@ai-ecoverse/slicc-kernel 1.85.0 → 1.86.0

package/dist/kernel-worker.js

@@ -97,6 +97,9 @@ var MemoryMeta = class {
   async get(paths) {
     return paths.map((path) => this.entries.get(path));
   }
+  async fresh(path) {
+    return this.entries.get(path);
+  }
   async update(path, change) {
     this.set(path, change(this.entries.get(path)));
   }
@@ -193,6 +196,16 @@ var IndexedDbMeta = class {
     }
     return paths.map((path) => this.cache.get(path) ?? void 0);
   }
+  async fresh(path) {
+    const [transaction, store] = this.transaction("readonly");
+    const request2 = store.get(path);
+    let entry;
+    request2.onsuccess = () => {
+      entry = request2.result ?? void 0;
+    };
+    await settle(transaction, () => void 0);
+    return entry;
+  }
   async update(path, change) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
@@ -207,6 +220,19 @@ var IndexedDbMeta = class {
     this.changed({ paths: [path] });
     this.cache.set(path, next2 ?? null);
   }
+  async updateMany(changes) {
+    const [transaction, store] = this.transaction("readwrite");
+    for (const { path, change } of changes) {
+      const request2 = store.get(path);
+      request2.onsuccess = () => store.put(change(request2.result));
+    }
+    await settle(transaction, () => void 0);
+    this.changed({ paths: changes.map(({ path }) => path) });
+  }
+  close() {
+    this.channel.close();
+    this.db.close();
+  }
   async move(from, to, root) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
@@ -326,6 +352,12 @@ async function lutimesOf(fs, path, atime, mtime) {
 function mayLink(fs, path) {
   return fs.links?.(path) ?? true;
 }
+function modeOption(mode) {
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
+    throw fsError("EINVAL", `not a mode: ${String(mode)}`);
+  }
+  return mode;
+}
 function fsError(code, path) {
   return Object.assign(new Error(`${code}: ${path}`), { code });
 }
@@ -857,7 +889,8 @@ function sidecar(meta) {
   const guarded2 = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
     throw translate(err, pathOf(args), "sidecar", false);
   });
-  const ops = Object.fromEntries(META_OPS.map((op) => [op, guarded2(op)]));
+  const names = meta.fresh ? [...META_OPS, "fresh"] : META_OPS;
+  const ops = Object.fromEntries(names.map((op) => [op, guarded2(op)]));
   if (meta.absent) ops.absent = meta.absent.bind(meta);
   const { removeFile } = meta;
   if (removeFile)
@@ -985,6 +1018,24 @@ var OpfsFs = class {
   committed(target) {
     if (this.remote?.watched()) this.remote.wrote(target);
   }
+  counted = [];
+  async stamp(path) {
+    const entry = this.meta.fresh ? await this.meta.fresh(path) : (await this.meta.get([path]))[0];
+    return String(entry?.writes ?? 0);
+  }
+  async counting(target) {
+    if (!isProtected(this.counted, target)) return;
+    await this.meta.update(target, (entry) => ({
+      ...entry,
+      path: target,
+      writes: (entry?.writes ?? 0) + 1
+    }));
+  }
+  async recounting(handle, target) {
+    if (this.counted.length === 0) return;
+    const where = await this.root.resolve(handle).catch(() => null);
+    await this.counting(where ? `/${where.join("/")}` : target);
+  }
   resolvePath(base, path) {
     return resolvePath(base, path);
   }
@@ -1043,6 +1094,7 @@ var OpfsFs = class {
   guarded = [];
   protect(prefixes2) {
     this.guarded = prefixes2;
+    this.counted = prefixes2;
   }
   unguarded() {
     return Object.create(this, { guarded: { value: [] } });
@@ -1379,9 +1431,10 @@ var OpfsFs = class {
     return this.retrying(
       path,
       async () => {
+        const stamp = await this.stamp(path);
         const file = await handle.getFile();
         const bytes = new Uint8Array(await file.arrayBuffer());
-        return { bytes, version: `${file.lastModified}:${file.size}` };
+        return { bytes, version: `${file.lastModified}:${file.size}:${stamp}` };
       },
       false
     );
@@ -1391,8 +1444,9 @@ var OpfsFs = class {
     return this.retrying(
       path,
       async () => {
+        const stamp = await this.stamp(path);
         const file = await handle.getFile();
-        return `${file.lastModified}:${file.size}`;
+        return `${file.lastModified}:${file.size}:${stamp}`;
       },
       false
     );
@@ -1407,14 +1461,24 @@ var OpfsFs = class {
   }
   async pwrite(path, offset, bytes) {
     const [handle, , target] = await this.fileFor(path);
-    await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
+    await this.counting(target);
+    try {
+      await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
+    } finally {
+      await this.recounting(handle, target);
+    }
     this.written(target);
   }
   async truncate(path, size) {
     const handle = await this.existing(path, true);
     const resolve2 = this.ranged || this.remote?.watched();
-    const target = resolve2 ? (await this.locate(path, true)).path : path;
-    await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
+    const target = resolve2 || this.counted.length > 0 ? (await this.locate(path, true)).path : path;
+    await this.counting(target);
+    try {
+      await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
+    } finally {
+      await this.recounting(handle, target);
+    }
     this.written(target);
   }
   async writeSession(path, truncate) {
@@ -2339,7 +2403,9 @@ function id(value) {
   return value;
 }
 function changeCred(cur, change) {
-  if (typeof change !== "object" || change === null) throw fsError("EINVAL", "not a change");
+  if (typeof change !== "object" || change === null || Array.isArray(change)) {
+    throw fsError("EINVAL", "not a change");
+  }
   const privileged = cur.euid === 0;
   const next2 = copyCred(cur);
   for (const keys of [UIDS, GIDS]) {
@@ -11843,7 +11909,7 @@ function ptySyscall(req, ctx) {
       const pair = ctx.ptys.get(req.n);
       ttyOpenable(ctx.guard, pair.slave);
       const slave = pair.openSlave();
-      const fd = ctx.fds.install(ctx.ttyFilter?.(slave) ?? slave, 3);
+      const fd = ctx.fds.install(ctx.outputFilter?.(slave) ?? slave, 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
       return json4(fd);
     }
@@ -13009,8 +13075,8 @@ var WasmProcess = class {
         const { ptys, jobs } = this.options;
         const owner = this.options.owners ? this.ttyOwner() : void 0;
         const guard2 = this.guarded();
-        const { ttyFilter } = this.options;
-        const ctx = { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner, ttyFilter };
+        const { outputFilter } = this.options;
+        const ctx = { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner, outputFilter };
         return ptySyscall(req, ctx);
       }
       return await this.procSyscall(req, cancelled);
@@ -13187,7 +13253,7 @@ var WasmProcess = class {
     if (!tty) throw new KernelError("ENXIO");
     if (name2 !== void 0) ttyOpenable(this.guarded(), tty);
     const file = tty.file();
-    return this.fds.install(this.options.ttyFilter?.(file) ?? file, 3);
+    return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
   openSealed() {
     const broker = this.options.sealed;
@@ -13199,7 +13265,8 @@ var WasmProcess = class {
     if (!broker) throw new KernelError("ENOENT");
     const mode = flags2 & WRITE_ACCESS;
     const access2 = mode === 0 ? "read" : mode === 1 ? "write" : "both";
-    return this.fds.install(broker.open(access2, await this.clipboardStamp()), 3);
+    const file = broker.open(access2, await this.clipboardStamp());
+    return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
   async clipboardStamp() {
     const shown = await this.options.identity?.();
@@ -13998,7 +14065,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
-    ...opts.ttyFilter ? { ttyFilter: opts.ttyFilter } : {},
+    ...opts.outputFilter ? { outputFilter: opts.outputFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
@@ -15000,7 +15067,7 @@ function scrubStdio(fds, scrubber) {
   const stdio = stdioFiles(fds);
   for (const fd of fds.numbers()) {
     const original = fds.get(fd);
-    if (!stdio.has(original) && !original.file.tty) continue;
+    if (!stdio.has(original) && !original.file.tty && !original.file.clipboard) continue;
     const known = wrapped.get(original);
     const flags2 = fds.statusFlags(fd);
     const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
@@ -18079,7 +18146,7 @@ var Launcher = class {
       ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
-      ...scrubs ? { ttyFilter: (file) => scrubbedAll(file, scrubs) } : {},
+      ...scrubs ? { outputFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
@@ -18612,17 +18679,21 @@ var Launcher = class {
     const real = await this.realLayoutPath("/tmp");
     const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
     if (real !== void 0 && st?.isDirectory && this.base.hasOwner && !await this.base.hasOwner(real)) {
+      const names = await this.base.readdir(real).catch(() => void 0);
       let removed = 0;
-      for (const name2 of await this.base.readdir(real).catch(() => [])) {
+      let left = names === void 0 ? 1 : 0;
+      for (const name2 of names ?? []) {
         const path = joinName(real, name2);
-        if (await this.base.hasOwner(path) || this.inUse(path)) continue;
-        const failed3 = await this.base.rm(path, { recursive: true, force: true }).catch(String);
+        if (await this.base.hasOwner(path)) continue;
+        const failed3 = this.inUse(path) ? "busy" : await this.base.rm(path, { recursive: true, force: true }).catch(String);
         if (failed3 === void 0) removed++;
+        else left++;
       }
       if (removed > 0) {
         console.warn(`slicc-kernel users: removed ${removed} entries from /tmp that had no owner`);
       }
-      await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
+      if (left === 0)
+        await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
     }
     if (st?.isDirectory) await this.base.chmod(real, 1023);
   }
@@ -19075,7 +19146,12 @@ var USERS_OPS = /* @__PURE__ */ new Set([
   "groups-add-member",
   "groups-remove-member"
 ]);
-var ATTEST_OPS = /* @__PURE__ */ new Set(["attest", "watch-files", "unwatch-files"]);
+var ATTEST_OPS = /* @__PURE__ */ new Set([
+  "attest",
+  "watch-files",
+  "unwatch-files",
+  "chmod"
+]);
 function isAttestRequest(req) {
   return ATTEST_OPS.has(req.op);
 }
@@ -19091,6 +19167,7 @@ function attestOps(port) {
   const watches = /* @__PURE__ */ new Map();
   return async (l, req) => {
     if (req.op === "attest") return l.attest(req.path);
+    if (req.op === "chmod") return l.fs.chmod(req.path, modeOption(req.mode)).then(() => true);
     if (req.op === "unwatch-files") {
       watches.get(req.watch)?.();
       return watches.delete(req.watch);