
@@ -17458,8 +17644,9 @@ var Launcher = class {
     return this.writers;
   }
   writerStack() {
+    const watched = this.watchers.wrap(this.mounts.wrap(this.unguardedRoot));
     const fs = withCommandDirs(
-      this.watchers.wrap(this.mounts.wrap(this.unguardedRoot)),
+      this.owners ? this.freshModules.wrap(watched) : watched,
       async () => new Set((await this.commands()).keys()),
       (dir) => this.userCommandDir(dir),
       this.owners