@amritk/nish-x86_64-linux 0.27.2 → 0.29.0

package/runtime/nish.d.ts

@@ -333,6 +333,14 @@ declare function spawnSyncTo(argv: string[], stdoutPath: string, stderrPath: str
  * the child is then killed and each array keeps at most the first 16 MiB.
  */
 declare function spawnPiped(argv: string[], stdin: readonly u8[], stdout: u8[], stderr: u8[]): i32;
+/**
+ * `spawn` with the child holding `fds[i]` as descriptor `3 + i`, inherited
+ * across the exec; every other descriptor stays close-on-exec. The child's pid,
+ * or a negative errno: -22 more than 64 descriptors or a negative one, -9 one
+ * that is not open, -24 (or -22 above the descriptor limit) a scratch
+ * descriptor the system cannot give. No reading under Node, which throws.
+ */
+declare function spawnWithFds(argv: string[], fds: readonly i32[]): i32;
 /**
  * Start `argv[0]` through `PATH` without waiting: the child's pid, or a
  * negative errno. The child is the program's until `waitPid` reaps it. No
@@ -460,6 +468,11 @@ declare function pollWait(loop: i32, ready: i32[], timeoutMs: i32): i32;
  * a negative errno (-9 a closed descriptor, -88 not a socket).
  */
 declare function netSetOption(fd: i32, option: i32, value: i32): i32;
+/**
+ * A connected TCP socket's send MSS, the payload bytes one segment carries;
+ * -1, never an errno, for anything else, and always on wasm.
+ */
+declare function netMss(fd: i32): i32;
 /** `TCP_NODELAY`: `value` 1 sends a small write at once, 0 lets Nagle batch it. */
 declare const NET_TCP_NODELAY: i32;
 /**
@@ -474,6 +487,57 @@ declare const NET_SO_KEEPALIVE: i32;
 declare const NET_SO_SNDBUF: i32;
 /** `SO_RCVBUF`: the receive buffer, `value` in bytes; Linux doubles the value it stores. */
 declare const NET_SO_RCVBUF: i32;
+/**
+ * A listening Unix stream socket at `path` (`@name`: Linux's abstract
+ * namespace), its file mode 0600. A path that exists is -98, unless `flags`
+ * holds `NET_UNIX_UNLINK_STALE`; -36 a path too long, -22 an empty one.
+ */
+declare function unixListen(path: string, backlog: i32, flags: i32): i32;
+/** `unixListen` with the socket file's mode chosen (0 to 0o777); -22 for an `@name`. */
+declare function unixListenMode(path: string, backlog: i32, flags: i32, mode: i32): i32;
+/** A non-blocking socket connected to the listener at `path`; -11 a full backlog on Linux (-111 on Darwin), -111 nothing listening. */
+declare function unixConnect(path: string): i32;
+/** The next connection on a Unix listener, non-blocking; -11 when none is waiting. */
+declare function unixAccept(fd: i32): i32;
+/**
+ * Two connected sockets into `fds[0]` and `fds[1]`, and 0: `kind` is
+ * `NET_UNIX_STREAM` or `NET_UNIX_SEQPACKET` (-95 on Darwin); -22 another kind
+ * or an `fds` shorter than 2.
+ */
+declare function unixSocketPair(kind: i32, fds: i32[]): i32;
+/**
+ * Send `buf[off..off+len)` over the Unix socket `sock` with a copy of the
+ * descriptor `fd` (`SCM_RIGHTS`): the bytes sent, or a negative errno; -22 a
+ * zero `len` or a negative `fd`, -9 a closed `sock` or `fd`, -88 a `sock`
+ * that is not a socket, -95 one that is not Unix. A stream socket can send
+ * short: the descriptor travels with the first bytes, so send the rest with
+ * `netWrite`.
+ */
+declare function sendFd(sock: i32, fd: i32, buf: readonly u8[], off: i32, len: i32): i32;
+/**
+ * Read at most `len` bytes into `buf[off..]` from the Unix socket `sock`, and
+ * the first descriptor that came with them into `fd[0]`, or -1: the bytes read,
+ * or a negative errno. Every other descriptor in the message is closed; the
+ * one kept is close-on-exec and keeps the sender's blocking mode. -22 a zero
+ * `len` or an empty `fd`, -9 a closed `sock`, -88 not a socket, -95 not
+ * Unix.
+ */
+declare function recvFd(sock: i32, buf: u8[], off: i32, len: i32, fd: i32[]): i32;
+/**
+ * The peer of the Unix socket `fd` as of its connect: `out` gets its pid, uid
+ * and gid, and the answer is 0; the pid is -1 where Darwin has no
+ * `LOCAL_PEERPID`. A uid or gid of 2^31 or above wraps (-2 is uid
+ * 4294967294). -22 an `out` shorter than 3, -9 a closed `fd`, -88 not a
+ * socket, -95 not Unix, -107 a socket with no peer (a listener, or one never
+ * connected).
+ */
+declare function peerCredentials(fd: i32, out: i32[]): i32;
+/** `unixListen` flag: unlink a socket file nothing listens on, then bind. */
+declare const NET_UNIX_UNLINK_STALE: i32;
+/** `unixSocketPair` kind: a byte stream. */
+declare const NET_UNIX_STREAM: i32;
+/** `unixSocketPair` kind: each write one message (`SOCK_SEQPACKET`). */
+declare const NET_UNIX_SEQPACKET: i32;
 
 // ---- `nish:term` ------------------------------------------------------------------
 //
@@ -580,6 +644,13 @@ declare module "nish:process" {
   export function spawnPiped(argv: string[], stdin: readonly u8[], stdout: u8[], stderr: u8[]): i32;
   /** Start a child without waiting: its pid, or a negative errno. */
   export function spawn(argv: string[]): i32;
+  /**
+   * `spawn` with the child holding `fds[i]` as descriptor `3 + i`: its pid, or
+   * a negative errno; -22 more than 64 descriptors or a negative one, -9 one
+   * that is not open, -24 (or -22 above the descriptor limit) a scratch
+   * descriptor the system cannot give.
+   */
+  export function spawnWithFds(argv: string[], fds: readonly i32[]): i32;
   /** Send 0, 2, 9 or 15 to `pid`: 0, or a negative errno; any other signal is -22. */
   export function kill(pid: i32, sig: i32): i32;
   /** `[pid, status]` for a child that exited, `[0, 0]` under WNOHANG (flag 1) with none, or `[-errno, 0]`. */
@@ -667,6 +738,11 @@ declare module "nish:net" {
    * a negative errno (-9 a closed descriptor, -88 not a socket).
    */
   export function netSetOption(fd: i32, option: i32, value: i32): i32;
+  /**
+   * A connected TCP socket's send MSS, the payload bytes one segment carries;
+   * -1, never an errno, for anything else, and always on wasm.
+   */
+  export function netMss(fd: i32): i32;
   /** `TCP_NODELAY`: `value` 1 sends a small write at once, 0 lets Nagle batch it. */
   export const NET_TCP_NODELAY: i32;
   /**
@@ -681,6 +757,57 @@ declare module "nish:net" {
   export const NET_SO_SNDBUF: i32;
   /** `SO_RCVBUF`: the receive buffer, `value` in bytes; Linux doubles the value it stores. */
   export const NET_SO_RCVBUF: i32;
+  /**
+   * A listening Unix stream socket at `path` (`@name`: Linux's abstract
+   * namespace), its file mode 0600. A path that exists is -98, unless `flags`
+   * holds `NET_UNIX_UNLINK_STALE`; -36 a path too long, -22 an empty one.
+   */
+  export function unixListen(path: string, backlog: i32, flags: i32): i32;
+  /** `unixListen` with the socket file's mode chosen (0 to 0o777); -22 for an `@name`. */
+  export function unixListenMode(path: string, backlog: i32, flags: i32, mode: i32): i32;
+  /** A non-blocking socket connected to the listener at `path`; -11 a full backlog on Linux (-111 on Darwin), -111 nothing listening. */
+  export function unixConnect(path: string): i32;
+  /** The next connection on a Unix listener, non-blocking; -11 when none is waiting. */
+  export function unixAccept(fd: i32): i32;
+  /**
+   * Two connected sockets into `fds[0]` and `fds[1]`, and 0: `kind` is
+   * `NET_UNIX_STREAM` or `NET_UNIX_SEQPACKET` (-95 on Darwin); -22 another kind
+   * or an `fds` shorter than 2.
+   */
+  export function unixSocketPair(kind: i32, fds: i32[]): i32;
+  /**
+   * Send `buf[off..off+len)` over the Unix socket `sock` with a copy of the
+   * descriptor `fd` (`SCM_RIGHTS`): the bytes sent, or a negative errno; -22 a
+   * zero `len` or a negative `fd`, -9 a closed `sock` or `fd`, -88 a `sock`
+   * that is not a socket, -95 one that is not Unix. A stream socket can send
+   * short: the descriptor travels with the first bytes, so send the rest with
+   * `netWrite`.
+   */
+  export function sendFd(sock: i32, fd: i32, buf: readonly u8[], off: i32, len: i32): i32;
+  /**
+   * Read at most `len` bytes into `buf[off..]` from the Unix socket `sock`, and
+   * the first descriptor that came with them into `fd[0]`, or -1: the bytes read,
+   * or a negative errno. Every other descriptor in the message is closed; the
+   * one kept is close-on-exec and keeps the sender's blocking mode. -22 a zero
+   * `len` or an empty `fd`, -9 a closed `sock`, -88 not a socket, -95 not
+   * Unix.
+   */
+  export function recvFd(sock: i32, buf: u8[], off: i32, len: i32, fd: i32[]): i32;
+  /**
+   * The peer of the Unix socket `fd` as of its connect: `out` gets its pid, uid
+   * and gid, and the answer is 0; the pid is -1 where Darwin has no
+   * `LOCAL_PEERPID`. A uid or gid of 2^31 or above wraps (-2 is uid
+   * 4294967294). -22 an `out` shorter than 3, -9 a closed `fd`, -88 not a
+   * socket, -95 not Unix, -107 a socket with no peer (a listener, or one never
+   * connected).
+   */
+  export function peerCredentials(fd: i32, out: i32[]): i32;
+  /** `unixListen` flag: unlink a socket file nothing listens on, then bind. */
+  export const NET_UNIX_UNLINK_STALE: i32;
+  /** `unixSocketPair` kind: a byte stream. */
+  export const NET_UNIX_STREAM: i32;
+  /** `unixSocketPair` kind: each write one message (`SOCK_SEQPACKET`). */
+  export const NET_UNIX_SEQPACKET: i32;
 }
 
 declare module "nish:unsafe" {
@@ -698,6 +825,55 @@ declare module "nish:unsafe" {
   export function readCString(p: CPtr): string;
 }
 
+// `nish:simd` (docs/LANGUAGE.md -> Vectors): the six sixteen-byte vector
+// types and the calls that make, load, store and take one apart. Under Node,
+// `runtime/nish.mjs` answers the import with `runtime/core.mjs`'s names.
+declare module "nish:simd" {
+  /**
+   * A sixteen-byte vector of lanes. Opaque: TypeScript refuses `+` on one, as
+   * `nish` does, but lets `===` and `<` through, which `nish` refuses. Under
+   * Node it is a typed array made once and never written after.
+   */
+  export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8 }
+  export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16 }
+  export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32 }
+  export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32 }
+  export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32 }
+  export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64 }
+  /** Any of the six. */
+  export type SimdVector = u8x16 | u16x8 | i32x4 | u32x4 | f32x4 | f64x2;
+  /** One value per lane, lane 0 first. */
+  export function u8x16(
+    a0: u8, a1: u8, a2: u8, a3: u8, a4: u8, a5: u8, a6: u8, a7: u8,
+    a8: u8, a9: u8, a10: u8, a11: u8, a12: u8, a13: u8, a14: u8, a15: u8
+  ): u8x16;
+  export function u16x8(a0: u16, a1: u16, a2: u16, a3: u16, a4: u16, a5: u16, a6: u16, a7: u16): u16x8;
+  export function i32x4(a0: i32, a1: i32, a2: i32, a3: i32): i32x4;
+  export function u32x4(a0: u32, a1: u32, a2: u32, a3: u32): u32x4;
+  export function f32x4(a0: f32, a1: f32, a2: f32, a3: f32): f32x4;
+  export function f64x2(a0: f64, a1: f64): f64x2;
+  /** `x` in every lane. */
+  export function splatU8x16(x: u8): u8x16;
+  export function splatU16x8(x: u16): u16x8;
+  export function splatI32x4(x: i32): i32x4;
+  export function splatU32x4(x: u32): u32x4;
+  export function splatF32x4(x: f32): f32x4;
+  export function splatF64x2(x: f64): f64x2;
+  /** `xs[i]` to `xs[i + N - 1]`, bounds-checked once for the whole vector. */
+  export function loadU8x16(xs: readonly u8[], i: i32): u8x16;
+  export function loadU16x8(xs: readonly u16[], i: i32): u16x8;
+  export function loadI32x4(xs: readonly i32[], i: i32): i32x4;
+  export function loadU32x4(xs: readonly u32[], i: i32): u32x4;
+  export function loadF32x4(xs: readonly f32[], i: i32): f32x4;
+  export function loadF64x2(xs: readonly f64[], i: i32): f64x2;
+  /** The lanes of `v` into `xs[i]` to `xs[i + N - 1]`, checked once. */
+  export function store<V extends SimdVector>(v: V, xs: V["__lane"][], i: i32): void;
+  /** Lane `k`, an integer literal in range. */
+  export function extract<V extends SimdVector>(v: V, k: i32): V["__lane"];
+  /** A new vector: `v` with lane `k` set to `x`. */
+  export function replace<V extends SimdVector>(v: V, k: i32, x: V["__lane"]): V;
+}
+
 declare module "nish:io" {
   /** `s` to stdout with no trailing newline and no conversion. */
   export function write(s: string): void;

package/runtime/nish.h

@@ -9,14 +9,17 @@
  * functions, the directory and subprocess calls, `nish_getenv`, the monotonic
  * clock, `nish_platform` / `nish_arch` — and runtime-parallel.c, runtime-host.c,
  * runtime-net.c, runtime-simd.c (the byte searches that read a vector at a
- * time), runtime-aes.c (AES-GCM on the CPU's AES instructions) and
- * runtime-term.c (stdin and the terminal, `nish:term`) split off
+ * time), runtime-aes.c (AES-GCM on the CPU's AES instructions),
+ * runtime-sha256.c (SHA-256 on the CPU's SHA instructions), runtime-checksum.c
+ * (CRC-32 on its carry-less multiply or CRC instructions) and runtime-term.c
+ * (stdin and the terminal, `nish:term`) split off
  * the same way since. They are separate so that each carries its own measured
  * code-size ceiling (docs/wp7-runtime.md, "Runtime additions and budget"); a
  * host links all of them, which `scripts/build.sh` does for you when handed
- * runtime.c, runtime-aes.c included: the compiler calls its kernels from
- * std/crypto/aes.ts, so `scripts/build.sh` pairs it and `src/run-cache.ts`
- * caches it like the others. `tests/run.js` checks that every runtime function
+ * runtime.c, runtime-aes.c, runtime-sha256.c and runtime-checksum.c included: the
+ * compiler calls their kernels from std/crypto/aes.ts, std/crypto/sha256.ts and
+ * std/compress/checksum.ts, so `scripts/build.sh` pairs each of them with
+ * runtime.c and `src/run-cache.ts` caches them like the others. `tests/run.js` checks that every runtime function
  * declared in runtime.ts has a prototype in this file.
  *
  * Headers generated by `nish --emit-header` include this one, so keep
@@ -197,6 +200,16 @@ extern void (*nish_fatal_hook)(void);
 /* Number to string, as `${n}` does: decimal for integers, shortest round-trip (JS Number#toString) for f64. */
 nish_str *nish_str_from_i32(int32_t v);
 nish_str *nish_str_from_f64(double v);
+/* The bytes `nish_str_from_f64` would hold, written into `out` with no NUL;
+   returns the length. 32 bytes is room to spare: the longest spelling,
+   -0.0000012345678901234567, is 25 (runtime.c says why, and runtime-test.c
+   pins it). For a caller that writes numbers into its own buffer. */
+#define NISH_F64_MAX 32
+int nish_f64_format(double v, char out[NISH_F64_MAX]);
+/* `nish_f64_format`'s bytes into `buf[at]` (std/json.ts's JsonWriter): the new
+   end, or -1, with nothing written, when `at < 0` or they do not fit before
+   `len`. `buf` may be null only when nothing fits. */
+int32_t nish_json_put_f64(uint8_t *buf, int32_t len, int32_t at, double v);
 nish_str *nish_str_from_i64(int64_t v);
 /* Unsigned decimal (WP15). u8/u16/u32 are zero-extended by the caller, so one
    symbol serves every unsigned width. */
@@ -348,6 +361,40 @@ void nish_aes_ctr(const nish_array *rk, int32_t rounds, const nish_array *j0, co
    `rk` instead, and they are the same H. 0 <= length <= data.len. */
 void nish_aes_ghash(nish_array *y, uint64_t hHi, uint64_t hLo, const nish_array *rk, const nish_array *data,
                     int32_t length);
+/* ---- SHA-256 on the CPU's SHA instructions --------------------------------
+ * runtime/runtime-sha256.c: SHA-NI on x86-64, the ARMv8 SHA-256 instructions
+ * on AArch64. The compiler calls the kernel in place of std/crypto/sha256.ts's
+ * private `sha256Compress`, behind `nish_sha256_hw`, and calls the Nish
+ * function itself when either answers 0. Constant time in the state and the
+ * block. */
+/* 1 when this process runs the kernel, 0 when it runs the Nish code. Resolved
+   on the first call and fixed from then on: `NISH_SHA256=soft` pins 0; unset,
+   `hw` or any other value is the best this machine has, read on that call from
+   CPUID (leaf 7's SHA, leaf 1's SSE4.1 and SSSE3), AArch64 Linux's AT_HWCAP
+   (SHA2) or macOS's `hw.optional.arm.FEAT_SHA256`. Always 0 on other targets,
+   wasm32 among them. */
+int32_t nish_sha256_hw(void);
+/* FIPS 180-4 §6.2.2 on the 64 bytes at src[at..at + 64) (u8[]), into the hash
+   value h[0..8) (u32[]); 1 when it ran. Answers 0 and writes nothing unless
+   h.len >= 8, w.len >= 64 and 0 <= at <= src.len - 64, `sha256Compress`'s
+   guard, so the caller's fallback panics as the Nish function does. `w` (u32[],
+   the message schedule the Nish code fills) is neither read nor written. */
+int32_t nish_sha256_compress(nish_array *h, const nish_array *w, const nish_array *src, int32_t at);
+/* ---- CRC-32 on the CPU's carry-less multiply or CRC instructions ---------
+ * runtime/runtime-checksum.c: PCLMULQDQ folding on x86-64, the ARMv8 CRC32
+ * instructions on AArch64. The compiler calls the kernel in
+ * place of std/compress/checksum.ts's private `crc32Walk`, behind
+ * `nish_crc32_hw`, and calls the Nish walker itself when that answers 0. */
+/* 1 when this process runs the kernel, 0 when it runs the Nish tables.
+   Resolved on the first call and fixed from then on: `NISH_CRC32=soft` pins 0;
+   unset or any other value is the best this machine has, read on that call
+   from CPUID leaf 1 (PCLMULQDQ, SSE4.1), AArch64's AT_HWCAP (CRC32) or
+   Darwin's hw.optional sysctls. Always 0 on other targets, wasm32 among them. */
+int32_t nish_crc32_hw(void);
+/* The CRC-32 (ISO 3309, RFC 1952) `crc` extended over buf[off..off+len)
+   (u8[]), conditioned as zlib's crc32(): 0 starts a message, and the answer
+   continues one. The caller has checked 0 <= off <= off + len <= buf.len. */
+uint32_t nish_crc32_update(uint32_t crc, const nish_array *buf, int32_t off, int32_t len);
 
 /* `secureZero(bytes)` (#385): sets every byte of `bytes` to zero through
  * `volatile` stores, out of line, so that neither `-O2` nor `-flto` can drop
@@ -477,6 +524,14 @@ int32_t nish_spawn_child(const nish_array *argv);
  * copied; SIGPIPE is blocked on the calling thread for the call, a SIGPIPE the
  * call raised is consumed, and the thread's mask is restored after it. */
 int32_t nish_spawn_piped(const nish_array *argv, const nish_array *in, nish_array *out, nish_array *err);
+/* `spawnWithFds(argv, fds)`: `nish_spawn_child` with the child holding
+ * `fds[i]` (element type `int32_t`) as descriptor `3 + i`, close-on-exec
+ * cleared there. More than 64 descriptors or a negative one is -EINVAL before
+ * anything starts, a source that is not open is -EBADF, and a scratch
+ * descriptor the system cannot give is -EMFILE (-EINVAL above the descriptor
+ * limit); -ENOSYS under
+ * WASI. This process's descriptors are left as they were. */
+int32_t nish_spawn_with_fds(const nish_array *argv, const nish_array *fds);
 /* `kill(pid, sig)`: send `sig` to `pid` and answer 0, or a negative errno. Only
  * 0, 2 (SIGINT), 9 (SIGKILL) and 15 (SIGTERM) are sent; any other signal, and
  * a pid of 0 or below, is -EINVAL. -ESRCH when no process has the pid, -EPERM
@@ -614,6 +669,9 @@ bool nish_is_executable(const nish_str *path);
  * whitelist, by the runtime's own id (1 `TCP_NODELAY`, 2 `TCP_QUICKACK`, 3
  * `SO_KEEPALIVE`, 4 `SO_SNDBUF`, 5 `SO_RCVBUF`); any other id is -22, and
  * `TCP_QUICKACK` off Linux is -95.
+ * `nish_net_mss(fd)`: a connected TCP socket's send MSS, from `TCP_INFO`'s
+ * `tcpi_snd_mss` or else `TCP_MAXSEG`; a plain -1, never an errno, for
+ * anything else (a closed descriptor, an unconnected or non-TCP socket).
  * `nish_tcp_connect(addr)`: a new socket connecting to `addr`, answered at
  * once; its `EINPROGRESS` is not a failure, and any other closes it.
  * `nish_connect_result(fd)`: `SO_ERROR` once the socket is writable, 0 when
@@ -638,7 +696,36 @@ bool nish_is_executable(const nish_str *path);
  * into `ready` (element type `int32_t`) a token and its events, 4 added for a
  * hang-up or an error, per ready descriptor: at most `ready->len / 2` pairs
  * and at most 64 in one call. It answers the count, 0 on a timeout or an
- * interrupting signal, and -22 for a `ready` shorter than 2. */
+ * interrupting signal, and -22 for a `ready` shorter than 2.
+ *
+ * Unix-domain sockets. A `path` names a socket file, or with a leading `@`
+ * Linux's abstract namespace (-95 on Darwin); empty, holding a NUL, or a bare
+ * `@` is -22, and one too long for `sun_path` with its NUL is -36, before any
+ * socket exists. `nish_unix_listen(path, backlog, flags)` is a listening
+ * stream socket whose file has mode 0600; a path that exists is -98, unless
+ * flag 1 (`NET_UNIX_UNLINK_STALE`) unlinks a socket file nothing listens on
+ * (anything but a socket is -17, a live listener -98). `nish_unix_listen_mode`
+ * takes the mode (0..0o777, -22 for an abstract name). `nish_unix_connect(path)`
+ * connects, -11 for a full backlog on Linux (-111 on Darwin). `nish_unix_accept(fd)` takes the next
+ * connection, -11 when none waits. `nish_unix_socket_pair(kind, fds)` writes
+ * two connected sockets into `fds` (element type `int32_t`, at least 2): kind
+ * 1 a stream, kind 2 `SOCK_SEQPACKET` (-95 on Darwin). Every descriptor is
+ * non-blocking and close-on-exec.
+ *
+ * Descriptors over a Unix socket: each of the three refuses a descriptor that
+ * is closed with -9, one that is not a socket with -88 and a socket of another
+ * family with -95.
+ * `nish_send_fd(sock, fd, buf, off, len)` sends `len` bytes (at least 1, else
+ * -22, as is a negative `fd`) carrying one `SCM_RIGHTS` copy of `fd`; a
+ * stream socket can send short, the descriptor gone with the first bytes. `nish_recv_fd(sock, buf, off,
+ * len, fd)` reads at most `len` bytes (at least 1, and `fd` at least one
+ * `int32_t` long, else -22) and writes the first descriptor received, or -1,
+ * into `fd[0]`, closing every other; the one kept is close-on-exec and its
+ * status flags are left as the sender's. `nish_peer_credentials(fd, out)`
+ * writes the peer's pid, uid and gid as of the connect into `out` (at least
+ * 3, else -22), wrapping a uid or gid of 2^31 or above into `int32_t`; a
+ * socket with no peer is -ENOTCONN (-107) on both platforms, and Darwin's pid
+ * is -1 where `LOCAL_PEERPID` is missing. */
 int32_t nish_net_address(nish_array *out, const nish_str *host, int32_t port);
 int32_t nish_net_local_port(int32_t fd);
 int32_t nish_tcp_listen(const nish_str *host, int32_t port, int32_t backlog);
@@ -649,6 +736,7 @@ int32_t nish_net_write(int32_t fd, const nish_array *buf, int64_t off, int64_t l
 int32_t nish_net_shutdown(int32_t fd, int32_t how);
 int32_t nish_net_close(int32_t fd);
 int32_t nish_net_set_option(int32_t fd, int32_t option, int32_t value);
+int32_t nish_net_mss(int32_t fd);
 int32_t nish_tcp_connect(const nish_array *addr);
 int32_t nish_connect_result(int32_t fd);
 int32_t nish_udp_bind(const nish_str *host, int32_t port, int32_t flags);
@@ -661,6 +749,14 @@ int32_t nish_poll_add(int32_t loop, int32_t fd, int32_t events, int32_t token);
 int32_t nish_poll_modify(int32_t loop, int32_t fd, int32_t events, int32_t token);
 int32_t nish_poll_remove(int32_t loop, int32_t fd);
 int32_t nish_poll_wait(int32_t loop, nish_array *ready, int32_t timeout_ms);
+int32_t nish_unix_listen(const nish_str *path, int32_t backlog, int32_t flags);
+int32_t nish_unix_listen_mode(const nish_str *path, int32_t backlog, int32_t flags, int32_t mode);
+int32_t nish_unix_connect(const nish_str *path);
+int32_t nish_unix_accept(int32_t fd);
+int32_t nish_unix_socket_pair(int32_t kind, nish_array *fds);
+int32_t nish_send_fd(int32_t sock, int32_t fd, const nish_array *buf, int64_t off, int64_t len);
+int32_t nish_recv_fd(int32_t sock, nish_array *buf, int64_t off, int64_t len, nish_array *fd);
+int32_t nish_peer_credentials(int32_t fd, nish_array *out);
 
 /* ---- The terminal, runtime/runtime-term.c, `nish:term` -------------------
  *
@@ -741,6 +837,17 @@ int64_t nish_cpu_count(void);
  * rounded up, and `NISH_NUM_THREADS` when it is set to a positive number. At
  * least 1; 1 under WASI. Read each call (runtime-os.c). */
 int64_t nish_cpu_online(void);
+/* WP37 `--sandbox` (runtime-sandbox.c): `nish_sandbox` confines the process to
+   the capability mask `caps` from `.preinit_array`, `mode` 1 strict and 2
+   best-effort, and `nish_sandbox_check` refuses to run at the top of `main`
+   when it never ran. `read_dirs` and `write_dirs` are the directories
+   Landlock scopes `fs.read` and `fs.write` to, `exec_paths` the programs
+   `process.spawn` may execute, each a run of NUL-terminated paths ended by an
+   empty one; null leaves the capability whole.
+   `nish_cpu_prime` caches the pool's CPU count while /sys is still readable. */
+void nish_sandbox(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs, const char *exec_paths);
+void nish_sandbox_check(void);
+void nish_cpu_prime(void);
 void nish_parallel_range(nish_par_body body, void *ctx, int64_t len, int64_t grain);
 /* Keeps every later region and join on threads created and joined per call,
  * as before the pool existed, so no parked worker outlives the code it would
@@ -766,6 +873,13 @@ __attribute__((constructor)) static void nish_napi_unpooled(void) { nish_pool_di
  * calling thread, so running short of threads costs speed and never an
  * answer.
  *
+ * `scope` points at a `ThreadScope` (std/threads.ts), whose first `int32_t` is
+ * the stack `scopeWithStack` asked for, or 0. A nonzero one runs every task on
+ * a new thread of its own started with that stack, rounded up to the page,
+ * plus a guard page, none on the calling thread; if one cannot be started the
+ * program ends, saying whether the system was out of threads or memory or
+ * refused the size (`nish_stack_fail`). Without threads the word is ignored.
+ *
  * The preconditions are the language's (docs/LANGUAGE.md, "Scoped tasks"):
  * `run` writes nothing another task or the caller can see, its result is a
  * scalar it writes into its own payload, and only `finish`, on the calling

package/runtime/nish.mjs

@@ -104,9 +104,11 @@ provide("realpathSync", shim.realpathSync);
 provide("spawnSync", shim.spawnSync);
 provide("spawnSyncTo", shim.spawnSyncTo);
 provide("spawnPiped", shim.spawnPiped);
-// WP34 N12. `spawn` and `waitPid` throw, naming themselves: a child is reaped
-// by Node's event loop. `kill`, `availableParallelism` and `totalMemory` answer.
+// WP34 N12. `spawn`, `spawnWithFds` and `waitPid` throw, naming themselves: a
+// child is reaped by Node's event loop. `kill`, `availableParallelism` and
+// `totalMemory` answer.
 provide("spawn", shim.spawn);
+provide("spawnWithFds", shim.spawnWithFds);
 provide("kill", shim.kill);
 provide("waitPid", shim.waitPid);
 provide("availableParallelism", shim.availableParallelism);
@@ -147,16 +149,28 @@ for (const name of [
   "pollRemove",
   "pollWait",
   "netSetOption",
+  "netMss",
+  "unixListen",
+  "unixListenMode",
+  "unixConnect",
+  "unixAccept",
+  "unixSocketPair",
+  "sendFd",
+  "recvFd",
+  "peerCredentials",
 ]) {
   provide(name, () => shim.noNetReading(name));
 }
-// `netSetOption`'s option ids are plain numbers, so they read the same here
-// as natively: only the call that takes one throws.
+// `netSetOption`'s option ids and the `NET_UNIX_` flag and kinds are plain
+// numbers, so they read the same here as natively: only a call throws.
 provide("NET_TCP_NODELAY", 1);
 provide("NET_TCP_QUICKACK", 2);
 provide("NET_SO_KEEPALIVE", 3);
 provide("NET_SO_SNDBUF", 4);
 provide("NET_SO_RCVBUF", 5);
+provide("NET_UNIX_UNLINK_STALE", 1);
+provide("NET_UNIX_STREAM", 1);
+provide("NET_UNIX_SEQPACKET", 2);
 
 // `nish:term`. Whether a descriptor is a terminal and how big stdout's is have
 // Node's answers; reading stdin, waiting for it and raw mode throw, each naming
@@ -314,6 +328,9 @@ provide("arena", shim.arena);
 // zero-fills it. `nish:unsafe` and `nish:term` are each answered by a module
 // that hands back the globals installed above: its functions are globals of this module either
 // way, and the import is what the compiler requires a program to write.
+// `nish:simd` is `runtime/core.mjs`, whose vectors are typed arrays made once
+// and never written after, so `--emit-ts` output and a program run as it was
+// written share one implementation.
 const UNSAFE_EXPORTS = ["uncheckedGet", "uncheckedSet", "wrappingAdd", "wrappingSub", "wrappingMul"];
 const unsafeSource = UNSAFE_EXPORTS.map((name) => `export const ${name} = globalThis.${name};`).join("\n");
 const TERM_EXPORTS = ["readStdin", "waitStdin", "isTerminal", "terminalSize", "setRawMode", "setTerminalRestore"];
@@ -326,6 +343,9 @@ registerHooks({
     if (specifier === "nish:unsafe") {
       return { url: `data:text/javascript,${encodeURIComponent(unsafeSource)}`, shortCircuit: true };
     }
+    if (specifier === "nish:simd") {
+      return next(new URL("./core.mjs", import.meta.url).href, context);
+    }
     if (specifier === "nish:term") {
       return { url: `data:text/javascript,${encodeURIComponent(termSource)}`, shortCircuit: true };
     }