@secure-exec/core 0.2.1 → 0.3.0-rc.2

package/dist/isolate-runtime/set-commonjs-file-globals.js

@@ -1,36 +0,0 @@
-"use strict";
-(() => {
-  // ../core/isolate-runtime/src/common/global-exposure.ts
-  function defineRuntimeGlobalBinding(name, value, mutable) {
-    Object.defineProperty(globalThis, name, {
-      value,
-      writable: mutable,
-      configurable: mutable,
-      enumerable: true
-    });
-  }
-  function createRuntimeGlobalExposer(mutable) {
-    return (name, value) => {
-      defineRuntimeGlobalBinding(name, value, mutable);
-    };
-  }
-  function getRuntimeExposeMutableGlobal() {
-    if (typeof globalThis.__runtimeExposeMutableGlobal === "function") {
-      return globalThis.__runtimeExposeMutableGlobal;
-    }
-    return createRuntimeGlobalExposer(true);
-  }
-
-  // ../core/isolate-runtime/src/inject/set-commonjs-file-globals.ts
-  var __runtimeExposeMutableGlobal = getRuntimeExposeMutableGlobal();
-  var __commonJsFileConfig = globalThis.__runtimeCommonJsFileConfig ?? {};
-  var __filePath = typeof __commonJsFileConfig.filePath === "string" ? __commonJsFileConfig.filePath : "/<entry>.js";
-  var __dirname = typeof __commonJsFileConfig.dirname === "string" ? __commonJsFileConfig.dirname : "/";
-  __runtimeExposeMutableGlobal("__filename", __filePath);
-  __runtimeExposeMutableGlobal("__dirname", __dirname);
-  var __currentModule = globalThis._currentModule;
-  if (__currentModule) {
-    __currentModule.dirname = __dirname;
-    __currentModule.filename = __filePath;
-  }
-})();

package/dist/isolate-runtime/set-stdin-data.js

@@ -1,10 +0,0 @@
-"use strict";
-(() => {
-  // ../core/isolate-runtime/src/inject/set-stdin-data.ts
-  if (typeof globalThis._stdinData !== "undefined") {
-    globalThis._stdinData = globalThis.__runtimeStdinData;
-    globalThis._stdinPosition = 0;
-    globalThis._stdinEnded = false;
-    globalThis._stdinFlowMode = false;
-  }
-})();

package/dist/isolate-runtime/setup-dynamic-import.js

@@ -1,123 +0,0 @@
-"use strict";
-(() => {
-  // ../core/isolate-runtime/src/common/global-access.ts
-  function isObjectLike(value) {
-    return value !== null && (typeof value === "object" || typeof value === "function");
-  }
-
-  // ../core/isolate-runtime/src/common/global-exposure.ts
-  function defineRuntimeGlobalBinding(name, value, mutable) {
-    Object.defineProperty(globalThis, name, {
-      value,
-      writable: mutable,
-      configurable: mutable,
-      enumerable: true
-    });
-  }
-  function createRuntimeGlobalExposer(mutable) {
-    return (name, value) => {
-      defineRuntimeGlobalBinding(name, value, mutable);
-    };
-  }
-  function getRuntimeExposeCustomGlobal() {
-    if (typeof globalThis.__runtimeExposeCustomGlobal === "function") {
-      return globalThis.__runtimeExposeCustomGlobal;
-    }
-    return createRuntimeGlobalExposer(false);
-  }
-
-  // ../core/isolate-runtime/src/inject/setup-dynamic-import.ts
-  var __runtimeExposeCustomGlobal = getRuntimeExposeCustomGlobal();
-  var __dynamicImportConfig = globalThis.__runtimeDynamicImportConfig ?? {};
-  var __fallbackReferrer = typeof __dynamicImportConfig.referrerPath === "string" && __dynamicImportConfig.referrerPath.length > 0 ? __dynamicImportConfig.referrerPath : "/";
-  var __dynamicImportCache = /* @__PURE__ */ new Map();
-  var __pathToFileURL = typeof globalThis.require === "function" ? globalThis.require("node:url").pathToFileURL ?? null : null;
-  var __resolveDynamicImportPath = function(request, referrer) {
-    if (!request.startsWith("./") && !request.startsWith("../") && !request.startsWith("/")) {
-      return request;
-    }
-    const baseDir = referrer.endsWith("/") ? referrer : referrer.slice(0, referrer.lastIndexOf("/")) || "/";
-    const segments = baseDir.split("/").filter(Boolean);
-    for (const part of request.split("/")) {
-      if (part === "." || part.length === 0) continue;
-      if (part === "..") {
-        segments.pop();
-        continue;
-      }
-      segments.push(part);
-    }
-    return `/${segments.join("/")}`;
-  };
-  var __dynamicImportHandler = function(specifier, fromPath) {
-    const request = String(specifier);
-    const referrer = typeof fromPath === "string" && fromPath.length > 0 ? fromPath : __fallbackReferrer;
-    let resolved = null;
-    if (typeof globalThis._resolveModuleSync !== "undefined") {
-      resolved = globalThis._resolveModuleSync.applySync(
-        void 0,
-        [request, referrer, "import"]
-      );
-    }
-    const resolvedPath = typeof resolved === "string" && resolved.length > 0 ? resolved : __resolveDynamicImportPath(request, referrer);
-    const cacheKey = typeof resolved === "string" && resolved.length > 0 ? resolved : `${referrer}\0${request}`;
-    const cached = __dynamicImportCache.get(cacheKey);
-    if (cached) return Promise.resolve(cached);
-    if (typeof globalThis._requireFrom !== "function") {
-      throw new Error("Cannot load module: " + resolvedPath);
-    }
-    let mod;
-    try {
-      mod = globalThis._requireFrom(resolved ?? request, referrer);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (error && typeof error === "object" && "code" in error && error.code === "MODULE_NOT_FOUND") {
-        throw new Error("Cannot load module: " + resolvedPath);
-      }
-      if (message.startsWith("Cannot find module ")) {
-        throw new Error("Cannot load module: " + resolvedPath);
-      }
-      throw error;
-    }
-    const namespaceFallback = { default: mod };
-    if (isObjectLike(mod)) {
-      for (const key of Object.keys(mod)) {
-        if (!(key in namespaceFallback)) {
-          namespaceFallback[key] = mod[key];
-        }
-      }
-    }
-    __dynamicImportCache.set(cacheKey, namespaceFallback);
-    return Promise.resolve(namespaceFallback);
-  };
-  var __importMetaResolveHandler = function(specifier, fromPath) {
-    const request = String(specifier);
-    const referrer = typeof fromPath === "string" && fromPath.length > 0 ? fromPath : __fallbackReferrer;
-    let resolved = null;
-    if (typeof globalThis._resolveModuleSync !== "undefined") {
-      resolved = globalThis._resolveModuleSync.applySync(
-        void 0,
-        [request, referrer, "import"]
-      );
-    }
-    if (resolved === null || resolved === void 0) {
-      resolved = globalThis._resolveModule.applySyncPromise(
-        void 0,
-        [request, referrer, "import"]
-      );
-    }
-    if (resolved === null) {
-      const err = new Error("Cannot find module '" + request + "'");
-      err.code = "MODULE_NOT_FOUND";
-      throw err;
-    }
-    if (resolved.startsWith("node:")) {
-      return resolved;
-    }
-    if (__pathToFileURL && resolved.startsWith("/")) {
-      return __pathToFileURL(resolved).href;
-    }
-    return resolved;
-  };
-  __runtimeExposeCustomGlobal("__dynamicImport", __dynamicImportHandler);
-  __runtimeExposeCustomGlobal("__importMetaResolve", __importMetaResolveHandler);
-})();

package/dist/isolate-runtime/setup-fs-facade.js

@@ -1,87 +0,0 @@
-"use strict";
-(() => {
-  // ../core/isolate-runtime/src/common/global-exposure.ts
-  function defineRuntimeGlobalBinding(name, value, mutable) {
-    Object.defineProperty(globalThis, name, {
-      value,
-      writable: mutable,
-      configurable: mutable,
-      enumerable: true
-    });
-  }
-  function createRuntimeGlobalExposer(mutable) {
-    return (name, value) => {
-      defineRuntimeGlobalBinding(name, value, mutable);
-    };
-  }
-  function getRuntimeExposeCustomGlobal() {
-    if (typeof globalThis.__runtimeExposeCustomGlobal === "function") {
-      return globalThis.__runtimeExposeCustomGlobal;
-    }
-    return createRuntimeGlobalExposer(false);
-  }
-
-  // ../core/isolate-runtime/src/inject/setup-fs-facade.ts
-  var __runtimeExposeCustomGlobal = getRuntimeExposeCustomGlobal();
-  var __fsFacade = {};
-  Object.defineProperties(__fsFacade, {
-    readFile: { get() {
-      return globalThis._fsReadFile;
-    }, enumerable: true },
-    writeFile: { get() {
-      return globalThis._fsWriteFile;
-    }, enumerable: true },
-    readFileBinary: { get() {
-      return globalThis._fsReadFileBinary;
-    }, enumerable: true },
-    writeFileBinary: { get() {
-      return globalThis._fsWriteFileBinary;
-    }, enumerable: true },
-    readDir: { get() {
-      return globalThis._fsReadDir;
-    }, enumerable: true },
-    mkdir: { get() {
-      return globalThis._fsMkdir;
-    }, enumerable: true },
-    rmdir: { get() {
-      return globalThis._fsRmdir;
-    }, enumerable: true },
-    exists: { get() {
-      return globalThis._fsExists;
-    }, enumerable: true },
-    stat: { get() {
-      return globalThis._fsStat;
-    }, enumerable: true },
-    unlink: { get() {
-      return globalThis._fsUnlink;
-    }, enumerable: true },
-    rename: { get() {
-      return globalThis._fsRename;
-    }, enumerable: true },
-    chmod: { get() {
-      return globalThis._fsChmod;
-    }, enumerable: true },
-    chown: { get() {
-      return globalThis._fsChown;
-    }, enumerable: true },
-    link: { get() {
-      return globalThis._fsLink;
-    }, enumerable: true },
-    symlink: { get() {
-      return globalThis._fsSymlink;
-    }, enumerable: true },
-    readlink: { get() {
-      return globalThis._fsReadlink;
-    }, enumerable: true },
-    lstat: { get() {
-      return globalThis._fsLstat;
-    }, enumerable: true },
-    truncate: { get() {
-      return globalThis._fsTruncate;
-    }, enumerable: true },
-    utimes: { get() {
-      return globalThis._fsUtimes;
-    }, enumerable: true }
-  });
-  __runtimeExposeCustomGlobal("_fs", __fsFacade);
-})();

package/dist/kernel/command-registry.d.ts

@@ -1,44 +0,0 @@
-/**
- * Command registry.
- *
- * Maps command names to runtime drivers. When a process calls
- * spawn("grep", ...), the registry resolves "grep" to the WasmVM driver.
- * Also populates /bin in the VFS so shell PATH lookup succeeds.
- */
-import type { RuntimeDriver } from "./types.js";
-import type { VirtualFileSystem } from "./vfs.js";
-export declare class CommandRegistry {
-    /** command name → RuntimeDriver */
-    private commands;
-    /** Warning log for command overrides. */
-    private warnings;
-    /**
-     * Register all commands from a driver.
-     * Last-mounted driver wins on conflicts (allows override with warning).
-     */
-    register(driver: RuntimeDriver): void;
-    /** Get recorded warnings (for testing). */
-    getWarnings(): readonly string[];
-    /**
-     * Register a single command to a driver.
-     * Used for on-demand dynamic registration (e.g. after tryResolve).
-     */
-    registerCommand(command: string, driver: RuntimeDriver): void;
-    /**
-     * Resolve a command name to a driver. Returns null if unknown.
-     * Supports path-based lookup: '/bin/ls' resolves to the driver for 'ls'.
-     */
-    resolve(command: string): RuntimeDriver | null;
-    /** List all registered commands. Returns command → driver name. */
-    list(): Map<string, string>;
-    /**
-     * Create a single /bin stub entry for a command.
-     * Used for on-demand registration after tryResolve discovers a new command.
-     */
-    populateBinEntry(vfs: VirtualFileSystem, command: string): Promise<void>;
-    /**
-     * Populate /bin in the VFS with stub entries for all registered commands.
-     * This enables brush-shell's PATH lookup to find commands.
-     */
-    populateBin(vfs: VirtualFileSystem): Promise<void>;
-}

package/dist/kernel/command-registry.js

@@ -1,114 +0,0 @@
-/**
- * Command registry.
- *
- * Maps command names to runtime drivers. When a process calls
- * spawn("grep", ...), the registry resolves "grep" to the WasmVM driver.
- * Also populates /bin in the VFS so shell PATH lookup succeeds.
- */
-export class CommandRegistry {
-    /** command name → RuntimeDriver */
-    commands = new Map();
-    /** Warning log for command overrides. */
-    warnings = [];
-    /**
-     * Register all commands from a driver.
-     * Last-mounted driver wins on conflicts (allows override with warning).
-     */
-    register(driver) {
-        for (const cmd of driver.commands) {
-            const existing = this.commands.get(cmd);
-            if (existing) {
-                const msg = `command "${cmd}" overridden: ${existing.name} → ${driver.name}`;
-                this.warnings.push(msg);
-                console.warn(`[CommandRegistry] ${msg}`);
-            }
-            this.commands.set(cmd, driver);
-        }
-    }
-    /** Get recorded warnings (for testing). */
-    getWarnings() {
-        return this.warnings;
-    }
-    /**
-     * Register a single command to a driver.
-     * Used for on-demand dynamic registration (e.g. after tryResolve).
-     */
-    registerCommand(command, driver) {
-        const existing = this.commands.get(command);
-        if (existing) {
-            const msg = `command "${command}" overridden: ${existing.name} → ${driver.name}`;
-            this.warnings.push(msg);
-            console.warn(`[CommandRegistry] ${msg}`);
-        }
-        this.commands.set(command, driver);
-    }
-    /**
-     * Resolve a command name to a driver. Returns null if unknown.
-     * Supports path-based lookup: '/bin/ls' resolves to the driver for 'ls'.
-     */
-    resolve(command) {
-        // Direct name lookup
-        const direct = this.commands.get(command);
-        if (direct)
-            return direct;
-        // Path-based: extract basename and retry
-        if (command.includes("/")) {
-            const basename = command.split("/").pop();
-            if (basename)
-                return this.commands.get(basename) ?? null;
-        }
-        return null;
-    }
-    /** List all registered commands. Returns command → driver name. */
-    list() {
-        const result = new Map();
-        for (const [cmd, driver] of this.commands) {
-            result.set(cmd, driver.name);
-        }
-        return result;
-    }
-    /**
-     * Create a single /bin stub entry for a command.
-     * Used for on-demand registration after tryResolve discovers a new command.
-     */
-    async populateBinEntry(vfs, command) {
-        if (!(await vfs.exists("/bin"))) {
-            await vfs.mkdir("/bin", { recursive: true });
-        }
-        const path = `/bin/${command}`;
-        if (!(await vfs.exists(path))) {
-            const stub = new TextEncoder().encode("#!/bin/sh\n# kernel command stub\n");
-            await vfs.writeFile(path, stub);
-            try {
-                await vfs.chmod(path, 0o755);
-            }
-            catch {
-                // chmod may not be supported by all VFS backends
-            }
-        }
-    }
-    /**
-     * Populate /bin in the VFS with stub entries for all registered commands.
-     * This enables brush-shell's PATH lookup to find commands.
-     */
-    async populateBin(vfs) {
-        // Ensure /bin exists
-        if (!(await vfs.exists("/bin"))) {
-            await vfs.mkdir("/bin", { recursive: true });
-        }
-        // Create a stub file for each command
-        const stub = new TextEncoder().encode("#!/bin/sh\n# kernel command stub\n");
-        for (const cmd of this.commands.keys()) {
-            const path = `/bin/${cmd}`;
-            if (!(await vfs.exists(path))) {
-                await vfs.writeFile(path, stub);
-                try {
-                    await vfs.chmod(path, 0o755);
-                }
-                catch {
-                    // chmod may not be supported by all VFS backends
-                }
-            }
-        }
-    }
-}

package/dist/kernel/device-backend.d.ts

@@ -1,14 +0,0 @@
-/**
- * Device backend.
- *
- * Standalone VirtualFileSystem that handles device nodes.
- * Receives relative paths (e.g. "null" not "/dev/null").
- * Designed to be mounted at /dev via MountTable.
- */
-import type { VirtualFileSystem } from "./vfs.js";
-/**
- * Create a standalone device backend VFS.
- * All paths are relative to /dev (e.g. "null", "zero", "pts/0").
- * Mount at /dev via MountTable.
- */
-export declare function createDeviceBackend(): VirtualFileSystem;

package/dist/kernel/device-backend.js

@@ -1,251 +0,0 @@
-/**
- * Device backend.
- *
- * Standalone VirtualFileSystem that handles device nodes.
- * Receives relative paths (e.g. "null" not "/dev/null").
- * Designed to be mounted at /dev via MountTable.
- */
-import { KernelError } from "./types.js";
-const DEVICE_NAMES = new Set([
-    "null",
-    "zero",
-    "stdin",
-    "stdout",
-    "stderr",
-    "urandom",
-    "random",
-    "tty",
-    "console",
-    "full",
-    "ptmx",
-]);
-const DEVICE_INO = {
-    null: 0xffff_0001,
-    zero: 0xffff_0002,
-    stdin: 0xffff_0003,
-    stdout: 0xffff_0004,
-    stderr: 0xffff_0005,
-    urandom: 0xffff_0006,
-    random: 0xffff_0007,
-    tty: 0xffff_0008,
-    console: 0xffff_0009,
-    full: 0xffff_000a,
-    ptmx: 0xffff_000b,
-};
-/** Device pseudo-directories that contain dynamic entries. */
-const DEVICE_DIRS = new Set(["fd", "pts", "shm"]);
-function isDeviceName(path) {
-    return (DEVICE_NAMES.has(path) || path.startsWith("fd/") || path.startsWith("pts/"));
-}
-function isDeviceDir(path) {
-    return path === "" || DEVICE_DIRS.has(path);
-}
-function deviceStat(path) {
-    const now = Date.now();
-    return {
-        mode: 0o666,
-        size: 0,
-        isDirectory: false,
-        isSymbolicLink: false,
-        atimeMs: now,
-        mtimeMs: now,
-        ctimeMs: now,
-        birthtimeMs: now,
-        ino: DEVICE_INO[path] ?? 0xffff_0000,
-        nlink: 1,
-        uid: 0,
-        gid: 0,
-    };
-}
-function dirStat(path) {
-    const now = Date.now();
-    return {
-        mode: 0o755,
-        size: 0,
-        isDirectory: true,
-        isSymbolicLink: false,
-        atimeMs: now,
-        mtimeMs: now,
-        ctimeMs: now,
-        birthtimeMs: now,
-        ino: DEVICE_INO[path] ?? 0xffff_0000,
-        nlink: 2,
-        uid: 0,
-        gid: 0,
-    };
-}
-const DEV_DIR_ENTRIES = [
-    { name: "null", isDirectory: false },
-    { name: "zero", isDirectory: false },
-    { name: "stdin", isDirectory: false },
-    { name: "stdout", isDirectory: false },
-    { name: "stderr", isDirectory: false },
-    { name: "urandom", isDirectory: false },
-    { name: "random", isDirectory: false },
-    { name: "tty", isDirectory: false },
-    { name: "console", isDirectory: false },
-    { name: "full", isDirectory: false },
-    { name: "ptmx", isDirectory: false },
-    { name: "fd", isDirectory: true },
-    { name: "pts", isDirectory: true },
-    { name: "shm", isDirectory: true },
-];
-function randomBytes(length) {
-    const buf = new Uint8Array(length);
-    if (typeof globalThis.crypto?.getRandomValues === "function") {
-        globalThis.crypto.getRandomValues(buf);
-    }
-    else {
-        for (let i = 0; i < buf.length; i++) {
-            buf[i] = (Math.random() * 256) | 0;
-        }
-    }
-    return buf;
-}
-function notFound(path) {
-    throw new KernelError("ENOENT", `no such device: ${path}`);
-}
-/**
- * Create a standalone device backend VFS.
- * All paths are relative to /dev (e.g. "null", "zero", "pts/0").
- * Mount at /dev via MountTable.
- */
-export function createDeviceBackend() {
-    const backend = {
-        async readFile(path) {
-            if (path === "null" || path === "full")
-                return new Uint8Array(0);
-            if (path === "zero")
-                return new Uint8Array(4096);
-            if (path === "urandom" || path === "random")
-                return randomBytes(4096);
-            if (path === "tty" || path === "console" || path === "ptmx")
-                return new Uint8Array(0);
-            if (path === "stdin" || path === "stdout" || path === "stderr")
-                return new Uint8Array(0);
-            notFound(path);
-        },
-        async pread(path, _offset, length) {
-            if (path === "null" || path === "full")
-                return new Uint8Array(0);
-            if (path === "zero")
-                return new Uint8Array(length);
-            if (path === "urandom" || path === "random")
-                return randomBytes(length);
-            if (path === "tty" || path === "console" || path === "ptmx")
-                return new Uint8Array(0);
-            if (path === "stdin" || path === "stdout" || path === "stderr")
-                return new Uint8Array(0);
-            notFound(path);
-        },
-        async readTextFile(path) {
-            const bytes = await this.readFile(path);
-            return new TextDecoder().decode(bytes);
-        },
-        async readDir(path) {
-            if (path === "")
-                return DEV_DIR_ENTRIES.map((e) => e.name);
-            if (DEVICE_DIRS.has(path))
-                return [];
-            notFound(path);
-        },
-        async readDirWithTypes(path) {
-            if (path === "")
-                return DEV_DIR_ENTRIES;
-            if (DEVICE_DIRS.has(path))
-                return [];
-            notFound(path);
-        },
-        async writeFile(path, _content) {
-            if (path === "full")
-                throw new KernelError("ENOSPC", "No space left on device");
-            if (DEVICE_NAMES.has(path) ||
-                path.startsWith("fd/") ||
-                path.startsWith("pts/")) {
-                return;
-            }
-            notFound(path);
-        },
-        async pwrite(path, _offset, _data) {
-            if (path === "full")
-                throw new KernelError("ENOSPC", "No space left on device");
-            if (DEVICE_NAMES.has(path) ||
-                path.startsWith("fd/") ||
-                path.startsWith("pts/")) {
-                return;
-            }
-            notFound(path);
-        },
-        async createDir(path) {
-            if (isDeviceDir(path))
-                return;
-            throw new KernelError("EPERM", "cannot create directory in /dev");
-        },
-        async mkdir(path, _options) {
-            if (isDeviceDir(path))
-                return;
-            throw new KernelError("EPERM", "cannot create directory in /dev");
-        },
-        async exists(path) {
-            return isDeviceName(path) || isDeviceDir(path);
-        },
-        async stat(path) {
-            if (isDeviceName(path))
-                return deviceStat(path);
-            if (isDeviceDir(path))
-                return dirStat(path);
-            notFound(path);
-        },
-        async removeFile(path) {
-            if (isDeviceName(path))
-                throw new KernelError("EPERM", "cannot remove device");
-            notFound(path);
-        },
-        async removeDir(path) {
-            if (isDeviceDir(path))
-                throw new KernelError("EPERM", "cannot remove device directory");
-            notFound(path);
-        },
-        async rename(_oldPath, _newPath) {
-            throw new KernelError("EPERM", "cannot rename device");
-        },
-        async realpath(path) {
-            if (isDeviceName(path) || isDeviceDir(path))
-                return path;
-            notFound(path);
-        },
-        async symlink(_target, _linkPath) {
-            throw new KernelError("EPERM", "cannot create symlink in /dev");
-        },
-        async readlink(path) {
-            notFound(path);
-        },
-        async lstat(path) {
-            return this.stat(path);
-        },
-        async link(_oldPath, _newPath) {
-            throw new KernelError("EPERM", "cannot link device");
-        },
-        async chmod(path, _mode) {
-            if (isDeviceName(path) || isDeviceDir(path))
-                return;
-            notFound(path);
-        },
-        async chown(path, _uid, _gid) {
-            if (isDeviceName(path) || isDeviceDir(path))
-                return;
-            notFound(path);
-        },
-        async utimes(path, _atime, _mtime) {
-            if (isDeviceName(path) || isDeviceDir(path))
-                return;
-            notFound(path);
-        },
-        async truncate(path, _length) {
-            if (isDeviceName(path) || isDeviceDir(path))
-                return;
-            notFound(path);
-        },
-    };
-    return backend;
-}