@amritk/nish-x86_64-linux 0.16.0 → 0.17.0

package/runtime/runtime-host.c

@@ -156,46 +156,65 @@ _Bool nish_is_executable(const nish_str *path) {
  * async-signal-safe. The write end is non-blocking, so a thousand unread
  * signals lose the newest rather than wedge the handler, and `errno` is put
  * back for the code the signal interrupted. The descriptor is made once and
- * every later `signalFd()` answers the same one. */
-static int nish_signal_read_end = -1;
-static int nish_signal_write_end = -1;
+ * every later `signalFd()` answers the same one.
+ *
+ * Both ends live in one word, the read end in the high half and the write end
+ * in the low, -1 until the pipe exists, so that publishing them is a single
+ * compare-and-swap (docs/security/runtime.md, RT-10). Two threads whose first
+ * calls overlap can each make a pipe; one swap wins, the other caller closes
+ * its own pipe and answers the winner's read end. With two separate words the
+ * call that finished last answered its own pipe while the handler wrote to
+ * the other, so one caller never heard a signal and a pipe leaked. Each first
+ * caller installs the handler itself before it returns, so neither can hand
+ * back a descriptor before a signal reaches it. */
+static int64_t nish_signal_pipe = -1;
 
 static void nish_on_signal(int sig) {
   int saved = errno;
   unsigned char b = (unsigned char)sig;
-  (void)!write(nish_signal_write_end, &b, 1);
+  /* The low half: the write end. */
+  (void)!write((int)__atomic_load_n(&nish_signal_pipe, __ATOMIC_RELAXED), &b, 1);
   errno = saved;
 }
 
 int32_t nish_signal_fd(void) {
-  if (nish_signal_read_end >= 0) return nish_signal_read_end;
-  int p[2];
+  int64_t cur = __atomic_load_n(&nish_signal_pipe, __ATOMIC_ACQUIRE);
+  if (cur < 0) {
+    int p[2];
 #if defined(__linux__)
-  /* Both ends close-on-exec from the moment they exist, so a child a sibling
-     thread spawns meanwhile cannot inherit either. */
-  if (pipe2(p, O_CLOEXEC) != 0) return -1;
+    /* Both ends close-on-exec from the moment they exist, so a child a sibling
+       thread spawns meanwhile cannot inherit either. */
+    if (pipe2(p, O_CLOEXEC) != 0) return -1;
 #else
-  /* Darwin has no `pipe2`, so there is a window between `pipe` and the two
-     `fcntl`s in which a child spawned by another thread inherits the ends. */
-  if (pipe(p) != 0) return -1;
-  fcntl(p[0], F_SETFD, FD_CLOEXEC);
-  fcntl(p[1], F_SETFD, FD_CLOEXEC);
+    /* Darwin has no `pipe2`, so there is a window between `pipe` and the two
+       `fcntl`s in which a child spawned by another thread inherits the ends. */
+    if (pipe(p) != 0) return -1;
+    fcntl(p[0], F_SETFD, FD_CLOEXEC);
+    fcntl(p[1], F_SETFD, FD_CLOEXEC);
 #endif
-  fcntl(p[1], F_SETFL, O_NONBLOCK);
-  nish_signal_write_end = p[1];
-  struct sigaction sa;
-  sa.sa_handler = nish_on_signal;
-  sa.sa_flags = SA_RESTART;
-  sigemptyset(&sa.sa_mask);
-  sigaction(SIGINT, &sa, 0);
-  sigaction(SIGTERM, &sa, 0);
-  return nish_signal_read_end = p[0];
+    fcntl(p[1], F_SETFL, O_NONBLOCK);
+    int64_t mine = (int64_t)p[0] << 32 | (uint32_t)p[1];
+    /* A failed swap leaves the winner's pair in `cur`. */
+    if (__atomic_compare_exchange_n(&nish_signal_pipe, &cur, mine, 0, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE)) {
+      cur = mine;
+    } else {
+      close(p[0]);
+      close(p[1]);
+    }
+    struct sigaction sa;
+    sa.sa_handler = nish_on_signal;
+    sa.sa_flags = SA_RESTART;
+    sigemptyset(&sa.sa_mask);
+    sigaction(SIGINT, &sa, 0);
+    sigaction(SIGTERM, &sa, 0);
+  }
+  return (int32_t)(cur >> 32);
 }
 
 /* Block until a signal's byte arrives and answer it: 15 or 2, or -1 for any
    `fd` that is not the signal descriptor and for a read that fails. */
 int32_t nish_read_signal(int32_t fd) {
-  if (fd != nish_signal_read_end) return -1;
+  if (fd != (int32_t)(__atomic_load_n(&nish_signal_pipe, __ATOMIC_ACQUIRE) >> 32)) return -1;
   unsigned char b;
   ssize_t n;
   do n = read(fd, &b, 1);

package/runtime/runtime-net.c

@@ -12,13 +12,15 @@
  * scripts/build.sh pairs this file with runtime.c like the other halves, so a
  * link line still names one runtime.
  *
- * The error convention is the one `signalFd` set: an `i32`, `>= 0` for
- * success (a descriptor, a byte count, 0), and a negative errno otherwise.
- * The codes a loop branches on are Linux's numbers on every platform (-11
+ * Errors take the shape `signalFd` set, an `i32` that is `>= 0` for success
+ * (a descriptor, a byte count, 0) and negative for a failure, and add the
+ * errno to it: where `signalFd` and `readSignal` answer a plain -1, a call
+ * here answers the failure's errno, negated. The codes a loop branches on are Linux's numbers on every platform (-11
  * would block, -95 unsupported, -32 the peer is gone, -104 reset, -98 the
- * address is in use, -22 a bad argument), so `nish_net_err` translates
- * Darwin's; any other failure is the host's own `-errno`. Nothing here
- * allocates: the addresses a call reads or writes are the caller's `u8[]`.
+ * address is in use, -111 refused, -110 timed out, -22 a bad argument), so
+ * `nish_net_err` translates Darwin's; any other failure is the host's own
+ * `-errno`. Nothing here allocates: the addresses a call reads or writes are
+ * the caller's `u8[]`.
  *
  * An address is 18 bytes of that array: the 16 bytes of an IPv6 address, an
  * IPv4 one as `::ffff:a.b.c.d`, then the port, big-endian. An IPv4 address is
@@ -33,7 +35,10 @@
  * both, never SIGPIPE), the errno numbers, UDP's segmentation offload
  * (`UDP_SEGMENT`, `UDP_GRO`) and ECN marks, which Linux has and for which
  * Darwin answers -95, and the readiness loop, which is epoll on Linux and
- * kqueue on Darwin. The Darwin branch is compiled by CI's Darwin bootstrap
+ * kqueue on Darwin. Only the sending side and the GRO bind say -95 there: a
+ * receive leaves `meta` at 0, 0, and a `meta[1]` of 0 is also what a real
+ * Not-ECT datagram reads as, so a program learns that Darwin has no ECN from
+ * the send, never from the receive. The Darwin branch is compiled by CI's Darwin bootstrap
  * rows and run by nothing. A WASI build has none of this (the checker refuses
  * every `nish:net` call under a wasm target), so there the file is empty.
  */
@@ -91,6 +96,8 @@ static int32_t nish_net_err(int e) {
   if (e == EOPNOTSUPP || e == ENOTSUP) return -95;
   if (e == ECONNRESET) return -104;
   if (e == EADDRINUSE) return -98;
+  if (e == ECONNREFUSED) return -111;
+  if (e == ETIMEDOUT) return -110;
 #endif
   return -e;
 }
@@ -111,8 +118,11 @@ static int nish_net_parse(const nish_str *s, unsigned char a[16]) {
   return inet_pton(AF_INET6, host, a) == 1;
 }
 
-/* `a` and `port` as a socket address of the family `v4` names. */
-static socklen_t nish_net_sockaddr(nish_sockaddr *s, const unsigned char a[16], int32_t port, int v4) {
+/* `a` and `port` as a socket address of the family `v4` names. `noinline`:
+   three calls share one body, which inlined into each was 42 bytes more of
+   `.text` than the calls cost. */
+__attribute__((noinline)) static socklen_t nish_net_sockaddr(nish_sockaddr *s, const unsigned char a[16],
+                                                             int32_t port, int v4) {
   memset(s, 0, sizeof *s);
   if (v4) {
     s->v4.sin_family = AF_INET;
@@ -269,6 +279,41 @@ int32_t nish_tcp_accept(int32_t fd, nish_array *peer) {
   return c;
 }
 
+/* `tcpConnect(addr)`: a new socket, non-blocking and close-on-exec, connecting
+   to the address in `addr`; an IPv4 one is an `AF_INET` socket, any other
+   `AF_INET6`. A non-blocking `connect` seldom finishes at once (on Linux not
+   even over loopback), and its `EINPROGRESS` (-115) is not a failure: the
+   descriptor is answered all the same, and the connection is made once the
+   loop reports it writable, when `connectResult` says how it went. Any other
+   failure closes the socket and is answered instead of it. An `addr` shorter
+   than 18 bytes is -22 before any socket exists. */
+int32_t nish_tcp_connect(const nish_array *addr) {
+  if (addr->len < NISH_ADDR_BYTES) return -22;
+  const unsigned char *p = (const unsigned char *)addr->data;
+  int v4 = memcmp(p, nish_mapped_prefix, 12) == 0;
+  int fd = nish_net_socket(v4 ? AF_INET : AF_INET6, SOCK_STREAM);
+  if (fd < 0) return nish_net_fail();
+  nish_sockaddr s;
+  socklen_t n = nish_net_sockaddr(&s, p, (p[16] << 8) | p[17], v4);
+  if (connect(fd, &s.sa, n) != 0 && errno != EINPROGRESS) {
+    int e = errno;
+    close(fd);
+    return nish_net_err(e);
+  }
+  return fd;
+}
+
+/* `connectResult(fd)`: how the connection `tcpConnect` started went, once the
+   descriptor is writable: 0 when it is made, or its failure (-111 refused,
+   -110 timed out) from `SO_ERROR`. The kernel clears `SO_ERROR` as it is
+   read, so a failure is answered once. */
+int32_t nish_connect_result(int32_t fd) {
+  int e = 0;
+  socklen_t n = sizeof e;
+  if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &e, &n) != 0) return nish_net_fail();
+  return e != 0 ? nish_net_err(e) : 0;
+}
+
 /* `netRead(fd, buf, off, len)`: at most `len` bytes into `buf` from `off`.
    The compiled call has already checked `0 <= off <= off + len <=
    buf.length`, unless the program was built with `--unchecked-indexing`. */
@@ -390,7 +435,9 @@ int32_t nish_udp_recv_from(int32_t fd, nish_array *buf, int64_t off, int64_t len
       .msg_name = &s, .msg_namelen = sizeof s, .msg_iov = &iov, .msg_iovlen = 1, .msg_control = c.b, .msg_controllen = sizeof c};
   ssize_t got = recvmsg(fd, &m, 0);
   if (got < 0) return nish_net_fail();
-  /* Darwin sets neither option, so both stay 0 there. */
+  /* Darwin sets neither option, so both stay 0 there: a `meta[1]` that reads
+     as Not-ECT whatever arrived, which is why the -95 of a marked send, not
+     this, is how a program learns ECN is unsupported. */
   int32_t info[2] = {0, 0};
 #if defined(__linux__)
   for (struct cmsghdr *h = CMSG_FIRSTHDR(&m); h != NULL; h = CMSG_NXTHDR(&m, h)) {

package/runtime/runtime-os.c

@@ -34,6 +34,7 @@
    the LEGACY symbol, for which a NULL second argument is undefined. */
 #define _XOPEN_SOURCE 700
 #include <dirent.h>
+#include <errno.h>
 #include <limits.h>
 #include <fcntl.h>
 #include <stdint.h>
@@ -59,6 +60,11 @@ extern char **environ;
 #if defined(__APPLE__) && !defined(O_NOFOLLOW)
 #define O_NOFOLLOW 0x00000100
 #endif
+/* `O_CLOEXEC` is POSIX 2008 and declared at that level everywhere; the
+   fallback is for an older Darwin SDK, with its value from the same header. */
+#if defined(__APPLE__) && !defined(O_CLOEXEC)
+#define O_CLOEXEC 0x01000000
+#endif
 
 /* The same spelling runtime.c uses for its own cold paths: a function that
    reports and exits is never on a path worth optimising for. */
@@ -96,9 +102,16 @@ static NISH_COLD void nish_io_fail(const char *what, const nish_str *path) {
  * narrower guard would have made it `null` here and split the two compilers
  * again for the entry a command line can name. `fstat` on the descriptor
  * rather than `stat` on the path, so the answer is about the file that was
- * opened and not about whatever the name means a moment later. */
+ * opened and not about whatever the name means a moment later.
+ *
+ * The descriptor is `O_CLOEXEC` (docs/security/runtime.md, RT-12): a child
+ * that a `scope()` task spawns while another task reads would otherwise
+ * inherit it. A `pread` that a signal interrupts before it moves a byte is
+ * retried rather than taken for the end of the file (RT-13). A local disk
+ * never interrupts one, but FUSE and NFS can, and stopping there would hand
+ * back the bytes so far as the whole file. */
 nish_str *nish_read_file_or_null(const nish_str *path) {
-  int fd = open(nish_cpath(path), O_RDONLY);
+  int fd = open(nish_cpath(path), O_RDONLY | O_CLOEXEC);
   if (fd < 0) return 0;
   struct stat st;
   off_t len = fstat(fd, &st) == 0 && !S_ISDIR(st.st_mode) ? lseek(fd, 0, SEEK_END) : -1;
@@ -114,7 +127,13 @@ nish_str *nish_read_file_or_null(const nish_str *path) {
   nish_str *s = nish_alloc_struct(8 + len + 1);
   uint64_t got = 0;
   ssize_t n;
-  while ((n = pread(fd, s->data + got, len - got, got)) > 0) got += n;
+  while ((n = pread(fd, s->data + got, len - got, got)) != 0) {
+    if (n > 0) {
+      got += n;
+    } else if (errno != EINTR) {
+      break;
+    }
+  }
   close(fd);
   s->len = got;
   s->data[got] = 0;
@@ -147,14 +166,21 @@ nish_str *nish_read_file(const nish_str *path) {
    followed to whatever file it names. `nish file.ts` writes `file.ll` beside
    its source, so a link planted at that name in a checkout would otherwise
    truncate any file the user can write. A link among the directories on the
-   way is still followed. */
+   way is still followed.
+
+   `O_CLOEXEC` for the reason the read has it (RT-12), and `EINTR` is retried
+   as the read retries it (RT-13): a write cut short is finished, and one that
+   fails is `cannot write`, never a silently short file. */
 static void nish_put_file(const nish_str *path, const nish_str *data, int flags) {
-  int fd = open(nish_cpath(path), O_WRONLY | O_CREAT | O_NOFOLLOW | flags, 0644);
+  int fd = open(nish_cpath(path), O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC | flags, 0644);
   if (fd < 0) nish_io_fail("write ", path);
   for (uint64_t done = 0; done < data->len;) {
     ssize_t n = write(fd, data->data + done, data->len - done);
-    if (n <= 0) nish_io_fail("write ", path);
-    done += n;
+    if (n > 0) {
+      done += n;
+    } else if (n == 0 || errno != EINTR) {
+      nish_io_fail("write ", path);
+    }
   }
   close(fd);
 }
@@ -214,24 +240,22 @@ static int32_t nish_spawn_impl(const nish_array *argv, const nish_str *out, cons
     if (v[i] != s[i]->data) return -1;
   }
   v[i] = 0;
+  /* One list of file actions whether or not a stream is redirected: an empty
+     list is the same spawn as none, and one path through is less code than
+     creating the list only when a stream needs it. */
   posix_spawn_file_actions_t fa;
-  posix_spawn_file_actions_t *fap = 0;
+  if (posix_spawn_file_actions_init(&fa)) return -1;
   const nish_str *to[2] = { out, err };
   for (int k = 0; k < 2; k++) {
-    if (!to[k]) continue;
-    if (!fap) {
-      if (posix_spawn_file_actions_init(&fa)) return -1;
-      fap = &fa;
-    }
     /* The child opens the file, not this process: a redirect that this process
        performed would have to be undone afterwards, and a failed open would
        leave its own stdout pointing at the file. */
-    posix_spawn_file_actions_addopen(fap, k + 1, nish_cpath(to[k]), O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0644);
+    if (to[k]) posix_spawn_file_actions_addopen(&fa, k + 1, nish_cpath(to[k]), O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0644);
   }
   pid_t pid;
   int status;
-  int failed = posix_spawnp(&pid, v[0], fap, 0, v, environ);
-  if (fap) posix_spawn_file_actions_destroy(fap);
+  int failed = posix_spawnp(&pid, v[0], &fa, 0, v, environ);
+  posix_spawn_file_actions_destroy(&fa);
   if (failed) return -1;
   if (waitpid(pid, &status, 0) < 0) return -1;
   return WIFSIGNALED(status) ? 128 + WTERMSIG(status) : WEXITSTATUS(status);
@@ -329,6 +353,10 @@ int64_t nish_monotonic_nanos(void) {
   return (int64_t)ts.tv_sec * 1000000000 + ts.tv_nsec;
 }
 
+/* A C string copied into the arena, or NULL for NULL: the shape of every
+   answer libc hands back by pointer, `getenv`'s here and `realpath`'s below. */
+static nish_str *nish_str_or_null(const char *v) { return v ? nish_str_new(v, strlen(v)) : 0; }
+
 /* ---- The environment (WP19 R1): `getenv(name)`, the one environment read the
    language has. A driver needs it to honour `CC` the way `scripts/build.sh`
    does before it spawns that script, which is the whole reason it exists.
@@ -340,8 +368,7 @@ int64_t nish_monotonic_nanos(void) {
    string with the lifetime every other one has. NULL for an unset variable,
    which is the language's `string | null`. Contract: nish.h. */
 nish_str *nish_getenv(const nish_str *name) {
-  const char *v = getenv(nish_cpath(name));
-  return v ? nish_str_new(v, strlen(v)) : 0;
+  return nish_str_or_null(getenv(nish_cpath(name)));
 }
 
 /* ---- Symlinks (WP19 §5a item 4): `realpathSync(path)`, the one path
@@ -363,10 +390,25 @@ nish_str *nish_getenv(const nish_str *name) {
    and the stack buffer is gone at the return. NULL when the path does not
    resolve -- a path that does not exist included -- which is the language's
    `string | null` rather than an error, because the caller is asking whether
-   it resolves. Contract: nish.h. */
+   it resolves. Contract: nish.h.
+
+   A wasi-libc from before 2024, which is what Ubuntu and Debian package,
+   neither declares nor defines `realpath`, so there every path is one that
+   does not resolve and the answer is NULL. WebAssembly/wasi-libc#463 declared
+   it and #473 defined it a month later, with no wasi-sdk release between, and
+   #463 also gave `<dirent.h>` its `DT_SOCK`, which the old headers spell only
+   for upstream musl. So a missing `DT_SOCK` is the test: it names the libc
+   without the function, and wasi-sdk 22 and later keep the real `realpath`.
+   It is a preprocessor test rather than a declaration of our own because the
+   old libc.a has no definition to link. */
 nish_str *nish_realpath(const nish_str *path) {
+#if defined(__wasi__) && !defined(DT_SOCK)
+  (void)path;
+  return 0;
+#else
   char buf[PATH_MAX];
-  return realpath(nish_cpath(path), buf) ? nish_str_new(buf, strlen(buf)) : 0;
+  return nish_str_or_null(realpath(nish_cpath(path), buf));
+#endif
 }
 
 /* ---- What machine this is (WP14 §7a): `process.platform` and `process.arch`,

package/runtime/runtime-wasm.c

@@ -119,6 +119,7 @@ void nish_array_grow(nish_array *a, uint64_t elem_size) {
 void nish_panic_index(uint64_t idx, uint64_t len) { (void)idx; (void)len; __builtin_trap(); }
 void nish_panic_slice(int64_t s, int64_t e, int64_t len) { (void)s; (void)e; (void)len; __builtin_trap(); }
 void nish_panic_div(_Bool by_zero) { (void)by_zero; __builtin_trap(); }
+void nish_panic_overflow(uint32_t op) { (void)op; __builtin_trap(); }
 void nish_exit(int32_t code) { (void)code; __builtin_trap(); }
 /* A panic's message (`panic`, `expect`, a failed range entry) has no stderr to
  * go to here; the `nish_exit` that follows it is the trap. An exported function

package/runtime/runtime.c

@@ -79,8 +79,12 @@ _Static_assert(offsetof(struct nish_arena, off) == 8, "the inlined allocator bum
 _Static_assert(offsetof(struct nish_arena, cap) == 16, "the inlined allocator reads field 2");
 _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI");
 
+/* `fputs` rather than one `write`: libc's own loop finishes a short write,
+   which a bare `write` would cut off (docs/security/runtime.md, RT-11), and
+   stderr is unbuffered, so the message leaves before `_exit`. A C host that
+   gives stderr a buffer of its own would lose it here. */
 static NISH_COLD void nish_die(const char *msg) {
-  (void)!write(2, msg, strlen(msg));
+  fputs(msg, stderr);
   _exit(1);
 }
 /* A function rather than a macro around `nish_die`: seven call sites each
@@ -214,7 +218,7 @@ nish_str *nish_str_concat(const nish_str *a, const nish_str *b) {
   s->len = len;
   memcpy(s->data, a->data, a->len);
   memcpy(s->data + a->len, b->data, b->len);
-  s->data[s->len] = 0;
+  s->data[len] = 0;
   return s;
 }
 
@@ -262,9 +266,22 @@ int64_t nish_str_index_of(const nish_str *s, const nish_str *sub) {
 }
 
 /* `console.log` / `console.error` / `write` / `writeError` and the message of
-   `panic`: fd 1 or 2, with or without the trailing newline. */
+   `panic`: fd 1 or 2, with or without the trailing newline.
+
+   A pipe or a socket can take part of a long string and answer the count it
+   took: a signal that lands mid-write ends the call early, and a full pipe
+   does the same. So the bytes are written until all of them are out, or until
+   a write fails (docs/security/runtime.md, RT-11). A failure still ends the
+   output, `EAGAIN` on a non-blocking stdout included, since spinning on it
+   would burn a core. `EINTR` is not retried here: it needs a handler
+   installed without `SA_RESTART`, and the only one this runtime installs
+   (runtime-host.c) has it, so an interrupted write either restarts in the
+   kernel or comes back short. The newline needs no loop: one byte is never
+   written in part. */
 void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
-  (void)!write(fd, s->data, s->len);
+  uint64_t done = 0;
+  ssize_t k;
+  while (done < s->len && (k = write(fd, s->data + done, s->len - done)) > 0) done += k;
   if (newline) (void)!write(fd, "\n", 1);
 }
 /* console.log(s) */
@@ -1203,6 +1220,20 @@ __attribute__((noinline)) void nish_array_grow(nish_array *a, uint64_t elem_size
   a->cap = cap;
 }
 
+/* `secureZero(bytes)` (#385): every byte of the array set to zero, in stores
+ * no optimisation may remove. A `memset` here would be a dead store wherever
+ * the buffer's life ends straight after the call -- a key in a frame that
+ * returns, a block that is freed -- and links use `-flto`, which inlines this
+ * body into that caller and lets dead-store elimination see it. Each store goes
+ * through a `volatile` pointer, so each is behaviour the C standard keeps
+ * whatever the optimiser can see, and `noinline` keeps the call itself in the
+ * binary for a reader of the disassembly. A byte at a time, because a secret
+ * is a key or a scalar of tens of bytes, not a buffer worth a vector loop. */
+__attribute__((noinline)) void nish_wipe(nish_array *bytes) {
+  volatile char *p = bytes->data;
+  for (uint64_t i = 0; i < bytes->len; i++) p[i] = 0;
+}
+
 void nish_panic_index(uint64_t idx, uint64_t len) {
   dprintf(2, "index out of range: %" PRIu64 " >= %" PRIu64 "\n", idx, len);
   _exit(1);
@@ -1221,7 +1252,14 @@ void nish_panic_slice(int64_t start, int64_t end, int64_t len) {
   _exit(1);
 }
 
-/* ---- Checked division (Rust semantics): the failed-check path */
-void nish_panic_div(_Bool by_zero) {
-  nish_die(by_zero ? "attempt to divide by zero\n" : "attempt to divide with overflow\n");
-}
+/* ---- Checked arithmetic (Rust semantics): the failed-check paths. One table
+   for both panics, because each message is "attempt to <what>" and the two
+   functions then share everything but the index. `nish_panic_overflow`'s `op`
+   is the operator whose `llvm.s*.with.overflow` flagged: 0 add, 1 subtract,
+   2 multiply, 3 negate, the order `src/emit-ops.ts` numbers them in. */
+static const char *const nish_arith_panics[6] = {
+  "attempt to add with overflow\n",      "attempt to subtract with overflow\n",
+  "attempt to multiply with overflow\n", "attempt to negate with overflow\n",
+  "attempt to divide with overflow\n",   "attempt to divide by zero\n"};
+void nish_panic_overflow(uint32_t op) { nish_die(nish_arith_panics[op]); }
+void nish_panic_div(_Bool by_zero) { nish_panic_overflow(4 + by_zero); }

package/runtime/shim.mjs

@@ -123,6 +123,52 @@ export function ctEq(a, b) {
   return (a ^ b) === 0 ? 0xffffffff : 0;
 }
 
+/**
+ * `nish:secret` (docs/LANGUAGE.md, "Secrets"). Natively the compiler holds a
+ * `Secret` to its rules and `wipe` is a volatile store of zeros; here the rules
+ * have already been checked by the compiler or by nobody, so a `Secret` is a
+ * plain wrapper and `wipe` zero-fills what it holds. `runtime/nish.mjs`
+ * resolves the `nish:secret` specifier to this module, so these are its
+ * exports by name. A zero-fill under Node promises nothing about copies the
+ * engine made, which is the native wipe's whole point and is not claimed here.
+ */
+export class Secret {
+  constructor(value) {
+    this.value = value;
+  }
+}
+
+export function secret(value) {
+  return new Secret(value);
+}
+
+export function expose(s, f) {
+  return f(s.value);
+}
+
+export function exposeWith(s, arg, f) {
+  return f(s.value, arg);
+}
+
+/** Zero an array of integers, or every integer field of a record: `0` for a number, `0n` for an `i64` or `u64`. */
+function zeroFill(target) {
+  if (Array.isArray(target) || ArrayBuffer.isView(target)) {
+    for (let i = 0; i < target.length; i++) {
+      target[i] = typeof target[i] === "bigint" ? 0n : 0;
+    }
+    return;
+  }
+  for (const key of Object.keys(target)) {
+    const field = target[key];
+    if (typeof field === "bigint") target[key] = 0n;
+    else if (typeof field === "number") target[key] = 0;
+  }
+}
+
+export function wipe(target) {
+  zeroFill(target instanceof Secret ? target.value : target);
+}
+
 /** Wrap a BigInt to the i64 range: every i64 `+ - * /` and unary minus goes through here. */
 export function wrapI64(x) {
   return BigInt.asIntN(64, x);
@@ -497,9 +543,22 @@ export function readFileBytesSync(path) {
   }
 }
 
+/**
+ * The flags `runtime-os.c` opens a file it writes with, `O_NOFOLLOW` included
+ * (docs/security/runtime.md, RT-4): a symbolic link as the last component of
+ * the path is refused rather than followed, so `writeFileSync`,
+ * `appendFileSync` and `spawnSyncTo` fail here where they fail natively. Node's
+ * `"w"` and `"a"` follow the link. A link among the directories on the way is
+ * still followed, as it is natively. Windows has no `O_NOFOLLOW`, and there the
+ * flag is 0.
+ */
+const { O_WRONLY, O_CREAT, O_TRUNC, O_APPEND, O_NOFOLLOW = 0 } = fs.constants;
+const WRITE_FLAGS = O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW;
+const APPEND_FLAGS = O_WRONLY | O_CREAT | O_APPEND | O_NOFOLLOW;
+
 export function writeFileSync(path, data) {
   try {
-    fs.writeFileSync(path, data, "utf8");
+    fs.writeFileSync(path, data, { encoding: "utf8", flag: WRITE_FLAGS });
   } catch {
     ioFail("write", path);
   }
@@ -507,7 +566,7 @@ export function writeFileSync(path, data) {
 
 export function appendFileSync(path, data) {
   try {
-    fs.appendFileSync(path, data, "utf8");
+    fs.appendFileSync(path, data, { encoding: "utf8", flag: APPEND_FLAGS });
   } catch {
     ioFail("write", path);
   }
@@ -623,8 +682,9 @@ export function getenv(name) {
  *
  * `out` and `err` are paths for the child's stdout and stderr, and an **empty**
  * string leaves that stream inherited. Each file is created or truncated at
- * 0644, which is what `"w"` asks `open(2)` for (`O_WRONLY | O_CREAT | O_TRUNC`)
- * and what the runtime's file actions ask for. The descriptors opened here are
+ * 0644 with `WRITE_FLAGS`, which is what the runtime's file actions ask for:
+ * `O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW`, so a symbolic link at the path
+ * is refused and the answer is -1, on both sides. The descriptors opened here are
  * closed again whichever way the child went; natively the child opens them and
  * its exit drops them.
  */
@@ -633,7 +693,7 @@ function spawnImpl(argv, out, err) {
   const opened = [];
   const stream = (target) => {
     if (target.length === 0) return "inherit";
-    const fd = fs.openSync(target, "w", 0o644);
+    const fd = fs.openSync(target, WRITE_FLAGS, 0o644);
     opened.push(fd);
     return fd;
   };
@@ -696,6 +756,51 @@ export function statMtimeSync(path) {
   return st.mtimeMs;
 }
 
+/**
+ * The RT-9 owner checks (#386): `lstatOwnerModeSync(path)` is the owner's uid
+ * in the high 32 bits and `st_mode` in the low 32 of one `lstat`, so a
+ * symbolic link answers for itself, or -1 when the path does not resolve or
+ * holds a NUL; `geteuid()` is the effective uid; `isExecutableSync(path)` is
+ * `access(path, X_OK)`. Each answers what `runtime-host.c` answers, the two
+ * `i64`s as BigInts because that is how an `i64` is held on this side. Node's
+ * `fs` throws on a NUL in a path where the runtime names nothing, so the
+ * `catch` is what makes the two agree there too.
+ */
+export function lstatOwnerModeSync(path) {
+  try {
+    const st = fs.lstatSync(path);
+    return BigInt.asIntN(64, (BigInt(st.uid >>> 0) << 32n) | BigInt(st.mode >>> 0));
+  } catch {
+    return -1n;
+  }
+}
+
+export function geteuid() {
+  return BigInt(process.geteuid());
+}
+
+export function isExecutableSync(path) {
+  try {
+    fs.accessSync(path, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * `secureZero(bytes)` (#385): every element set to zero, which is what the
+ * native `nish_wipe` leaves. Nothing here can drop a store to an array the
+ * caller still holds, so a loop is the whole of it. What it cannot promise is
+ * what the native build does: a collector that moved the array may have left a
+ * copy of the old bytes behind, and JavaScript has no way to reach it.
+ */
+export function secureZero(bytes) {
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = 0;
+  }
+}
+
 /**
  * Node's own fill, taken before `runtime/nish.mjs` puts the one below in its
  * place on the same object: `webcrypto` is the global `crypto`.
@@ -807,3 +912,7 @@ export function arenaUsed() { return 0; }
 export function arenaMark() { return 0; }
 export function arenaRelease() {}
 export function arenaReset() {}
+/** `using a = arena()`: a disposable whose disposal does nothing, because there is no arena to release. */
+export function arena() {
+  return { [Symbol.dispose]() {} };
+}

package/scripts/build.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Build an Nish .ll module (plus optional C sources) into a native binary.
 #
-#   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm]
+#   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm|wasi|napi]
 #
 # The C runtime is five translation units and is named as one: an input
 # <dir>/runtime.c also compiles <dir>/runtime-os.c, the half that wraps the
@@ -20,8 +20,6 @@
 #          load it from Node. Add runtime/runtime-wasm.c to the inputs when a
 #          function uses arrays (the arena and the array cold paths, no libc);
 #          strings and I/O still need a WASI runtime and are not available.
-#   wasm   wasm32 freestanding module exporting every non-internal function
-#          (for modules that do not use the C runtime); load it from Node.
 #   wasi   wasm32-wasi command module: runtime.c linked against wasi-libc, so
 #          string programs run under any WASI host (`_start` runs `main`;
 #          `node examples/wasi-host.mjs app.wasm args...`). Needs a WASI