409 lines
14 KiB
JavaScript
409 lines
14 KiB
JavaScript
/**
|
|
* Stable introspection for custom kernels and scripts (`ctx.bareOsRuntimeCaps`).
|
|
* Keep in sync with `vfs.js` pseudo paths and `shell.js` pipeline limits.
|
|
*/
|
|
|
|
import { BARE_OS_CTX_API_VERSION } from './bare-os-ctx-api.js'
|
|
import {
|
|
bareOsBareDriveBundlesEnabled,
|
|
bareOsBareHostImportsEnabled,
|
|
bareOsBareModulesEnabled
|
|
} from './bare-os-ctx-bare.js'
|
|
import {
|
|
DEFAULT_PIPELINE_MAX_CAPTURE_BYTES,
|
|
DEFAULT_PIPELINE_MAX_CAPTURE_LINES,
|
|
DEFAULT_PIPELINE_MAX_STAGES,
|
|
getBareOsPipelineLimits
|
|
} from '../shell/shell.js'
|
|
import { bareOsChatMuxEnabled } from '../services/bare-os-chat-service.js'
|
|
|
|
/**
|
|
* Documented pseudo filesystem paths (read-mostly; some accept discard writes).
|
|
* @type {readonly string[]}
|
|
*/
|
|
export const BARE_OS_PSEUDO_FS_PATHS = Object.freeze([
|
|
'/dev',
|
|
'/dev/null',
|
|
'/dev/zero',
|
|
'/dev/urandom',
|
|
'/proc',
|
|
'/proc/bare_os',
|
|
'/proc/bare_os/index.json',
|
|
'/proc/bare_os/features',
|
|
'/proc/bare_os/features.json',
|
|
'/proc/bare_os/swarm',
|
|
'/proc/bare_os/swarm.json',
|
|
'/proc/bare_os/swarm_health.json',
|
|
'/proc/bare_os/swarm_status.json',
|
|
'/proc/bare_os/swarm_replication_status.json',
|
|
'/proc/bare_os/swarm_relay_status.json',
|
|
'/proc/bare_os/swarm_datagrams_status.json',
|
|
'/proc/bare_os/swarm_connection_manager_status.json',
|
|
'/proc/bare_os/swarm_key_broker_status.json',
|
|
'/proc/bare_os/swarm_holepunch_status.json',
|
|
'/proc/bare_os/swarm_datagram_replication_status.json',
|
|
'/proc/bare_os/replication',
|
|
'/proc/bare_os/resources',
|
|
'/proc/bare_os/quotas',
|
|
'/proc/bare_os/capabilities',
|
|
'/proc/bare_os/capabilities.json',
|
|
'/proc/bare_os/seed_handshake',
|
|
'/proc/bare_os/virtual_registry',
|
|
'/proc/bare_os/manifest_hints',
|
|
'/proc/bare_os/peer_health',
|
|
'/proc/bare_os/staging_slot',
|
|
'/proc/bare_os/provenance',
|
|
'/proc/bare_os/pear_ipc.json',
|
|
'/proc/bare_os/initd_dag.json',
|
|
'/proc/bare_os/metrics_live.json',
|
|
'/proc/bare_os/chat.json',
|
|
'/proc/bare_os/net_summary.json',
|
|
'/proc/bare_os/host_os.json',
|
|
'/proc/bare_os/sync_window.json',
|
|
'/proc/bare_os/clock.json',
|
|
'/proc/bare_os/openssh.json',
|
|
'/proc/bare_os/debug.json',
|
|
'/proc/bare_os/extensions.json',
|
|
'/proc/bare_os/hdms_hints.json',
|
|
'/proc/bare_os/pear_trust.json',
|
|
'/proc/bare_os/rlimits.json',
|
|
'/proc/bare_os/hdms_health.json',
|
|
'/proc/bare_os/initd_graph.json',
|
|
'/proc/bare_os/udx_extended.json',
|
|
'/proc/bare_os/dht_status.json',
|
|
'/proc/bare_os/replication_backpressure.json',
|
|
'/proc/bare_os/ipc_backpressure.json',
|
|
'/proc/bare_os/delegate_red.json',
|
|
'/proc/bare_os/build_attestation_pointer.json',
|
|
'/proc/bare_os/pear_ipc_health.json',
|
|
'/proc/bare_os/hypercore_lengths.json',
|
|
'/proc/bare_os/slo_hints.json',
|
|
'/proc/bare_os/locale.json',
|
|
'/proc/bare_os/worker_budget.json',
|
|
'/proc/bare_os/sandbox_profile.json',
|
|
'/proc/bare_os/dns_map_active.json',
|
|
'/proc/bare_os/kernel_program.json',
|
|
'/proc/bare_os/giant_phase_program.json',
|
|
'/proc/bare_os/git_delegate_stats.json',
|
|
'/proc/bare_os/snapshot_hints.json',
|
|
'/proc/bare_os/activity_queue_depth.json',
|
|
'/proc/bare_os/autobase_writer_hint.json',
|
|
'/proc/bare_os/bare_boot_phase_map.json',
|
|
'/proc/bare_os/bare_inspect_policy.json',
|
|
'/proc/bare_os/bare_logger_policy.json',
|
|
'/proc/bare_os/bare_performance_counters.json',
|
|
'/proc/bare_os/bare_rpc_registry_sketch.json',
|
|
'/proc/bare_os/bare_signals_mask.json',
|
|
'/proc/bare_os/bare_stream_backpressure.json',
|
|
'/proc/bare_os/bare_timers_budget.json',
|
|
'/proc/bare_os/bare_tls_session_hint.json',
|
|
'/proc/bare_os/bare_ws_gateway_sketch.json',
|
|
'/proc/bare_os/blind_pairing_sketch.json',
|
|
'/proc/bare_os/broadcast_encryption_hint.json',
|
|
'/proc/bare_os/pear_api_allowlist_sketch.json',
|
|
'/proc/bare_os/pear_doctor_state.json',
|
|
'/proc/bare_os/pear_rti_pointer.json',
|
|
'/proc/bare_os/pear_user_dirs_map.json',
|
|
'/proc/bare_os/pear_workshop_flags.json',
|
|
'/proc/bare_os_activity_queue_depth.json',
|
|
'/proc/bare_os_autobase_writer_hint.json',
|
|
'/proc/bare_os_bare_boot_phase_map.json',
|
|
'/proc/bare_os_bare_inspect_policy.json',
|
|
'/proc/bare_os_bare_logger_policy.json',
|
|
'/proc/bare_os_bare_performance_counters.json',
|
|
'/proc/bare_os_bare_rpc_registry_sketch.json',
|
|
'/proc/bare_os_bare_signals_mask.json',
|
|
'/proc/bare_os_bare_stream_backpressure.json',
|
|
'/proc/bare_os_bare_timers_budget.json',
|
|
'/proc/bare_os_bare_tls_session_hint.json',
|
|
'/proc/bare_os_bare_ws_gateway_sketch.json',
|
|
'/proc/bare_os_blind_pairing_sketch.json',
|
|
'/proc/bare_os_broadcast_encryption_hint.json',
|
|
'/proc/bare_os_pear_api_allowlist_sketch.json',
|
|
'/proc/bare_os_pear_doctor_state.json',
|
|
'/proc/bare_os_pear_rti_pointer.json',
|
|
'/proc/bare_os_pear_user_dirs_map.json',
|
|
'/proc/bare_os_pear_workshop_flags.json',
|
|
'/proc/bare_os_snapshot_hints.json',
|
|
'/proc/bare_os_extensions.json',
|
|
'/proc/bare_os_hdms_hints.json',
|
|
'/proc/bare_os_manifest_hints',
|
|
'/proc/bare_os_peer_health',
|
|
'/proc/bare_os_staging_slot',
|
|
'/proc/bare_os_provenance',
|
|
'/proc/bare_os_initd_dag.json',
|
|
'/proc/bare_os_metrics_live.json',
|
|
'/proc/bare_os/session_stats',
|
|
'/proc/bare_os/union',
|
|
'/proc/bare_os/bootstrap',
|
|
'/proc/bare_os/version',
|
|
'/proc/bare_os_features',
|
|
'/proc/bare_os_quotas',
|
|
'/proc/bare_os_resources',
|
|
'/proc/bare_os_swarm',
|
|
'/proc/bare_os_swarm_health.json',
|
|
'/proc/bare_os_replication',
|
|
'/proc/bare_os_capabilities',
|
|
'/proc/bare_os_capabilities.json',
|
|
'/proc/bare_os_bootstrap',
|
|
'/proc/bare_os_union',
|
|
'/proc/bare_os_seed_handshake',
|
|
'/proc/bare_os_virtual_registry',
|
|
'/proc/bare_os_session_stats',
|
|
'/proc/bare_os_version',
|
|
'/proc/cpuinfo',
|
|
'/proc/diskstats',
|
|
'/proc/loadavg',
|
|
'/proc/meminfo',
|
|
'/proc/mounts',
|
|
'/proc/net',
|
|
'/proc/net/dev',
|
|
'/proc/net/tcp',
|
|
'/proc/net/udp',
|
|
'/proc/self/cgroups',
|
|
'/proc/self',
|
|
'/proc/self/cmdline',
|
|
'/proc/self/environ',
|
|
'/proc/self/exe',
|
|
'/proc/self/fd',
|
|
'/proc/self/fd/0',
|
|
'/proc/self/fd/1',
|
|
'/proc/self/fd/2',
|
|
'/proc/uptime',
|
|
'/proc/version',
|
|
'/run',
|
|
'/run/bare-os',
|
|
'/run/bare-os/boot.json',
|
|
'/run/bare-os/boot_profile',
|
|
'/snapshots',
|
|
'/snapshots/system',
|
|
'/run/bare-os/ready',
|
|
'/run/bare-os/session',
|
|
'/run/bare-os/units',
|
|
'/run/bare-os/unit-journal',
|
|
'/run/bare-os/virtual',
|
|
'/run/bare-os/ipc',
|
|
'/sys',
|
|
'/sys/class',
|
|
'/sys/class/net',
|
|
'/sys/class/net/lo',
|
|
'/sys/devices',
|
|
'/sys/devices/virtual',
|
|
'/sys/fs',
|
|
'/sys/fs/bare_os',
|
|
'/sys/fs/bare_os/build_id',
|
|
'/sys/fs/bare_os/version'
|
|
])
|
|
|
|
/**
|
|
* @param {Record<string, string>} shellEnv Session environment (same object as `ctx.env` / `vfs.env`).
|
|
* @param {{ booterPackageVersion?: string, kernelFeatureBitsDoc?: number }} [extra]
|
|
*/
|
|
export function buildBareOsRuntimeCaps(shellEnv, extra = {}) {
|
|
const pl = getBareOsPipelineLimits(shellEnv)
|
|
const auditOn =
|
|
shellEnv.BARE_OS_AUDIT === '1' || shellEnv.BARE_OS_AUDIT === 'true'
|
|
const minimalBoot =
|
|
shellEnv.BARE_OS_BOOT_MINIMAL === '1' ||
|
|
shellEnv.BARE_OS_BOOT_MINIMAL === 'true'
|
|
const vfsWatchOn =
|
|
shellEnv.BARE_OS_VFS_WATCH !== '0' && shellEnv.BARE_OS_VFS_WATCH !== 'false'
|
|
const vfsWatchPseudoOn =
|
|
shellEnv.BARE_OS_VFS_WATCH_PSEUDO === '1' ||
|
|
shellEnv.BARE_OS_VFS_WATCH_PSEUDO === 'true'
|
|
const envDashSOn =
|
|
shellEnv.BARE_OS_ENV_DASH_S === '1' ||
|
|
shellEnv.BARE_OS_ENV_DASH_S === 'true'
|
|
const shellParamV2On =
|
|
shellEnv.BARE_OS_SHELL_PARAM_EXPANSION_V2 === '1' ||
|
|
shellEnv.BARE_OS_SHELL_PARAM_EXPANSION_V2 === 'true'
|
|
const diagnosticsOn =
|
|
shellEnv.BARE_OS_DIAGNOSTICS_SUBSCRIBE === '1' ||
|
|
shellEnv.BARE_OS_DIAGNOSTICS_SUBSCRIBE === 'true'
|
|
const parsePosInt = (key, def) => {
|
|
const raw = shellEnv[key]
|
|
if (raw == null || raw === '') return def
|
|
const n = Number.parseInt(String(raw), 10)
|
|
return Number.isFinite(n) && n > 0 ? n : def
|
|
}
|
|
const execMaxDepth = parsePosInt('BARE_OS_EXEC_MAX_DEPTH', 64)
|
|
const ipcMaxBytes = parsePosInt('BARE_OS_IPC_MAX_BYTES', 1024 * 1024)
|
|
const ipcFanoutOn =
|
|
shellEnv.BARE_OS_IPC_FANOUT !== '0' &&
|
|
shellEnv.BARE_OS_IPC_FANOUT !== 'false'
|
|
return Object.freeze({
|
|
ctxApiVersion: BARE_OS_CTX_API_VERSION,
|
|
booterPackageVersion: extra.booterPackageVersion,
|
|
kernelFeatureBitsDoc: extra.kernelFeatureBitsDoc,
|
|
pipeline: Object.freeze({
|
|
maxStages: pl.maxStages,
|
|
maxBytes: pl.maxBytes,
|
|
maxLines: pl.maxLines,
|
|
baseMaxBytes: pl.baseMaxBytes,
|
|
baseMaxLines: pl.baseMaxLines,
|
|
absCapBytes: pl.absCapBytes,
|
|
absCapLines: pl.absCapLines,
|
|
streamingEnabled: pl.streamingEnabled === true,
|
|
defaults: Object.freeze({
|
|
maxStages: DEFAULT_PIPELINE_MAX_STAGES,
|
|
maxBytes: DEFAULT_PIPELINE_MAX_CAPTURE_BYTES,
|
|
maxLines: DEFAULT_PIPELINE_MAX_CAPTURE_LINES
|
|
}),
|
|
streamingMultiplier: pl.streamingMultiplier ?? 1,
|
|
envKeys: Object.freeze([
|
|
'BARE_OS_PIPELINE_MAX_STAGES',
|
|
'BARE_OS_PIPELINE_MAX_BYTES',
|
|
'BARE_OS_PIPELINE_MAX_LINES',
|
|
'BARE_OS_PIPELINE_ABS_MAX_BYTES',
|
|
'BARE_OS_PIPELINE_ABS_MAX_LINES',
|
|
'BARE_OS_SHELL_STREAMING',
|
|
'BARE_OS_SHELL_STREAMING_MULT',
|
|
'BARE_OS_STREAMING_MULTIPLIER'
|
|
])
|
|
}),
|
|
pseudoFsPaths: BARE_OS_PSEUDO_FS_PATHS,
|
|
quotas: Object.freeze({
|
|
execLineMaxDepth: execMaxDepth,
|
|
ipcMaxBytesBacklog: ipcMaxBytes,
|
|
envKeys: Object.freeze([
|
|
'BARE_OS_EXEC_MAX_DEPTH',
|
|
'BARE_OS_IPC_MAX_BYTES',
|
|
'BARE_OS_IPC_CHANNEL_MAX_BYTES',
|
|
'BARE_OS_INITD_JOURNAL_MAX_LINES'
|
|
])
|
|
}),
|
|
features: Object.freeze({
|
|
simulatedPipelines: true,
|
|
bareInitd: true,
|
|
vfsTwoDrive: true,
|
|
identityVault: true,
|
|
httpDelegate: true,
|
|
gitDelegate: true,
|
|
systemctlDelegate: true,
|
|
jobControl: true,
|
|
shellHereString: true,
|
|
shellHereDocument: true,
|
|
ipcFifoSimulated: true,
|
|
bootReadyPseudoFs: true,
|
|
sessionStatsProc: true,
|
|
initdRequiresWants: true,
|
|
initdTimeoutsRestart: true,
|
|
vfsChown: true,
|
|
auditLog: auditOn,
|
|
recoveryBootCapable: true,
|
|
minimalBootActive: minimalBoot,
|
|
vfsWatch: vfsWatchOn,
|
|
ipcRpcJson: true,
|
|
initdSocketActivation: true,
|
|
initdTimerDropIns: true,
|
|
bootEventSubscribe: true,
|
|
kernelEventSubscribe: true,
|
|
eventBusSubscribe: true,
|
|
swarmChat: bareOsChatMuxEnabled(shellEnv),
|
|
swarmConnectionManagerSketch: true,
|
|
keyBrokerHandleSketch: true,
|
|
hdmsLifecycleSubscribe: true,
|
|
seederRpcExtended: true,
|
|
ipcFanout: ipcFanoutOn,
|
|
abortableExecLine: true,
|
|
httpFetchPolicy: true,
|
|
virtualRegisterFiles: true,
|
|
hostStatsBridge: true,
|
|
bareCtxModules: bareOsBareModulesEnabled(shellEnv),
|
|
bareHostImportsForCtx:
|
|
bareOsBareModulesEnabled(shellEnv) &&
|
|
bareOsBareHostImportsEnabled(shellEnv),
|
|
bareDriveBundles:
|
|
bareOsBareModulesEnabled(shellEnv) &&
|
|
bareOsBareDriveBundlesEnabled(shellEnv),
|
|
sandboxScript:
|
|
shellEnv.BARE_OS_SANDBOX_SCRIPT !== '0' &&
|
|
shellEnv.BARE_OS_SANDBOX_SCRIPT !== 'false',
|
|
bootPhaseHooks: true,
|
|
bootStepHooks: true,
|
|
ipcDuplexBridge: true,
|
|
vfsUnionRead:
|
|
shellEnv.BARE_OS_VFS_UNION_PREFIXES != null &&
|
|
String(shellEnv.BARE_OS_VFS_UNION_PREFIXES).trim() !== '',
|
|
procSwarmSnapshot: true,
|
|
bootManifestVerify:
|
|
shellEnv.BARE_OS_BOOT_MANIFEST === '1' ||
|
|
shellEnv.BARE_OS_BOOT_MANIFEST === 'true',
|
|
bareModuleLockfile: true,
|
|
oidcPublishHook: true,
|
|
ipcDuplexJsonRpc: true,
|
|
procReplicationSnapshot: true,
|
|
procCapabilitiesExport: true,
|
|
blindBootstrapProc: true,
|
|
initdUnitJournal: true,
|
|
initdParallelStart:
|
|
Number.parseInt(
|
|
String(shellEnv.BARE_OS_INITD_MAX_PARALLEL || '1'),
|
|
10
|
|
) > 1,
|
|
vfsBinReadCache:
|
|
shellEnv.BARE_OS_VFS_BIN_CACHE === '1' ||
|
|
shellEnv.BARE_OS_VFS_BIN_CACHE === 'true',
|
|
bootManifestEd25519:
|
|
shellEnv.BARE_OS_BOOT_MANIFEST_SIGN === '1' ||
|
|
shellEnv.BARE_OS_BOOT_MANIFEST_SIGN === 'true',
|
|
sandboxWorkerHint:
|
|
shellEnv.BARE_OS_SANDBOX_WORKER === '1' ||
|
|
shellEnv.BARE_OS_SANDBOX_WORKER === 'true',
|
|
mirrorRequestHook: true,
|
|
personalSnapshotExportHook: true,
|
|
pearIpcEmitHook: true,
|
|
shellStreamingPipelines:
|
|
shellEnv.BARE_OS_SHELL_STREAMING === '1' ||
|
|
shellEnv.BARE_OS_SHELL_STREAMING === 'true',
|
|
shellCmdsubst:
|
|
shellEnv.BARE_OS_SHELL_CMDSUBST === '1' ||
|
|
shellEnv.BARE_OS_SHELL_CMDSUBST === 'true',
|
|
seedRpcHandshake:
|
|
shellEnv.BARE_OS_SEED_RPC_HANDSHAKE !== '0' &&
|
|
shellEnv.BARE_OS_SEED_RPC_HANDSHAKE !== 'false',
|
|
vfsUnionWriteDeny:
|
|
shellEnv.BARE_OS_VFS_UNION_WRITE_DENY != null &&
|
|
String(shellEnv.BARE_OS_VFS_UNION_WRITE_DENY).trim() !== '',
|
|
ipcPerChannelMaxBytes:
|
|
shellEnv.BARE_OS_IPC_CHANNEL_MAX_BYTES != null &&
|
|
String(shellEnv.BARE_OS_IPC_CHANNEL_MAX_BYTES).trim() !== '',
|
|
telemetryNdjson:
|
|
shellEnv.BARE_OS_TELEMETRY_NDJSON != null &&
|
|
String(shellEnv.BARE_OS_TELEMETRY_NDJSON).trim() !== '' &&
|
|
shellEnv.BARE_OS_TELEMETRY_NDJSON !== '0' &&
|
|
shellEnv.BARE_OS_TELEMETRY_NDJSON !== 'false',
|
|
bootPolicyFile:
|
|
shellEnv.BARE_OS_BOOT_POLICY === '1' ||
|
|
shellEnv.BARE_OS_BOOT_POLICY === 'true',
|
|
shellWaitBuiltin: true,
|
|
initdRestartMaxAttempts: true,
|
|
vfsWatchPseudoMetrics: vfsWatchPseudoOn,
|
|
envDashSAndEnvFile: envDashSOn,
|
|
shellParamExpansionV2: shellParamV2On,
|
|
procLinuxCompatCgroupsNet: true,
|
|
procKernelExtRegistry: true,
|
|
initdIdleStop: true,
|
|
initdUnitsDFragments: true,
|
|
cronRebootAndJitter: true,
|
|
diagnosticsChannel: diagnosticsOn,
|
|
pearIpcRequest: true,
|
|
mirrorDriveHintEmit: true,
|
|
hdmsAutopassHintsProc: true,
|
|
binWorkerOffloadGate:
|
|
shellEnv.BARE_OS_BIN_WORKER_OFFLOAD === '1' ||
|
|
shellEnv.BARE_OS_BIN_WORKER_OFFLOAD === 'true',
|
|
jsonSchemasRepoArtifact: true,
|
|
wave6OperatorProc: true,
|
|
wave6SeedRpc: true,
|
|
wave6BootPolicyV6: true,
|
|
ctxBareSubprocessSpawn:
|
|
shellEnv.BARE_OS_CTX_BARE_SUBPROCESS_SPAWN === '1' ||
|
|
shellEnv.BARE_OS_CTX_BARE_SUBPROCESS_SPAWN === 'true',
|
|
tuiSdk:
|
|
shellEnv.BARE_OS_TUI !== '0' && shellEnv.BARE_OS_TUI !== 'false',
|
|
ircTls: shellEnv.BARE_OS_IRC !== '0' && shellEnv.BARE_OS_IRC !== 'false'
|
|
})
|
|
})
|
|
}
|