snxraven/bare-operating-system
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Kernel Updates

Browse Source
This commit is contained in:
Raven Scott
2026-04-03 23:21:30 -04:00
parent 184b7fe3b1
commit d8e580d1af
44 changed files with 1869 additions and 476 deletions
Download Patch File Download Diff File Expand all files Collapse all files
developer-guide/02-the-context-object.md
+5 -2
View File
@@ -53,8 +53,11 @@ The following are set on `ctx` before the kernel starts (unless noted as overwri
| **`bareOsAwaitInitdUnits(names, timeoutMs)`** | Resolves when all listed initd units are **`active`** (polls **`getBareServiceRuntime`**); returns **`false`** on timeout. |
| **`bareOsGetResourceStatus()`** | Returns a plain object snapshot (pipeline limits, exec depth, IPC **`stats()`**, session counters, swarm peer count)—mirrors **`/proc/bare_os_resources`**. |
| **`bareOsRegisterVirtualFile(name, reader)`** | Registers **`/run/bare-os/virtual/<name>`** content; **`reader`** may return string or **`Uint8Array`** (sync or async). Gated by runtime cap **`virtualRegisterFiles`**. |
| **`bareOsSandboxRunScript()`** | **Throws** today—reserved for future worker/isolate execution; see [Chapter 9](09-security-and-trust.md). |
| **`bareOsRequestPearReload()`** | Returns **`{ requested, hint, env }`** for Pear OTA integration (host must apply); not a host IPC call by itself. |
| **`bareOsSandboxRunScript(source, argv?, opts?)`** | Runs script source with a **restricted `ctx`** (personal-drive writes only; identity/virtual registration disabled). Respects **`raceWithAbortAndTimeout`** opts. Disable with **`BARE_OS_SANDBOX_SCRIPT=0`**. See [Chapter 9](09-security-and-trust.md). |
| **`bareOsBootFileSha256Hex(buf)`** | **`sha256` hex for boot manifest checks** (`BARE_OS_BOOT_MANIFEST` + `/etc/bare-os/boot.manifest.json` on the stock kernel). |
| **`bareOsRegisterBootPhaseHook(phase, fn)`** / **`bareOsInvokeBootPhaseHooks(ev)`** | Hooks around stock **`kernel/init.js`** phases; **`ev`** includes **`phase`**, **`when`** (`before` / `after`), **`label`**. **`phase`** may be `*` or `before:rc` style. |
| **`bareOsInvalidateVirtualFile(name)`** / **`bareOsUpdateVirtualFileMeta(name, patch)`** | Virtual files under **`/run/bare-os/virtual/`**; **`bareOsRegisterVirtualFile`** accepts optional **`{ etag }`** third argument or **`{ read }`** object. |
| **`bareOsRequestPearReload(opts?)`** | **`async`** — returns **`{ requested, hint, env }`**; with **`{ persistRequest: true }`** writes **`~/.bare-os/pear-reload.request`** and may **`process.emit('bare-os:pear-reload', …)`** on Node. |
| **`bareOsHostStats`** _(optional)_ | When the **`bare-os`** npm module loads on the host, a **frozen** snapshot: **`hostname`**, **`loadavg`**, **`cpus`**, **`networkInterfaces`**. |
| **`httpFetch`** _(optional)_ | When Node/global **`fetch`** exists, the booter sets a **`fetch`** compatible function with optional **HTTP allow/deny** policy (**`BARE_OS_HTTP_ALLOWLIST`**, **`BARE_OS_HTTP_DENYLIST`**) and audit hooks when **`BARE_OS_AUDIT`** is on. |
developer-guide/09-security-and-trust.md
+1 -1
View File
@@ -18,7 +18,7 @@ The **system** Hyperdrive is the **OS image**. You normally obtain it by **repli
**IPC JSON-RPC:** when **`BARE_OS_IPC_RPC_TOKEN`** is set, **`pushJson`** payloads must include matching **`bareOsIpcToken`** or the push throws. Line size is capped (**`BARE_OS_IPC_JSON_MAX_BYTES`**, default 256 KiB).
**Future isolation:** **`ctx.bareOsSandboxRunScript()`** is reserved and **throws** today; real worker or Pear-isolate execution would narrow trust for untrusted scripts—see the handbook blueprints chapter for the architectural split.
**Sandboxed scripts:** **`ctx.bareOsSandboxRunScript(source, argv?, opts?)`** runs in-image JS with a **restricted `ctx`**: writes are limited to the personal namespace (same routing rules as `isPersonalRoute`), and identity / vault / virtual-file registration hooks are disabled. Disable entirely with **`BARE_OS_SANDBOX_SCRIPT=0`**. This is still **not** a hardware isolate—treat it as a trust reducer, not a security boundary.
---