@ai-ecoverse/slicc-kernel 1.85.0 → 1.86.0

package/dist/process-worker.js

@@ -1112,10 +1112,14 @@ function liveNodePath(node) {
   const root = node.mount.opts.root.replace(/\/+$/, "");
   return parts.length === 0 ? root || "/" : `${root}/${parts.reverse().join("/")}`;
 }
-function modeFromStat(st) {
+function exactIn(node) {
+  return node?.mount.opts.bridge.owners === true;
+}
+function modeFromStat(st, exact = false) {
   const type = st.isSymbolicLink ? S_IFLNK : st.isDirectory ? S_IFDIR : S_IFREG;
   const fallback = st.isDirectory || st.isSymbolicLink ? 511 : 438;
-  return type | ((st.mode ?? fallback) & PERM_MASK || fallback);
+  const perm = (st.mode ?? fallback) & PERM_MASK;
+  return type | (exact ? perm : perm || fallback);
 }
 function toMs(v) {
   if (v === void 0 || v === null) return void 0;
@@ -1223,7 +1227,7 @@ function createHelpers(Fs, ops) {
     return { ...stat ? { stat, statAt } : {}, len: 0, loaded: false, dirty: false, openCount: 0 };
   }
   function makeNode(parent, name2, st) {
-    const node = Fs.createNode(parent, name2, modeFromStat(st), 0);
+    const node = Fs.createNode(parent, name2, modeFromStat(st, exactIn(parent)), 0);
     node.node_ops = ops.node;
     node.stream_ops = ops.stream;
     node.live = freshState(st);
@@ -1237,7 +1241,7 @@ function createHelpers(Fs, ops) {
     if (!cachedStat(node.live, Fs.isDir(node.mode))) {
       const st = call2(() => bridgeOf(node).lstat(liveNodePath(linked.holder(node))));
       Object.assign(node.live, { stat: st, statAt: syncCallCount() });
-      node.mode = modeFromStat(st);
+      node.mode = modeFromStat(st, exactIn(node));
     }
     return node.live.stat;
   }
@@ -1575,9 +1579,21 @@ function createStreamOps(h) {
     }
     return want;
   };
+  const directory = (stream) => {
+    const bridge = bridgeOf(stream.node);
+    if (!bridge.owners || !Fs.isDir(stream.node.mode) || stream.flags & O_PATH) return;
+    try {
+      h.call(
+        () => bridge.access?.(liveNodePath(stream.node), accessOf(wantOf(stream.flags)), "open")
+      );
+    } catch (err) {
+      if (stream.fd !== void 0) Fs.closeStream?.(stream.fd);
+      throw err;
+    }
+  };
   return {
     open(stream) {
-      if (!Fs.isFile(stream.node.mode)) return;
+      if (!Fs.isFile(stream.node.mode)) return directory(stream);
       const s = stream.node.live;
       const created = s.created === true;
       s.created = void 0;
@@ -1709,6 +1725,7 @@ function createLiveVfsPlugin(Fs) {
       const st = h.call(() => mount.opts.bridge.stat(mount.opts.root));
       if (!st.isDirectory) throw new Fs.ErrnoError(wasiErrno("ENOTDIR"));
       const root = h.makeNode(null, "/", st);
+      root.mode = modeFromStat(st, mount.opts.bridge.owners === true);
       mounts.add(mount);
       return root;
     }
@@ -1918,7 +1935,7 @@ function useLiveChown(Fs) {
     Fs.chown(target, uid, gid);
   };
 }
-var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, stale;
+var S_IFDIR, S_IFREG, S_IFLNK, PERM_MASK, DEFAULT_DIR_PERM, UMASK, SEEK_CUR, SEEK_END, EARLY_WHOLE_FILE, O_ACCMODE, O_TRUNC, O_PATH, stale;
 var init_live_vfs_fs = __esm({
   "src/realm/live-vfs-fs.ts"() {
     "use strict";
@@ -1938,6 +1955,7 @@ var init_live_vfs_fs = __esm({
     EARLY_WHOLE_FILE = 64 * 1024;
     O_ACCMODE = 3;
     O_TRUNC = 512;
+    O_PATH = 2097152;
     stale = (s) => !!s.orphan && !s.kept;
   }
 });
@@ -2757,7 +2775,7 @@ function pathOpensLinks(Fs) {
   const fs = Fs;
   const { mayOpen, isLink } = fs;
   if (!mayOpen || !isLink) return;
-  fs.mayOpen = (node, flags) => flags & O_PATH && isLink.call(fs, node.mode) ? 0 : mayOpen.call(fs, node, flags);
+  fs.mayOpen = (node, flags) => flags & O_PATH2 && isLink.call(fs, node.mode) ? 0 : mayOpen.call(fs, node, flags);
 }
 function importKey(namespace, name2, glue) {
   const own = glue?.[name2];
@@ -3237,7 +3255,24 @@ function kernelAccess(imports, fs, memory, glue) {
     }
   });
 }
+function kernelChdir(Fs) {
+  const { chdir, lookupPath, ErrnoError } = Fs;
+  if (!chdir || !lookupPath || !ErrnoError) return;
+  Fs.chdir = (path) => {
+    const { node } = lookupPath.call(Fs, path, { follow: true });
+    const directory = Fs.isDir?.(node.mode) === true;
+    const bridge = node.live && directory ? node.mount.opts.bridge : void 0;
+    try {
+      bridge?.access?.(liveNodePath(node), X_ACCESS, "eaccess", false);
+    } catch (err) {
+      throw new ErrnoError(errnoOf(err));
+    }
+    chdir.call(Fs, path);
+  };
+}
 function linuxDevices(Fs) {
+  Fs.ignorePermissions = true;
+  kernelChdir(Fs);
   const { chmod } = Fs;
   if (!chmod) return;
   for (const [path, mode] of DEVICE_MODES) {
@@ -3247,7 +3282,7 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH2, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, X_ACCESS, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
@@ -3275,7 +3310,7 @@ var init_process_fds = __esm({
     EBADF = 8;
     AT_SYMLINK_NOFOLLOW = 256;
     EMSCRIPTEN_EPERM = 63;
-    O_PATH = 2097152;
+    O_PATH2 = 2097152;
     LITERALS = {
       openat: "__syscall_openat",
       mkdirat: "__syscall_mkdirat",
@@ -3307,6 +3342,7 @@ var init_process_fds = __esm({
     AT_FDCWD = -100;
     AT_EACCESS = 512;
     W_ACCESS = 2;
+    X_ACCESS = 1;
     DEVICE_MODES = [
       ["/", 493],
       ["/dev", 493],
@@ -6904,7 +6940,7 @@ var init_wasi_host = __esm({
           }
           return path;
         };
-        const modeOf = (st) => (st.mode ?? 0) & 4095;
+        const modeOf2 = (st) => (st.mode ?? 0) & 4095;
         const chown = (path, uid, gid, follow2) => {
           const { chown: own } = this.o.fs;
           if (!own) throw new WasiError("ENOSYS");
@@ -6983,7 +7019,7 @@ var init_wasi_host = __esm({
           fd_mode: (fd, out) => {
             const e = fds.get(fd);
             const kind = e.type === "kernel" ? fds.kind(fd, e) : void 0;
-            const mode = kind === "stream" ? S_IFIFO | 384 : kind === "sealed" || kind === "clipboard" ? SEALED_MODE : modeOf(this.o.fs.stat(pathOf(fd)));
+            const mode = kind === "stream" ? S_IFIFO | 384 : kind === "sealed" || kind === "clipboard" ? SEALED_MODE : modeOf2(this.o.fs.stat(pathOf(fd)));
             mem.view().setUint32(out, mode, true);
           },
           path_mode: (dirfd, p, l, flags, out) => {
@@ -6991,7 +7027,7 @@ var init_wasi_host = __esm({
             if (this.synthetic(path) && deviceOf(path) === void 0)
               return void mem.view().setUint32(out, SEALED_MODE, true);
             const st = flags & AT_SYMLINK_NOFOLLOW2 ? this.o.fs.lstat(path) : this.o.fs.stat(path);
-            mem.view().setUint32(out, modeOf(st), true);
+            mem.view().setUint32(out, modeOf2(st), true);
           }
         });
       }
@@ -11088,6 +11124,12 @@ var init_async_sab = __esm({
 });
 
 // src/process/js/js-kernel.ts
+function modeOf(mode) {
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
+    throw new JsCallError("EINVAL", "chmod");
+  }
+  return mode;
+}
 function callError(result, op) {
   const { errno: errno2, message: message2 } = result;
   const detailed = typeof message2 === "string" && message2 !== errno2 && DETAILED.has(op);
@@ -12700,10 +12742,15 @@ function syncPathOps(kernel, resolve, statOf, open) {
       if (inDev(abs)) return devSync(kernel, devReaddir(abs));
       return kernel.json({ op: "readdir", path: abs });
     },
-    mkdir: (path) => void kernel.call({ op: "mkdir", path: resolve(path) }),
+    mkdir: (path, options) => void kernel.call({
+      op: "mkdir",
+      path: resolve(path),
+      ...options?.recursive === false ? { exclusive: true } : {}
+    }),
     rm: (path) => void kernel.call({ op: "rm", path: resolve(path) }),
     unlink: (path) => void kernel.call({ op: "unlink", path: resolve(path) }),
     rename: (from, to) => void kernel.call({ op: "rename", path: resolve(from), arg2: resolve(to) }),
+    chmod: (path, mode) => void kernel.call({ op: "chmod", path: resolve(path), mode: modeOf(mode) }),
     link: (from, to) => void kernel.call({ op: "link", path: resolve(from), arg2: resolve(to) }),
     symlink: (target, path) => void kernel.call({ op: "symlink", path: resolve(path), arg2: target }),
     readlink(path) {
@@ -13206,7 +13253,9 @@ function createContext(o) {
     kill: killer({ self: o.pid, kernel, syncKernel, lane, writes, modes: terminal.modes }),
     cred: () => syncKernel.json({ op: "proc-cred" }),
     setcred(change) {
-      if (typeof change !== "object" || change === null) throw new JsCallError("EINVAL", "setcred");
+      if (typeof change !== "object" || change === null || Array.isArray(change)) {
+        throw new JsCallError("EINVAL", "setcred");
+      }
       return syncKernel.json({ op: "proc-setcred", change: { ...change } });
     }
   };
@@ -13402,10 +13451,15 @@ function pathOps(kernel, resolve, statOf, open) {
       if (inDev(abs)) return devAsync(kernel, devReaddir(abs));
       return await kernel.json({ op: "readdir", path: abs });
     },
-    mkdir: async (path) => void await kernel.call({ op: "mkdir", path: resolve(path) }),
+    mkdir: async (path, options) => void await kernel.call({
+      op: "mkdir",
+      path: resolve(path),
+      ...options?.recursive === false ? { exclusive: true } : {}
+    }),
     rm: async (path) => void await kernel.call({ op: "rm", path: resolve(path) }),
     unlink: async (path) => void await kernel.call({ op: "unlink", path: resolve(path) }),
     rename: async (from, to) => void await kernel.call({ op: "rename", path: resolve(from), arg2: resolve(to) }),
+    chmod: async (path, mode) => void await kernel.call({ op: "chmod", path: resolve(path), mode: modeOf(mode) }),
     link: async (from, to) => void await kernel.call({ op: "link", path: resolve(from), arg2: resolve(to) }),
     symlink: async (target, path) => void await kernel.call({ op: "symlink", path: resolve(path), arg2: target }),
     async readlink(path) {