@ai-ecoverse/slicc-kernel 1.85.0 → 1.85.1

package/README.md

@@ -648,7 +648,7 @@ The kernel then asks the hook `{ v: 1, op: 'materializeConsume', ticket, stamp,
 - `interpreters` is the chain of `#!` and `binfmt` interpreters the kernel will really run, outermost first, each absolute with its symlinks resolved, and empty for a program of the catalog (Emscripten, WASI or JS) and the `/usr/bin/<name>` entries for one. A plain `#!/usr/bin/env X` (or `env -S X …`) is reported as `X`: a command of the catalog as `/usr/bin/X`, a script command by its file. `env` with any other option or a `NAME=value` assignment is run and reported as `/usr/bin/env` itself;
 - `trusted` is true when the program and every interpreter are regular files owned by root and not writable by group or others, under directories that are all the same, up to `/` (for a command of the catalog, its package files). It's false unless `users` is `'enforce'`: under `'off'` files have no owners, and under `'report'` owners don't stop a write. The reply must be `{ values, placeholders }` (string maps) within 10 s; anything else is `EACCES`. Each variable of the child's environment whose value is exactly `placeholders[NAME]` gets `values[NAME]`; nothing else changes. The kernel keeps no copy and logs nothing of either. Like any environment, the values are inherited by whatever the child itself spawns or execs, as on Linux. A ticket isn't carried across `sudo`, which builds its own environment: a `sudo` run with `SLICC_SEALED_TICKET` set fails with `EACCES`, and burns the ticket.
 
-**The child's output is scrubbed (S2).** The kernel compiles a [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub) scrubber (1.0.0, bundled; the published package has no runtime dependency) over exactly the values it swapped in, and gives the child new open file descriptions for fd 1 and fd 2, for every other descriptor it holds on the same descriptions (a `dup` of them), and for every descriptor on a terminal (fd 0 of a terminal session is one), that pass every write through it into the originals (one wrapper per original description, so `2>&1` keeps its order). A value appears as its placeholder, and a fragment or encoded form of it (JSON, percent, HTML, base64, hex, wrapped) as `[redacted:NAME]`. Bytes go through at once unless they may still be the start of a match; such a tail is let out after 50 ms without a write when it's shorter than 16 bytes, and otherwise at the next write or at close. The child's descendants inherit the scrubbed descriptions through fork, spawn, exec and `dup`, and a descendant that opens its controlling terminal (`/dev/tty`, or a terminal by name) gets one scrubbed too, as does a pseudo-terminal slave (`/dev/pts/N`) it opens. Files, sockets and pipes the child or a descendant opens itself are not scrubbed, so `printf %s "$T" > f` writes the value. A scrubbed fd 1 or 2 is a stream: it doesn't seek. A descendant that redeems a ticket of its own adds its values: its output is scrubbed for both sets. A value under 8 bytes is swapped but can't be scrubbed. The scrubber goes when the last process and description holding it do.
+**The child's output is scrubbed (S2).** The kernel compiles a [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub) scrubber (1.0.0, bundled; the published package has no runtime dependency) over exactly the values it swapped in, and gives the child new open file descriptions for fd 1 and fd 2, for every other descriptor it holds on the same descriptions (a `dup` of them), and for every descriptor on a terminal (fd 0 of a terminal session is one), that pass every write through it into the originals (one wrapper per original description, so `2>&1` keeps its order). A value appears as its placeholder, and a fragment or encoded form of it (JSON, percent, HTML, base64, hex, wrapped) as `[redacted:NAME]`. Bytes go through at once unless they may still be the start of a match; such a tail is let out after 50 ms without a write when it's shorter than 16 bytes, and otherwise at the next write or at close. The child's descendants inherit the scrubbed descriptions through fork, spawn, exec and `dup`, and a descendant that opens its controlling terminal (`/dev/tty`, or a terminal by name) gets one scrubbed too, as does a pseudo-terminal slave (`/dev/pts/N`) or [`/dev/clipboard`](#devclipboard) it opens, and a `/dev/clipboard` descriptor it inherited is wrapped at the redeem like fd 1 and 2, so the page's clipboard gets placeholders, never the values. Files, sockets and pipes the child or a descendant opens itself are not scrubbed, so `printf %s "$T" > f` writes the value. A scrubbed fd 1 or 2 is a stream: it doesn't seek. A descendant that redeems a ticket of its own adds its values: its output is scrubbed for both sets. A value under 8 bytes is swapped but can't be scrubbed. The scrubber goes when the last process and description holding it do.
 
 ### `/dev/clipboard`
 

package/dist/kernel-worker.js

@@ -11843,7 +11843,7 @@ function ptySyscall(req, ctx) {
       const pair = ctx.ptys.get(req.n);
       ttyOpenable(ctx.guard, pair.slave);
       const slave = pair.openSlave();
-      const fd = ctx.fds.install(ctx.ttyFilter?.(slave) ?? slave, 3);
+      const fd = ctx.fds.install(ctx.outputFilter?.(slave) ?? slave, 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
       return json4(fd);
     }
@@ -13009,8 +13009,8 @@ var WasmProcess = class {
         const { ptys, jobs } = this.options;
         const owner = this.options.owners ? this.ttyOwner() : void 0;
         const guard2 = this.guarded();
-        const { ttyFilter } = this.options;
-        const ctx = { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner, ttyFilter };
+        const { outputFilter } = this.options;
+        const ctx = { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner, outputFilter };
         return ptySyscall(req, ctx);
       }
       return await this.procSyscall(req, cancelled);
@@ -13187,7 +13187,7 @@ var WasmProcess = class {
     if (!tty) throw new KernelError("ENXIO");
     if (name2 !== void 0) ttyOpenable(this.guarded(), tty);
     const file = tty.file();
-    return this.fds.install(this.options.ttyFilter?.(file) ?? file, 3);
+    return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
   openSealed() {
     const broker = this.options.sealed;
@@ -13199,7 +13199,8 @@ var WasmProcess = class {
     if (!broker) throw new KernelError("ENOENT");
     const mode = flags2 & WRITE_ACCESS;
     const access2 = mode === 0 ? "read" : mode === 1 ? "write" : "both";
-    return this.fds.install(broker.open(access2, await this.clipboardStamp()), 3);
+    const file = broker.open(access2, await this.clipboardStamp());
+    return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
   async clipboardStamp() {
     const shown = await this.options.identity?.();
@@ -13998,7 +13999,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
-    ...opts.ttyFilter ? { ttyFilter: opts.ttyFilter } : {},
+    ...opts.outputFilter ? { outputFilter: opts.outputFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
@@ -15000,7 +15001,7 @@ function scrubStdio(fds, scrubber) {
   const stdio = stdioFiles(fds);
   for (const fd of fds.numbers()) {
     const original = fds.get(fd);
-    if (!stdio.has(original) && !original.file.tty) continue;
+    if (!stdio.has(original) && !original.file.tty && !original.file.clipboard) continue;
     const known = wrapped.get(original);
     const flags2 = fds.statusFlags(fd);
     const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
@@ -18079,7 +18080,7 @@ var Launcher = class {
       ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
-      ...scrubs ? { ttyFilter: (file) => scrubbedAll(file, scrubs) } : {},
+      ...scrubs ? { outputFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,