@secure-exec/core 0.1.1-rc.3 → 0.2.0-rc.1

package/dist/index.d.ts

@@ -1,4 +1,27 @@
-export type { ChildProcessAccessRequest, CommandExecutor, EnvAccessRequest, FsAccessRequest, NetworkAccessRequest, NetworkAdapter, NetworkServerAddress, NetworkServerListenOptions, NetworkServerRequest, NetworkServerResponse, PermissionCheck, PermissionDecision, Permissions, SpawnedProcess, VirtualDirEntry, VirtualFileSystem, VirtualStat, } from "./types.js";
+export { createKernel } from "./kernel/kernel.js";
+export type { Kernel, KernelOptions, KernelInterface, ExecOptions as KernelExecOptions, ExecResult as KernelExecResult, SpawnOptions as KernelSpawnOptions, ManagedProcess, RuntimeDriver as KernelRuntimeDriver, ProcessContext, DriverProcess, ProcessEntry, ProcessInfo, FDStat, FileDescription, FDEntry, Pipe, PermissionDecision, PermissionCheck, FsAccessRequest, NetworkAccessRequest, ChildProcessAccessRequest, EnvAccessRequest, KernelErrorCode, Termios, TermiosCC, OpenShellOptions, ShellHandle, ConnectTerminalOptions, Permissions, } from "./kernel/types.js";
+export { KernelError, defaultTermios } from "./kernel/types.js";
+export type { VirtualFileSystem, VirtualDirEntry, VirtualStat, } from "./kernel/vfs.js";
+export { FDTableManager, ProcessFDTable } from "./kernel/fd-table.js";
+export { ProcessTable } from "./kernel/process-table.js";
+export { TimerTable } from "./kernel/timer-table.js";
+export type { KernelTimer, TimerTableOptions } from "./kernel/timer-table.js";
+export { createDeviceLayer } from "./kernel/device-layer.js";
+export { createProcLayer, createProcessScopedFileSystem, resolveProcSelfPath, } from "./kernel/proc-layer.js";
+export { PipeManager } from "./kernel/pipe-manager.js";
+export { PtyManager } from "./kernel/pty.js";
+export type { LineDisciplineConfig } from "./kernel/pty.js";
+export { CommandRegistry } from "./kernel/command-registry.js";
+export { FileLockManager, LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB } from "./kernel/file-lock.js";
+export { UserManager } from "./kernel/user.js";
+export type { UserConfig } from "./kernel/user.js";
+export { SocketTable } from "./kernel/socket-table.js";
+export { AF_INET, AF_INET6, AF_UNIX, SOCK_STREAM, SOCK_DGRAM, } from "./kernel/socket-table.js";
+export type { HostNetworkAdapter, HostSocket, HostListener, HostUdpSocket, DnsResult, } from "./kernel/host-adapter.js";
+export { checkChildProcess } from "./kernel/permissions.js";
+export { O_RDONLY, O_WRONLY, O_RDWR, O_CREAT, O_EXCL, O_TRUNC, O_APPEND, O_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, FD_CLOEXEC, SEEK_SET, SEEK_CUR, SEEK_END, FILETYPE_UNKNOWN, FILETYPE_CHARACTER_DEVICE, FILETYPE_DIRECTORY, FILETYPE_REGULAR_FILE, FILETYPE_SYMBOLIC_LINK, FILETYPE_PIPE, SIGHUP, SIGINT, SIGQUIT, SIGKILL, SIGPIPE, SIGALRM, SIGTERM, SIGCHLD, SIGCONT, SIGSTOP, SIGTSTP, SIGWINCH, WNOHANG, } from "./kernel/types.js";
+export { encodeExitStatus, encodeSignalStatus, WIFEXITED, WEXITSTATUS, WIFSIGNALED, WTERMSIG, } from "./kernel/wstatus.js";
+export type { CommandExecutor, NetworkAdapter, NetworkServerAddress, NetworkServerListenOptions, NetworkServerRequest, NetworkServerResponse, SpawnedProcess, } from "./types.js";
 export type { DriverRuntimeConfig, NodeRuntimeDriver, NodeRuntimeDriverFactory, PythonRuntimeDriver, PythonRuntimeDriverFactory, ResourceBudgets, RuntimeDriver, RuntimeDriverFactory, RuntimeDriverOptions, SharedRuntimeDriver, SystemDriver, } from "./runtime-driver.js";
 export type { ExecOptions, ExecResult, ExecutionStatus, OSConfig, ProcessConfig, PythonRunOptions, PythonRunResult, RunResult, StdioChannel, StdioEvent, StdioHook, TimingMitigation, } from "./shared/api-types.js";
 export { TIMEOUT_EXIT_CODE, TIMEOUT_ERROR_MESSAGE, } from "./shared/constants.js";
@@ -17,10 +40,6 @@ export { exposeCustomGlobal, exposeGlobalBinding, exposeMutableRuntimeStateGloba
 export type { IsolateRuntimeSourceId } from "./generated/isolate-runtime.js";
 export { getIsolateRuntimeSource, ISOLATE_RUNTIME_SOURCES, } from "./generated/isolate-runtime.js";
 export { POLYFILL_CODE_MAP } from "./generated/polyfills.js";
-export { NodeRuntime } from "./runtime.js";
-export type { NodeRuntimeOptions } from "./runtime.js";
-export { PythonRuntime } from "./python-runtime.js";
-export type { PythonRuntimeOptions } from "./python-runtime.js";
 export type { DirEntry, StatInfo } from "./fs-helpers.js";
 export { exists, stat, rename, readDirWithTypes, mkdir } from "./fs-helpers.js";
 export { BUILTIN_NAMED_EXPORTS, normalizeBuiltinSpecifier, getPathDir, } from "./module-resolver.js";

package/dist/index.js

@@ -1,3 +1,26 @@
+// Kernel — VFS, process table, FD table, device layer, pipes, PTY, command registry, permissions.
+export { createKernel } from "./kernel/kernel.js";
+export { KernelError, defaultTermios } from "./kernel/types.js";
+// Kernel components.
+export { FDTableManager, ProcessFDTable } from "./kernel/fd-table.js";
+export { ProcessTable } from "./kernel/process-table.js";
+export { TimerTable } from "./kernel/timer-table.js";
+export { createDeviceLayer } from "./kernel/device-layer.js";
+export { createProcLayer, createProcessScopedFileSystem, resolveProcSelfPath, } from "./kernel/proc-layer.js";
+export { PipeManager } from "./kernel/pipe-manager.js";
+export { PtyManager } from "./kernel/pty.js";
+export { CommandRegistry } from "./kernel/command-registry.js";
+export { FileLockManager, LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB } from "./kernel/file-lock.js";
+export { UserManager } from "./kernel/user.js";
+// Socket table (kernel TCP/UDP/Unix socket management).
+export { SocketTable } from "./kernel/socket-table.js";
+export { AF_INET, AF_INET6, AF_UNIX, SOCK_STREAM, SOCK_DGRAM, } from "./kernel/socket-table.js";
+// Kernel permission helpers (kernel-level, different from SDK-level shared/permissions).
+export { checkChildProcess } from "./kernel/permissions.js";
+// Kernel constants.
+export { O_RDONLY, O_WRONLY, O_RDWR, O_CREAT, O_EXCL, O_TRUNC, O_APPEND, O_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, FD_CLOEXEC, SEEK_SET, SEEK_CUR, SEEK_END, FILETYPE_UNKNOWN, FILETYPE_CHARACTER_DEVICE, FILETYPE_DIRECTORY, FILETYPE_REGULAR_FILE, FILETYPE_SYMBOLIC_LINK, FILETYPE_PIPE, SIGHUP, SIGINT, SIGQUIT, SIGKILL, SIGPIPE, SIGALRM, SIGTERM, SIGCHLD, SIGCONT, SIGSTOP, SIGTSTP, SIGWINCH, WNOHANG, } from "./kernel/types.js";
+// POSIX wstatus encoding/decoding.
+export { encodeExitStatus, encodeSignalStatus, WIFEXITED, WEXITSTATUS, WIFSIGNALED, WTERMSIG, } from "./kernel/wstatus.js";
 // Shared constants.
 export { TIMEOUT_EXIT_CODE, TIMEOUT_ERROR_MESSAGE, } from "./shared/constants.js";
 // Shared utilities.
@@ -12,9 +35,6 @@ export { exposeCustomGlobal, exposeGlobalBinding, exposeMutableRuntimeStateGloba
 export { getIsolateRuntimeSource, ISOLATE_RUNTIME_SOURCES, } from "./generated/isolate-runtime.js";
 // Generated polyfills.
 export { POLYFILL_CODE_MAP } from "./generated/polyfills.js";
-// Runtime facades.
-export { NodeRuntime } from "./runtime.js";
-export { PythonRuntime } from "./python-runtime.js";
 export { exists, stat, rename, readDirWithTypes, mkdir } from "./fs-helpers.js";
 // Module resolution.
 export { BUILTIN_NAMED_EXPORTS, normalizeBuiltinSpecifier, getPathDir, } from "./module-resolver.js";

package/dist/isolate-runtime/apply-custom-global-policy.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-access.ts
+  // ../core/isolate-runtime/src/common/global-access.ts
   function hasOwnGlobal(name) {
     return Object.prototype.hasOwnProperty.call(globalThis, name);
   }
@@ -8,7 +8,7 @@
     return Reflect.get(globalThis, name);
   }
 
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -35,7 +35,7 @@
     return createRuntimeGlobalExposer(true);
   }
 
-  // isolate-runtime/src/inject/apply-custom-global-policy.ts
+  // ../core/isolate-runtime/src/inject/apply-custom-global-policy.ts
   var __runtimeExposeCustomGlobal = getRuntimeExposeCustomGlobal();
   var __runtimeExposeMutableGlobal = getRuntimeExposeMutableGlobal();
   var __globalPolicy = globalThis.__runtimeCustomGlobalPolicy ?? {};

package/dist/isolate-runtime/apply-timing-mitigation-freeze.js

@@ -1,11 +1,11 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-access.ts
+  // ../core/isolate-runtime/src/common/global-access.ts
   function setGlobalValue(name, value) {
     Reflect.set(globalThis, name, value);
   }
 
-  // isolate-runtime/src/inject/apply-timing-mitigation-freeze.ts
+  // ../core/isolate-runtime/src/inject/apply-timing-mitigation-freeze.ts
   var __timingConfig = globalThis.__runtimeTimingMitigationConfig ?? {};
   var __frozenTimeMs = typeof __timingConfig.frozenTimeMs === "number" && Number.isFinite(__timingConfig.frozenTimeMs) ? __timingConfig.frozenTimeMs : Date.now();
   var __frozenDateNow = () => __frozenTimeMs;

package/dist/isolate-runtime/apply-timing-mitigation-off.js

@@ -1,11 +1,11 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-access.ts
+  // ../core/isolate-runtime/src/common/global-access.ts
   function setGlobalValue(name, value) {
     Reflect.set(globalThis, name, value);
   }
 
-  // isolate-runtime/src/inject/apply-timing-mitigation-off.ts
+  // ../core/isolate-runtime/src/inject/apply-timing-mitigation-off.ts
   if (typeof globalThis.performance === "undefined" || globalThis.performance === null) {
     setGlobalValue("performance", {
       now: () => Date.now()

package/dist/isolate-runtime/bridge-attach.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -21,7 +21,7 @@
     return createRuntimeGlobalExposer(false);
   }
 
-  // isolate-runtime/src/inject/bridge-attach.ts
+  // ../core/isolate-runtime/src/inject/bridge-attach.ts
   var __runtimeExposeCustomGlobal = getRuntimeExposeCustomGlobal();
   if (typeof globalThis.bridge !== "undefined") {
     __runtimeExposeCustomGlobal("bridge", globalThis.bridge);

package/dist/isolate-runtime/bridge-initial-globals.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -21,12 +21,17 @@
     return createRuntimeGlobalExposer(true);
   }
 
-  // isolate-runtime/src/inject/bridge-initial-globals.ts
+  // ../core/isolate-runtime/src/common/global-access.ts
+  function setGlobalValue(name, value) {
+    Reflect.set(globalThis, name, value);
+  }
+
+  // ../core/isolate-runtime/src/inject/bridge-initial-globals.ts
   var __runtimeExposeMutableGlobal = getRuntimeExposeMutableGlobal();
   var __bridgeSetupConfig = globalThis.__runtimeBridgeSetupConfig ?? {};
   var __initialCwd = typeof __bridgeSetupConfig.initialCwd === "string" ? __bridgeSetupConfig.initialCwd : "/";
-  var __jsonPayloadLimitBytes = typeof __bridgeSetupConfig.jsonPayloadLimitBytes === "number" && Number.isFinite(__bridgeSetupConfig.jsonPayloadLimitBytes) ? Math.max(0, Math.floor(__bridgeSetupConfig.jsonPayloadLimitBytes)) : 4 * 1024 * 1024;
-  var __payloadLimitErrorCode = typeof __bridgeSetupConfig.payloadLimitErrorCode === "string" && __bridgeSetupConfig.payloadLimitErrorCode.length > 0 ? __bridgeSetupConfig.payloadLimitErrorCode : "ERR_SANDBOX_PAYLOAD_TOO_LARGE";
+  globalThis.__runtimeJsonPayloadLimitBytes = typeof __bridgeSetupConfig.jsonPayloadLimitBytes === "number" && Number.isFinite(__bridgeSetupConfig.jsonPayloadLimitBytes) ? Math.max(0, Math.floor(__bridgeSetupConfig.jsonPayloadLimitBytes)) : 4 * 1024 * 1024;
+  globalThis.__runtimePayloadLimitErrorCode = typeof __bridgeSetupConfig.payloadLimitErrorCode === "string" && __bridgeSetupConfig.payloadLimitErrorCode.length > 0 ? __bridgeSetupConfig.payloadLimitErrorCode : "ERR_SANDBOX_PAYLOAD_TOO_LARGE";
   function __scEncode(value, seen) {
     if (value === null) return null;
     if (value === void 0) return { t: "undef" };
@@ -224,9 +229,11 @@
         );
       },
       deserialize: function(buffer) {
-        if (buffer.length > __jsonPayloadLimitBytes) {
+        const limit = globalThis.__runtimeJsonPayloadLimitBytes ?? 4 * 1024 * 1024;
+        const errorCode = globalThis.__runtimePayloadLimitErrorCode ?? "ERR_SANDBOX_PAYLOAD_TOO_LARGE";
+        if (buffer.length > limit) {
           throw new Error(
-            __payloadLimitErrorCode + ": v8.deserialize exceeds " + String(__jsonPayloadLimitBytes) + " bytes"
+            errorCode + ": v8.deserialize exceeds " + String(limit) + " bytes"
           );
         }
         const text = buffer.toString();
@@ -243,4 +250,136 @@
   }
   __runtimeExposeMutableGlobal("_pendingModules", {});
   __runtimeExposeMutableGlobal("_currentModule", { dirname: __initialCwd });
+  globalThis.__runtimeApplyConfig = function(config) {
+    if (typeof config.payloadLimitBytes === "number" && Number.isFinite(config.payloadLimitBytes)) {
+      globalThis.__runtimeJsonPayloadLimitBytes = Math.max(
+        0,
+        Math.floor(config.payloadLimitBytes)
+      );
+    }
+    if (typeof config.payloadLimitErrorCode === "string" && config.payloadLimitErrorCode.length > 0) {
+      globalThis.__runtimePayloadLimitErrorCode = config.payloadLimitErrorCode;
+    }
+    if (config.timingMitigation === "freeze") {
+      const frozenTimeMs = typeof config.frozenTimeMs === "number" && Number.isFinite(config.frozenTimeMs) ? config.frozenTimeMs : Date.now();
+      const frozenDateNow = () => frozenTimeMs;
+      try {
+        Object.defineProperty(Date, "now", {
+          value: frozenDateNow,
+          configurable: false,
+          writable: false
+        });
+      } catch {
+        Date.now = frozenDateNow;
+      }
+      const OrigDate = Date;
+      const FrozenDate = function Date2(...args) {
+        if (new.target) {
+          if (args.length === 0) {
+            return new OrigDate(frozenTimeMs);
+          }
+          return new OrigDate(...args);
+        }
+        return OrigDate();
+      };
+      Object.defineProperty(FrozenDate, "prototype", {
+        value: OrigDate.prototype,
+        writable: false,
+        configurable: false
+      });
+      FrozenDate.now = frozenDateNow;
+      FrozenDate.parse = OrigDate.parse;
+      FrozenDate.UTC = OrigDate.UTC;
+      Object.defineProperty(FrozenDate, "now", {
+        value: frozenDateNow,
+        configurable: false,
+        writable: false
+      });
+      try {
+        Object.defineProperty(globalThis, "Date", {
+          value: FrozenDate,
+          configurable: false,
+          writable: false
+        });
+      } catch {
+        globalThis.Date = FrozenDate;
+      }
+      const frozenPerformanceNow = () => 0;
+      const origPerf = globalThis.performance;
+      const frozenPerf = /* @__PURE__ */ Object.create(null);
+      if (typeof origPerf !== "undefined" && origPerf !== null) {
+        const src = origPerf;
+        for (const key of Object.getOwnPropertyNames(
+          Object.getPrototypeOf(origPerf) ?? origPerf
+        )) {
+          if (key !== "now") {
+            try {
+              const val = src[key];
+              if (typeof val === "function") {
+                frozenPerf[key] = val.bind(origPerf);
+              } else {
+                frozenPerf[key] = val;
+              }
+            } catch {
+            }
+          }
+        }
+      }
+      Object.defineProperty(frozenPerf, "now", {
+        value: frozenPerformanceNow,
+        configurable: false,
+        writable: false
+      });
+      Object.freeze(frozenPerf);
+      try {
+        Object.defineProperty(globalThis, "performance", {
+          value: frozenPerf,
+          configurable: false,
+          writable: false
+        });
+      } catch {
+        globalThis.performance = frozenPerf;
+      }
+      const OrigSAB = globalThis.SharedArrayBuffer;
+      if (typeof OrigSAB === "function") {
+        try {
+          const proto = OrigSAB.prototype;
+          if (proto) {
+            for (const key of [
+              "byteLength",
+              "slice",
+              "grow",
+              "maxByteLength",
+              "growable"
+            ]) {
+              try {
+                Object.defineProperty(proto, key, {
+                  get() {
+                    throw new TypeError(
+                      "SharedArrayBuffer is not available in sandbox"
+                    );
+                  },
+                  configurable: false
+                });
+              } catch {
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      try {
+        Object.defineProperty(globalThis, "SharedArrayBuffer", {
+          value: void 0,
+          configurable: false,
+          writable: false,
+          enumerable: false
+        });
+      } catch {
+        Reflect.deleteProperty(globalThis, "SharedArrayBuffer");
+        setGlobalValue("SharedArrayBuffer", void 0);
+      }
+    }
+    delete globalThis.__runtimeApplyConfig;
+  };
 })();

package/dist/isolate-runtime/eval-script-result.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/inject/eval-script-result.ts
+  // ../core/isolate-runtime/src/inject/eval-script-result.ts
   var __runtimeIndirectEval = globalThis.eval;
   globalThis.__scriptResult__ = __runtimeIndirectEval(
     String(globalThis.__runtimeExecCode)

package/dist/isolate-runtime/global-exposure-helpers.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -31,6 +31,6 @@
     }
   }
 
-  // isolate-runtime/src/inject/global-exposure-helpers.ts
+  // ../core/isolate-runtime/src/inject/global-exposure-helpers.ts
   ensureRuntimeExposureHelpers();
 })();

package/dist/isolate-runtime/init-commonjs-module-globals.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -21,7 +21,7 @@
     return createRuntimeGlobalExposer(true);
   }
 
-  // isolate-runtime/src/inject/init-commonjs-module-globals.ts
+  // ../core/isolate-runtime/src/inject/init-commonjs-module-globals.ts
   var __runtimeExposeMutableGlobal = getRuntimeExposeMutableGlobal();
   __runtimeExposeMutableGlobal("module", { exports: {} });
   __runtimeExposeMutableGlobal("exports", globalThis.module.exports);

package/dist/isolate-runtime/override-process-cwd.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/inject/override-process-cwd.ts
+  // ../core/isolate-runtime/src/inject/override-process-cwd.ts
   var __cwd = globalThis.__runtimeProcessCwdOverride;
   if (typeof __cwd === "string") {
     process.cwd = () => __cwd;

package/dist/isolate-runtime/override-process-env.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/inject/override-process-env.ts
+  // ../core/isolate-runtime/src/inject/override-process-env.ts
   var __envPatch = globalThis.__runtimeProcessEnvOverride;
   if (__envPatch && typeof __envPatch === "object") {
     Object.assign(process.env, __envPatch);