@ai-ecoverse/slicc-kernel 1.86.0 → 1.87.0

package/dist/kernel-worker.js

@@ -2580,6 +2580,10 @@ var KernelError = class extends Error {
     if (detail !== void 0) this.detail = detail;
   }
 };
+function openAccess(flags2) {
+  const mode = flags2 & 3;
+  return mode === 0 ? "read" : mode === 1 ? "write" : "both";
+}
 function pollFile(file) {
   return file.poll?.() ?? { readable: !!file.read, writable: !!file.write, hangup: false };
 }
@@ -13255,17 +13259,15 @@ var WasmProcess = class {
     const file = tty.file();
     return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
-  openSealed() {
+  openSealed(flags2) {
     const broker = this.options.sealed;
     if (!broker) throw new KernelError("ENOENT");
-    return this.fds.install(broker.open(), 3);
+    return this.fds.install(broker.open(openAccess(flags2)), 3);
   }
   async openClipboard(flags2) {
     const broker = this.options.clipboard;
     if (!broker) throw new KernelError("ENOENT");
-    const mode = flags2 & WRITE_ACCESS;
-    const access2 = mode === 0 ? "read" : mode === 1 ? "write" : "both";
-    const file = broker.open(access2, await this.clipboardStamp());
+    const file = broker.open(openAccess(flags2), await this.clipboardStamp());
     return this.fds.install(this.options.outputFilter?.(file) ?? file, 3);
   }
   async clipboardStamp() {
@@ -13424,7 +13426,7 @@ var WasmProcess = class {
       case "fd-tty-names":
         return { ok: true, kind: "json", json: this.options.jobs?.terminalNames() ?? [] };
       case "fd-open-sealed":
-        return { ok: true, kind: "json", json: this.openSealed() };
+        return { ok: true, kind: "json", json: this.openSealed(req.flags) };
       case "fd-open-clipboard":
         return { ok: true, kind: "json", json: await this.openClipboard(req.flags) };
       case "fd-tty-owner":
@@ -15143,14 +15145,19 @@ var SealedChannel = class {
   offset = 0;
   inflight;
   broker;
-  constructor(broker) {
+  access;
+  constructor(broker, access2) {
     this.broker = broker;
+    this.access = access2;
   }
   send(bytes, caller, gone) {
+    if (this.access === "read") {
+      bytes.fill(0);
+      throw new KernelError("EBADF");
+    }
     const length2 = bytes.length;
     const fields = parseSealed(bytes);
-    this.reply = void 0;
-    this.offset = 0;
+    this.drop();
     this.inflight?.control.abort("replaced");
     const control = new AbortController();
     const withdraw = () => control.abort("withdrawn");
@@ -15186,15 +15193,18 @@ var SealedChannel = class {
     if (!signal.aborted) return reply;
     return signal.reason === "timeout" ? errorReply("ETIMEDOUT", "the vault did not answer within 10 s") : void 0;
   }
+  drop() {
+    this.reply?.fill(0);
+    this.reply = void 0;
+    this.offset = 0;
+  }
   async read(max, signal) {
+    if (this.access === "write") throw new KernelError("EBADF");
     for (; ; ) {
       if (this.reply) {
         const out = this.reply.slice(this.offset, this.offset + max);
         this.offset += out.length;
-        if (this.offset >= this.reply.length) {
-          this.reply = void 0;
-          this.offset = 0;
-        }
+        if (this.offset >= this.reply.length) this.drop();
         return out;
       }
       const flight = this.inflight;
@@ -15227,7 +15237,7 @@ var SealedChannel = class {
   close() {
     this.inflight?.control.abort("withdrawn");
     this.inflight = void 0;
-    this.reply = void 0;
+    this.drop();
   }
 };
 function swapOf(reply) {
@@ -15284,12 +15294,14 @@ var SealedBroker = class {
       control.abort("done");
     }
   }
-  open() {
-    const channel = new SealedChannel(this);
+  open(access2 = "both") {
+    const channel = new SealedChannel(this, access2);
     return new OpenFile({
-      read: (max, signal) => channel.read(max, signal),
-      write: async () => {
-        throw new KernelError("EINVAL");
+      ...access2 === "write" ? {} : { read: (max, signal) => channel.read(max, signal) },
+      ...access2 === "read" ? {} : {
+        write: async () => {
+          throw new KernelError("EINVAL");
+        }
       },
       poll: () => channel.poll(),
       changed: (signal) => channel.changed(signal),
@@ -16908,7 +16920,10 @@ var SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 var DEFAULT_SUDOERS = "%sudo Cmnd *\n";
 var SUDO_TIMEOUT_MS = 3e5;
 var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
-var RULE = /^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?Cmnd(?:\s+(.*))?$/;
+var WORD = String.raw`(?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|[^\s'"\\])+`;
+var RULE = new RegExp(
+  String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?(?:Cwd\s+(${WORD})\s+)?Cmnd(?:\s+(.*))?$`
+);
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
@@ -16943,17 +16958,25 @@ function validWho(who) {
   if (who === "ALL") return true;
   return NAME3.test(who.startsWith("%") ? who.slice(1) : who);
 }
+function cwdOf(word) {
+  const words2 = splitWords(word);
+  const path = words2?.length === 1 ? words2[0] : "";
+  return path.startsWith("/") ? normalizePath(path) : "";
+}
 function parseRule(line) {
   const text = line.trim();
   if (text === "" || text.startsWith("#")) return null;
   const m = RULE.exec(text);
   if (!m) return void 0;
-  const [, nopasswd, who = "", target = "root", rest2 = ""] = m;
+  const [, nopasswd, who = "", target = "root", dir, rest2 = ""] = m;
   if (!validWho(who) || target !== "ALL" && !NAME3.test(target)) return void 0;
-  if (rest2.trim() === "*") return { nopasswd: !!nopasswd, who, target, cmnd: "*" };
+  const cwd = dir === void 0 ? void 0 : cwdOf(dir);
+  if (cwd === "") return void 0;
+  const rule = { nopasswd: !!nopasswd, who, target, ...cwd !== void 0 ? { cwd } : {} };
+  if (rest2.trim() === "*") return { ...rule, cmnd: "*" };
   const cmnd = splitWords(rest2);
   if (!cmnd?.[0]?.startsWith("/")) return void 0;
-  return { nopasswd: !!nopasswd, who, target, cmnd };
+  return { ...rule, cmnd };
 }
 function flags(parsed2, arg, next2) {
   for (let j = 1; j < arg.length; j++) {
@@ -16992,7 +17015,8 @@ function parseArgs(args) {
 }
 function described(rule) {
   const cmnd = rule.cmnd === "*" ? "ALL" : rule.cmnd.map(quoteWord).join(" ");
-  return `    (${rule.target}) ${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
+  const cwd = rule.cwd === void 0 ? "" : `CWD=${quoteWord(rule.cwd)} `;
+  return `    (${rule.target}) ${cwd}${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
 }
 var Sudo = class {
   o;
@@ -17132,7 +17156,7 @@ var Sudo = class {
     if (untrusted) return untrusted;
     const argv = [path, ...args];
     const matching = rules.filter(
-      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
+      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
     );
     const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
@@ -17154,7 +17178,7 @@ var Sudo = class {
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer === "always" && !await this.remember(self, target, argv)) {
+      if (answer === "always" && !await this.remember(self, target, cwd, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
       return grant();
@@ -17219,7 +17243,7 @@ ${lines2}
       requester.removeEventListener("abort", withdraw);
     }
   }
-  async remember(self, target, argv) {
+  async remember(self, target, cwd, argv) {
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
     if (!NAME3.test(self.name)) return false;
@@ -17229,7 +17253,8 @@ ${lines2}
       const st = await fs.lstat(path).catch(() => void 0);
       if (st && !await this.trusted(path)) return false;
       const old = st ? await fs.readFile(path) : "";
-      const line = `NOPASSWD ${self.name} (${target.name}) Cmnd ${argv.map(quoteWord).join(" ")}
+      const words2 = argv.map(quoteWord).join(" ");
+      const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Cmnd ${words2}
 `;
       const text = old === "" || old.endsWith("\n") ? `${old}${line}` : `${old}
 ${line}`;