@ai-ecoverse/slicc-kernel 1.85.1 → 1.87.0

package/dist/kernel-worker.js

@@ -97,6 +97,9 @@ var MemoryMeta = class {
   async get(paths) {
     return paths.map((path) => this.entries.get(path));
   }
+  async fresh(path) {
+    return this.entries.get(path);
+  }
   async update(path, change) {
     this.set(path, change(this.entries.get(path)));
   }
@@ -193,6 +196,16 @@ var IndexedDbMeta = class {
     }
     return paths.map((path) => this.cache.get(path) ?? void 0);
   }
+  async fresh(path) {
+    const [transaction, store] = this.transaction("readonly");
+    const request2 = store.get(path);
+    let entry;
+    request2.onsuccess = () => {
+      entry = request2.result ?? void 0;
+    };
+    await settle(transaction, () => void 0);
+    return entry;
+  }
   async update(path, change) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
@@ -207,6 +220,19 @@ var IndexedDbMeta = class {
     this.changed({ paths: [path] });
     this.cache.set(path, next2 ?? null);
   }
+  async updateMany(changes) {
+    const [transaction, store] = this.transaction("readwrite");
+    for (const { path, change } of changes) {
+      const request2 = store.get(path);
+      request2.onsuccess = () => store.put(change(request2.result));
+    }
+    await settle(transaction, () => void 0);
+    this.changed({ paths: changes.map(({ path }) => path) });
+  }
+  close() {
+    this.channel.close();
+    this.db.close();
+  }
   async move(from, to, root) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
@@ -326,6 +352,12 @@ async function lutimesOf(fs, path, atime, mtime) {
 function mayLink(fs, path) {
   return fs.links?.(path) ?? true;
 }
+function modeOption(mode) {
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
+    throw fsError("EINVAL", `not a mode: ${String(mode)}`);
+  }
+  return mode;
+}
 function fsError(code, path) {
   return Object.assign(new Error(`${code}: ${path}`), { code });
 }
@@ -857,7 +889,8 @@ function sidecar(meta) {
   const guarded2 = (op) => (...args) => meta[op].apply(meta, args).catch((err) => {
     throw translate(err, pathOf(args), "sidecar", false);
   });
-  const ops = Object.fromEntries(META_OPS.map((op) => [op, guarded2(op)]));
+  const names = meta.fresh ? [...META_OPS, "fresh"] : META_OPS;
+  const ops = Object.fromEntries(names.map((op) => [op, guarded2(op)]));
   if (meta.absent) ops.absent = meta.absent.bind(meta);
   const { removeFile } = meta;
   if (removeFile)
@@ -985,6 +1018,24 @@ var OpfsFs = class {
   committed(target) {
     if (this.remote?.watched()) this.remote.wrote(target);
   }
+  counted = [];
+  async stamp(path) {
+    const entry = this.meta.fresh ? await this.meta.fresh(path) : (await this.meta.get([path]))[0];
+    return String(entry?.writes ?? 0);
+  }
+  async counting(target) {
+    if (!isProtected(this.counted, target)) return;
+    await this.meta.update(target, (entry) => ({
+      ...entry,
+      path: target,
+      writes: (entry?.writes ?? 0) + 1
+    }));
+  }
+  async recounting(handle, target) {
+    if (this.counted.length === 0) return;
+    const where = await this.root.resolve(handle).catch(() => null);
+    await this.counting(where ? `/${where.join("/")}` : target);
+  }
   resolvePath(base, path) {
     return resolvePath(base, path);
   }
@@ -1043,6 +1094,7 @@ var OpfsFs = class {
   guarded = [];
   protect(prefixes2) {
     this.guarded = prefixes2;
+    this.counted = prefixes2;
   }
   unguarded() {
     return Object.create(this, { guarded: { value: [] } });
@@ -1379,9 +1431,10 @@ var OpfsFs = class {
     return this.retrying(
       path,
       async () => {
+        const stamp = await this.stamp(path);
         const file = await handle.getFile();
         const bytes = new Uint8Array(await file.arrayBuffer());
-        return { bytes, version: `${file.lastModified}:${file.size}` };
+        return { bytes, version: `${file.lastModified}:${file.size}:${stamp}` };
       },
       false
     );
@@ -1391,8 +1444,9 @@ var OpfsFs = class {
     return this.retrying(
       path,
       async () => {
+        const stamp = await this.stamp(path);
         const file = await handle.getFile();
-        return `${file.lastModified}:${file.size}`;
+        return `${file.lastModified}:${file.size}:${stamp}`;
       },
       false
     );
@@ -1407,14 +1461,24 @@ var OpfsFs = class {
   }
   async pwrite(path, offset, bytes) {
     const [handle, , target] = await this.fileFor(path);
-    await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
+    await this.counting(target);
+    try {
+      await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
+    } finally {
+      await this.recounting(handle, target);
+    }
     this.written(target);
   }
   async truncate(path, size) {
     const handle = await this.existing(path, true);
     const resolve2 = this.ranged || this.remote?.watched();
-    const target = resolve2 ? (await this.locate(path, true)).path : path;
-    await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
+    const target = resolve2 || this.counted.length > 0 ? (await this.locate(path, true)).path : path;
+    await this.counting(target);
+    try {
+      await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
+    } finally {
+      await this.recounting(handle, target);
+    }
     this.written(target);
   }
   async writeSession(path, truncate) {
@@ -2339,7 +2403,9 @@ function id(value) {
   return value;
 }
 function changeCred(cur, change) {
-  if (typeof change !== "object" || change === null) throw fsError("EINVAL", "not a change");
+  if (typeof change !== "object" || change === null || Array.isArray(change)) {
+    throw fsError("EINVAL", "not a change");
+  }
   const privileged = cur.euid === 0;
   const next2 = copyCred(cur);
   for (const keys of [UIDS, GIDS]) {
@@ -2514,6 +2580,10 @@ var KernelError = class extends Error {
     if (detail !== void 0) this.detail = detail;
   }
 };
+function openAccess(flags2) {
+  const mode = flags2 & 3;
+  return mode === 0 ? "read" : mode === 1 ? "write" : "both";
+}
 function pollFile(file) {
   return file.poll?.() ?? { readable: !!file.read, writable: !!file.write, hangup: false };
 }
@@ -13189,17 +13259,15 @@ var WasmProcess = class {
     const file = tty.file();
     return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
-  openSealed() {
+  openSealed(flags2) {
     const broker = this.options.sealed;
     if (!broker) throw new KernelError("ENOENT");
-    return this.fds.install(broker.open(), 3);
+    return this.fds.install(broker.open(openAccess(flags2)), 3);
   }
   async openClipboard(flags2) {
     const broker = this.options.clipboard;
     if (!broker) throw new KernelError("ENOENT");
-    const mode = flags2 & WRITE_ACCESS;
-    const access2 = mode === 0 ? "read" : mode === 1 ? "write" : "both";
-    const file = broker.open(access2, await this.clipboardStamp());
+    const file = broker.open(openAccess(flags2), await this.clipboardStamp());
     return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
   async clipboardStamp() {
@@ -13358,7 +13426,7 @@ var WasmProcess = class {
       case "fd-tty-names":
         return { ok: true, kind: "json", json: this.options.jobs?.terminalNames() ?? [] };
       case "fd-open-sealed":
-        return { ok: true, kind: "json", json: this.openSealed() };
+        return { ok: true, kind: "json", json: this.openSealed(req.flags) };
       case "fd-open-clipboard":
         return { ok: true, kind: "json", json: await this.openClipboard(req.flags) };
       case "fd-tty-owner":
@@ -15077,14 +15145,19 @@ var SealedChannel = class {
   offset = 0;
   inflight;
   broker;
-  constructor(broker) {
+  access;
+  constructor(broker, access2) {
     this.broker = broker;
+    this.access = access2;
   }
   send(bytes, caller, gone) {
+    if (this.access === "read") {
+      bytes.fill(0);
+      throw new KernelError("EBADF");
+    }
     const length2 = bytes.length;
     const fields = parseSealed(bytes);
-    this.reply = void 0;
-    this.offset = 0;
+    this.drop();
     this.inflight?.control.abort("replaced");
     const control = new AbortController();
     const withdraw = () => control.abort("withdrawn");
@@ -15120,15 +15193,18 @@ var SealedChannel = class {
     if (!signal.aborted) return reply;
     return signal.reason === "timeout" ? errorReply("ETIMEDOUT", "the vault did not answer within 10 s") : void 0;
   }
+  drop() {
+    this.reply?.fill(0);
+    this.reply = void 0;
+    this.offset = 0;
+  }
   async read(max, signal) {
+    if (this.access === "write") throw new KernelError("EBADF");
     for (; ; ) {
       if (this.reply) {
         const out = this.reply.slice(this.offset, this.offset + max);
         this.offset += out.length;
-        if (this.offset >= this.reply.length) {
-          this.reply = void 0;
-          this.offset = 0;
-        }
+        if (this.offset >= this.reply.length) this.drop();
         return out;
       }
       const flight = this.inflight;
@@ -15161,7 +15237,7 @@ var SealedChannel = class {
   close() {
     this.inflight?.control.abort("withdrawn");
     this.inflight = void 0;
-    this.reply = void 0;
+    this.drop();
   }
 };
 function swapOf(reply) {
@@ -15218,12 +15294,14 @@ var SealedBroker = class {
       control.abort("done");
     }
   }
-  open() {
-    const channel = new SealedChannel(this);
+  open(access2 = "both") {
+    const channel = new SealedChannel(this, access2);
     return new OpenFile({
-      read: (max, signal) => channel.read(max, signal),
-      write: async () => {
-        throw new KernelError("EINVAL");
+      ...access2 === "write" ? {} : { read: (max, signal) => channel.read(max, signal) },
+      ...access2 === "read" ? {} : {
+        write: async () => {
+          throw new KernelError("EINVAL");
+        }
       },
       poll: () => channel.poll(),
       changed: (signal) => channel.changed(signal),
@@ -16842,7 +16920,10 @@ var SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 var DEFAULT_SUDOERS = "%sudo Cmnd *\n";
 var SUDO_TIMEOUT_MS = 3e5;
 var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
-var RULE = /^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?Cmnd(?:\s+(.*))?$/;
+var WORD = String.raw`(?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|[^\s'"\\])+`;
+var RULE = new RegExp(
+  String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?(?:Cwd\s+(${WORD})\s+)?Cmnd(?:\s+(.*))?$`
+);
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
@@ -16877,17 +16958,25 @@ function validWho(who) {
   if (who === "ALL") return true;
   return NAME3.test(who.startsWith("%") ? who.slice(1) : who);
 }
+function cwdOf(word) {
+  const words2 = splitWords(word);
+  const path = words2?.length === 1 ? words2[0] : "";
+  return path.startsWith("/") ? normalizePath(path) : "";
+}
 function parseRule(line) {
   const text = line.trim();
   if (text === "" || text.startsWith("#")) return null;
   const m = RULE.exec(text);
   if (!m) return void 0;
-  const [, nopasswd, who = "", target = "root", rest2 = ""] = m;
+  const [, nopasswd, who = "", target = "root", dir, rest2 = ""] = m;
   if (!validWho(who) || target !== "ALL" && !NAME3.test(target)) return void 0;
-  if (rest2.trim() === "*") return { nopasswd: !!nopasswd, who, target, cmnd: "*" };
+  const cwd = dir === void 0 ? void 0 : cwdOf(dir);
+  if (cwd === "") return void 0;
+  const rule = { nopasswd: !!nopasswd, who, target, ...cwd !== void 0 ? { cwd } : {} };
+  if (rest2.trim() === "*") return { ...rule, cmnd: "*" };
   const cmnd = splitWords(rest2);
   if (!cmnd?.[0]?.startsWith("/")) return void 0;
-  return { nopasswd: !!nopasswd, who, target, cmnd };
+  return { ...rule, cmnd };
 }
 function flags(parsed2, arg, next2) {
   for (let j = 1; j < arg.length; j++) {
@@ -16926,7 +17015,8 @@ function parseArgs(args) {
 }
 function described(rule) {
   const cmnd = rule.cmnd === "*" ? "ALL" : rule.cmnd.map(quoteWord).join(" ");
-  return `    (${rule.target}) ${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
+  const cwd = rule.cwd === void 0 ? "" : `CWD=${quoteWord(rule.cwd)} `;
+  return `    (${rule.target}) ${cwd}${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
 }
 var Sudo = class {
   o;
@@ -17066,7 +17156,7 @@ var Sudo = class {
     if (untrusted) return untrusted;
     const argv = [path, ...args];
     const matching = rules.filter(
-      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
+      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
     );
     const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
@@ -17088,7 +17178,7 @@ var Sudo = class {
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer === "always" && !await this.remember(self, target, argv)) {
+      if (answer === "always" && !await this.remember(self, target, cwd, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
       return grant();
@@ -17153,7 +17243,7 @@ ${lines2}
       requester.removeEventListener("abort", withdraw);
     }
   }
-  async remember(self, target, argv) {
+  async remember(self, target, cwd, argv) {
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
     if (!NAME3.test(self.name)) return false;
@@ -17163,7 +17253,8 @@ ${lines2}
       const st = await fs.lstat(path).catch(() => void 0);
       if (st && !await this.trusted(path)) return false;
       const old = st ? await fs.readFile(path) : "";
-      const line = `NOPASSWD ${self.name} (${target.name}) Cmnd ${argv.map(quoteWord).join(" ")}
+      const words2 = argv.map(quoteWord).join(" ");
+      const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Cmnd ${words2}
 `;
       const text = old === "" || old.endsWith("\n") ? `${old}${line}` : `${old}
 ${line}`;
@@ -18613,17 +18704,21 @@ var Launcher = class {
     const real = await this.realLayoutPath("/tmp");
     const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
     if (real !== void 0 && st?.isDirectory && this.base.hasOwner && !await this.base.hasOwner(real)) {
+      const names = await this.base.readdir(real).catch(() => void 0);
       let removed = 0;
-      for (const name2 of await this.base.readdir(real).catch(() => [])) {
+      let left = names === void 0 ? 1 : 0;
+      for (const name2 of names ?? []) {
         const path = joinName(real, name2);
-        if (await this.base.hasOwner(path) || this.inUse(path)) continue;
-        const failed3 = await this.base.rm(path, { recursive: true, force: true }).catch(String);
+        if (await this.base.hasOwner(path)) continue;
+        const failed3 = this.inUse(path) ? "busy" : await this.base.rm(path, { recursive: true, force: true }).catch(String);
         if (failed3 === void 0) removed++;
+        else left++;
       }
       if (removed > 0) {
         console.warn(`slicc-kernel users: removed ${removed} entries from /tmp that had no owner`);
       }
-      await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
+      if (left === 0)
+        await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
     }
     if (st?.isDirectory) await this.base.chmod(real, 1023);
   }
@@ -19076,7 +19171,12 @@ var USERS_OPS = /* @__PURE__ */ new Set([
   "groups-add-member",
   "groups-remove-member"
 ]);
-var ATTEST_OPS = /* @__PURE__ */ new Set(["attest", "watch-files", "unwatch-files"]);
+var ATTEST_OPS = /* @__PURE__ */ new Set([
+  "attest",
+  "watch-files",
+  "unwatch-files",
+  "chmod"
+]);
 function isAttestRequest(req) {
   return ATTEST_OPS.has(req.op);
 }
@@ -19092,6 +19192,7 @@ function attestOps(port) {
   const watches = /* @__PURE__ */ new Map();
   return async (l, req) => {
     if (req.op === "attest") return l.attest(req.path);
+    if (req.op === "chmod") return l.fs.chmod(req.path, modeOption(req.mode)).then(() => true);
     if (req.op === "unwatch-files") {
       watches.get(req.watch)?.();
       return watches.delete(req.watch);