fs/metal/browser_storage.sg (sigil-fs 28c42bf) adds persistent key-value storage for the sigilOS browser — localStorage and cookie namespaces, backed by the VFS. Two namespaces: /<pfx>/browser/local/<key> (localStorage) and /<pfx>/browser/cookie/<key> (cookies). Keys: printable ASCII, ≤63B, no / or null (path-traversal rejected at the key-validation layer). Values: ≤4096B. Idempotent set (unlink + create). ABCDEFG test: 7-step round-trip verified.
VFS path model
/<pfx>/browser/local/<key>. Each localStorage entry is a VFS file at this path. bs_local_set(key, val, vlen): validate key → fs_unlink (idempotent) → fs_create → fs_write(val, vlen). bs_local_get(key, buf, max): fs_open → fs_read → fs_close; returns byte count read, or 0 if missing. bs_local_del(key): fs_unlink (no-op if missing)./<pfx>/browser/cookie/<key>. Identical API: bs_cookie_set/get/del. The prefix (/pfx) is a mount-point token derived from the browser's VFS capability — each browser session has its own prefix cap; cookies from one origin cannot cross into another's prefix.bs_key_valid(key): walks byte-by-byte, rejects if any byte is 0x00 (null), 0x2F ('/'), or outside printable ASCII (0x20–0x7E). Length must be 1–63B. Returned as a bool; bs_local_set/get/del return BSTORE_ERR_KEY on rejection. This prevents path traversal at the FS layer — no key can name a parent directory or escape the namespace.bs_local_set calls fs_unlink before fs_create unconditionally — no "file exists" branch. This makes repeated sets atomic: the old value is removed before the new one is written.ABCDEFG test
7-step round-trip verification:
| Step | Action | Expected |
|---|---|---|
| A | browser_storage_init() | Namespace prefixes created |
| B | bs_local_set("theme", "dark", 4) | BSTORE_OK |
| C | bs_local_get("theme", buf, 32) | "dark", 4 bytes |
| D | bs_cookie_set("session", "abc123", 6) | BSTORE_OK |
| E | bs_cookie_get("session", buf, 32) | "abc123", 6 bytes |
| F | bs_local_del("theme"); bs_local_get("theme", ...) | 0 (missing) |
| G | bs_local_set("bad/key", ...) | BSTORE_ERR_KEY |
Integration
browser_storage.sg is the persistence layer for the cc0 runtime's localStorage and document.cookie APIs. The cc0 JS engine calls bs_local_set/get/del and bs_cookie_set/get/del directly; the VFS provides the backing store. No SQLite, no JSON index — each key is a file.