@secure-exec/core 0.2.0-rc.1 → 0.2.0-rc.2

package/dist/shared/global-exposure.js

@@ -480,6 +480,11 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host HTTP/2 session settings bridge reference.",
     },
+    {
+        name: "_networkHttp2SessionSetLocalWindowSizeRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 session local-window bridge reference.",
+    },
     {
         name: "_networkHttp2SessionGoawayRaw",
         classification: "hardened",
@@ -500,6 +505,16 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host HTTP/2 session lifetime bridge reference.",
     },
+    {
+        name: "_networkHttp2ServerPollRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 server event-poll bridge reference.",
+    },
+    {
+        name: "_networkHttp2SessionPollRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 session event-poll bridge reference.",
+    },
     {
         name: "_networkHttp2StreamRespondRaw",
         classification: "hardened",
@@ -520,6 +535,31 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host HTTP/2 stream end bridge reference.",
     },
+    {
+        name: "_networkHttp2StreamCloseRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 stream close bridge reference.",
+    },
+    {
+        name: "_networkHttp2StreamPauseRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 stream pause bridge reference.",
+    },
+    {
+        name: "_networkHttp2StreamResumeRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 stream resume bridge reference.",
+    },
+    {
+        name: "_networkHttp2StreamRespondWithFileRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 stream respondWithFile bridge reference.",
+    },
+    {
+        name: "_networkHttp2ServerRespondRaw",
+        classification: "hardened",
+        rationale: "Host HTTP/2 server-response bridge reference.",
+    },
     {
         name: "_upgradeSocketWriteRaw",
         classification: "hardened",
@@ -610,6 +650,46 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Host net server close bridge reference.",
     },
+    {
+        name: "_dgramSocketCreateRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket create bridge reference.",
+    },
+    {
+        name: "_dgramSocketBindRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket bind bridge reference.",
+    },
+    {
+        name: "_dgramSocketRecvRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket receive bridge reference.",
+    },
+    {
+        name: "_dgramSocketSendRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket send bridge reference.",
+    },
+    {
+        name: "_dgramSocketCloseRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket close bridge reference.",
+    },
+    {
+        name: "_dgramSocketAddressRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket address bridge reference.",
+    },
+    {
+        name: "_dgramSocketSetBufferSizeRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket buffer-size setter bridge reference.",
+    },
+    {
+        name: "_dgramSocketGetBufferSizeRaw",
+        classification: "hardened",
+        rationale: "Host dgram socket buffer-size getter bridge reference.",
+    },
     {
         name: "_batchResolveModules",
         classification: "hardened",
@@ -715,11 +795,26 @@ export const NODE_CUSTOM_GLOBAL_INVENTORY = [
         classification: "hardened",
         rationale: "Network Response API global — must not be replaceable by sandbox code.",
     },
+    {
+        name: "DOMException",
+        classification: "hardened",
+        rationale: "DOMException global stub for undici/bootstrap compatibility.",
+    },
+    {
+        name: "__importMetaResolve",
+        classification: "hardened",
+        rationale: "Internal import.meta.resolve helper for transformed ESM modules.",
+    },
     {
         name: "Blob",
         classification: "hardened",
         rationale: "Blob API global stub — must not be replaceable by sandbox code.",
     },
+    {
+        name: "File",
+        classification: "hardened",
+        rationale: "File API global stub — must not be replaceable by sandbox code.",
+    },
     {
         name: "FormData",
         classification: "hardened",

package/dist/shared/in-memory-fs.d.ts

@@ -53,9 +53,12 @@ export declare class InMemoryFileSystem implements VirtualFileSystem {
     private cloneInode;
     private allocateFileInode;
     private allocateDirectoryInode;
+    private allocateSymlinkInode;
     private updateFileMetadata;
     private requirePathInode;
     private requireFileInode;
     private requireInode;
+    private ensureDirectory;
+    private adjustParentDirectoryLinkCount;
 }
 export declare function createInMemoryFileSystem(): InMemoryFileSystem;

package/dist/shared/in-memory-fs.js

@@ -123,7 +123,7 @@ export class InMemoryFileSystem {
                 });
             }
         }
-        for (const linkPath of this.symlinks.keys()) {
+        for (const [linkPath, link] of this.symlinks.entries()) {
             if (!linkPath.startsWith(prefix))
                 continue;
             const rest = linkPath.slice(prefix.length);
@@ -132,7 +132,7 @@ export class InMemoryFileSystem {
                     name: rest,
                     isDirectory: false,
                     isSymbolicLink: true,
-                    ino: 0,
+                    ino: link.ino,
                 });
             }
         }
@@ -189,9 +189,7 @@ export class InMemoryFileSystem {
             let current = "";
             for (const part of parts) {
                 current += `/${part}`;
-                if (!this.dirs.has(current)) {
-                    this.dirs.set(current, this.allocateDirectoryInode().ino);
-                }
+                this.ensureDirectory(current);
             }
             const inode = this.allocateFileInode();
             this.files.set(resolved, inode.ino);
@@ -218,18 +216,14 @@ export class InMemoryFileSystem {
         if (!this.dirs.has(parent)) {
             throw new Error(`ENOENT: no such file or directory, mkdir '${normalized}'`);
         }
-        if (!this.dirs.has(normalized)) {
-            this.dirs.set(normalized, this.allocateDirectoryInode().ino);
-        }
+        this.ensureDirectory(normalized);
     }
     async mkdir(path, _options) {
         const parts = splitPath(path);
         let current = "";
         for (const part of parts) {
             current += `/${part}`;
-            if (!this.dirs.has(current)) {
-                this.dirs.set(current, this.allocateDirectoryInode().ino);
-            }
+            this.ensureDirectory(current);
         }
     }
     resolveIfSymlink(normalized) {
@@ -238,22 +232,23 @@ export class InMemoryFileSystem {
     resolveSymlink(normalized, maxDepth = 16) {
         let current = normalized;
         for (let i = 0; i < maxDepth; i++) {
-            const target = this.symlinks.get(current);
-            if (!target)
+            const link = this.symlinks.get(current);
+            if (!link)
                 return current;
-            current = target.startsWith("/")
-                ? normalizePath(target)
-                : normalizePath(`${dirname(current)}/${target}`);
+            current = link.target.startsWith("/")
+                ? normalizePath(link.target)
+                : normalizePath(`${dirname(current)}/${link.target}`);
         }
         throw new Error(`ELOOP: too many levels of symbolic links, stat '${normalized}'`);
     }
     statForInode(inode) {
         const isDirectory = (inode.mode & 0o170000) === S_IFDIR;
+        const isSymbolicLink = (inode.mode & 0o170000) === S_IFLNK;
         return {
             mode: inode.mode,
             size: isDirectory ? 4096 : inode.size,
             isDirectory,
-            isSymbolicLink: false,
+            isSymbolicLink,
             atimeMs: inode.atime.getTime(),
             mtimeMs: inode.mtime.getTime(),
             ctimeMs: inode.ctime.getTime(),
@@ -295,7 +290,13 @@ export class InMemoryFileSystem {
     }
     async removeFile(path) {
         const normalized = normalizePath(path);
-        if (this.symlinks.delete(normalized)) {
+        const symlink = this.symlinks.get(normalized);
+        if (symlink) {
+            this.symlinks.delete(normalized);
+            this.inodeTable.decrementLinks(symlink.ino);
+            if (this.inodeTable.shouldDelete(symlink.ino)) {
+                this.inodeTable.delete(symlink.ino);
+            }
             return;
         }
         const resolved = this.resolveSymlink(normalized);
@@ -337,6 +338,8 @@ export class InMemoryFileSystem {
         const ino = this.dirs.get(normalized);
         this.dirs.delete(normalized);
         this.inodeTable.decrementLinks(ino);
+        this.inodeTable.decrementLinks(ino);
+        this.adjustParentDirectoryLinkCount(normalized, -1);
         if (this.inodeTable.shouldDelete(ino)) {
             this.inodeTable.delete(ino);
         }
@@ -412,6 +415,10 @@ export class InMemoryFileSystem {
         for (const [path, target] of symlinkEntries) {
             this.symlinks.set(`${targetPrefix}${path.slice(sourcePrefix.length)}`, target);
         }
+        if (dirname(oldNormalized) !== dirname(newNormalized)) {
+            this.adjustParentDirectoryLinkCount(oldNormalized, -1);
+            this.adjustParentDirectoryLinkCount(newNormalized, 1);
+        }
     }
     async symlink(target, linkPath) {
         const normalized = normalizePath(linkPath);
@@ -421,35 +428,22 @@ export class InMemoryFileSystem {
             throw new Error(`EEXIST: file already exists, symlink '${target}' -> '${normalized}'`);
         }
         await this.mkdir(dirname(normalized));
-        this.symlinks.set(normalized, target);
+        const inode = this.allocateSymlinkInode(target);
+        this.symlinks.set(normalized, { target, ino: inode.ino });
     }
     async readlink(path) {
         const normalized = normalizePath(path);
-        const target = this.symlinks.get(normalized);
-        if (target === undefined) {
+        const link = this.symlinks.get(normalized);
+        if (link === undefined) {
             throw new Error(`EINVAL: invalid argument, readlink '${normalized}'`);
         }
-        return target;
+        return link.target;
     }
     async lstat(path) {
         const normalized = normalizePath(path);
-        const target = this.symlinks.get(normalized);
-        if (target !== undefined) {
-            const now = Date.now();
-            return {
-                mode: S_IFLNK | 0o777,
-                size: new TextEncoder().encode(target).byteLength,
-                isDirectory: false,
-                isSymbolicLink: true,
-                atimeMs: now,
-                mtimeMs: now,
-                ctimeMs: now,
-                birthtimeMs: now,
-                ino: 0,
-                nlink: 1,
-                uid: 0,
-                gid: 0,
-            };
+        const link = this.symlinks.get(normalized);
+        if (link !== undefined) {
+            return this.statForInode(this.requireInode(link.ino));
         }
         return this.statEntry(normalized);
     }
@@ -532,11 +526,13 @@ export class InMemoryFileSystem {
     reindexInodes(oldTable) {
         const oldContents = new Map(this.fileContents);
         const oldFiles = new Map(this.files);
+        const oldSymlinks = new Map(this.symlinks);
         const oldDirs = Array.from(this.dirs.entries()).sort(([a], [b]) => a.length - b.length);
         const inoMap = new Map();
         this.files = new Map();
         this.fileContents = new Map();
         this.dirs = new Map();
+        this.symlinks = new Map();
         for (const [dirPath, oldIno] of oldDirs) {
             const ino = this.cloneInode(oldIno, oldTable, S_IFDIR | 0o755).ino;
             this.dirs.set(dirPath, ino);
@@ -557,6 +553,11 @@ export class InMemoryFileSystem {
                 this.requireInode(mapped).size = content.byteLength;
             }
         }
+        for (const [path, link] of oldSymlinks) {
+            const mapped = this.cloneInode(link.ino, oldTable, S_IFLNK | 0o777).ino;
+            this.symlinks.set(path, { target: link.target, ino: mapped });
+            this.requireInode(mapped).size = new TextEncoder().encode(link.target).byteLength;
+        }
     }
     cloneInode(oldIno, oldTable, fallbackMode) {
         const source = oldTable.get(oldIno);
@@ -575,9 +576,15 @@ export class InMemoryFileSystem {
     }
     allocateDirectoryInode() {
         const inode = this.inodeTable.allocate(S_IFDIR | 0o755, 0, 0);
+        inode.nlink = 2;
         inode.size = 4096;
         return inode;
     }
+    allocateSymlinkInode(target) {
+        const inode = this.inodeTable.allocate(S_IFLNK | 0o777, 0, 0);
+        inode.size = new TextEncoder().encode(target).byteLength;
+        return inode;
+    }
     updateFileMetadata(ino, size) {
         const inode = this.requireFileInode(ino);
         const now = new Date();
@@ -609,6 +616,34 @@ export class InMemoryFileSystem {
         }
         return inode;
     }
+    ensureDirectory(path) {
+        const normalized = normalizePath(path);
+        if (normalized === "/")
+            return;
+        if (this.dirs.has(normalized))
+            return;
+        const parent = dirname(normalized);
+        if (!this.dirs.has(parent)) {
+            throw new Error(`ENOENT: no such file or directory, mkdir '${normalized}'`);
+        }
+        this.dirs.set(normalized, this.allocateDirectoryInode().ino);
+        this.adjustParentDirectoryLinkCount(normalized, 1);
+    }
+    adjustParentDirectoryLinkCount(path, delta) {
+        const normalized = normalizePath(path);
+        if (normalized === "/")
+            return;
+        const parent = dirname(normalized);
+        const parentIno = this.dirs.get(parent);
+        if (parentIno === undefined)
+            return;
+        if (delta > 0) {
+            this.inodeTable.incrementLinks(parentIno);
+        }
+        else {
+            this.inodeTable.decrementLinks(parentIno);
+        }
+    }
 }
 export function createInMemoryFileSystem() {
     return new InMemoryFileSystem();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secure-exec/core",
-  "version": "0.2.0-rc.1",
+  "version": "0.2.0-rc.2",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",