@amritk/nish-aarch64-darwin 0.25.0 → 0.27.2

package/runtime/runtime-os.c

@@ -49,6 +49,7 @@
 #include <unistd.h>
 #ifndef __wasi__
 /* WASI has no processes, so `spawn.h` and `wait.h` do not exist there. */
+#include <poll.h>
 #include <signal.h>
 #include <spawn.h>
 #include <sys/resource.h>
@@ -170,20 +171,9 @@ nish_str *nish_read_file(const nish_str *path) {
   return s;
 }
 
-/* `O_NOFOLLOW` (docs/security/runtime.md, RT-4): a symbolic link as the last
-   component of the path is refused, as an unwritable file is, rather than
-   followed to whatever file it names. `nish file.ts` writes `file.ll` beside
-   its source, so a link planted at that name in a checkout would otherwise
-   truncate any file the user can write. A link among the directories on the
-   way is still followed.
-
-   `O_CLOEXEC` for the reason the read has it (RT-12), and `EINTR` is retried
-   as the read retries it (RT-13): a write cut short is finished, and one that
-   fails is `cannot write`, never a silently short file.
-
-   The loop is `nish_put_all`, which `writeFileBytesSync` and `writeBytes`
-   share: all `n` bytes of `p` to `fd`, answering 0 or the negative errno of
-   the write that failed (-EIO for one that wrote nothing). */
+/* All `n` bytes of `p` to `fd`, answering 0 or the negative errno of the
+   write that failed (-EIO for one that wrote nothing). A write cut short is
+   finished and `EINTR` retried (RT-13). Every writer below shares it. */
 static int32_t nish_put_all(int fd, const char *p, uint64_t n) {
   for (uint64_t done = 0; done < n;) {
     ssize_t k = write(fd, p + done, n - done);
@@ -193,6 +183,17 @@ static int32_t nish_put_all(int fd, const char *p, uint64_t n) {
   }
   return 0;
 }
+
+/* `O_NOFOLLOW` (docs/security/runtime.md, RT-4): a symbolic link as the last
+   component of the path is refused, as an unwritable file is, rather than
+   followed to whatever file it names. `nish file.ts` writes `file.ll` beside
+   its source, so a link planted at that name in a checkout would otherwise
+   truncate any file the user can write. A link among the directories on the
+   way is still followed.
+
+   `O_CLOEXEC` for the reason the read has it (RT-12), and the bytes go out
+   through `nish_put_all`, so a write that fails is `cannot write`, never a
+   silently short file. */
 static void nish_put_file(const nish_str *path, const nish_str *data, int flags) {
   int fd = open(nish_cpath(path), O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC | flags, 0644);
   if (fd < 0 || nish_put_all(fd, data->data, data->len) < 0) nish_io_fail("write ", path);
@@ -248,6 +249,73 @@ int32_t nish_write_file_bytes(const nish_str *path, const nish_array *bytes) {
   return r < 0 ? r : (int32_t)bytes->len;
 }
 
+/* ---- Files and directories with an explicit mode (docs/security/runtime.md,
+   RT-24 to RT-26): `writeFileSyncMode`, `createFileExclusiveSync` and
+   `mkdirSyncMode`. Each answers a value and never exits, as the writers just
+   above do. A mode outside 0..0777 is -EINVAL before any system call: the
+   setuid, setgid and sticky bits are refused, not applied, so the mode asked
+   for is the mode the file has. WASI
+   has no file modes to apply, so there each answers -ENOSYS and creates
+   nothing rather than a file whose mode was not set. */
+
+/* The two file writers' shared body: `open(p, O_WRONLY | O_CREAT |
+   O_NOFOLLOW | O_CLOEXEC | flags, mode)`, then `fchmod(fd, mode)` before a
+   byte is written, so the file is exactly `mode` whatever the umask and
+   whatever mode a file already there had: no reader that opens it while it is
+   written finds it wider (RT-24). Then the data through `nish_put_all` and a
+   checked `close`, as `nish_write_file_bytes` does. The open truncates
+   before the `fchmod`, so a file there that this process may write but does
+   not own is emptied and then answers -EPERM. When `flags` holds `O_EXCL`,
+   any failure after the create unlinks the file this call made, so a lock
+   whose write failed does not stay taken. */
+static int32_t nish_put_file_mode(const nish_str *path, const nish_str *data, int flags, int32_t mode) {
+  const char *p = nish_cpath(path);
+  if (p != path->data || mode < 0 || mode > 0777) return -EINVAL;
+  if (data->len > NISH_LENGTH_MAX) return -EFBIG;
+#ifdef __wasi__
+  (void)flags;
+  return -ENOSYS;
+#else
+  int fd = open(p, O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC | flags, (mode_t)mode);
+  if (fd < 0) return -errno;
+  int32_t r = fchmod(fd, (mode_t)mode) == 0 ? 0 : -errno;
+  if (r == 0) r = nish_put_all(fd, data->data, data->len);
+  if (close(fd) != 0 && r == 0 && errno != EINTR) r = -errno;
+  if (r < 0 && (flags & O_EXCL)) unlink(p);
+  return r < 0 ? r : (int32_t)data->len;
+#endif
+}
+
+/* `writeFileSyncMode(path, data, mode)`: `writeFileSync` with the mode given
+   and an answer instead of an exit. A link at the path is refused (-ELOOP on
+   Linux) and the file it names is untouched (RT-25). */
+int32_t nish_write_file_mode(const nish_str *path, const nish_str *data, int32_t mode) {
+  return nish_put_file_mode(path, data, O_TRUNC, mode);
+}
+
+/* `createFileExclusiveSync(path, data, mode)`: `O_EXCL`, so the path is
+   created by this call or the call answers -EEXIST, a link there included,
+   dangling or not. Of N processes racing for one path exactly one wins, which
+   is what a lock file needs; a winner whose write then fails removes the file
+   and answers the error. */
+int32_t nish_create_file_exclusive(const nish_str *path, const nish_str *data, int32_t mode) {
+  return nish_put_file_mode(path, data, O_EXCL, mode);
+}
+
+/* `mkdirSyncMode(path, mode)`: mkdir(2) with `mode`, one directory, not
+   recursive. A path already there is -EEXIST and its mode is left as it was.
+   The kernel applies the umask, so the directory is `mode & ~umask`: 0700 is
+   exact under any umask that leaves the owner's bits (RT-26). */
+int32_t nish_mkdir_mode(const nish_str *path, int32_t mode) {
+  const char *p = nish_cpath(path);
+  if (p != path->data || mode < 0 || mode > 0777) return -EINVAL;
+#ifdef __wasi__
+  return -ENOSYS;
+#else
+  return mkdir(p, (mode_t)mode) == 0 ? 0 : -errno;
+#endif
+}
+
 /* `writeBytes(bytes, off, len)` (nish:io): the bytes `[off, off + len)` of a
    `u8[]` on stdout, through `nish_put_all`, so a short write is finished and `EINTR` retried. The
    emitter has range-checked `off` and `len` against `bytes->len`
@@ -290,17 +358,19 @@ _Bool nish_mkdir(const nish_str *path) {
    value rather than through a child that has already run.
 
    `out` and `err` are paths for the child's stdout and stderr, or NULL to let
-   it inherit this process's. Every spawn builtin starts its child here, so the
+   it inherit this process's; `dup`, when not NULL, is three descriptors the
+   child takes as its stdin, stdout and stderr instead (`spawnPiped`'s pipes). Every spawn builtin starts its child here, so the
    argv vector and the redirects are written once; it is `static`, so a program
    that spawns nothing loses it to `--gc-sections`. The answer is the child's
    pid, or a negative errno: -EINVAL for an empty argv or an argument holding a
    NUL, and `posix_spawnp`'s own error otherwise (-ENOENT for a command that is
    not on PATH, on glibc). */
-static int32_t nish_spawn_start(const nish_array *argv, const nish_str *out, const nish_str *err) {
+static int32_t nish_spawn_start(const nish_array *argv, const nish_str *out, const nish_str *err, const int *dup) {
 #ifdef __wasi__
   (void)argv;
   (void)out;
   (void)err;
+  (void)dup;
   return -ENOSYS;
 #else
   if (!argv->len) return -EINVAL; /* argv[0] would read past an empty array */
@@ -323,6 +393,13 @@ static int32_t nish_spawn_start(const nish_array *argv, const nish_str *out, con
   posix_spawn_file_actions_t fa;
   int failed = posix_spawn_file_actions_init(&fa);
   if (failed) return -failed;
+  /* A `dup2` action that could not be recorded would start the child on this
+     process's own stream in its place, so it fails the spawn. */
+  for (int k = 0; dup && k < 3 && !failed; k++) failed = posix_spawn_file_actions_adddup2(&fa, dup[k], k);
+  if (failed) {
+    posix_spawn_file_actions_destroy(&fa);
+    return -failed;
+  }
   const nish_str *to[2] = { out, err };
   for (int k = 0; k < 2; k++) {
     /* The child opens the file, not this process: a redirect that this process
@@ -348,7 +425,7 @@ static int32_t nish_exit_code(int status) {
 /* The two blocking builtins: start, then wait for that one child. A failed
    start is -1, the answer they have always given. */
 static int32_t nish_spawn_impl(const nish_array *argv, const nish_str *out, const nish_str *err) {
-  int32_t pid = nish_spawn_start(argv, out, err);
+  int32_t pid = nish_spawn_start(argv, out, err, 0);
   if (pid < 0) return -1;
 #ifdef __wasi__
   return -1;
@@ -379,7 +456,160 @@ int32_t nish_spawn_to(const nish_array *argv, const nish_str *out, const nish_st
 /* `spawn(argv)`: the child's pid, or a negative errno, without waiting. The
    child is this process's until a `waitPid` reaps it; one never reaped stays
    a zombie until the program exits, as it would in C. */
-int32_t nish_spawn_child(const nish_array *argv) { return nish_spawn_start(argv, 0, 0); }
+int32_t nish_spawn_child(const nish_array *argv) { return nish_spawn_start(argv, 0, 0, 0); }
+
+/* `spawnPiped(argv, stdin, stdout, stderr)`: run the child as `nish_spawn`
+   does, with `stdin`'s bytes on its standard input and its standard output
+   and error appended to `stdout` and `stderr`, and answer its status. -1 is
+   `nish_spawn`'s failure (an empty argv, a NUL, a child that cannot start or
+   be waited for, a pipe or `poll` that fails), and -2 is a stream that passed
+   NISH_PIPED_CAP bytes: the child is killed with SIGKILL and reaped, and the
+   array holds the first NISH_PIPED_CAP bytes of that stream.
+
+   The three pipes are close-on-exec, so no other child this process starts
+   inherits an end, and each end is moved off descriptors 0 to 2, where a
+   `dup2` onto itself would leave close-on-exec set and the child without
+   that stream. Darwin has no `pipe2`, so there an end is close-on-exec only
+   once `F_DUPFD_CLOEXEC` has moved it: a child another thread starts in
+   that window inherits it (docs/security/runtime.md, RT-30).
+
+   One `poll` loop over non-blocking ends writes stdin and reads both outputs
+   as each is ready, so a child that fills its stdout before it reads all its
+   stdin, or the reverse, cannot deadlock against this process. A child that
+   exits, or closes its stdin, before reading everything ends the writing
+   with EPIPE rather than SIGPIPE: the signal is blocked on this thread once
+   the child has started, the one a write raised is taken off the pending
+   set, and the mask is put back before the answer (docs/security/runtime.md,
+   RT-29). Ignoring it instead would be process-wide, and every child
+   started meanwhile, this one included, would inherit SIGPIPE ignored and
+   never die of a reader that has gone.
+
+   The bytes are written from the caller's array as they stand, and nothing
+   copies them: the only copies are the kernel's pipe buffer and the child.
+   The length is read once, so `stdout` being the same array as `stdin`
+   appends to it without feeding the output back in, and the pointer at each
+   write, because that array moves when it grows and its stdin bytes stay
+   its first `n`. */
+#define NISH_PIPED_CAP (16u << 20)
+#ifndef __wasi__
+static int nish_pipe(int *p) {
+#ifdef __linux__
+  if (pipe2(p, O_CLOEXEC)) return -1;
+#else
+  if (pipe(p)) return -1;
+#endif
+  for (int k = 0; k < 2; k++) {
+#ifdef __linux__
+    if (p[k] > 2) continue;
+#endif
+    int moved = fcntl(p[k], F_DUPFD_CLOEXEC, 3);
+    close(p[k]);
+    p[k] = moved;
+    if (moved < 0) return -1;
+  }
+  return 0;
+}
+
+#endif
+
+int32_t nish_spawn_piped(const nish_array *argv, const nish_array *in, nish_array *out, nish_array *err) {
+#ifdef __wasi__
+  (void)argv;
+  (void)in;
+  (void)out;
+  (void)err;
+  return -1;
+#else
+  uint64_t n = in->len, sent = 0, got[3] = { 0, 0, 0 };
+  int p[6] = { -1, -1, -1, -1, -1, -1 };
+  int32_t rc = -1;
+  if (nish_pipe(p) || nish_pipe(p + 2) || nish_pipe(p + 4)) goto done;
+  int child[3] = { p[0], p[3], p[5] };
+  int32_t pid = nish_spawn_start(argv, 0, 0, child);
+  /* The child holds its ends now; this process keeps only its own. */
+  for (int k = 0; k < 3; k++) {
+    close(child[k]);
+    p[k ? 2 * k + 1 : 0] = -1;
+  }
+  if (pid < 0) goto done;
+  sigset_t pipe_sig, mask, pending;
+  sigemptyset(&pipe_sig);
+  sigaddset(&pipe_sig, SIGPIPE);
+  pthread_sigmask(SIG_BLOCK, &pipe_sig, &mask);
+  sigpending(&pending);
+  int queued = sigismember(&pending, SIGPIPE);
+  struct pollfd f[3] = { { p[1], POLLOUT, 0 }, { p[2], POLLIN, 0 }, { p[4], POLLIN, 0 } };
+  p[1] = p[2] = p[4] = -1;
+  /* A blocking end could stall the loop on one stream while the child fills
+     another, so an end that stays blocking fails the run: the loop is skipped
+     and the child killed. */
+  rc = 0;
+  for (int k = 0; k < 3; k++)
+    if (fcntl(f[k].fd, F_SETFL, O_NONBLOCK) < 0) rc = -1;
+  if (!n) {
+    close(f[0].fd);
+    f[0].fd = -1;
+  }
+  nish_array *to[3] = { 0, out, err };
+  while (!rc && (f[0].fd >= 0 || f[1].fd >= 0 || f[2].fd >= 0)) {
+    if (poll(f, 3, -1) < 0) {
+      if (errno != EINTR) rc = -1;
+      continue;
+    }
+    if (f[0].revents) {
+      ssize_t k = write(f[0].fd, in->data + sent, n - sent);
+      if (k > 0) sent += k;
+      if (sent == n || (k < 0 && errno != EINTR && errno != EAGAIN)) {
+        close(f[0].fd);
+        f[0].fd = -1;
+      }
+    }
+    for (int s = 1; s < 3 && !rc; s++) {
+      if (!f[s].revents) continue;
+      nish_array *a = to[s];
+      /* Grown as `push` grows it, so the array keeps the shape every other
+         array has, and an ASan build tracks the block the same way. */
+      if (a->len == a->cap) nish_array_grow(a, 1);
+      /* One byte past the cap at most, which is how a stream that ends at
+         exactly the cap is told from one that goes on. */
+      uint64_t room = a->cap - a->len, left = NISH_PIPED_CAP + 1 - got[s];
+      ssize_t k = read(f[s].fd, a->data + a->len, room < left ? room : left);
+      if (k > 0) {
+        a->len += k;
+        got[s] += k;
+        if (got[s] > NISH_PIPED_CAP) {
+          a->len--;
+          rc = -2;
+        }
+      } else if (!k || (errno != EINTR && errno != EAGAIN)) {
+        close(f[s].fd);
+        f[s].fd = -1;
+      }
+    }
+  }
+  sigpending(&pending);
+  if (!queued && sigismember(&pending, SIGPIPE)) {
+    int sig;
+    sigwait(&pipe_sig, &sig);
+  }
+  pthread_sigmask(SIG_SETMASK, &mask, 0);
+  if (rc) kill(pid, SIGKILL);
+  for (int k = 0; k < 3; k++)
+    if (f[k].fd >= 0) close(f[k].fd);
+  int status;
+  while (waitpid(pid, &status, 0) < 0) {
+    if (errno != EINTR) {
+      rc = -1;
+      break;
+    }
+  }
+  if (!rc) rc = nish_exit_code(status);
+done:
+  for (int k = 0; k < 6; k++)
+    if (p[k] >= 0) close(p[k]);
+  return rc;
+#endif
+}
 
 /* `kill(pid, sig)`: 0, or a negative errno. Only the four signals a program
    asks a child to stop or report with are sent -- 0 (is it there), SIGINT,
@@ -545,15 +775,20 @@ int64_t nish_total_memory(void) {
 }
 
 /* `setNice(n)`: this process's nice value set to `n`, 0 or a negative errno.
-   The kernel clamps `n` to its range (-20 to 19), so only lowering the value
-   below what the process has can fail: -EACCES (Linux, Darwin) or -EPERM
-   without the privilege to raise a priority. Linux keeps the value per thread,
-   so it is the calling thread's and every thread started after it. */
+   Lower-only, even as root: `n` takes 0..19 (-EINVAL outside it, with no system
+   call), and a value below the current one is -EACCES (Linux, Darwin) without
+   a `setpriority` call, so the priority never rises. Linux keeps the value per
+   thread, so it is the calling thread's and every thread started after it. */
 int32_t nish_set_nice(int32_t n) {
 #ifdef __wasi__
   (void)n;
   return -ENOSYS;
 #else
+  if (n < 0 || n > 19) return -EINVAL;
+  errno = 0;
+  int current = getpriority(PRIO_PROCESS, 0);
+  if (current == -1 && errno != 0) return -errno;
+  if (n < current) return -EACCES;
   return setpriority(PRIO_PROCESS, 0, n) == 0 ? 0 : -errno;
 #endif
 }

package/runtime/runtime-simd.c

@@ -1,5 +1,6 @@
 /* Nish runtime, the vector half: byte searches that read sixteen or thirty-two
- * bytes at a time (WP38 S1, docs/wp38-simd.md §3.1).
+ * bytes at a time (WP38 S1, docs/wp38-simd.md §3.1), and the SSE4.1 rounding
+ * behind `Math.floor`, `Math.ceil` and `Math.trunc` (#943, at the end).
  *
  * A translation unit of its own for the reason runtime-host.c is one: each file
  * carries its own measured `.text*` ceiling in tests/runtime-budgets.js, and
@@ -176,10 +177,17 @@ static int nish_cpu_has_avx2(void) {
    `base` never reads the CPU's feature bits at all. */
 enum { NISH_PATH_SCALAR, NISH_PATH_BASE, NISH_PATH_AVX2 };
 
-static int nish_simd_choose(void) {
+/* The path `NISH_SIMD` pins, or -1 when it pins none. */
+static int nish_simd_pin(void) {
   const char *pin = getenv("NISH_SIMD");
   if (pin != NULL && strcmp(pin, "scalar") == 0) return NISH_PATH_SCALAR;
   if (pin != NULL && strcmp(pin, "base") == 0) return NISH_PATH_BASE;
+  return -1;
+}
+
+static int nish_simd_choose(void) {
+  int pin = nish_simd_pin();
+  if (pin >= 0) return pin;
 #if defined(NISH_SIMD_SSE2)
   if (nish_cpu_has_avx2()) return NISH_PATH_AVX2;
 #endif
@@ -425,3 +433,56 @@ int64_t nish_regex_scan(const nish_str *s, const nish_array *masks, int64_t dept
                         int64_t from) {
   return __atomic_load_n(&nish_scan, __ATOMIC_RELAXED)(s, masks, depth, off, width, from);
 }
+
+/* `Math.floor`, `Math.ceil` and `Math.trunc`, and the floor `Math.round` takes
+   (#943), the contract in nish.h. SSE4.1's `roundsd` answers each in one
+   instruction, but the x86-64 baseline is SSE2, where LLVM lowers
+   `llvm.floor.f64` to a call of libm's `floor` through the GOT. So a module
+   for x86-64 calls these instead (`roundingCallee`, src/emit-builtins.ts) and
+   registers a constructor that hands `nish_round_init` libm's three routines;
+   it asks the CPU once, before `main`, and keeps them only when the answer is
+   no. The runtime names no libm symbol itself, so a link without `-lm` (a C
+   host, a program that never rounds) still resolves: the module that rounds
+   brings the reference, as it did before. A null slot is the instruction and
+   is never written after the constructor, so on a CPU without SSE4.1 each
+   call is an indirect jump to libm, the path a module took before.
+   `NISH_SIMD=scalar` keeps libm, the forced fallback a test runs. `base` does
+   not: the instruction gate counts under it, and glibc's own `floor` takes
+   `roundsd` there as well, so the count is of the instruction both call.
+   Built for a machine that has SSE4.1 already (`--cpu x86-64-v3`), or for any
+   other, each is the builtin, which is the one instruction there, and the
+   constructor keeps nothing. The immediate is the rounding mode, 1 down, 2 up,
+   3 toward zero, plus 8, which keeps the precision exception quiet as libm's
+   `floor` does. */
+#if defined(NISH_SIMD_SSE2) && !defined(__SSE4_1__)
+static double (*nish_round_libm[3])(double);
+
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double)) {
+  unsigned a, b, c, d;
+  if (nish_simd_pin() != NISH_PATH_SCALAR && __get_cpuid(1, &a, &b, &c, &d) && (c & bit_SSE4_1)) return;
+  nish_round_libm[0] = floor_fn;
+  nish_round_libm[1] = ceil_fn;
+  nish_round_libm[2] = trunc_fn;
+}
+
+#define NISH_ROUNDING(name, base, slot, mode)                                                                \
+  double name(double x) {                                                                                    \
+    double (*libm)(double) = nish_round_libm[slot];                                                          \
+    if (libm) return libm(x);                                                                                \
+    __asm__("roundsd $" #mode ", %0, %0" : "+x"(x));                                                         \
+    return x;                                                                                                \
+  }
+#else
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double)) {
+  (void)floor_fn;
+  (void)ceil_fn;
+  (void)trunc_fn;
+}
+
+#define NISH_ROUNDING(name, base, slot, mode)                                                                \
+  double name(double x) { return __builtin_##base(x); }
+#endif
+
+NISH_ROUNDING(nish_floor, floor, 0, 9)
+NISH_ROUNDING(nish_ceil, ceil, 1, 10)
+NISH_ROUNDING(nish_trunc, trunc, 2, 11)

package/runtime/runtime-wasm.c

@@ -128,3 +128,21 @@ void nish_exit(int32_t code) { (void)code; __builtin_trap(); }
 void nish_panic(const void *s) { (void)s; __builtin_trap(); }
 /* Output has nowhere to go either. */
 void nish_write(const void *s, int32_t fd, _Bool newline) { (void)s; (void)fd; (void)newline; }
+
+/* ---- Rounding (#943): IR compiled for the host calls these and registers a
+ * constructor that passes `nish_round_init` libm's three routines
+ * (runtime-simd.c has the native ones). On wasm32 each is the one
+ * instruction, f64.floor, f64.ceil or f64.trunc, and there is no CPU to ask.
+ * The link is freestanding, so the libm names the constructor takes are
+ * defined here too, as the same instructions. */
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double)) {
+  (void)floor_fn;
+  (void)ceil_fn;
+  (void)trunc_fn;
+}
+double nish_floor(double x) { return __builtin_floor(x); }
+double nish_ceil(double x) { return __builtin_ceil(x); }
+double nish_trunc(double x) { return __builtin_trunc(x); }
+double floor(double x) { return __builtin_floor(x); }
+double ceil(double x) { return __builtin_ceil(x); }
+double trunc(double x) { return __builtin_trunc(x); }

package/scripts/build.sh

@@ -10,7 +10,8 @@
 # threads, <dir>/runtime-cross.c, the copies that carry a string or an array
 # from one thread's arena to another's, <dir>/runtime-host.c, the wall clock, entropy, file times and
 # signals, <dir>/runtime-net.c, the sockets of `nish:net`,
-# <dir>/runtime-simd.c, the byte searches that read a vector at a time,
+# <dir>/runtime-simd.c, the byte searches that read a vector at a time and
+# the SSE4.1 rounding of `Math.floor` and its kin,
 # <dir>/runtime-aes.c, AES-GCM on the CPU's AES instructions,
 # <dir>/runtime-term.c, stdin and the terminal of `nish:term`, and
 # <dir>/runtime-bytes.c, the byte-class runs of `nish/bytes`. Each of those
@@ -665,6 +666,20 @@ case "$profile" in
     if [ "$bytes_wanted" = 1 ] && [ "$bytes_named" = 0 ]; then
       inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-bytes.c")
     fi
+    # IR compiled for the host rounds through runtime-simd.c's `nish_floor` and its
+    # kin behind the constructor `nish_round_init` (#943). runtime-wasm.c has their
+    # wasm32 bodies, and it is added the same way when such IR does not name it.
+    wasm_named=0
+    round_wanted=0
+    for i in ${inputs[@]+"${inputs[@]}"}; do
+      case "$i" in
+        */runtime-wasm.c|runtime-wasm.c) wasm_named=1 ;;
+        *.ll) if grep -q '@nish_round_init' "$i"; then round_wanted=1; fi ;;
+      esac
+    done
+    if [ "$round_wanted" = 1 ] && [ "$wasm_named" = 0 ]; then
+      inputs+=("$(cd "$(dirname "$0")/../runtime" && pwd)/runtime-wasm.c")
+    fi
     # -mbulk-memory lowers llvm.memset/memcpy (`new Array<T>(n)`, `push` growth) to the
     # memory.fill/memory.copy instructions instead of libc calls the freestanding link lacks.
     "$CC" -Wno-override-module --target=wasm32-unknown-unknown -Oz -nostdlib -mbulk-memory \

package/std/README.md

@@ -225,6 +225,7 @@ reads one, and it still takes its randomness as an argument.
 | [`net/qpack.ts`](./net/qpack.ts) | QPACK, HTTP/3's field compression, with a dynamic table of capacity 0: `QpackEncoder` and `QpackDecoder`, one per connection. The encoder writes a field section that starts `00 00` (Required Insert Count 0, Base 0) with `beginSection`, then one field line per `encodeField(out, name, off, len, value, off, len, neverIndexed, huffman)`: an Indexed Field Line when the 99-entry static table holds the field, else a literal with the name by static index when it can, each string Huffman-coded when that is shorter and `huffman` is set, and a never-indexed field always a literal with the N bit. The decoder answers a section's fields as windows into its own `bytes` (`nameStart`, `nameLength`, `valueStart`, `valueLength`, `neverIndexed`, `count`), its arrays reused from section to section. It answers QPACK_DECOMPRESSION_FAILED, and stays spent, for a truncated section, an integer past 2^62 − 1, a non-zero Required Insert Count, a negative Base, any dynamic-table reference, a static index past 98 and bad Huffman; a section past `maxFieldSectionSize` answers `QPACK_SECTION_TOO_LARGE`, which is not fatal. `receiveEncoderStream` accepts Set Dynamic Table Capacity 0 and answers QPACK_ENCODER_STREAM_ERROR for any other capacity, Insert or Duplicate; the encoder's `receiveDecoderStream` accepts Stream Cancellations, split anywhere, and answers QPACK_DECODER_STREAM_ERROR for a Section Acknowledgment or Insert Count Increment; `reason` names the rule. `qpackPushStreamCancellation` is the one instruction it may send. The Huffman code is `nish/net/hpack`'s. A window outside its buffer, a negative limit and a stream ID outside 0 to 2^62 − 1 panic | RFC 9204 Appendix B.1, every Appendix A entry by its index, B.2 to B.5's instructions refused, and a request matched byte for byte with pylsqpack's encoding |
 | [`net/http1.ts`](./net/http1.ts) | `Http1Parser`, an incremental HTTP/1.1 request parser: `feed(buf, off, len)` any slice, then `next()` answers `HTTP1_NEED_MORE`, `HTTP1_HEAD` (`method`, `target`, `minor`, lowercased `names` beside `values`, `header(name)`, `contentLength` or `chunked`, `keepAlive`, `upgrade`), `HTTP1_BODY` (a window onto its buffer, de-chunked), `HTTP1_END`, or one of three final events: `HTTP1_UPGRADE` (`upgradeBytes()` and `declineUpgrade()`), `HTTP1_CLOSED` and `HTTP1_ERROR` with the `status` to answer. It refuses with 400 every request-smuggling shape — `Content-Length` with `Transfer-Encoding`, a repeated or non-digit `Content-Length`, an obs-fold, a bare LF, whitespace before a colon, a malformed chunk size or terminator — and with 413, 414, 431, 501 and 505 what those mean. The head is also kept as spans in a buffer reused from request to request (`head`, `spans`, `methodIs`, `targetIs`, `headerIndex`, `headerIs`, `upgradeIs`), so a parser with `keepText` off allocates nothing per request; `maxChunk` caps each `HTTP1_BODY`, and `restart()` readies it for the next connection. The writer is `http1ResponseHead(status, reason, names, values, bodyLength)`, which adds the framing field itself and refuses (`null`) a CR, LF or other control character anywhere a caller's string lands, and `http1Chunk` and `http1LastChunk` for a chunked body; `http1WriteResponseHead` and `http1WriteChunk` write the same bytes into a caller's buffer at an offset, answering `HTTP1_NO_ROOM` or `HTTP1_REFUSED`, and the first takes a date's bytes to send as a `Date` field on a final response, unless the caller's fields hold one | RFC 9112 §2–§7 and §9.3, RFC 9110 §5, §6.2, §7.2 and §7.8; a corpus fed at every split point (`tests/link/net_http1`) |
 | [`net/http1-client.ts`](./net/http1-client.ts) | The client side of HTTP/1.1, sans-IO. The writer is `http1RequestHead(method, target, names, values, bodyLength)`, `Host` first and the framing field added for `bodyLength` (`Content-Length`, `HTTP1_CHUNKED` or `HTTP1_NO_BODY`), and `http1WriteRequestHead` into a caller's buffer, answering `HTTP1_NO_ROOM` or `HTTP1_REFUSED` with nothing written; it refuses a method that is not a token, a target that is not a form the method may send, a CR, LF or control byte in a value, not exactly one `Host`, the caller's own framing fields and a `Connection: upgrade`. `Http1ResponseParser(maxStatusLine, maxHeaderBytes, maxHeaders, maxBody, maxTrailerBytes)` is told what was asked (`expect(head, connect)`), fed any slice, and `next()` answers `HTTP1_INFORMATIONAL`, `HTTP1_HEAD` (`status`, `reason`, `minor`, lowercased `names` beside `values`, `header(name)`, `contentLength`), `HTTP1_BODY` (a window, de-chunked), `HTTP1_END` with `keepAlive()`, or the final `HTTP1_UPGRADE` (a 2xx to CONNECT, `tunnelBytes()`), `HTTP1_CLOSED` and `HTTP1_ERROR`; `finish()` reports the close that ends a body read until close, and anywhere else is `HTTP1_E_TRUNCATED`. Every smuggling shape is refused with its own `HTTP1_E_*` code, as is a 101, more than `HTTP1_MAX_INFORMATIONAL` interim responses and a chunk-size line over `HTTP1_MAX_CHUNK_LINE`. Record: [`docs/security/http1-client.md`](../docs/security/http1-client.md) | RFC 9112 §4–§7 and §9.3, RFC 9110 §9.3.6 and §15.2; a corpus fed whole, cut at every byte and a byte at a time, every refusal and limit at its edge, and the server parser reading what the writer writes (`tests/link/net_http1_client`, `_f64`, `_feed_window`) |
+| [`net/http-client.ts`](./net/http-client.ts) | A blocking HTTP/1.1 client for command-line programs: `httpFetch(request, options)` looks the host up, connects, sends an `HttpRequest` (`method`, `url`, `header(name, value)`, `body`) and answers an `HttpResponse` (`status`, `reason`, `url`, `header(name)`) once its head is in, its body read through `body.read` or `body.readAll(limit)`; null on a failure. `HttpClient(options)` does the same and keeps one connection alive between fetches, sending an idempotent request once more when a kept connection turns out to be gone, and says why a fetch failed in `error` (an `HTTP_E_*` code, `httpErrorName`) and `errorText`. `HttpOptions` bounds every wait (`connectTimeoutMs`, `readTimeoutMs`, `totalTimeoutMs`) and every body (`maxBodyBytes`), follows redirects only when asked (`followRedirects`, `maxRedirects`, `crossOriginRedirects`, never https to http, credentials dropped across origins), and reads `http_proxy`, `https_proxy` and `no_proxy` when `useEnvProxy` is set (`HTTP_PROXY` ignored under CGI; https through `CONNECT`). Every byte goes through `nish/net/http1-client`. Native only. Record: [`docs/security/http-client.md`](../docs/security/http-client.md) | RFC 9110 §9.2.2 and §15.4, RFC 9112; a loopback server and proxy in the test itself: keep-alive, retries, redirects, proxies, timeouts and body caps (`tests/link/net_http_fetch`) |
 | [`net/tls/ticket.ts`](./net/tls/ticket.ts) | Session tickets a server seals for itself (RFC 8446 §4.6.1): `tlsTicketSeal` and `tlsTicketOpen` seal a `TlsTicketState` (suite, issue time, lifetime, chain start, server name, resumption PSK) under ChaCha20-Poly1305 with a borrowed `Secret<u8[]>` key, as key id ‖ nonce ‖ ciphertext ‖ tag, and wipe the plaintext on every path. `TlsTicketKeyInfo`, `tlsTicketKeyDraw` and `tlsTicketKeyDue` are a key's public record, its draw and when to replace it: a key seals for 12 h of awake time and 2^30 tickets, and opens for 14 h. `TlsTicketStrikes` is the bounded strike register (§8.1) that makes a ticket single-use, failing closed when full | `tests/link/net_tls_ticket`: every bound at its instant and 1 ns past it, a flipped bit in each region, three key rotations, replay and a full register |
 | [`net/websocket.ts`](./net/websocket.ts) | `WsDecoder(expectMasked, maxMessage)`, the same `feed` and `next()` over WebSocket frames: `WS_MESSAGE` (fragments joined, text checked as UTF-8 fragment by fragment), `WS_PING`, `WS_PONG`, and the final `WS_CLOSE` and `WS_ERROR`, whose `closeCode` is the 1002, 1007 or 1009 to close with. `websocketFrame` encodes a frame with the mask key the caller supplies (`websocketWriteFrame` into a caller's buffer, `websocketFrameSize` its length), `reset()` readies a decoder for the next connection, `websocketClosePayload` a close frame's code and reason, and `websocketIsUtf8` checks a window. The handshake is `websocketRequestKey(parser)` over an `Http1Parser`'s head, `websocketAcceptKey`, `websocketKeyIsValid` and `websocketUpgradeResponse`, the 101 | RFC 6455 §1.3's accept key, the §5.7 example frames byte for byte, §5.5's control-frame rules, §7.4's close codes |
 | [`net/http1-server.ts`](./net/http1-server.ts) | The server side of HTTP/1.1 (WP34 H1): `Http1Connection`, sans-IO, drives an `Http1Parser` — `feed`, then `next()` answers `H1_REQUEST` (the parser's head), `H1_BODY` (at most `chunkSize` bytes, either framing), `H1_END`, `H1_WRITE` (a held-back write may go again), `H1_WS_MESSAGE`, `H1_WS_CLOSE` or the final `H1_ERROR`; the program answers with `respond(status, names, values, bodyLength)`, `write` and `end`, or `acceptWebSocket(protocol)` and then `sendFrame` and `closeWebSocket`. Keep-alive and pipelining one exchange at a time, a response with a length or chunked (unframed to an HTTP/1.0 client), `Connection` and the framing decided by the server, every parser refusal answered with its status and a close, pings and closes answered on a WebSocket. Two slot pools for a program that owns its loop: `Http1Server` on plain TCP and `Http1TlsServer` on `nish/net/tls-tcp` with ALPN `http/1.1` or none (`accept`, `readable` / `writable`, `next(slot)`, `flush(slot)`, `close`, `expire(now)` for the idle timeout and the deadline for a whole head, `headTimeout`, against a client that trickles its head). Both build a slot's connection on the first accept into it rather than at start-up. `Http1Server` reads a socket until a short read rather than until it would block, takes a free slot off a stack of released slots or the next never-used one rather than scanning for one, and answers `rearm(slot, wants)`, whether the interest changed and needs a `pollModify` at all: a keep-alive request is one `recv` and one `send`. The slots borrow their output from one `Http1OutputPool` while they write and give it back once sent, so a pool's memory follows the connections the socket is holding back, not its size: an idle slot holds no output buffer. Every final response carries a `Date` from `HttpDate`, which reads `Date.now()` and formats at most once a second, shared by a pool's slots; `pin(unixMs)` fixes it for a test, and a program's own `date` field replaces it. Every cap is an `Http1Config` number fixed at start-up, and a warmed slot allocates nothing per request (`docs/security/http1.md`). Native only, as `nish:net` is | RFC 9112 §6, §7, §9; RFC 9110 §9.3.2, §15; RFC 6455 §4.2, §5.5. Nish clients over loopback against both carriers, requests cut at every byte, 2 MiB bodies each way, pipelining, a WebSocket echo, the arena flat over two hundred requests, the date formatted once a second, and every refusal (`tests/link/net_http1_server`); `curl` against its `serve` mode |
@@ -239,7 +240,7 @@ reads one, and it still takes its randomness as an argument.
 | [`net/webtransport.ts`](./net/webtransport.ts) | `WebTransport`, the server side of WebTransport over HTTP/3 as draft-ietf-webtrans-http3-02 has it and Chrome and `wtransport` 0.7 negotiate it, a layer over one `Http3Connection` whose `Http3Config.webtransportSessions` turns it on (extended CONNECT, SETTINGS_H3_DATAGRAM and the draft's two WebTransport settings): `next()` answers `WT_SESSION` (the program `accept`s or `refuse`s it), `WT_DATAGRAM`, `WT_STREAM`, `WT_STREAM_DATA`, `WT_STREAM_END`, `WT_STREAM_RESET`, `WT_STREAM_STOPPED`, `WT_WRITABLE`, `WT_DRAIN` and `WT_CLOSED`, and passes a plain request's `H3_*` events through; `sendDatagram` (the quarter stream ID, then the payload), `openStream`, `write`, `resetStream`, `stopSending`, `close` (CLOSE_WEBTRANSPORT_SESSION) and `drain`. Streams that arrive before their session wait, bounded; every cap is fixed at start-up, and a warm session allocates nothing per datagram or stream (`docs/security/webtransport.md`) | RFC 9220, RFC 9297 and draft-02: a Nish client over QUIC — sessions, datagrams at the size limits, streams both ways, close and drain from either side, every refusal — and one exchange recorded from a `wtransport` 0.7 client replayed byte for byte (`tests/link/net_webtransport`) |
 | [`net/http-compress.ts`](./net/http-compress.ts) | Content coding for HTTP responses: `httpAcceptEncoding(buf, start, end, offered)` reads an `Accept-Encoding` value (q-values, `*`, `identity`, `x-gzip`) into `HTTP_CODING_GZIP`, `HTTP_CODING_DEFLATE`, `HTTP_CODING_IDENTITY` or `HTTP_CODING_NONE`, allocating nothing; `HttpCompressor(level, minLength, maxLength)` gzips a body into its own buffer when it is worth it (-1 to send it as it is) and builds the response fields (`addFields`: `Content-Encoding: gzip` and, while `vary`, `Vary: Accept-Encoding`). On HTTP/1.1, `Http1Connection.acceptEncoding()` and `respondEncoded(status, names, values, body, off, len, enc, coding)` answer a request in one call with the compressed `Content-Length`, or nothing at all (`H1_AGAIN`, `H1_INVALID`). Opt-in; BREACH is the program's to avoid (`docs/security/compress.md`) | RFC 9110 §8.4 and §12.5.3: the negotiation table, and sans-IO responses gunzipped back (`tests/link/std_http_compress`) |
 | [`net/router.ts`](./net/router.ts) | `Router`, a method and path router that knows no carrier and allocates nothing per match: `add(method, pattern)` answers the route's index (0, 1, 2 in the order added) or a refusal — `ROUTER_BAD_PATTERN`, `ROUTER_BAD_METHOD`, `ROUTER_TOO_LONG`, `ROUTER_AMBIGUOUS` (`*` not last), `ROUTER_DUPLICATE` (the same shape and method, whatever the parameter names) or `ROUTER_FULL`, against `RouterLimits`; `match(method, mStart, mEnd, target, tStart, tEnd, params)` answers the index, `ROUTER_NOT_FOUND` or `ROUTER_METHOD_NOT_ALLOWED`, writing each `:name` and a final `*` as a `[start, end)` pair into the caller's `params` (`ROUTER_TOO_MANY_PARAMS` when it is short). Literal before parameter before `*`, segment by segment, backtracking; a lookup enters each node at most once. The query is left unparsed and nothing is decoded: `routerDecode` decodes one parameter (`ROUTER_BAD_ESCAPE`, `ROUTER_NO_ROOM`) (`docs/security/router.md`) | Every refusal code, precedence and backtracking, 405 against 404, `%2F` kept in one segment, the query, `*` and authority-form targets, a target deeper than any route, the lookup bound, params past storage, and the arena flat over matches (`tests/link/net_router`, `net_router_f64`, five `net_router_negative_*`) |
-| [`net/postgres.ts`](./net/postgres.ts) | `PgConnection`, a PostgreSQL client that reads no socket: the program fills `inputBuffer()` and sends `outputBuffer()`, and `next()` answers `PG_NEED_MORE`, `PG_READY`, `PG_DESCRIBED`, `PG_ROW`, `PG_COMPLETE`, `PG_ERROR`, `PG_NOTICE`, `PG_GROUP_DONE` or the final `PG_FAILED` (`failure`, one of the `PG_ERR_*` codes). Protocol 3.0: startup, `trust` and SCRAM-SHA-256 with the server's signature checked (cleartext and MD5 refused), the extended query protocol — `prepare`, `bindStart`, `paramInt` / `paramText` / `paramBytes` / `paramTextArray` / `paramIntArray` / `paramNull`, an array built element by element into the Bind (`arrayStart`, `arrayElement`, `arrayInt`, `arrayNull`, `arrayEnd`), `bindEnd`, `bindCancel` to drop a Bind not yet ended, `closeStatement`, `sync` — with up to `maxInFlight` groups pipelined. `PgBatcher` queues keyed reads of one statement shape (`addInt`, `addText`) and `take(conn)` binds up to `maxRequests` of them, each key once, as one execution over `unnest($1) with ordinality`; `row`, `end` and `fail` route its rows by their server-supplied ordinal, checked first, to `next(run)`'s per-request `PG_BATCH_ROW` and `PG_BATCH_DONE` / `PG_BATCH_MISSING` / `PG_BATCH_FAILED`; `take` answers a fresh handle each time, so a server's late or repeated event on a spent one is counted in `stray`, never routed or panicked on. It reads no clock and allocates nothing per request or row. A row's columns are windows onto the receive buffer (`colStart`, `colLength`), read in place by `int`, `bool`, `isNull` and `PgText`'s decoders (`timestamptz`, `PgArrayWalker` for `text[]`); no per-row or per-column allocation. The password is a `Secret<u8[]>`, wiped once the proof is made. Caps on message size, columns, groups in flight and SCRAM iterations (`docs/security/postgres.md`) | PostgreSQL 18's frontend/backend protocol chapter, RFC 5802 and RFC 7677: every builder, event and refusal (`tests/link/std_postgres`), and exchanges recorded from PostgreSQL 18 by `tests/postgres/record.mjs` replayed byte for byte (`tests/link/std_postgres_replay`); the batcher's queueing, caps and ordinal refusals (`tests/link/std_postgres_batch`) |
+| [`net/postgres.ts`](./net/postgres.ts) | `PgConnection`, a PostgreSQL client that reads no socket: the program fills `inputBuffer()` and sends `outputBuffer()`, and `next()` answers `PG_NEED_MORE`, `PG_READY`, `PG_DESCRIBED`, `PG_ROW`, `PG_COMPLETE`, `PG_ERROR`, `PG_NOTICE`, `PG_GROUP_DONE` or the final `PG_FAILED` (`failure`, one of the `PG_ERR_*` codes). Protocol 3.0: startup, `trust` and SCRAM-SHA-256 with the server's signature checked (cleartext and MD5 refused), the extended query protocol — `prepare`, `bindStart`, `paramInt` / `paramText` / `paramBytes` / `paramTextArray` / `paramIntArray` / `paramNull`, an array built element by element into the Bind (`arrayStart`, `arrayElement`, `arrayInt`, `arrayNull`, `arrayEnd`), `bindEnd`, `bindStartBinary` for a Bind whose result columns come in binary (read in place by `binaryInt`, `binaryBool`, `binaryFloat` and `PgBinary`'s `timestamp` and `iso`, and a one-dimensional `int2[]`, `int4[]` or `int8[]` by `PgBinaryArray`), `bindCancel` to drop a Bind not yet ended, `closeStatement`, `sync` — with up to `maxInFlight` groups pipelined. `PgBatcher` queues keyed reads of one statement shape (`addInt`, `addText`) and `take(conn)` binds up to `maxRequests` of them, each key once, as one execution over `unnest($1) with ordinality`; `row`, `end` and `fail` route its rows by their server-supplied ordinal, checked first (read with `binaryInt` when `PgBatchConfig.binary` is set, so the batch's rows come in binary too), to `next(run)`'s per-request `PG_BATCH_ROW` and `PG_BATCH_DONE` / `PG_BATCH_MISSING` / `PG_BATCH_FAILED`; `take` answers a fresh handle each time, so a server's late or repeated event on a spent one is counted in `stray`, never routed or panicked on. It reads no clock and allocates nothing per request or row. A row's columns are windows onto the receive buffer (`colStart`, `colLength`), read in place by `int`, `bool`, `isNull` and `PgText`'s decoders (`timestamptz`, `PgArrayWalker` for `text[]`); no per-row or per-column allocation. The password is a `Secret<u8[]>`, wiped once the proof is made. Caps on message size, columns, groups in flight and SCRAM iterations (`docs/security/postgres.md`) | PostgreSQL 18's frontend/backend protocol chapter, RFC 5802 and RFC 7677: every builder, event and refusal (`tests/link/std_postgres`), and exchanges recorded from PostgreSQL 18 by `tests/postgres/record.mjs` replayed byte for byte (`tests/link/std_postgres_replay`); the batcher's queueing, caps and ordinal refusals (`tests/link/std_postgres_batch`) |
 
 **How a carrier drives `TlsServer`.** The server speaks in handshake
 *messages*, tagged by level: `TLS_LEVEL_INITIAL` (cleartext — ClientHello,
@@ -496,7 +497,7 @@ have, and all three have since landed as builtins:
 | Was missing | Now |
 | --- | --- |
 | a directory listing | `readdirSync(path): string[] \| null`, sorted by bytes, because there is no `sort` for a caller to reach for |
-| a child's **output** — `spawnSync` answers a status and nothing else | `spawnSyncTo(argv, stdoutPath, stderrPath)`, each stream to a file, an empty path inheriting |
+| a child's **output** — `spawnSync` answers a status and nothing else | `spawnSyncTo(argv, stdoutPath, stderrPath)`, each stream to a file, an empty path inheriting; `spawnPiped(argv, stdin, stdout, stderr)`, stdin from a `u8[]` and both outputs into `u8[]`s, for a secret the child reads on stdin |
 | a clock | `monotonicNanos(): i64` |
 
 So the driver exists, in the language, and it is