@volter/tabnode 0.4.0 → 0.5.0

package/src/process-registry.ts

@@ -0,0 +1,144 @@
+/** Native process identity shared by the container's worker realms. */
+export interface ProcessIdentity {
+  readonly pid: number;
+  readonly ppid: number;
+}
+
+/** A run already admitted by the container owner into this realm's scope. */
+export interface InitialProcessRegistration {
+  readonly token: string;
+  readonly identity: ProcessIdentity;
+}
+
+/** Installed by the trusted embedding host before this realm starts runs. */
+export interface ProcessRegistry {
+  allocate(): number;
+  publish(token: string, identity: ProcessIdentity): void;
+  forget(token: string): void;
+  lookup(pid: number): ProcessIdentity | undefined;
+  /**
+   * `kill(pid, signal)` for a live process of another realm in this container:
+   * whether a process there took the signal. A machine lets a process signal
+   * any process of its user, including one its parent left behind.
+   */
+  signal(pid: number, signal: string): boolean;
+}
+
+export interface ProcessRegistryScope extends ProcessRegistry {
+  /** Trusted owner only: how this realm answers a signal sent to one of its processes. */
+  receiveSignals(handler: (pid: number, signal: string) => boolean): void;
+  /** Trusted owner handoff before the destination worker starts; not a guest operation. */
+  adoptRun(source: ProcessRegistryScope, sourceToken: string, token: string, parentPid?: number): ProcessIdentity;
+  /** Ends this realm's registrations, including after abrupt worker death. */
+  dispose(): void;
+}
+
+/**
+ * One container owns the counter and live table. Each realm receives a scope,
+ * so identical local run tokens cannot overwrite or release another realm's
+ * process. Allocation alone does not announce a live process.
+ */
+export function createProcessRegistryOwner(): { createScope(): ProcessRegistryScope } {
+  let nextPid = 1000 + Math.floor(Math.random() * 30000);
+  const live = new Map<number, ProcessIdentity>();
+  // Which realm's scope answers for each live pid, including after handoff.
+  const receivers = new Map<number, { handler?: (pid: number, signal: string) => boolean }>();
+  const scopes = new WeakMap<ProcessRegistryScope, {
+    allocated: Set<number>;
+    runs: Map<string, ProcessIdentity>;
+    active(): void;
+  }>();
+  return {
+    createScope() {
+      const allocated = new Set<number>();
+      const runs = new Map<string, ProcessIdentity>();
+      let disposed = false;
+      const receiver: { handler?: (pid: number, signal: string) => boolean } = {};
+      const active = (): void => {
+        if (disposed) throw new Error('Process registry scope is closed.');
+      };
+      const scope: ProcessRegistryScope = {
+        adoptRun(source, sourceToken, token, parentPid) {
+          active();
+          const parent = scopes.get(source);
+          if (!parent) throw new Error('Process scopes belong to different container owners.');
+          parent.active();
+          if (allocated.size || runs.size) throw new Error('Process handoff requires an unused destination scope.');
+          if (typeof sourceToken !== 'string' || typeof token !== 'string' || !token.length) throw new Error('Invalid process handoff token.');
+          const identity = parent.runs.get(sourceToken);
+          if (!identity || live.get(identity.pid) !== identity) throw new Error('Source scope does not own that live process.');
+          if (parentPid !== undefined) {
+            // The trusted holder retains its admitted parent PID. The parent
+            // may already have exited; publication established this ancestry
+            // while it still belonged to the source scope.
+            if (!Number.isSafeInteger(parentPid) || parentPid < 1 || identity.pid === parentPid || identity.ppid !== parentPid) {
+              throw new Error('Process admission does not name a child of the source realm.');
+            }
+          }
+          // The PID stays live throughout the synchronous owner operation.
+          // Old-scope disposal/forget cannot remove the child's new ownership.
+          parent.runs.delete(sourceToken);
+          parent.allocated.delete(identity.pid);
+          allocated.add(identity.pid);
+          runs.set(token, identity);
+          receivers.set(identity.pid, receiver);
+          return identity;
+        },
+        allocate() {
+          active();
+          if (nextPid > 0x7fffffff) throw new Error('Process identifier space exhausted.');
+          const pid = nextPid++;
+          allocated.add(pid);
+          return pid;
+        },
+        publish(token, identity) {
+          active();
+          const previous = runs.get(token);
+          if (previous?.pid === identity.pid && previous.ppid === identity.ppid) return;
+          if (previous || !allocated.has(identity.pid) || live.has(identity.pid)) {
+            throw new Error('Process identity is not owned by this run.');
+          }
+          if (!Number.isInteger(identity.ppid) || identity.ppid < 0 || identity.ppid > 0x7fffffff) {
+            throw new Error('Invalid parent process identifier.');
+          }
+          if (identity.ppid !== 0 && !Array.from(runs.values()).some(parent => parent.pid === identity.ppid)) {
+            throw new Error('Parent process is not owned by this realm.');
+          }
+          const entry = Object.freeze({ pid: identity.pid, ppid: identity.ppid });
+          runs.set(token, entry);
+          live.set(entry.pid, entry);
+          receivers.set(entry.pid, receiver);
+        },
+        forget(token) {
+          active();
+          const entry = runs.get(token);
+          if (!entry) return;
+          runs.delete(token);
+          live.delete(entry.pid);
+          receivers.delete(entry.pid);
+          allocated.delete(entry.pid);
+        },
+        lookup(pid) { active(); return live.get(pid); },
+        signal(pid, signal) {
+          active();
+          if (!live.has(pid) || typeof signal !== 'string') return false;
+          return receivers.get(pid)?.handler?.(pid, signal) === true;
+        },
+        receiveSignals(handler) {
+          active();
+          receiver.handler = handler;
+        },
+        dispose() {
+          if (disposed) return;
+          disposed = true;
+          for (const entry of runs.values()) { live.delete(entry.pid); receivers.delete(entry.pid); }
+          receiver.handler = undefined;
+          runs.clear();
+          allocated.clear();
+        },
+      };
+      scopes.set(scope, { allocated, runs, active });
+      return scope;
+    },
+  };
+}

package/src/process-tokens.ts

@@ -15,7 +15,9 @@
  * command gives its process has it removed.
  */
 
+import type { Process } from './shims/process';
 import { AsyncLocalStorage } from './shims/async_hooks';
+import { createProcessRegistryOwner, type ProcessRegistry, type ProcessRegistryScope, type InitialProcessRegistration } from './process-registry';
 
 /** Whatever the embedding runtime uses to name one guest process. */
 export type ProcessToken = string;
@@ -25,6 +27,10 @@ export const PROCESS_TOKEN_ENV = '__TABNODE_PROCESS_TOKEN';
 
 /** What the engine can answer about one named run. */
 export interface OwnedRun {
+  /** The guest whose cwd and inherited streams belong to this run. */
+  process: Process;
+  stdout(text: string): void;
+  stderr(text: string): void;
   /** The timers the run's guest still holds, as Node's loop counts them. */
   pendingTimers(): number;
   /** Clear those timers, as ending the process clears them. */
@@ -38,6 +44,7 @@ export interface OwnedRun {
 }
 
 const runs = new Map<ProcessToken, OwnedRun>();
+const tokensByProcess = new WeakMap<Process, ProcessToken>();
 
 /**
  * The run whose guest code is executing, as an async-local value rather than a
@@ -60,14 +67,22 @@ export function enterRun<T>(token: ProcessToken, fn: () => T): T {
  */
 export function __recordRun(token: ProcessToken, run: OwnedRun): () => void {
   runs.set(token, run);
+  tokensByProcess.set(run.process, token);
   let released = false;
   return () => {
     if (released) return;
     released = true;
     if (runs.get(token) === run) runs.delete(token);
+    // Retain the weak association so delayed callbacks cannot turn an ended
+    // process into an unowned host request. The Process itself remains weak.
   };
 }
 
+/** Bound guest globals retain their actual process across native await turns. */
+export function __tokenForProcess(process: Process): ProcessToken | null {
+  return tokensByProcess.get(process) ?? null;
+}
+
 /** The run recorded under this name, while it lasts. */
 export function __runFor(token: ProcessToken): OwnedRun | undefined {
   return runs.get(token);
@@ -120,16 +135,51 @@ export function __stopOwnedProcess(token: ProcessToken): void {
  * every extension in the tab sat at "Activating..." and `vscode.git` never
  * started at all.
  */
-let __nextPid = 1000 + Math.floor(Math.random() * 30000);
+const processRegistryOwner = createProcessRegistryOwner();
+let processRegistry: ProcessRegistry = processRegistryOwner.createScope();
+let registryInstalled = false;
+let registryUsed = false;
 const pidsOfRuns = new Map<ProcessToken, { pid: number; ppid: number }>();
 
+/** Each child realm gets its own registration authority in this container. */
+export function createProcessRegistryScope(): ProcessRegistryScope {
+  if (registryInstalled) throw new Error('Only the container owner can create process registry scopes.');
+  return processRegistryOwner.createScope();
+}
+
+/** Trusted container owner only; worker clients cannot expose their authority. */
+export function ownerProcessRegistryScope(): ProcessRegistryScope {
+  if (registryInstalled) throw new Error('This realm is a process registry client, not the container owner.');
+  return processRegistry as ProcessRegistryScope;
+}
+
+/** Startup-only host seam; never swap identity authorities under live runs. */
+export function installProcessRegistry(registry: ProcessRegistry, initial?: InitialProcessRegistration): void {
+  if (registryInstalled || registryUsed) throw new Error('Process registry must be installed once before creating processes.');
+  if (initial) {
+    if (typeof initial.token !== 'string' || initial.token.length === 0) throw new Error('Invalid initial process token.');
+    // Validate with the owner before installing any local state. For an
+    // adopted child this is an idempotent publication, not a new PID or a
+    // guest claim to another realm's parent. Container construction can
+    // allocate an anonymous Runtime first; that must not consume this PID.
+    const identity = Object.freeze({ pid: initial.identity.pid, ppid: initial.identity.ppid });
+    registry.publish(initial.token, identity);
+    pidsOfRuns.set(initial.token, identity);
+  }
+  processRegistry = registry;
+  registryInstalled = true;
+}
+
 /** The next process number this engine hands out. */
 export function mintPid(): number {
-  return __nextPid++;
+  registryUsed = true;
+  return processRegistry.allocate();
 }
 
 /** Record the numbers a named run was started with, for the run to read back. */
 export function setRunPid(token: ProcessToken, pid: number, ppid: number): void {
+  registryUsed = true;
+  processRegistry.publish(token, { pid, ppid });
   pidsOfRuns.set(token, { pid, ppid });
 }
 
@@ -140,17 +190,21 @@ export function runPid(token: ProcessToken | null | undefined): { pid: number; p
 
 /** A run that has ended is no longer a process; its number is nobody's. */
 export function forgetRunPid(token: ProcessToken): void {
+  processRegistry.forget(token);
   pidsOfRuns.delete(token);
 }
 
 /** Whether a live run carries this number, which is what `kill(pid, 0)` asks. */
 export function pidIsLive(pid: number): boolean {
-  for (const entry of pidsOfRuns.values()) if (entry.pid === pid) return true;
-  return false;
+  return processRegistry.lookup(pid) !== undefined;
+}
+
+/** `kill(pid, signal)` to another realm's live process; whether one took it. */
+export function signalPid(pid: number, signal: string): boolean {
+  return processRegistry.signal(pid, signal);
 }
 
 /** The numbers a live process carries, looked up by its own pid. */
 export function processByPid(pid: number): { pid: number; ppid: number } | undefined {
-  for (const entry of pidsOfRuns.values()) if (entry.pid === pid) return entry;
-  return undefined;
+  return processRegistry.lookup(pid);
 }

package/src/promise-ownership.ts

@@ -0,0 +1,28 @@
+// A browser rejection event belongs to one guest, not every run sharing the
+// worker. Keep provenance on the promise itself; the active/last process at
+// event-delivery time is not necessarily the process which rejected it.
+const owners = new WeakMap<object, object>();
+const constructors = new WeakMap<object, PromiseConstructor>();
+export const intrinsicPromise = Promise;
+
+export function promiseOwner(promise: unknown): object | undefined {
+  return promise !== null && typeof promise === 'object' ? owners.get(promise) : undefined;
+}
+
+export function guestPromise(owner: object): PromiseConstructor {
+  let constructor = constructors.get(owner);
+  if (!constructor) {
+    // Used only by the runtime's existing `new Identifier(...)` seam. The
+    // visible global stays native, including prototype/resolve identity.
+    // Unobserved async/static/species construction retains unknown ownership.
+    constructor = new Proxy(intrinsicPromise, {
+      construct(target, args) {
+        const promise = Reflect.construct(target, args, target);
+        owners.set(promise, owner);
+        return promise;
+      },
+    });
+    constructors.set(owner, constructor);
+  }
+  return constructor;
+}