@nimbus-sh/core 0.4.0 → 0.5.0

package/src/substrate/lifo/commands/net/ip.ts

@@ -1,4 +1,4 @@
-import type { Command } from '../types.js';
+import type { Command, CommandContext } from '../types.js';
 import type { NetworkStack } from '../../kernel/network/index.js';
 import type { Kernel } from '../../kernel/index.js';
 import { VETHPair } from '../../kernel/network/tunnel/VETHPair.js';
@@ -65,7 +65,7 @@ Examples:
 // ═══════════════════════════════════════════════════════════════
 
 async function handleLink(
-  ctx: any,
+  ctx: CommandContext,
   command: string,
   args: string[],
   networkStack: NetworkStack
@@ -108,7 +108,7 @@ Examples:
   }
 }
 
-async function linkShow(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function linkShow(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   let targetInterface: string | undefined;
 
   // Parse "dev NAME"
@@ -154,7 +154,7 @@ async function linkShow(ctx: any, args: string[], networkStack: NetworkStack): P
   return 0;
 }
 
-async function linkAdd(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function linkAdd(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   if (args.length < 3) {
     ctx.stderr.write('Usage: ip link add NAME type TYPE [ OPTIONS ]\n');
     return 1;
@@ -207,7 +207,7 @@ async function linkAdd(ctx: any, args: string[], networkStack: NetworkStack): Pr
   return 1;
 }
 
-async function linkDelete(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function linkDelete(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   if (args.length < 1) {
     ctx.stderr.write('Usage: ip link del NAME\n');
     return 1;
@@ -243,7 +243,7 @@ async function linkDelete(ctx: any, args: string[], networkStack: NetworkStack):
   return 1;
 }
 
-async function linkSet(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function linkSet(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   if (args.length < 2) {
     ctx.stderr.write('Usage: ip link set NAME { up | down | netns NETNS }\n');
     return 1;
@@ -362,7 +362,7 @@ async function linkSet(ctx: any, args: string[], networkStack: NetworkStack): Pr
 // ═══════════════════════════════════════════════════════════════
 
 async function handleAddr(
-  ctx: any,
+  ctx: CommandContext,
   command: string,
   _args: string[],
   _networkStack: NetworkStack
@@ -393,7 +393,7 @@ Examples:
 // ═══════════════════════════════════════════════════════════════
 
 async function handleRoute(
-  ctx: any,
+  ctx: CommandContext,
   command: string,
   _args: string[],
   _networkStack: NetworkStack
@@ -426,7 +426,7 @@ Examples:
 // ═══════════════════════════════════════════════════════════════
 
 async function handleNetns(
-  ctx: any,
+  ctx: CommandContext,
   command: string,
   args: string[],
   networkStack: NetworkStack
@@ -458,7 +458,7 @@ Examples:
   }
 }
 
-async function netnsShow(ctx: any, _args: string[], networkStack: NetworkStack): Promise<number> {
+async function netnsShow(ctx: CommandContext, _args: string[], networkStack: NetworkStack): Promise<number> {
   const namespaces = networkStack.getAllNamespaces();
 
   for (const ns of namespaces) {
@@ -468,7 +468,7 @@ async function netnsShow(ctx: any, _args: string[], networkStack: NetworkStack):
   return 0;
 }
 
-async function netnsAdd(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function netnsAdd(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   if (args.length < 1) {
     ctx.stderr.write('Usage: ip netns add NAME\n');
     return 1;
@@ -487,7 +487,7 @@ async function netnsAdd(ctx: any, args: string[], networkStack: NetworkStack): P
   }
 }
 
-async function netnsDelete(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function netnsDelete(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   if (args.length < 1) {
     ctx.stderr.write('Usage: ip netns del NAME\n');
     return 1;
@@ -520,7 +520,7 @@ async function netnsDelete(ctx: any, args: string[], networkStack: NetworkStack)
 // ═══════════════════════════════════════════════════════════════
 
 async function handleBridge(
-  ctx: any,
+  ctx: CommandContext,
   command: string,
   args: string[],
   networkStack: NetworkStack
@@ -547,7 +547,7 @@ Examples:
   }
 }
 
-async function bridgeFdb(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function bridgeFdb(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   const command = args[0] || 'show';
 
   if (command !== 'show') {
@@ -585,7 +585,7 @@ async function bridgeFdb(ctx: any, args: string[], networkStack: NetworkStack):
   return 0;
 }
 
-async function bridgeLink(ctx: any, args: string[], networkStack: NetworkStack): Promise<number> {
+async function bridgeLink(ctx: CommandContext, args: string[], networkStack: NetworkStack): Promise<number> {
   const command = args[0] || 'show';
 
   if (command !== 'show') {

package/src/substrate/lifo/commands/system/ps.ts

@@ -1,5 +1,6 @@
 import type { Command } from '../types.js';
 import type { ProcessRegistry } from '../../shell/ProcessRegistry.js';
+import type { JobTable } from '../../shell/jobs.js';
 
 export function createPsCommand(processRegistry: ProcessRegistry): Command {
   return async (ctx) => {
@@ -20,7 +21,7 @@ export function createPsCommand(processRegistry: ProcessRegistry): Command {
 }
 
 // Legacy function for backward compatibility
-export function createPsCommandFromJobTable(jobTable: any): Command {
+export function createPsCommandFromJobTable(jobTable: JobTable): Command {
   return async (ctx) => {
     ctx.stdout.write('  PID TTY          TIME CMD\n');
 

package/src/substrate/lifo/kernel/ServiceManager.ts

@@ -191,8 +191,6 @@ export class ServiceManager {
     }
 
     if (svc.exitCode !== null) {
-      // Already stopped
-      svc.exitCode = svc.exitCode;
       return { ok: true, message: '' };
     }
 

package/src/substrate/lifo/kernel/network/NetworkStack.ts

@@ -11,6 +11,8 @@ import type {
   RouteEntry,
   NetworkTunnel,
 } from './types.js';
+import type { VETHPair } from './tunnel/VETHPair.js';
+import type { Bridge } from './Bridge.js';
 
 /** Port binding with concrete Socket type */
 interface PortBinding {
@@ -21,6 +23,13 @@ interface PortBinding {
   namespace: string;
 }
 
+/**
+ * A tunnel as the stack holds it. `NetworkTunnel` declares its interface as the
+ * plain device record; namespaces hold the concrete device, which is what every
+ * tunnel implementation exposes (see `BaseTunnel`).
+ */
+type BoundTunnel = Omit<NetworkTunnel, 'interface'> & { interface: NetworkInterface };
+
 /**
  * Virtual network stack
  * Provides Linux-like networking with interfaces, routing, sockets, DNS, and tunneling
@@ -33,9 +42,9 @@ export class NetworkStack {
   private nextNamespaceId = 1;
 
   // Tunnel management
-  private tunnels = new Map<string, NetworkTunnel>(); // tunnel name -> tunnel
-  private vethPairs = new Map<string, any>(); // veth pair id -> VETHPair
-  private bridges = new Map<string, any>(); // bridge name -> Bridge
+  private tunnels = new Map<string, BoundTunnel>(); // tunnel name -> tunnel
+  private vethPairs = new Map<string, VETHPair>(); // veth pair id -> VETHPair
+  private bridges = new Map<string, Bridge>(); // bridge name -> Bridge
   private nextTunnelId = 0;
 
   constructor() {
@@ -396,18 +405,16 @@ export class NetworkStack {
   /**
    * Add tunnel to network stack
    */
-  addTunnel(name: string, tunnel: NetworkTunnel): void {
+  addTunnel(name: string, tunnel: BoundTunnel): void {
     if (this.tunnels.has(name)) {
       throw new Error(`Tunnel ${name} already exists`);
     }
 
     this.tunnels.set(name, tunnel);
 
-    // Add tunnel interface to namespace
-    // Cast to NetworkInterface class since tunnel.interface is the concrete class
     const ns = this.namespaces.get(tunnel.interface.namespace);
     if (ns) {
-      ns.addInterface(tunnel.interface as any as NetworkInterface);
+      ns.addInterface(tunnel.interface);
     }
   }
 
@@ -435,28 +442,28 @@ export class NetworkStack {
   /**
    * Get tunnel by name
    */
-  getTunnel(name: string): NetworkTunnel | undefined {
+  getTunnel(name: string): BoundTunnel | undefined {
     return this.tunnels.get(name);
   }
 
   /**
    * Get all tunnels
    */
-  getAllTunnels(): NetworkTunnel[] {
+  getAllTunnels(): BoundTunnel[] {
     return Array.from(this.tunnels.values());
   }
 
   /**
    * Get tunnels by namespace
    */
-  getTunnelsByNamespace(namespace: string): NetworkTunnel[] {
+  getTunnelsByNamespace(namespace: string): BoundTunnel[] {
     return this.getAllTunnels().filter((t) => t.interface.namespace === namespace);
   }
 
   /**
    * Add VETH pair
    */
-  addVETHPair(id: string, vethPair: any): void {
+  addVETHPair(id: string, vethPair: VETHPair): void {
     if (this.vethPairs.has(id)) {
       throw new Error(`VETH pair ${id} already exists`);
     }
@@ -496,7 +503,7 @@ export class NetworkStack {
   /**
    * Get VETH pair by ID or interface name
    */
-  getVETHPair(idOrName: string): any | undefined {
+  getVETHPair(idOrName: string): VETHPair | undefined {
     // Try by ID first
     const byId = this.vethPairs.get(idOrName);
     if (byId) return byId;
@@ -514,7 +521,7 @@ export class NetworkStack {
   /**
    * Get all VETH pairs
    */
-  getAllVETHPairs(): any[] {
+  getAllVETHPairs(): VETHPair[] {
     return Array.from(this.vethPairs.values());
   }
 
@@ -532,7 +539,7 @@ export class NetworkStack {
   /**
    * Add bridge to network stack
    */
-  addBridge(name: string, bridge: any): void {
+  addBridge(name: string, bridge: Bridge): void {
     if (this.bridges.has(name)) {
       throw new Error(`Bridge ${name} already exists`);
     }
@@ -570,21 +577,21 @@ export class NetworkStack {
   /**
    * Get bridge by name
    */
-  getBridge(name: string): any | undefined {
+  getBridge(name: string): Bridge | undefined {
     return this.bridges.get(name);
   }
 
   /**
    * Get all bridges
    */
-  getAllBridges(): any[] {
+  getAllBridges(): Bridge[] {
     return Array.from(this.bridges.values());
   }
 
   /**
    * Get bridges by namespace
    */
-  getBridgesByNamespace(namespace: string): any[] {
+  getBridgesByNamespace(namespace: string): Bridge[] {
     return this.getAllBridges().filter((b) => b.interface.namespace === namespace);
   }
 }

package/src/substrate/lifo/kernel/network/tunnel/WebSocketTunnel.ts

@@ -3,6 +3,33 @@ import type { NetworkStack } from '../NetworkStack.js';
 import { BaseTunnel } from './BaseTunnel.js';
 import { Buffer } from '../../../node-compat/buffer.js';
 import type { VirtualResponseWithDone } from '../../../node-compat/http.js';
+import type { VirtualRequestHandler } from '../../index.js';
+
+/** Payload a WebSocket `message` event can carry. */
+type WebSocketData = string | ArrayBufferLike | ArrayBufferView | Blob;
+
+/** HTTP request forwarded to us by the tunnel server. */
+interface TunnelRequestMessage {
+	type: 'request';
+	requestId: string;
+	method: string;
+	url: string;
+	headers: Record<string, string>;
+	/** base64-encoded */
+	body: string;
+}
+
+/** HTTP response carried over the tunnel, in either direction. */
+interface TunnelResponseMessage {
+	type: 'response';
+	requestId: string;
+	statusCode: number;
+	headers: Record<string, string>;
+	/** base64-encoded */
+	body: string;
+}
+
+type TunnelMessage = TunnelRequestMessage | TunnelResponseMessage;
 
 /**
  * WebSocket Tunnel - Bridge virtual network to external WebSocket server
@@ -21,9 +48,9 @@ export class WebSocketTunnel extends BaseTunnel {
 
 	private wsUrl: string;
 	private ws: WebSocket | null = null;
-	private portRegistry?: Map<number, any>;
+	private portRegistry?: Map<number, VirtualRequestHandler>;
 	private defaultPort: number | null = null;
-	private reconnectTimer?: any;
+	private reconnectTimer?: ReturnType<typeof setTimeout>;
 	private isReconnecting = false;
 
 	// Packet queue
@@ -34,7 +61,7 @@ export class WebSocketTunnel extends BaseTunnel {
 		id: string,
 		wsUrl: string,
 		networkStack: NetworkStack,
-		portRegistry?: Map<number, any>,
+		portRegistry?: Map<number, VirtualRequestHandler>,
 		namespace = 'default',
 		defaultPort: number | null = null
 	) {
@@ -201,9 +228,9 @@ export class WebSocketTunnel extends BaseTunnel {
 	/**
 	 * Handle incoming WebSocket message
 	 */
-	private handleMessage(data: any): void {
+	private handleMessage(data: WebSocketData): void {
 		try {
-			const message = JSON.parse(data.toString());
+			const message = JSON.parse(data.toString()) as TunnelMessage;
 
 			if (message.type === 'request') {
 				// Handle HTTP request from tunnel server
@@ -220,7 +247,7 @@ export class WebSocketTunnel extends BaseTunnel {
 	/**
 	 * Handle HTTP request from tunnel server
 	 */
-	private async handleHttpRequest(message: any): Promise<void> {
+	private async handleHttpRequest(message: TunnelRequestMessage): Promise<void> {
 		const { requestId, method, url, headers, body } = message;
 
 		let port: number;
@@ -243,15 +270,13 @@ export class WebSocketTunnel extends BaseTunnel {
 			path = match[2] || '/';
 		}
 
-		// Check if port exists in registry
-		if (!this.portRegistry || !this.portRegistry.has(port)) {
+		// Check if a server is listening on the port
+		const handler = this.portRegistry?.get(port);
+		if (!handler) {
 			this.sendError(requestId, 404, `No server listening on port ${port}`);
 			return;
 		}
 
-		// Get handler
-		const handler = this.portRegistry.get(port);
-
 		// Create virtual request/response
 		const vReq = {
 			method,
@@ -298,7 +323,7 @@ export class WebSocketTunnel extends BaseTunnel {
 	/**
 	 * Handle HTTP response (for client-side requests)
 	 */
-	private handleHttpResponse(_message: any): void {
+	private handleHttpResponse(_message: TunnelResponseMessage): void {
 		// For future client-side request support
 		// Not needed for current server-only implementation
 	}

package/src/substrate/lifo/kernel/vfs/VFS.ts

@@ -436,6 +436,40 @@ export class VFS {
     }
   }
 
+  /**
+   * Type probes, mount-aware through {@link stat}.
+   *
+   * `CredentialedVfs` declares these and the durable coreutils call them on
+   * whatever `ctx.vfs` is, so a view that omitted them was not merely missing
+   * a convenience: `touch` on an existing file died with
+   * `targetVfs.isDirectory is not a function`, because `&&` short-circuited
+   * past the call whenever the file was absent — which is why creating a file
+   * worked and touching one did not.
+   *
+   * A structural miss answers false, the way `fs.existsSync` does. A denial
+   * still throws: traverse-x enforcement must not be maskable into a quiet
+   * false, which is the rule `SqliteVFS.probeInode` already follows.
+   */
+  isDirectory(path: string): boolean {
+    return this.probeType(path) === 'directory';
+  }
+
+  isFile(path: string): boolean {
+    return this.probeType(path) === 'file';
+  }
+
+  private probeType(path: string): string | undefined {
+    try {
+      return this.stat(path).type;
+    } catch (error) {
+      if (error !== null && typeof error === 'object' && 'code' in error) {
+        const code = error.code;
+        if (code === 'ENOENT' || code === 'ENOTDIR') return undefined;
+      }
+      throw error;
+    }
+  }
+
   access(path: string, mode: number): void {
     const vp = this.getProvider(path);
     if (vp) {

package/src/substrate/lifo/node-compat/esbuild.ts

@@ -11,28 +11,36 @@ const ESBUILD_WASM_VERSION = '0.24.2';
 const ESBUILD_WASM_URL = `https://unpkg.com/esbuild-wasm@${ESBUILD_WASM_VERSION}/esbuild.wasm`;
 const ESBUILD_ESM_URL = `https://unpkg.com/esbuild-wasm@${ESBUILD_WASM_VERSION}/esm/browser.min.js`;
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-let esbuildModule: any = null;
-let initPromise: Promise<void> | null = null;
+/** The esbuild-wasm surface this shim forwards to. */
+interface EsbuildWasm {
+  initialize(options: { wasmURL: string }): Promise<void>;
+  transform(code: string, options?: unknown): Promise<unknown>;
+  build(options?: unknown): Promise<unknown>;
+  formatMessages(messages: unknown, options?: unknown): Promise<unknown>;
+  analyzeMetafile(metafile: unknown, options?: unknown): Promise<unknown>;
+  context(options?: unknown): Promise<unknown>;
+}
+
+let esbuildModule: EsbuildWasm | null = null;
+let initPromise: Promise<EsbuildWasm> | null = null;
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function ensureInitialized(): Promise<any> {
+async function ensureInitialized(): Promise<EsbuildWasm> {
   if (esbuildModule) return esbuildModule;
 
   if (!initPromise) {
     initPromise = (async () => {
       // Use dynamic import from CDN
       // This works in browsers natively
-      const mod = await import(/* @vite-ignore */ ESBUILD_ESM_URL);
+      const mod: EsbuildWasm = await import(/* @vite-ignore */ ESBUILD_ESM_URL);
       await mod.initialize({
         wasmURL: ESBUILD_WASM_URL,
       });
       esbuildModule = mod;
+      return mod;
     })();
   }
 
-  await initPromise;
-  return esbuildModule;
+  return await initPromise;
 }
 
 export function createEsbuild(): Record<string, unknown> {

package/src/substrate/lifo/node-compat/index.ts

@@ -22,6 +22,7 @@ import { createModuleShim } from './module.js';
 import * as readlineModule from './readline.js';
 import { createRimraf } from './rimraf.js';
 import { createEsbuild } from './esbuild.js';
+import { assertEqualHolds } from './loose-equality.js';
 
 export interface NodeContext {
   vfs: VFS;
@@ -114,9 +115,9 @@ export function createModuleMap(ctx: NodeContext): Record<string, () => unknown>
         if (!value) throw new Error(message || 'AssertionError');
       };
       assert.ok = assert;
-      assert.equal = (a: unknown, b: unknown, msg?: string) => { if (a != b) throw new Error(msg || `${a} != ${b}`); };
+      assert.equal = (a: unknown, b: unknown, msg?: string) => { if (!assertEqualHolds(a, b)) throw new Error(msg || `${a} != ${b}`); };
       assert.strictEqual = (a: unknown, b: unknown, msg?: string) => { if (a !== b) throw new Error(msg || `${a} !== ${b}`); };
-      assert.notEqual = (a: unknown, b: unknown, msg?: string) => { if (a == b) throw new Error(msg || `${a} == ${b}`); };
+      assert.notEqual = (a: unknown, b: unknown, msg?: string) => { if (assertEqualHolds(a, b)) throw new Error(msg || `${a} == ${b}`); };
       assert.notStrictEqual = (a: unknown, b: unknown, msg?: string) => { if (a === b) throw new Error(msg || `${a} === ${b}`); };
       assert.deepStrictEqual = (a: unknown, b: unknown, msg?: string) => {
         if (JSON.stringify(a) !== JSON.stringify(b)) throw new Error(msg || 'deepStrictEqual failed');

package/src/substrate/lifo/node-compat/loose-equality.ts

@@ -0,0 +1,81 @@
+/**
+ * loose-equality.ts — the `==` coercions, spelled out.
+ *
+ * `assert.equal`/`assert.notEqual` are specified against the `==` operator —
+ * Node's own docs call it "shallow, coercive equality between the actual and
+ * expected parameters using the == operator" — and since Node 14 both also
+ * treat two NaNs as identical, which `==` on its own does not. Guest code
+ * inside the sandbox sees those semantics, so the shim carries them here
+ * instead of the strict comparison a reader would expect of new code.
+ */
+
+/** The spec's Object type: everything callable or keyed, null excluded. */
+function isObject(value: unknown): value is object {
+  return value !== null && (typeof value === 'object' || typeof value === 'function');
+}
+
+/** ToPrimitive(value) with the default hint. */
+function toPrimitive(value: object): unknown {
+  if (Symbol.toPrimitive in value) {
+    const exotic = value[Symbol.toPrimitive];
+    if (typeof exotic === 'function') return exotic.call(value, 'default');
+  }
+  for (const method of ['valueOf', 'toString'] as const) {
+    if (!(method in value)) continue;
+    const convert = value[method];
+    if (typeof convert !== 'function') continue;
+    const primitive: unknown = convert.call(value);
+    if (!isObject(primitive)) return primitive;
+  }
+  throw new TypeError('Cannot convert object to primitive value');
+}
+
+/**
+ * A bigint compares against the mathematical value of its counterpart, so a
+ * fractional number, a non-finite one, or a string naming no integer can
+ * never match one.
+ */
+function bigIntLooseEqual(big: bigint, other: unknown): boolean {
+  if (typeof other === 'number') return Number.isInteger(other) && BigInt(other) === big;
+  if (typeof other !== 'string') return false;
+  try {
+    return BigInt(other) === big;
+  } catch {
+    return false;
+  }
+}
+
+/** IsLooselyEqual — what `a == b` answers. */
+export function looseEqual(a: unknown, b: unknown): boolean {
+  if (a === null || a === undefined) return b === null || b === undefined;
+  if (b === null || b === undefined) return false;
+
+  // Two objects match only as the same reference; an object against a
+  // primitive matches on the object's own primitive value.
+  if (isObject(a)) {
+    return isObject(b) ? a === b : looseEqual(toPrimitive(a), b);
+  }
+  if (isObject(b)) return looseEqual(a, toPrimitive(b));
+
+  const aType = typeof a;
+  const bType = typeof b;
+  if (aType === bType) return a === b;
+  if (aType === 'boolean') return looseEqual(Number(a), b);
+  if (bType === 'boolean') return looseEqual(a, Number(b));
+  if (aType === 'symbol' || bType === 'symbol') return false;
+  if (typeof a === 'bigint') return bigIntLooseEqual(a, b);
+  if (typeof b === 'bigint') return bigIntLooseEqual(b, a);
+  return Number(a) === Number(b);
+}
+
+/**
+ * Whether Node's legacy assertions call these equal: `==`, widened by the
+ * both-sides-NaN case Node folded into `assert.equal` in v14. Node reaches
+ * for the non-coercing `Number.isNaN`, so a string spelling "NaN" is not it.
+ */
+export function assertEqualHolds(a: unknown, b: unknown): boolean {
+  if (typeof a === 'number' && typeof b === 'number') {
+    if (Number.isNaN(a) && Number.isNaN(b)) return true;
+  }
+  return looseEqual(a, b);
+}

package/src/substrate/lifo/node-compat/process.ts

@@ -148,8 +148,11 @@ export function createProcess(opts: ProcessOptions) {
     },
     removeListener: (event: string, fn: (...args: unknown[]) => void) => proc.off(event, fn),
     removeAllListeners: (event?: string) => {
-      if (event) delete listeners[event];
-      else Object.keys(listeners).forEach((k) => delete listeners[k]);
+      if (event) {
+        delete listeners[event];
+      } else {
+        for (const k of Object.keys(listeners)) delete listeners[k];
+      }
       return proc;
     },
     listeners: (event: string) => listeners[event] ? [...listeners[event]] : [],