@ai-ecoverse/slicc-kernel 1.77.0 → 1.77.1

package/dist/kernel-worker.js

@@ -373,6 +373,9 @@ function writerTags(protection) {
   return new Set(writers);
 }
 function protectedPrefixes(paths) {
+  if (!Array.isArray(paths) || paths.some((p) => typeof p !== "string" || !p.startsWith("/"))) {
+    throw new TypeError("protect.paths must be a list of absolute paths");
+  }
   return [...new Set(paths.map((p) => normalizePath(p)))];
 }
 function within(path, prefix) {
@@ -476,6 +479,9 @@ var ProtectedFs = class {
         await check(path, true);
         return fs.utimes(path, atime, mtime);
       },
+      async mayChange(path, follow2) {
+        await check(path, follow2);
+      },
       async stat(path) {
         return marked(path, await fs.stat(path));
       },
@@ -1155,6 +1161,10 @@ var OpfsFs = class {
     };
   }
   async describe(found) {
+    const stat = await this.described(found);
+    return isProtected(this.guarded, found.path) ? { ...stat, readonly: true } : stat;
+  }
+  async described(found) {
     if (found.link) return this.owned(this.linkStat(found.link), found.path, found.link);
     const touched = this.timesOf(found.path);
     if (!this.owners) {
@@ -7318,6 +7328,83 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   };
 }
 
+// src/fs/fresh-modules.ts
+var MAGIC = [0, 97, 115, 109];
+var MAX_FRESH = 65536;
+function isModule(bytes) {
+  return MAGIC.every((b, i) => bytes[i] === b);
+}
+var FreshModules = class {
+  fresh = /* @__PURE__ */ new Map();
+  add(path, umask, pid) {
+    const key = normalizePath(path);
+    this.fresh.delete(key);
+    const oldest = this.fresh.size >= MAX_FRESH ? this.fresh.keys().next().value : void 0;
+    if (oldest !== void 0) this.fresh.delete(oldest);
+    this.fresh.set(key, { umask: umask & 511, pid, added: 0 });
+  }
+  forget(pid) {
+    for (const [path, fresh2] of this.fresh) if (fresh2.pid === pid) this.fresh.delete(path);
+  }
+  wrap(fs) {
+    const decide = async (given, bytes) => {
+      const path = normalizePath(given);
+      const fresh2 = this.fresh.get(path);
+      if (!fresh2 || typeof bytes === "string" || bytes.length < MAGIC.length) return;
+      const want = isModule(bytes) ? 73 & ~fresh2.umask : 0;
+      if (want === fresh2.added) return;
+      const mode = (await fs.stat(path)).mode & 4095;
+      await fs.chmod(path, mode & ~fresh2.added | want);
+      fresh2.added = want;
+    };
+    const overrides = {
+      writeFile: async (path, content, owner) => {
+        await fs.writeFile(path, content, owner);
+        await decide(path, content);
+      },
+      chmod: async (path, mode) => {
+        const fresh2 = this.fresh.get(normalizePath(path));
+        const creating = fresh2?.added === 0 && (mode & 4095) === (438 & ~fresh2.umask);
+        if (!creating) this.fresh.delete(normalizePath(path));
+        await fs.chmod(path, mode);
+      },
+      rm: async (path, options) => {
+        this.fresh.delete(normalizePath(path));
+        await fs.rm(path, options);
+      },
+      rename: async (from, to) => {
+        await fs.rename(from, to);
+        const fresh2 = this.fresh.get(normalizePath(from));
+        this.fresh.delete(normalizePath(from));
+        this.fresh.delete(normalizePath(to));
+        if (fresh2) this.fresh.set(normalizePath(to), fresh2);
+      }
+    };
+    const ranged2 = rangedOps(fs);
+    if (ranged2) {
+      overrides.pwrite = async (path, at, bytes, transfer) => {
+        const head = at === 0 && this.fresh.has(normalizePath(path)) ? bytes.slice(0, 4) : void 0;
+        await ranged2.pwrite(path, at, bytes, transfer);
+        if (head) await decide(path, head);
+      };
+    }
+    const bound = /* @__PURE__ */ new WeakMap();
+    return new Proxy(fs, {
+      get(target, key, receiver) {
+        if (Object.hasOwn(overrides, key)) return overrides[key];
+        const value = Reflect.get(target, key, receiver);
+        if (typeof value !== "function") return value;
+        let method = bound.get(value);
+        if (method === void 0) {
+          method = value.bind(target);
+          bound.set(value, method);
+        }
+        return method;
+      }
+    });
+  }
+};
+
 // src/fs/physical-path.ts
 var MAX_HOPS = 40;
 function start(path) {
@@ -9194,6 +9281,7 @@ async function run(entry, path, req) {
     case "create":
       await createExclusive(fs, path, ownerFor2(entry, req.mode ?? 438));
       entry.created?.add(path);
+      entry.fresh?.(path);
       return done;
     case "readlink":
       return json2(await fs.readlink(path));
@@ -9292,11 +9380,39 @@ async function accessOp(entry, path, req) {
   await need({ ...g, cred }, open ? "open" : "access", path, req.mode ?? 0, options);
   return done;
 }
+var CHANGING = /* @__PURE__ */ new Set([
+  "mkdir",
+  "create",
+  "symlink",
+  "unlink",
+  "rmdir",
+  "rm",
+  "rename",
+  "link",
+  "utimes",
+  "lutimes",
+  "chmod",
+  "chown",
+  "lchown"
+]);
+var CONTENT = /* @__PURE__ */ new Set(["write", "pwrite", "truncate"]);
+async function mayChange(entry, path, req) {
+  const { mayChange: mayChange2 } = entry.fs;
+  if (!mayChange2) return;
+  const { op } = req;
+  if (CONTENT.has(op) && req.handle === void 0) return mayChange2.call(entry.fs, path, true);
+  if (!CHANGING.has(op)) return;
+  await mayChange2.call(entry.fs, path, op === "utimes" || op === "chmod" || op === "chown");
+  if (op === "rename" || op === "link") {
+    await mayChange2.call(entry.fs, entry.fs.resolvePath(entry.cwd, req.arg2 ?? ""), false);
+  }
+}
 async function guarded(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return void 0;
   if (LOOKS.has(req.op) && await entry.holdsKept?.(path)) return void 0;
   try {
+    await mayChange(entry, path, req);
     await guard(g, path, req, entry.cwd);
     return void 0;
   } catch (err) {
@@ -12613,6 +12729,7 @@ var WasmProcess = class {
       throw Object.assign(new Error(alias.refused), { code: alias.refused });
     if (alias !== void 0) return this.openProc(req, alias);
     await refuseReadonly(this.options.fs, req.path, req.flags, req);
+    if (this.writesAt(req)) await this.options.fs.mayChange?.(req.path, !req.exclusive);
     await this.mayOpen(req);
     const fd = this.fds.install(heldFile(), 3);
     try {
@@ -13483,6 +13600,7 @@ function holdingToken(opts, holds, caller) {
   return mintSyncFsToken({
     ...opts.owners ? caller : {},
     ...opts.dac ? { dac: opts.dac, pid: opts.pid, created: caller.created } : {},
+    ...opts.fresh ? { fresh: (path) => opts.fresh?.(path, caller.umask()) } : {},
     fs: opts.fs,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
@@ -16321,6 +16439,7 @@ var Launcher = class {
   described = /* @__PURE__ */ new Map();
   creds = /* @__PURE__ */ new Map();
   tags = /* @__PURE__ */ new Map();
+  freshModules = new FreshModules();
   granted = /* @__PURE__ */ new Map();
   users;
   sudoer;
@@ -16391,7 +16510,8 @@ var Launcher = class {
       changed: this.watchers.changed.bind(this.watchers),
       owners: this.owners
     });
-    this.base = this.watchers.wrap(this.mounts.wrap(options.fs));
+    const watched = this.watchers.wrap(this.mounts.wrap(options.fs));
+    this.base = this.owners ? this.freshModules.wrap(watched) : watched;
     this.createWorker = options.createWorker;
     this.createDriverWorker = options.createDriverWorker;
     this.media = options.media ?? memoryMedia();
@@ -16794,6 +16914,7 @@ var Launcher = class {
       ...req.ignored ? { ignored: req.ignored } : {},
       ...req.umask !== void 0 ? { umask: req.umask } : {},
       cred: req.cred,
+      ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
       clipboard: this.clipboard,
@@ -16856,6 +16977,7 @@ var Launcher = class {
       (state) => state === "stopped" ? this.stopped.add(pid) : this.stopped.delete(pid)
     );
     void handle.exited.then(() => {
+      this.freshModules.forget(pid);
       const spent = handle.times?.();
       if (spent) this.spent.set(pid, spent);
       if (spent) addTimes(this.imageTimes, this.jobs.shown(pid), spent);
@@ -17522,8 +17644,9 @@ var Launcher = class {
     return this.writers;
   }
   writerStack() {
+    const watched = this.watchers.wrap(this.mounts.wrap(this.unguardedRoot));
     const fs = withCommandDirs(
-      this.watchers.wrap(this.mounts.wrap(this.unguardedRoot)),
+      this.owners ? this.freshModules.wrap(watched) : watched,
       async () => new Set((await this.commands()).keys()),
       (dir) => this.userCommandDir(dir),
       this.owners