@secure-exec/core 0.1.1-rc.3 → 0.2.0-rc.2

package/dist/isolate-runtime/set-commonjs-file-globals.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -21,7 +21,7 @@
     return createRuntimeGlobalExposer(true);
   }
 
-  // isolate-runtime/src/inject/set-commonjs-file-globals.ts
+  // ../core/isolate-runtime/src/inject/set-commonjs-file-globals.ts
   var __runtimeExposeMutableGlobal = getRuntimeExposeMutableGlobal();
   var __commonJsFileConfig = globalThis.__runtimeCommonJsFileConfig ?? {};
   var __filePath = typeof __commonJsFileConfig.filePath === "string" ? __commonJsFileConfig.filePath : "/<entry>.js";

package/dist/isolate-runtime/set-stdin-data.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/inject/set-stdin-data.ts
+  // ../core/isolate-runtime/src/inject/set-stdin-data.ts
   if (typeof globalThis._stdinData !== "undefined") {
     globalThis._stdinData = globalThis.__runtimeStdinData;
     globalThis._stdinPosition = 0;

package/dist/isolate-runtime/setup-dynamic-import.js

@@ -1,11 +1,11 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-access.ts
+  // ../core/isolate-runtime/src/common/global-access.ts
   function isObjectLike(value) {
     return value !== null && (typeof value === "object" || typeof value === "function");
   }
 
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -26,30 +26,58 @@
     return createRuntimeGlobalExposer(false);
   }
 
-  // isolate-runtime/src/inject/setup-dynamic-import.ts
+  // ../core/isolate-runtime/src/inject/setup-dynamic-import.ts
   var __runtimeExposeCustomGlobal = getRuntimeExposeCustomGlobal();
   var __dynamicImportConfig = globalThis.__runtimeDynamicImportConfig ?? {};
   var __fallbackReferrer = typeof __dynamicImportConfig.referrerPath === "string" && __dynamicImportConfig.referrerPath.length > 0 ? __dynamicImportConfig.referrerPath : "/";
-  var __dynamicImportHandler = async function(specifier, fromPath) {
+  var __dynamicImportCache = /* @__PURE__ */ new Map();
+  var __pathToFileURL = typeof globalThis.require === "function" ? globalThis.require("node:url").pathToFileURL ?? null : null;
+  var __resolveDynamicImportPath = function(request, referrer) {
+    if (!request.startsWith("./") && !request.startsWith("../") && !request.startsWith("/")) {
+      return request;
+    }
+    const baseDir = referrer.endsWith("/") ? referrer : referrer.slice(0, referrer.lastIndexOf("/")) || "/";
+    const segments = baseDir.split("/").filter(Boolean);
+    for (const part of request.split("/")) {
+      if (part === "." || part.length === 0) continue;
+      if (part === "..") {
+        segments.pop();
+        continue;
+      }
+      segments.push(part);
+    }
+    return `/${segments.join("/")}`;
+  };
+  var __dynamicImportHandler = function(specifier, fromPath) {
     const request = String(specifier);
     const referrer = typeof fromPath === "string" && fromPath.length > 0 ? fromPath : __fallbackReferrer;
-    const allowRequireFallback = request.endsWith(".cjs") || request.endsWith(".json");
-    const namespace = await globalThis._dynamicImport.apply(
-      void 0,
-      [request, referrer],
-      { result: { promise: true } }
-    );
-    if (namespace !== null) {
-      return namespace;
+    let resolved = null;
+    if (typeof globalThis._resolveModuleSync !== "undefined") {
+      resolved = globalThis._resolveModuleSync.applySync(
+        void 0,
+        [request, referrer, "import"]
+      );
     }
-    if (!allowRequireFallback) {
-      throw new Error("Cannot find module '" + request + "'");
+    const resolvedPath = typeof resolved === "string" && resolved.length > 0 ? resolved : __resolveDynamicImportPath(request, referrer);
+    const cacheKey = typeof resolved === "string" && resolved.length > 0 ? resolved : `${referrer}\0${request}`;
+    const cached = __dynamicImportCache.get(cacheKey);
+    if (cached) return Promise.resolve(cached);
+    if (typeof globalThis._requireFrom !== "function") {
+      throw new Error("Cannot load module: " + resolvedPath);
     }
-    const runtimeRequire = globalThis.require;
-    if (typeof runtimeRequire !== "function") {
-      throw new Error("Cannot find module '" + request + "'");
+    let mod;
+    try {
+      mod = globalThis._requireFrom(resolved ?? request, referrer);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (error && typeof error === "object" && "code" in error && error.code === "MODULE_NOT_FOUND") {
+        throw new Error("Cannot load module: " + resolvedPath);
+      }
+      if (message.startsWith("Cannot find module ")) {
+        throw new Error("Cannot load module: " + resolvedPath);
+      }
+      throw error;
     }
-    const mod = runtimeRequire(request);
     const namespaceFallback = { default: mod };
     if (isObjectLike(mod)) {
       for (const key of Object.keys(mod)) {
@@ -58,7 +86,38 @@
         }
       }
     }
-    return namespaceFallback;
+    __dynamicImportCache.set(cacheKey, namespaceFallback);
+    return Promise.resolve(namespaceFallback);
+  };
+  var __importMetaResolveHandler = function(specifier, fromPath) {
+    const request = String(specifier);
+    const referrer = typeof fromPath === "string" && fromPath.length > 0 ? fromPath : __fallbackReferrer;
+    let resolved = null;
+    if (typeof globalThis._resolveModuleSync !== "undefined") {
+      resolved = globalThis._resolveModuleSync.applySync(
+        void 0,
+        [request, referrer, "import"]
+      );
+    }
+    if (resolved === null || resolved === void 0) {
+      resolved = globalThis._resolveModule.applySyncPromise(
+        void 0,
+        [request, referrer, "import"]
+      );
+    }
+    if (resolved === null) {
+      const err = new Error("Cannot find module '" + request + "'");
+      err.code = "MODULE_NOT_FOUND";
+      throw err;
+    }
+    if (resolved.startsWith("node:")) {
+      return resolved;
+    }
+    if (__pathToFileURL && resolved.startsWith("/")) {
+      return __pathToFileURL(resolved).href;
+    }
+    return resolved;
   };
   __runtimeExposeCustomGlobal("__dynamicImport", __dynamicImportHandler);
+  __runtimeExposeCustomGlobal("__importMetaResolve", __importMetaResolveHandler);
 })();

package/dist/isolate-runtime/setup-fs-facade.js

@@ -1,6 +1,6 @@
 "use strict";
 (() => {
-  // isolate-runtime/src/common/global-exposure.ts
+  // ../core/isolate-runtime/src/common/global-exposure.ts
   function defineRuntimeGlobalBinding(name, value, mutable) {
     Object.defineProperty(globalThis, name, {
       value,
@@ -21,28 +21,67 @@
     return createRuntimeGlobalExposer(false);
   }
 
-  // isolate-runtime/src/inject/setup-fs-facade.ts
+  // ../core/isolate-runtime/src/inject/setup-fs-facade.ts
   var __runtimeExposeCustomGlobal = getRuntimeExposeCustomGlobal();
-  var __fsFacade = {
-    readFile: globalThis._fsReadFile,
-    writeFile: globalThis._fsWriteFile,
-    readFileBinary: globalThis._fsReadFileBinary,
-    writeFileBinary: globalThis._fsWriteFileBinary,
-    readDir: globalThis._fsReadDir,
-    mkdir: globalThis._fsMkdir,
-    rmdir: globalThis._fsRmdir,
-    exists: globalThis._fsExists,
-    stat: globalThis._fsStat,
-    unlink: globalThis._fsUnlink,
-    rename: globalThis._fsRename,
-    chmod: globalThis._fsChmod,
-    chown: globalThis._fsChown,
-    link: globalThis._fsLink,
-    symlink: globalThis._fsSymlink,
-    readlink: globalThis._fsReadlink,
-    lstat: globalThis._fsLstat,
-    truncate: globalThis._fsTruncate,
-    utimes: globalThis._fsUtimes
-  };
+  var __fsFacade = {};
+  Object.defineProperties(__fsFacade, {
+    readFile: { get() {
+      return globalThis._fsReadFile;
+    }, enumerable: true },
+    writeFile: { get() {
+      return globalThis._fsWriteFile;
+    }, enumerable: true },
+    readFileBinary: { get() {
+      return globalThis._fsReadFileBinary;
+    }, enumerable: true },
+    writeFileBinary: { get() {
+      return globalThis._fsWriteFileBinary;
+    }, enumerable: true },
+    readDir: { get() {
+      return globalThis._fsReadDir;
+    }, enumerable: true },
+    mkdir: { get() {
+      return globalThis._fsMkdir;
+    }, enumerable: true },
+    rmdir: { get() {
+      return globalThis._fsRmdir;
+    }, enumerable: true },
+    exists: { get() {
+      return globalThis._fsExists;
+    }, enumerable: true },
+    stat: { get() {
+      return globalThis._fsStat;
+    }, enumerable: true },
+    unlink: { get() {
+      return globalThis._fsUnlink;
+    }, enumerable: true },
+    rename: { get() {
+      return globalThis._fsRename;
+    }, enumerable: true },
+    chmod: { get() {
+      return globalThis._fsChmod;
+    }, enumerable: true },
+    chown: { get() {
+      return globalThis._fsChown;
+    }, enumerable: true },
+    link: { get() {
+      return globalThis._fsLink;
+    }, enumerable: true },
+    symlink: { get() {
+      return globalThis._fsSymlink;
+    }, enumerable: true },
+    readlink: { get() {
+      return globalThis._fsReadlink;
+    }, enumerable: true },
+    lstat: { get() {
+      return globalThis._fsLstat;
+    }, enumerable: true },
+    truncate: { get() {
+      return globalThis._fsTruncate;
+    }, enumerable: true },
+    utimes: { get() {
+      return globalThis._fsUtimes;
+    }, enumerable: true }
+  });
   __runtimeExposeCustomGlobal("_fs", __fsFacade);
 })();

package/dist/kernel/command-registry.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Command registry.
+ *
+ * Maps command names to runtime drivers. When a process calls
+ * spawn("grep", ...), the registry resolves "grep" to the WasmVM driver.
+ * Also populates /bin in the VFS so shell PATH lookup succeeds.
+ */
+import type { RuntimeDriver } from "./types.js";
+import type { VirtualFileSystem } from "./vfs.js";
+export declare class CommandRegistry {
+    /** command name → RuntimeDriver */
+    private commands;
+    /** Warning log for command overrides. */
+    private warnings;
+    /**
+     * Register all commands from a driver.
+     * Last-mounted driver wins on conflicts (allows override with warning).
+     */
+    register(driver: RuntimeDriver): void;
+    /** Get recorded warnings (for testing). */
+    getWarnings(): readonly string[];
+    /**
+     * Register a single command to a driver.
+     * Used for on-demand dynamic registration (e.g. after tryResolve).
+     */
+    registerCommand(command: string, driver: RuntimeDriver): void;
+    /**
+     * Resolve a command name to a driver. Returns null if unknown.
+     * Supports path-based lookup: '/bin/ls' resolves to the driver for 'ls'.
+     */
+    resolve(command: string): RuntimeDriver | null;
+    /** List all registered commands. Returns command → driver name. */
+    list(): Map<string, string>;
+    /**
+     * Create a single /bin stub entry for a command.
+     * Used for on-demand registration after tryResolve discovers a new command.
+     */
+    populateBinEntry(vfs: VirtualFileSystem, command: string): Promise<void>;
+    /**
+     * Populate /bin in the VFS with stub entries for all registered commands.
+     * This enables brush-shell's PATH lookup to find commands.
+     */
+    populateBin(vfs: VirtualFileSystem): Promise<void>;
+}

package/dist/kernel/command-registry.js

@@ -0,0 +1,114 @@
+/**
+ * Command registry.
+ *
+ * Maps command names to runtime drivers. When a process calls
+ * spawn("grep", ...), the registry resolves "grep" to the WasmVM driver.
+ * Also populates /bin in the VFS so shell PATH lookup succeeds.
+ */
+export class CommandRegistry {
+    /** command name → RuntimeDriver */
+    commands = new Map();
+    /** Warning log for command overrides. */
+    warnings = [];
+    /**
+     * Register all commands from a driver.
+     * Last-mounted driver wins on conflicts (allows override with warning).
+     */
+    register(driver) {
+        for (const cmd of driver.commands) {
+            const existing = this.commands.get(cmd);
+            if (existing) {
+                const msg = `command "${cmd}" overridden: ${existing.name} → ${driver.name}`;
+                this.warnings.push(msg);
+                console.warn(`[CommandRegistry] ${msg}`);
+            }
+            this.commands.set(cmd, driver);
+        }
+    }
+    /** Get recorded warnings (for testing). */
+    getWarnings() {
+        return this.warnings;
+    }
+    /**
+     * Register a single command to a driver.
+     * Used for on-demand dynamic registration (e.g. after tryResolve).
+     */
+    registerCommand(command, driver) {
+        const existing = this.commands.get(command);
+        if (existing) {
+            const msg = `command "${command}" overridden: ${existing.name} → ${driver.name}`;
+            this.warnings.push(msg);
+            console.warn(`[CommandRegistry] ${msg}`);
+        }
+        this.commands.set(command, driver);
+    }
+    /**
+     * Resolve a command name to a driver. Returns null if unknown.
+     * Supports path-based lookup: '/bin/ls' resolves to the driver for 'ls'.
+     */
+    resolve(command) {
+        // Direct name lookup
+        const direct = this.commands.get(command);
+        if (direct)
+            return direct;
+        // Path-based: extract basename and retry
+        if (command.includes("/")) {
+            const basename = command.split("/").pop();
+            if (basename)
+                return this.commands.get(basename) ?? null;
+        }
+        return null;
+    }
+    /** List all registered commands. Returns command → driver name. */
+    list() {
+        const result = new Map();
+        for (const [cmd, driver] of this.commands) {
+            result.set(cmd, driver.name);
+        }
+        return result;
+    }
+    /**
+     * Create a single /bin stub entry for a command.
+     * Used for on-demand registration after tryResolve discovers a new command.
+     */
+    async populateBinEntry(vfs, command) {
+        if (!(await vfs.exists("/bin"))) {
+            await vfs.mkdir("/bin", { recursive: true });
+        }
+        const path = `/bin/${command}`;
+        if (!(await vfs.exists(path))) {
+            const stub = new TextEncoder().encode("#!/bin/sh\n# kernel command stub\n");
+            await vfs.writeFile(path, stub);
+            try {
+                await vfs.chmod(path, 0o755);
+            }
+            catch {
+                // chmod may not be supported by all VFS backends
+            }
+        }
+    }
+    /**
+     * Populate /bin in the VFS with stub entries for all registered commands.
+     * This enables brush-shell's PATH lookup to find commands.
+     */
+    async populateBin(vfs) {
+        // Ensure /bin exists
+        if (!(await vfs.exists("/bin"))) {
+            await vfs.mkdir("/bin", { recursive: true });
+        }
+        // Create a stub file for each command
+        const stub = new TextEncoder().encode("#!/bin/sh\n# kernel command stub\n");
+        for (const cmd of this.commands.keys()) {
+            const path = `/bin/${cmd}`;
+            if (!(await vfs.exists(path))) {
+                await vfs.writeFile(path, stub);
+                try {
+                    await vfs.chmod(path, 0o755);
+                }
+                catch {
+                    // chmod may not be supported by all VFS backends
+                }
+            }
+        }
+    }
+}

package/dist/kernel/device-layer.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Device layer.
+ *
+ * Intercepts device node paths (/dev/*) before they reach the VFS backend.
+ * Wraps a VirtualFileSystem and handles device-specific read/write semantics.
+ */
+import type { VirtualFileSystem } from "./vfs.js";
+/**
+ * Wrap a VFS with device node interception.
+ * Device paths are handled directly; all other paths pass through.
+ */
+export declare function createDeviceLayer(vfs: VirtualFileSystem): VirtualFileSystem;