@ai-ecoverse/slicc-kernel 1.89.0 → 1.90.0

package/dist/kernel-worker.js

@@ -2052,7 +2052,7 @@ function portCdpHook(ask, gone) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 10];
+var PROTOCOL = [1, 11];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -2083,6 +2083,52 @@ function fresh(bytes, start2 = 0, end = bytes.length) {
   return new Uint8Array(bytes.subarray(start2, end));
 }
 
+// src/facade/port.ts
+var FACADE_GONE = "the facade host is gone";
+function portFacadeHook(ask, gone) {
+  return (stamp, { name: name2 }) => new Promise((resolve2, reject) => {
+    const { port1, port2 } = new MessageChannel();
+    let closed = false;
+    const shut = () => {
+      closed = true;
+      port1.close();
+    };
+    const conn = {
+      send: (bytes) => {
+        if (closed) return;
+        const copy = bytes.slice();
+        port1.postMessage({ b: copy }, [copy.buffer]);
+      },
+      onmessage: null,
+      onclose: null,
+      close: (reason) => {
+        if (closed) return;
+        port1.postMessage({ close: reason ?? true });
+        shut();
+      }
+    };
+    port1.addEventListener("message", ({ data }) => {
+      if ("b" in data) conn.onmessage?.(data.b);
+      else if ("open" in data) resolve2(conn);
+      else if ("error" in data) {
+        shut();
+        reject(new Error(data.error));
+      } else if (!closed) {
+        shut();
+        conn.onclose?.();
+      }
+    });
+    port1.start();
+    void gone?.then(() => {
+      if (closed) return;
+      shut();
+      reject(new Error(FACADE_GONE));
+      conn.onclose?.(FACADE_GONE);
+    });
+    ask({ name: name2, stamp }, port2);
+  });
+}
+
 // src/fs/walk.ts
 var MAX_LINKS3 = 40;
 function parentOf4(path) {
@@ -3137,6 +3183,7 @@ var KernelSocket = class _KernelSocket {
   local;
   peer;
   peerCred;
+  peerStamp;
   listenerCred;
   link;
   readShut = false;
@@ -3207,10 +3254,10 @@ var KernelSocket = class _KernelSocket {
     for (const wait2 of waits) wait2.catch(() => void 0);
     return pipeCall(() => Promise.race(waits));
   }
-  bind(addr) {
+  bind(addr, kernel = false) {
     if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    this.local = this.net.bind(this, addr);
+    this.local = this.net.bind(this, addr, kernel);
     this.boundAt = this.local;
   }
   listen(backlog, cred) {
@@ -3239,7 +3286,7 @@ var KernelSocket = class _KernelSocket {
     this.changes.wake();
     return true;
   }
-  connect(addr, viaUplink = true, cred) {
+  connect(addr, viaUplink = true, cred, stamp) {
     if (this.state === "connected") throw new KernelError("EISCONN");
     if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
@@ -3258,6 +3305,7 @@ var KernelSocket = class _KernelSocket {
     server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
     server.peer = this.local;
     server.peerCred = cred;
+    server.peerStamp = stamp;
     this.peer = server.local;
     this.peerCred = target.listenerCred;
     link(this, server);
@@ -3398,6 +3446,8 @@ var LoopbackNet = class {
   bound = /* @__PURE__ */ new Map();
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
+  reserved = /* @__PURE__ */ new Set();
+  facades = /* @__PURE__ */ new Map();
   nextEphemeral = EPHEMERAL_FIRST;
   route;
   useUplink(route) {
@@ -3412,6 +3462,18 @@ var LoopbackNet = class {
     if (reserve) this.internal.add(port);
     return this.internal.has(port);
   }
+  reserve(port) {
+    this.reserved.add(port);
+  }
+  facade(port, name2) {
+    this.reserve(port);
+    this.kernelOnly(port, true);
+    this.facades.set(port, name2);
+  }
+  facadeAt(addr) {
+    if (addr.family !== "inet" || !isLoopback(canonicalHost(addr.host))) return void 0;
+    return this.facades.get(addr.port);
+  }
   activate(addr, start2) {
     this.activators.set(keyOf(addr), start2);
   }
@@ -3420,7 +3482,7 @@ var LoopbackNet = class {
   }
   listen(addr, backlog = 128) {
     const socket = this.socket(addr.family);
-    socket.bind(addr);
+    socket.bind(addr, true);
     socket.listen(backlog);
     return socket;
   }
@@ -3429,11 +3491,13 @@ var LoopbackNet = class {
     void socket.connect(addr, false);
     return socket;
   }
-  bind(socket, addr) {
+  bind(socket, addr, kernel = false) {
     if (addr.family === "unix") {
       if (addr.path === "") throw new KernelError("EINVAL");
     } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
       throw new KernelError("EADDRNOTAVAIL");
+    } else if (!kernel && this.reserved.has(addr.port)) {
+      throw new KernelError("EADDRINUSE");
     }
     const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
     const key = keyOf(named);
@@ -3460,7 +3524,7 @@ var LoopbackNet = class {
     for (let i = 0; i < span; i++) {
       const port = this.nextEphemeral;
       this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
-      if (!this.bound.has(`inet:${port}`)) return port;
+      if (!this.bound.has(`inet:${port}`) && !this.reserved.has(port)) return port;
     }
     throw new KernelError("EADDRINUSE");
   }
@@ -3756,12 +3820,12 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
       }
       sockets.set(call.nid, socket);
       peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
-      void relay(call.nid, socket);
+      void relay2(call.nid, socket);
     } catch (e) {
       fail2(call.nid, e);
     }
   };
-  const relay = async (nid, socket) => {
+  const relay2 = async (nid, socket) => {
     let ending;
     let late;
     const unanswered = new Promise((resolve2) => {
@@ -4395,6 +4459,45 @@ function cdpRegistry(send, gone) {
     }
   };
 }
+function facadeRegistry(send, gone) {
+  const registered = /* @__PURE__ */ new Map();
+  const drop = (id2) => {
+    registered.get(id2)?.();
+    return registered.delete(id2);
+  };
+  return {
+    serve(l, req) {
+      const hook = portFacadeHook(
+        (request2, facade) => send({ facadeOpen: { ...request2, registration: req.id }, port: facade }, [
+          facade
+        ]),
+        gone
+      );
+      registered.set(req.id, l.facades.register(req.name, hook));
+      return req.id;
+    },
+    drop,
+    close: () => {
+      for (const id2 of [...registered.keys()]) drop(id2);
+    }
+  };
+}
+function hostRegistries(send, gone) {
+  const cdps = cdpRegistry(send, gone);
+  const facades = facadeRegistry(send, gone);
+  return {
+    answer(l, req) {
+      if (req.op === "serve-cdp") return cdps.serve(l, req);
+      if (req.op === "unserve-cdp") return cdps.drop(req.registration);
+      if (req.op === "serve-facade") return facades.serve(l, req);
+      return facades.drop(req.registration);
+    },
+    close() {
+      cdps.close();
+      facades.close();
+    }
+  };
+}
 function visibleTo(g, notify) {
   if (!g?.dac.enforcing) return notify;
   let queue = Promise.resolve();
@@ -4438,7 +4541,7 @@ function serveClient(port, host) {
     if (state !== "closed") port.postMessage(message3, transfer);
   };
   const reply = (id2, body, transfer) => send({ id: id2, ...body }, transfer);
-  const cdps = cdpRegistry(send, ended.promise);
+  const hosts = hostRegistries(send, ended.promise);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
     send({ bye });
@@ -4446,7 +4549,7 @@ function serveClient(port, host) {
     net?.close();
     for (const unwatch of watches.values()) unwatch();
     watches.clear();
-    cdps.close();
+    hosts.close();
     for (const session of terminals.values()) session.close();
     terminals.clear();
     if (kill) killGroups(host, [...groups]);
@@ -4543,16 +4646,16 @@ function serveClient(port, host) {
       case "mount":
         return { result: await l.mountAs(clientCred(self), req.spec) };
       case "umount":
-        await l.umountAs(clientCred(self), req.target);
-        return { result: true };
+        return { result: await l.umountAs(clientCred(self), req.target).then(() => true) };
       case "mounts":
         return { result: l.mounts.list() };
       case "dial":
         return dialFor(l, req, watches);
       case "serve-cdp":
-        return { result: cdps.serve(l, req) };
       case "unserve-cdp":
-        return { result: cdps.drop(req.registration) };
+      case "serve-facade":
+      case "unserve-facade":
+        return { result: hosts.answer(l, req) };
       case "detach":
         return { result: true };
       default:
@@ -7127,6 +7230,7 @@ var Relay = class {
 function enableCdp(net, hosts) {
   let facade;
   net.kernelOnly(CDP_PORT, true);
+  net.reserve(CDP_PORT);
   net.activate({ family: "inet", host: "127.0.0.1", port: CDP_PORT }, () => {
     const started = new CdpFacade({ net, hosts });
     facade = started;
@@ -7441,9 +7545,9 @@ async function scanFilesystems(fs, modules) {
     } catch {
       continue;
     }
-    const declared = manifest.slicc?.filesystems;
-    if (!declared || typeof declared !== "object") continue;
-    for (const [type, entry] of Object.entries(declared)) {
+    const declared2 = manifest.slicc?.filesystems;
+    if (!declared2 || typeof declared2 !== "object") continue;
+    for (const [type, entry] of Object.entries(declared2)) {
       const module = inside(pkg, entry?.module);
       if (NAME2.test(type) && module && !found.has(type)) found.set(type, module);
     }
@@ -7461,9 +7565,9 @@ async function scanBinfmts(fs, modules, warn = () => {
     } catch {
       continue;
     }
-    const declared = manifest.slicc?.binfmt;
-    if (!declared || typeof declared !== "object") continue;
-    for (const [suffix, command] of Object.entries(declared)) {
+    const declared2 = manifest.slicc?.binfmt;
+    if (!declared2 || typeof declared2 !== "object") continue;
+    for (const [suffix, command] of Object.entries(declared2)) {
       if (!SUFFIX.test(suffix) || typeof command !== "string" || !NAME2.test(command)) continue;
       const owner = owners.get(suffix);
       if (owner === void 0) {
@@ -7493,6 +7597,132 @@ function binfmtOf(binfmts, path) {
   return best === void 0 ? void 0 : binfmts.get(best);
 }
 
+// src/facade/types.ts
+var FACADE_NAME = /^[a-z][a-z0-9-]*$/;
+function facadeEnvName(name2) {
+  return `SLICC_${name2.toUpperCase().replaceAll("-", "_")}_URL`;
+}
+function facadeUrl(port) {
+  return `tcp://127.0.0.1:${port}`;
+}
+
+// src/facade/hosts.ts
+var TAKEN_PORTS = /* @__PURE__ */ new Set([CDP_PORT, REALM_PROXY_PORT]);
+var READ_CHUNK = 64 * 1024;
+var FACADE_MAX_PENDING = 16 * 1024 * 1024;
+var FACADE_FLOODED = `slicc-kernel: more than ${FACADE_MAX_PENDING} bytes are waiting for the program to read`;
+function declared(specs) {
+  const out = /* @__PURE__ */ new Map();
+  const ports = /* @__PURE__ */ new Set();
+  for (const [name2, spec] of Object.entries(specs ?? {})) {
+    if (!FACADE_NAME.test(name2)) throw new TypeError(`facades: not a facade name: ${name2}`);
+    const port = spec?.port;
+    if (!Number.isInteger(port) || port < 1 || port > 65535 || TAKEN_PORTS.has(port)) {
+      throw new TypeError(`facades.${name2}: not a free port: ${String(port)}`);
+    }
+    if (ports.has(port)) throw new TypeError(`facades.${name2}: port ${port} is taken twice`);
+    if (spec.hook !== void 0 && typeof spec.hook !== "function") {
+      throw new TypeError(`facades.${name2}: hook must be a function`);
+    }
+    ports.add(port);
+    out.set(name2, { port, embedder: spec.hook, clients: [] });
+  }
+  return out;
+}
+var FacadeHosts = class {
+  facades;
+  constructor(specs) {
+    this.facades = declared(specs);
+  }
+  env() {
+    const env = {};
+    for (const [name2, { port }] of this.facades) env[facadeEnvName(name2)] = facadeUrl(port);
+    return env;
+  }
+  enable(net) {
+    for (const [name2, { port }] of this.facades) {
+      net.facade(port, name2);
+      net.activate({ family: "inet", host: "127.0.0.1", port }, () => {
+        const listener = net.listen({ family: "inet", host: "127.0.0.1", port });
+        void acceptAll(listener, (socket) => this.serve(name2, socket));
+      });
+    }
+  }
+  register(name2, hook) {
+    const entry = this.facades.get(name2);
+    if (!entry || typeof hook !== "function") throw new KernelError("EINVAL");
+    entry.clients.push(hook);
+    return () => {
+      const at = entry.clients.indexOf(hook);
+      if (at >= 0) entry.clients.splice(at, 1);
+    };
+  }
+  async serve(name2, socket) {
+    const entry = this.facades.get(name2);
+    const hook = entry.clients.at(-1) ?? entry.embedder;
+    const stamp = socket.peerStamp;
+    if (!hook || !stamp) return socket.close();
+    let conn;
+    try {
+      conn = await hook(structuredClone(stamp), { name: name2 });
+    } catch {
+      return socket.close();
+    }
+    await relay(socket, conn);
+  }
+};
+async function acceptAll(listener, serve) {
+  for (; ; ) {
+    const socket = await listener.accept();
+    void serve(socket);
+  }
+}
+async function relay(socket, conn) {
+  let ended = false;
+  let pending = 0;
+  let writes = Promise.resolve();
+  const end = () => {
+    if (ended) return;
+    ended = true;
+    socket.close();
+  };
+  conn.onmessage = (bytes) => {
+    if (ended) return;
+    const chunk2 = bytes.slice();
+    pending += chunk2.length;
+    if (pending > FACADE_MAX_PENDING) {
+      end();
+      conn.close(FACADE_FLOODED);
+      return;
+    }
+    writes = writes.then(async () => {
+      if (ended) return;
+      let at = 0;
+      while (at < chunk2.length) at += await socket.write(chunk2.subarray(at));
+      pending -= chunk2.length;
+    });
+    writes.catch(() => {
+      end();
+      conn.close();
+    });
+  };
+  conn.onclose = () => {
+    writes.then(end, end);
+  };
+  try {
+    for (; ; ) {
+      const bytes = await socket.read(READ_CHUNK);
+      if (bytes.length === 0 || ended) break;
+      conn.send(bytes);
+    }
+  } catch {
+  }
+  if (!ended) {
+    end();
+    conn.close();
+  }
+}
+
 // src/fs/attest.ts
 var ATTEST_MAX = 1024 * 1024;
 var UNOWNED = 1e3;
@@ -10849,7 +11079,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.89.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.90.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12489,7 +12719,9 @@ async function socketSyscall(req, proc) {
     case "sock-accept":
       return ok(await accept(proc, req.fd, req.nonblock));
     case "sock-connect": {
-      const dialing = socketAt(fds, req.fd).connect(req.addr, true, proc.cred?.());
+      const socket = socketAt(fds, req.fd);
+      const stamp = net.facadeAt(req.addr) && await proc.stamp?.();
+      const dialing = socket.connect(req.addr, true, proc.cred?.(), stamp || void 0);
       if (req.nonblock) {
         dialing?.catch(() => void 0);
         throw new KernelError("EINPROGRESS");
@@ -13668,6 +13900,9 @@ var WasmProcess = class {
       if (channel) channel.stamp = stamp;
     }
   }
+  connectorStamp() {
+    return this.sealedCaller();
+  }
   async sealedCaller() {
     const shown = await this.options.identity?.();
     const broker = this.options.sealed;
@@ -14006,7 +14241,8 @@ var WasmProcess = class {
       net: this.net,
       blocking: () => this.blockingSignal(cancelled),
       resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking),
-      cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid })
+      cred: () => ({ pid: this.pid, uid: this.cred.euid, gid: this.cred.egid }),
+      stamp: () => this.connectorStamp()
     });
   }
   tty(fd) {
@@ -18010,6 +18246,7 @@ var Launcher = class {
   );
   net = new LoopbackNet();
   cdp;
+  facades;
   ca;
   transport;
   uplink;
@@ -18084,10 +18321,16 @@ var Launcher = class {
     this.modulesDir = options.modules ?? "/node_modules";
     this.appended = appendedRoots(options.commands);
     this.cdp = new CdpHosts(options.cdp);
+    this.facades = new FacadeHosts(options.facades);
     const hostname = options.hostname ?? DEFAULT_HOSTNAME;
     if (!isHostname(hostname)) throw new Error(`not a host name: ${String(hostname)}`);
     this.hostname = hostname;
-    this.env = { ...networkEnv(hostname), SLICC_CDP_URL: this.cdp.url, ...options.env };
+    this.env = {
+      ...networkEnv(hostname),
+      SLICC_CDP_URL: this.cdp.url,
+      ...this.facades.env(),
+      ...options.env
+    };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = replayingHops(options.transport ?? missingTransport());
     this.announcedTraits = JSON.stringify(this.transport.traits);
@@ -18102,6 +18345,7 @@ var Launcher = class {
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
+    this.facades.enable(this.net);
     const fs = withCommandDirs(
       this.base,
       async () => new Set((await this.commands()).keys()),
@@ -19035,6 +19279,9 @@ var Launcher = class {
       }
     };
   }
+  connectorStamp(pid) {
+    return this.sealed.stamp(this.identityOf(pid), this.credOf(pid), this.tagOf(pid));
+  }
   identityOf(pid) {
     const parent = this.jobs.shownParent(pid);
     const alive = parent !== void 0 && this.running(parent);
@@ -19706,6 +19953,20 @@ function cdpOption(req, port) {
     )
   };
 }
+function pageHooks(req, port) {
+  return { ...cdpOption(req, port), ...facadesOption(req, port) };
+}
+function facadesOption(req, port) {
+  if (!req.facades) return {};
+  const hook = portFacadeHook(
+    (request2, facade) => port.postMessage({ facadeOpen: request2, port: facade }, [facade])
+  );
+  const facades = {};
+  for (const [name2, spec] of Object.entries(req.facades)) {
+    facades[name2] = { port: spec.port, ...spec.hook ? { hook } : {} };
+  }
+  return { facades };
+}
 function remotes(port, req) {
   return {
     ...req.transport ? { transport: new RemoteTransport(port, req.transport) } : {},
@@ -19919,7 +20180,7 @@ function serveKernel(port, deps) {
         ...media ? { media } : {},
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
-        ...cdpOption(req, port),
+        ...pageHooks(req, port),
         ...mountPolicy(req.processMounts),
         caStore: caStore(deps.metadata ? caDb(req) : false)
       });