@ai-ecoverse/slicc-kernel 1.93.0 → 1.93.1

package/README.md

@@ -161,6 +161,8 @@ Page-only: neither is on an attached client (`attachKernel`, `connect()`), so no
   - A change is a write, a truncate, a rename, a removal, or a change of mode, owner or times of the file or of any directory above it. A change to a parent directory's own metadata counts too, and creating or removing a sibling changes it when the change comes from another kernel.
   - It sees changes made through any slicc kernel on the origin, in this tab or another one: the kernels tell each other which files are watched and report writes to those. `watch` resolves once every other live kernel on the origin has the watch (a kernel that doesn't answer within 500 ms is not waited for), so a write made after it resolves is reported. A kernel that ends with watches still on is forgotten (by its Web Lock) at the next reported write or unanswered announcement. This needs the shared metadata (the default): with `metadata: false` a kernel sees only its own changes. It doesn't see writes made with the OPFS API outside a kernel, such as a page script or an installer writing the root directly. After such a write the page should attest again itself (and may also attest on tab focus, as a safety net).
   - The cost when no kernel on the origin watches anything is one empty-set check per write.
+  - **A kernel that starts late:** a kernel learns the other kernels' watched files only when they answer its greeting, one message round trip (usually milliseconds) after it starts. A write it makes before then isn't reported. A consumer that must not miss a change checks again (attests) after its first report.
+  - **Trust:** the kernels coordinate over a `BroadcastChannel`, which every same-origin context can post to. A script on the origin can fake an acknowledgement, so `watch` resolves before another kernel really has it, clear a kernel's watched files, or report changes that didn't happen. That is the same boundary as a direct OPFS write, which `watch` doesn't see either. Treat `watch` as an invalidation signal only, never as proof: attest again before each use that matters, as the vault and bios do.
 
 ### `attachKernel(port, options?) → Promise<KernelClient>`
 
@@ -618,7 +620,7 @@ Lowering a soft resource limit (`ulimit -S -n 64`) still fails with `EPERM` in E
 Every process has credentials in the kernel, as on Linux: real, effective and saved user and group ids, and supplementary groups. A process gets them from the user it was started as (`run`, `openTerminal`, a client's `spawn`, or the client's own user; root by default) and keeps its parent's across fork, spawn and exec. Setuid and setgid bits are never honoured on exec. Files may have owners (see [File owners](#file-owners)), checked against the credentials with `users: 'enforce'` (see [Permissions](#permissions)); the credentials also decide who may signal whom, and what `/proc` and `ps` show.
 
 - **The database:** `/etc/passwd` and `/etc/group` are real files. On first start the kernel writes them when they're missing, with `root` (uid 0, home `/root`, created `0700`) and `nobody` (65534), and the groups `root`, `sudo` (27), `users` (100) and `nogroup` (65534); files already there are kept as they are. The kernel reads them for every lookup, so an edit counts at once. [`kernel.users`](#kernelusers) adds and removes users.
-- **Environment:** a process started as a user gets `HOME`, `USER`, `LOGNAME`, `PNPM_HOME`, `NPM_CONFIG_PREFIX` and `PATH`. A user's `PNPM_HOME` is `~/.local/share/pnpm` and its npm prefix `~/.local`; root's are `/usr/local/share/pnpm` (or the embedder's `env.PNPM_HOME`) and `/usr/local`. `PATH` is `$PNPM_HOME/bin:/usr/local/bin:/usr/bin:/bin`.
+- **Environment:** a process started as a user gets `HOME`, `USER`, `LOGNAME`, `PNPM_HOME`, `NPM_CONFIG_PREFIX` and `PATH`. A user's `PNPM_HOME` is `~/.local/share/pnpm` and its npm prefix `~/.local`; root's are `/usr/local/share/pnpm` (or the embedder's `env.PNPM_HOME`) and `/usr/local`. `PATH` is `$PNPM_HOME/bin:/usr/local/bin:/usr/bin:/bin`. pnpm makes only `$PNPM_HOME/bin`, so the kernel makes root's `PNPM_HOME` when it is missing, just before a process starts: once at boot, and again after any mount or unmount, a removable medium inserted, a `hostfs` folder coming back, or a change at that directory or above it (removing it, say), and after a failed try (no medium yet). With owners on, the directories it makes there get root's owner and `0755`, as the boot layout does. A process already running when a medium arrives gets it at its next child launch. Writes inside it cost nothing extra.
 - **Commands per user:** root's global packages (`pnpm add -g` as root) are commands every user finds in `/usr/bin`. A user's own global packages are commands for that user only: they show up in the user's `~/.local/share/pnpm/bin`, first on its `PATH`, and a program the user starts finds them by name before the system's; another user, root included, doesn't. A user's packages can map file suffixes (`binfmt`) for that user too. The kernel picks up an install, a removal and a new user as they happen.
 - **Changing credentials:** POSIX `setresuid`/`setresgid` rules. Root (effective uid 0) may set any id and the group list; anyone else may only swap among their own real, effective and saved ids, and gets `EPERM` otherwise.
 - **Signals:** a process may signal another if its effective uid is 0, or if its real or effective uid is the target's real or saved uid; otherwise `kill` fails with `EPERM`. A group kill signals the members it may, and fails with `EPERM` only when it may signal none.

package/dist/kernel-worker.js

@@ -11569,7 +11569,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.93.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.93.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -19249,6 +19249,9 @@ var Launcher = class {
   hostname;
   watchers = new FsWatchers();
   pnpmHome;
+  pnpmChain;
+  pnpmMade;
+  pnpmEpoch = 0;
   mounts;
   createDriverWorker;
   media;
@@ -19299,7 +19302,10 @@ var Launcher = class {
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
       busy: (target) => [...this.openFiles].some((nodes) => nodes.holds(target)) || heldUnder(this.held, target),
-      changed: this.watchers.changed.bind(this.watchers),
+      changed: (...paths) => {
+        if (paths.some((path) => this.pnpmChain.has(path))) this.pnpmStale();
+        this.watchers.changed(...paths);
+      },
       owners: this.owners
     });
     this.mounted = this.mounts.wrap(options.fs);
@@ -19312,6 +19318,7 @@ var Launcher = class {
     this.fstabRetries = options.fstabRetries ?? FSTAB_RETRIES;
     this.processMounts = options.processMounts ?? true;
     this.pnpmHome = options.env?.PNPM_HOME ?? SYSTEM_PNPM_HOME;
+    this.pnpmChain = new Set(chain(normalizePath(this.pnpmHome)));
     this.modulesDir = options.modules ?? "/node_modules";
     this.appended = appendedRoots(options.commands);
     this.cdp = new CdpHosts(options.cdp);
@@ -19918,6 +19925,7 @@ var Launcher = class {
     delete env[TICKET_ENV];
     env.HOSTNAME = this.hostname;
     let program;
+    await this.pnpmReady();
     try {
       const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tag };
       if (this.integrity) await this.checkedSources(planned, caller);
@@ -20562,8 +20570,7 @@ var Launcher = class {
       this.fs
     );
     void this.unlinked.sweep(entry.target);
-    if (this.pnpmHome.startsWith(`${entry.target.replace(/\/$/, "")}/`))
-      await this.provisionPnpmHome();
+    this.pnpmStale();
     return entry;
   }
   async ownTmp() {
@@ -20611,8 +20618,18 @@ var Launcher = class {
     if (path === "/") return path;
     return joinName(await realDir(this.base, parentOf4(path)), baseName(path));
   }
-  async provisionPnpmHome() {
-    await this.base.mkdir(this.pnpmHome, { recursive: true }).catch(() => void 0);
+  pnpmReady() {
+    if (this.pnpmMade !== void 0) return this.pnpmMade;
+    const epoch = this.pnpmEpoch;
+    const made2 = this.base.mkdir(this.pnpmHome, { recursive: true }).then(() => this.owners ? this.stampLayout() : void 0).catch(() => {
+      if (this.pnpmEpoch === epoch) this.pnpmMade = void 0;
+    });
+    this.pnpmMade = made2;
+    return made2;
+  }
+  pnpmStale() {
+    this.pnpmEpoch++;
+    this.pnpmMade = void 0;
   }
   mountedBy(spec, cred) {
     if (!this.owners || cred.euid === 0 && cred.egid === 0) return spec;
@@ -20646,6 +20663,7 @@ var Launcher = class {
   umount(target, detach = false) {
     const at = normalizePath(target);
     this.mounts.umount(at, detach);
+    this.pnpmStale();
     if (!detach) return;
     for (const nodes of this.openFiles) nodes.revoke(at);
     for (const holds of this.held) holds.revoke(at);
@@ -20711,7 +20729,7 @@ var Launcher = class {
     await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     if (this.owners) await this.ownTmp();
-    await this.provisionPnpmHome();
+    await this.pnpmReady();
     await this.users.ensure();
     if (this.owners) await this.stampLayout();
     if (this.owners) await this.sudoer.provision();