@ai-ecoverse/slicc-kernel 1.98.4 → 1.99.1

package/dist/node.js

@@ -1038,6 +1038,7 @@ function kernelFdKind(file) {
 }
 var FdTable = class _FdTable {
   static MAX_FDS = 1024;
+  handles;
   fds = /* @__PURE__ */ new Map();
   cloexec = /* @__PURE__ */ new Set();
   status = /* @__PURE__ */ new Map();
@@ -1134,6 +1135,7 @@ var FdTable = class _FdTable {
     for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
     for (const fd of this.cloexec) child.cloexec.add(fd);
     for (const [fd, flags2] of this.status) child.status.set(fd, flags2);
+    child.handles = this.handles?.fork();
     return child;
   }
   async closeAll() {
@@ -1141,6 +1143,7 @@ var FdTable = class _FdTable {
     this.fds.clear();
     this.cloexec.clear();
     this.status.clear();
+    this.handles?.clear();
     await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
   }
 };
@@ -3269,7 +3272,7 @@ function serveClient(port, host) {
       case "umount":
         return { result: await l.umountAs(clientCred(self), req.target).then(() => true) };
       case "mounts":
-        return { result: l.mounts.list() };
+        return { result: l.mounts.listed() };
       case "dial":
         return dialFor(l, req, watches);
       case "serve-cdp":
@@ -7476,6 +7479,18 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
   };
 }
 
+// src/fs/dev-removal.ts
+var SHM = "/dev/shm";
+function inDevTree(path) {
+  if (path.startsWith(`${SHM}/`)) return false;
+  return path === "/dev" || path.startsWith("/dev/");
+}
+function devRemoval(path, cred) {
+  if (!inDevTree(path)) return void 0;
+  if (cred && cred.euid !== 0) return "EACCES";
+  return path === "/dev" ? "EBUSY" : "EPERM";
+}
+
 // src/fs/fresh-modules.ts
 var MAGIC = [0, 97, 115, 109];
 var MAX_FRESH = 65536;
@@ -8602,6 +8617,7 @@ var MountTable = class {
   devices = 0;
   pending = /* @__PURE__ */ new Set();
   notes = /* @__PURE__ */ new Map();
+  system = /* @__PURE__ */ new Set();
   deps;
   constructor(deps) {
     this.deps = deps;
@@ -8623,6 +8639,13 @@ var MountTable = class {
     const noted = [...this.notes.values()].filter((note) => !this.mounts.has(note.target));
     return [...mounted, ...noted.map((note) => ({ ...note, options: { ...note.options } }))];
   }
+  listed() {
+    return this.list().filter((entry) => !this.system.has(entry.target));
+  }
+  async mountSystem(spec, fs) {
+    await this.mount(spec, fs);
+    this.system.add(normalizePath(spec.target));
+  }
   note(spec, state, error) {
     const target = normalizePath(spec.target);
     this.notes.set(target, {
@@ -8729,6 +8752,7 @@ var MountTable = class {
     if (!mount && this.notes.delete(at)) return;
     if (!mount) throw errnoError("EINVAL", `${at} is not mounted`);
     if (!detach && this.deps.busy(at)) throw errnoError("EBUSY", `${at} has open files`);
+    this.system.delete(at);
     this.notes.delete(at);
     this.mounts.delete(at);
     this.deps.reshaped?.();
@@ -9637,16 +9661,6 @@ var MountFs = class _MountFs {
   }
 };
 
-// src/fs/dev-removal.ts
-function inDevTree(path) {
-  return path === "/dev" || path.startsWith("/dev/");
-}
-function devRemoval(path, cred) {
-  if (!inDevTree(path)) return void 0;
-  if (cred && cred.euid !== 0) return "EACCES";
-  return path === "/dev" ? "EBUSY" : "EPERM";
-}
-
 // src/realm/sync-fs-token-registry.ts
 var registry = /* @__PURE__ */ new Map();
 function mintSyncFsToken(entry) {
@@ -11075,7 +11089,7 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 var EARLY_WHOLE_FILE = 64 * 1024;
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.98.4" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.99.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -14173,6 +14187,206 @@ async function waitReady(fds, read, write, deadline, interrupted3) {
   }
 }
 
+// src/kernel/sem.ts
+var SEM_VALUE_MAX = 2147483647;
+var SEM_NAMES_MAX = 4096;
+var SEM_HANDLES_MAX = 256;
+var NAME_MAX = 251;
+var TIMER_MAX_MS = 2147483647;
+var SEM_OPS = [
+  "sem-open",
+  "sem-close",
+  "sem-unlink",
+  "sem-post",
+  "sem-wait",
+  "sem-getvalue"
+];
+var Semaphore = class {
+  value;
+  uid;
+  gid;
+  mode;
+  waiters = [];
+  constructor(value, uid, gid, mode) {
+    this.value = value;
+    this.uid = uid;
+    this.gid = gid;
+    this.mode = mode;
+  }
+  post() {
+    const next2 = this.waiters.shift();
+    if (next2) next2.grant();
+    else if (this.value >= SEM_VALUE_MAX) throw new KernelError("EOVERFLOW");
+    else this.value++;
+  }
+  take() {
+    if (this.value === 0) return false;
+    this.value--;
+    return true;
+  }
+  wait(signal, timeoutMs) {
+    if (this.take()) return Promise.resolve(true);
+    if (signal.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve2, reject) => {
+      const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : performance.now() + timeoutMs;
+      let timer;
+      const leave = () => {
+        const at = this.waiters.indexOf(waiter);
+        if (at >= 0) this.waiters.splice(at, 1);
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+      };
+      const waiter = {
+        grant: () => {
+          leave();
+          resolve2(true);
+        }
+      };
+      const abort = () => {
+        leave();
+        reject(new KernelError("EINTR"));
+      };
+      const expire = () => {
+        const left = deadline - performance.now();
+        if (left > 0) {
+          timer = setTimeout(expire, Math.min(left, TIMER_MAX_MS));
+          return;
+        }
+        leave();
+        resolve2(false);
+      };
+      this.waiters.push(waiter);
+      signal.addEventListener("abort", abort, { once: true });
+      if (deadline !== Number.POSITIVE_INFINITY) {
+        timer = setTimeout(expire, Math.min(timeoutMs, TIMER_MAX_MS));
+      }
+    });
+  }
+};
+var SemTable = class {
+  names = /* @__PURE__ */ new Map();
+  limit;
+  constructor(limit = SEM_NAMES_MAX) {
+    this.limit = limit;
+  }
+  open(name2, create, exclusive, make, check, adopt) {
+    const found = this.names.get(name2);
+    if (found) {
+      if (create && exclusive) throw new KernelError("EEXIST");
+      check(found);
+      return adopt(found);
+    }
+    if (!create) throw new KernelError("ENOENT");
+    if (this.names.size >= this.limit) throw new KernelError("ENOSPC");
+    const sem = make();
+    const handle = adopt(sem);
+    this.names.set(name2, sem);
+    return handle;
+  }
+  unlink(name2, check) {
+    const found = this.names.get(name2);
+    if (!found) throw new KernelError("ENOENT");
+    check(found);
+    this.names.delete(name2);
+  }
+};
+var SemHandles = class _SemHandles {
+  byHandle = /* @__PURE__ */ new Map();
+  next = 1;
+  add(sem) {
+    for (const [handle2, entry] of this.byHandle) {
+      if (entry.sem === sem) {
+        entry.opens++;
+        return handle2;
+      }
+    }
+    if (this.byHandle.size >= SEM_HANDLES_MAX) throw new KernelError("EMFILE");
+    const handle = this.next++;
+    this.byHandle.set(handle, { sem, opens: 1 });
+    return handle;
+  }
+  get(handle) {
+    const entry = this.byHandle.get(handle);
+    if (!entry) throw new KernelError("EINVAL");
+    return entry.sem;
+  }
+  close(handle) {
+    const entry = this.byHandle.get(handle);
+    if (!entry) throw new KernelError("EINVAL");
+    if (--entry.opens === 0) this.byHandle.delete(handle);
+  }
+  fork() {
+    const child = new _SemHandles();
+    child.next = this.next;
+    for (const [handle, entry] of this.byHandle) child.byHandle.set(handle, { ...entry });
+    return child;
+  }
+  clear() {
+    this.byHandle.clear();
+  }
+};
+function semName(raw) {
+  const name2 = raw.replace(/^\/+/, "");
+  if (name2 === "" || name2.includes("/") || name2 === "." || name2 === "..") {
+    throw new KernelError("EINVAL");
+  }
+  if (new TextEncoder().encode(name2).length > NAME_MAX) throw new KernelError("ENAMETOOLONG");
+  return name2;
+}
+var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
+async function semSyscall(req, proc) {
+  const { table, handles, cred } = proc;
+  if (!table) throw new KernelError("ENOSYS");
+  const { denied: denied2 } = proc;
+  const shown = (name2) => `/dev/shm/sem.${name2}`;
+  const opens = (name2) => (sem) => {
+    const perm = { uid: sem.uid, gid: sem.gid, mode: sem.mode };
+    if (denied2 && !permits(cred, perm, R_OK | W_OK, false)) denied2("sem_open", shown(name2));
+  };
+  const unlinks = (name2) => (sem) => {
+    if (denied2 && cred.euid !== 0 && cred.euid !== sem.uid) denied2("sem_unlink", shown(name2));
+  };
+  switch (req.op) {
+    case "sem-open": {
+      if (req.value < 0 || req.value > SEM_VALUE_MAX) throw new KernelError("EINVAL");
+      const name2 = semName(req.name);
+      const mode = req.mode & 511 & ~proc.umask;
+      return ok2(
+        table.open(
+          name2,
+          req.create,
+          req.exclusive,
+          () => new Semaphore(req.value, cred.euid, cred.egid, mode),
+          opens(name2),
+          (sem) => handles.add(sem)
+        )
+      );
+    }
+    case "sem-close":
+      handles.close(req.handle);
+      return ok2();
+    case "sem-unlink": {
+      const name2 = semName(req.name);
+      table.unlink(name2, unlinks(name2));
+      return ok2();
+    }
+    case "sem-post":
+      handles.get(req.handle).post();
+      return ok2();
+    case "sem-getvalue":
+      return ok2(handles.get(req.handle).value);
+    case "sem-wait": {
+      const sem = handles.get(req.handle);
+      if (sem.take()) return ok2();
+      if (req.how === "try") throw new KernelError("EAGAIN");
+      if (req.how === "timed" && req.timeoutMs === 0) throw new KernelError("ETIMEDOUT");
+      const got = await sem.wait(proc.blocking(), req.how === "block" ? -1 : req.timeoutMs);
+      if (!got) throw new KernelError("ETIMEDOUT");
+      return ok2();
+    }
+  }
+}
+
 // src/kernel/net/datagram-wire.ts
 function encodeReceived(got) {
   const host = new TextEncoder().encode(got.host);
@@ -14219,20 +14433,20 @@ function dgramAt(fds, fd) {
   if (!(file instanceof KernelDgram)) throw new KernelError("EOPNOTSUPP");
   return file;
 }
-var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
+var ok3 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
     case "sock-open": {
       if (req.type === "dgram" && req.domain !== "inet") throw new KernelError("EPROTONOSUPPORT");
       const file = req.type === "dgram" ? new KernelDgram(net) : net.socket(req.domain);
-      return ok2(fds.install(new OpenFile(file), 3));
+      return ok3(fds.install(new OpenFile(file), 3));
     }
     case "sock-pair": {
       const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
       try {
-        return ok2([first, fds.install(new OpenFile(b), 3)]);
+        return ok3([first, fds.install(new OpenFile(b), 3)]);
       } catch (e) {
         await Promise.resolve(fds.close(first));
         throw e;
@@ -14240,32 +14454,32 @@ async function socketSyscall(req, proc) {
     }
     case "sock-bind":
       anySocketAt(fds, req.fd).bind(req.addr);
-      return ok2();
+      return ok3();
     case "sock-listen":
       socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
-      return ok2();
+      return ok3();
     case "sock-accept":
-      return ok2(await accept(proc, req.fd, req.nonblock));
+      return ok3(await accept(proc, req.fd, req.nonblock));
     case "sock-connect":
       return connect(req, proc);
     case "sock-shutdown":
       anySocketAt(fds, req.fd).shutdown(req.how);
-      return ok2();
+      return ok3();
     case "sock-name": {
       const socket = anySocketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;
       if (req.peer && !addr) throw new KernelError("ENOTCONN");
-      return ok2(addr ?? unnamed(socket instanceof KernelDgram ? "inet" : socket.domain));
+      return ok3(addr ?? unnamed(socket instanceof KernelDgram ? "inet" : socket.domain));
     }
     case "sock-getopt":
-      return ok2(anySocketAt(fds, req.fd).getOption(req.level, req.name));
+      return ok3(anySocketAt(fds, req.fd).getOption(req.level, req.name));
     case "sock-setopt":
       anySocketAt(fds, req.fd).setOption(req.level, req.name, req.value);
-      return ok2();
+      return ok3();
     case "sock-resolve": {
       const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
       if (addresses.length === 0) throw new KernelError("ENOENT");
-      return ok2(addresses);
+      return ok3(addresses);
     }
     default:
       return datagram(req, proc);
@@ -14275,7 +14489,7 @@ async function connect(req, proc) {
   const target = anySocketAt(proc.fds, req.fd);
   if (target instanceof KernelDgram) {
     target.connectTo(req.addr);
-    return ok2();
+    return ok3();
   }
   const stamp = proc.net.facadeAt(req.addr) && await proc.stamp?.();
   const dialing = target.connect(req.addr, true, proc.cred?.(), stamp || void 0);
@@ -14284,13 +14498,13 @@ async function connect(req, proc) {
     throw new KernelError("EINPROGRESS");
   }
   if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
-  return ok2();
+  return ok3();
 }
 async function datagram(req, proc) {
   const dgram = dgramAt(proc.fds, req.fd);
   if (req.op === "sock-sendto") {
     if (req.nonblock && !pollFile(dgram).writable) throw new KernelError("EAGAIN");
-    return ok2(await dgram.send(req.body, req.addr));
+    return ok3(await dgram.send(req.body, req.addr));
   }
   const ready2 = pollFile(dgram).readable;
   if (req.nonblock && !ready2) throw new KernelError("EAGAIN");
@@ -15056,6 +15270,9 @@ function isHttpSyscall(req) {
 function isSocketSyscall(req) {
   return req.op.startsWith("sock-");
 }
+function isSemSyscall(req) {
+  return req.op.startsWith("sem-");
+}
 function isEpollSyscall(req) {
   return EPOLL_OPS.includes(req.op);
 }
@@ -15150,6 +15367,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "sig-pause",
   ...SOCKET_OPS,
   ...EPOLL_OPS,
+  ...SEM_OPS,
   ...HTTP_OPS,
   ...PTY_OPS,
   ...HOST_OPS
@@ -15382,6 +15600,7 @@ var WasmProcess = class {
       if (isTtySyscall(req)) return this.ttySyscall(req);
       if (isJobSyscall(req)) return this.jobSyscall(req);
       if (isSocketSyscall(req)) return await this.socketSyscall(req, cancelled);
+      if (isSemSyscall(req)) return await this.semSyscall(req, cancelled);
       if (isEpollSyscall(req)) {
         return await epollSyscall(req, {
           fds: this.fds,
@@ -16101,6 +16320,20 @@ var WasmProcess = class {
     if (!http) return Promise.resolve({ ok: false, errno: "ENETUNREACH", message: NO_TRANSPORT });
     return http.syscall(req);
   }
+  semSyscall(req, cancelled) {
+    const g = this.guarded();
+    const known = this.fds.handles;
+    const handles = known instanceof SemHandles ? known : new SemHandles();
+    this.fds.handles = handles;
+    return semSyscall(req, {
+      table: this.options.sems,
+      handles,
+      cred: this.cred,
+      denied: g ? (op, path) => deny(g, op, path) : void 0,
+      umask: this.umask,
+      blocking: () => this.blockingSignal(cancelled)
+    });
+  }
   socketSyscall(req, cancelled) {
     this.net ??= this.options.net ?? new LoopbackNet();
     const resolver = this.options.resolver ?? HOSTS_ONLY;
@@ -16611,6 +16844,7 @@ function processOptions(opts, header4, hooks, created3) {
     net: opts.net,
     http: opts.http,
     locks: opts.locks,
+    ...opts.sems ? { sems: opts.sems } : {},
     onReap: opts.onReap,
     resolver: opts.resolver,
     ...notifiers(header4),
@@ -20084,6 +20318,9 @@ var NOT_EXECUTABLE = 126;
 var DECIDE_MS = 100;
 var INIT_PID = 1;
 var SHARED_DIRS = ["/tmp", "/home"];
+function unref2(port) {
+  port.unref?.();
+}
 var LAYOUT = [
   ["/", 493],
   ["/root", 448],
@@ -20272,6 +20509,7 @@ var Launcher = class {
   sudoer;
   jobs = new JobTable();
   locks = new LockTable();
+  sems = new SemTable();
   settling = new SettlingChildren((pid) => this.jobs.pgidOf(pid));
   ptys = new PtyTable(
     (tty, sig) => this.keySignal(tty, 0, sig, () => this.jobs.signalOwnedForeground(tty, sig)),
@@ -20293,6 +20531,7 @@ var Launcher = class {
   pnpmMade;
   pnpmEpoch = 0;
   mounts;
+  shmPorts = [];
   createDriverWorker;
   media;
   onMountPending;
@@ -21130,6 +21369,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport, pid, this.loopbackFor(pid)),
       locks: this.locks,
+      sems: this.sems,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child, pid),
       ...req.fork ? { fork: req.fork } : {},
@@ -21556,6 +21796,7 @@ var Launcher = class {
         },
         { owned: true }
       );
+      if (spec.target === SHM) this.shmPorts = [port1, port2];
       return {
         port: port1,
         dispose: () => {
@@ -21658,6 +21899,12 @@ var Launcher = class {
     this.pnpmStale();
     return entry;
   }
+  async mountShm() {
+    await this.base.mkdir(SHM, { recursive: true });
+    await this.mounts.mountSystem({ type: "tmpfs", source: "shm", target: SHM }, this.fs);
+    for (const port of this.shmPorts) unref2(port);
+    await this.fs.chmod(SHM, 1023);
+  }
   async ownTmp() {
     const real = await this.realLayoutPath("/tmp");
     const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
@@ -21814,6 +22061,7 @@ var Launcher = class {
     await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
     if (this.owners) await this.ownTmp();
+    await this.mountShm();
     await this.pnpmReady();
     await this.users.ensure();
     if (this.owners) await this.stampLayout();
@@ -23554,7 +23802,7 @@ async function createNodeKernel(options = {}) {
     readFile: async (path) => launcher.fs.readFileBuffer(path),
     mount: (spec) => guard2(() => launcher.mount(spec)),
     umount: (target) => guard2(async () => launcher.umount(target)),
-    mounts: async () => launcher.mounts.list(),
+    mounts: async () => launcher.mounts.listed(),
     setRoutes: (routes) => guard2(async () => launcher.setRoutes(routes)),
     updateTransportTraits: () => guard2(async () => launcher.updateTransportTraits()),
     users: {