kino 0.1.3-aarch64-linux → 0.2.1-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1125d6e6dc02e476cd98a406a415cf2ca0921fc95366a043751f3cf0e45344b1
-  data.tar.gz: 2026c1c8221f96b568d9544a36059079c5dd96af8aa914f07147b93d3bf3ceb5
+  metadata.gz: d664928d6dfad3b60c6fdcbd27c2dffc008a9485a224bda3b7179f033c4c7cf5
+  data.tar.gz: d52e42477237ff7e65ea5f8752a63c6ac1d1f20cfa3f9189ad3a80a4d5e51f69
 SHA512:
-  metadata.gz: bee0236c5585cd08d64bdca886fa7639223d5fe39f5bdcc7abbf1ca4eb9f7fb59e8cf59647641969189c2a3d8331d61472f13f93a9eab7864cd78e9b9895f80d
-  data.tar.gz: 6e161ab88637c5c1db6ae4ba3cd881850bc171abb08bffee2bc16ec8cf63355d6fee91699891260390e58a014fb8222f5c115e759c8d060acd1cdcef3d85807a
+  metadata.gz: e0a0a7ac4cfc422143b11938423cd1b9022e4e065bf131548b485a95d1cd88042798f778b5b87f3fc6a51a12814cf564be8bce8d4ed61366e68c6133e775a3e1
+  data.tar.gz: 1d52a5e4715075b324cd9997e525be33c4edf69c4fe0547dcbf8633228783b3f7414699a88a70caeab2d7f1122d80283f4ab7c5cd7f45669bd67b3dae190a12c

data/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [0.2.1] - 2026-07-27
+
+- Update Rust dependencies for Kino.
+- Update: puma 8 in benchmarks.
+
+## [0.2.0] - 2026-07-13
+
+- Strip debug info from release builds.
+- A panic in the native layer now raises a RuntimeError on the affected
+  worker (visible to `on_error` and the error log) instead of killing the
+  server process.
+- The pidfile is claimed exclusively: starting refuses (instead of silently
+  overwriting) while the pidfile's owner is alive, a leftover file from a
+  dead process is replaced, symlinks are never followed, and shutdown
+  removes the file only while it still holds our pid.
+- Zero-copy response bodies: bodies of 4 KB and up ride to the network
+  layer by reference instead of being copied at the FFI boundary, in both
+  dispatch modes. A 10 KB-body endpoint now serves at plaintext speed.
+
 ## [0.1.3] - 2026-07-04
 
 - Non-String response header names and values (booleans, numbers, symbols)

data/README.md

@@ -21,6 +21,8 @@ and a threaded fallback mode runs everything else, Rails included.
   small process.
 * **Production plumbing included.** Graceful drain, crash supervision
   and respawn, bounded queues with 503 backpressure, request timeouts,
+  hardened intake (slowloris and TLS-handshake deadlines, connection
+  and body-size caps), an `on_error` hook for your error tracker,
   TLS (rustls), live stats, async access and app logging.
 * **Tells you why.** `kino --check` lists exactly what blocks your app
   from ractor mode, finding by finding, so you do not have to decode
@@ -181,7 +183,7 @@ bundle add kino      # or: gem install kino (outside a bundle)
 or put it in the `Gemfile` yourself:
 
 ```ruby
-gem "kino", "~> 0.1"
+gem "kino"
 ```
 
 Then generate a config and serve:
@@ -224,6 +226,9 @@ server = Kino::Server.new(app,
   queue_depth: 1024,          # bounded queue; overflow → 503
   queue_timeout: 5.0,         # seconds before 503 on a full queue
   request_timeout: nil,       # seconds before a slow response becomes a 504 (nil = off)
+  max_connections: 8192,      # cap concurrent connections; default: most of ulimit -n
+  max_body_size: 50 * 1024 * 1024,  # bytes before a 413; nil = let a proxy handle it
+  on_error: ->(e, env) { ErrorTracker.capture(e) },  # after the client got its 500
   shutdown_timeout: 30,       # drain deadline
   tls: { cert: "cert.pem", key: "key.pem" },  # file paths or inline PEM
 )
@@ -303,6 +308,18 @@ is unsafe. A stuck handler still occupies its worker slot until it
 returns, so set the deadline above your slowest legitimate endpoint and
 watch `stats[:timeouts]`.
 
+Timeouts guard your app; the network intake guards itself. New
+connections past `max_connections` (default: most of `ulimit -n`) wait
+in the kernel backlog; request bodies past `max_body_size` (default
+50 MB, `nil` delegates to a fronting proxy) get a **413**; and fixed
+deadlines drop slow-header clients (15 s), stalled TLS handshakes
+(10 s), and uploads stalled mid-body (30 s). When a worker catches an
+app or delivery error,
+`on_error ->(error, env) { ErrorTracker.capture(error) }` is called
+after the client got its 500—the only place a tracker sees errors
+raised while the response was being written (in `:ractor` mode, build
+the handler with `Ractor.shareable_proc`).
+
 ## Stats
 
 `server.stats` returns a live snapshot: the configuration plus counters
@@ -415,6 +432,14 @@ bundle exec rake                       # compile, Rust tests, specs, RBS, lint
 RB_SYS_CARGO_PROFILE=dev bundle exec rake compile   # fast dev rebuilds
 ```
 
+## Acknowledgements
+
+Thanks to [Mat Sadler](https://github.com/matsadler) for [magnus](https://github.com/matsadler/magnus).
+
+For ractors, thanks to [Koichi Sasada](https://github.com/ko1), [John Hawthorn](https://github.com/jhawthorn), [Jean Boussier](https://github.com/byroot), [Luke Gruber](https://github.com/luke-gruber), and other Ruby core contributors.
+
+For the Rust network stack, thanks to [Sean McArthur](https://github.com/seanmonstar) for [hyper](https://github.com/hyperium/hyper), and to [Carl Lerche](https://github.com/carllerche), [Alice Ryhl](https://github.com/Darksonn), and the other [Tokio](https://github.com/tokio-rs/tokio) maintainers for the runtime underneath it. Thanks to [Joshua Barretto](https://github.com/zesterer) for [flume](https://github.com/zesterer/flume)—its channels carry every request between the network side and the workers.
+
 ## Assisted by
 
 Claude Code (Mythos, Opus).

data/lib/kino/server.rb

@@ -73,17 +73,28 @@ module Kino
     def start
       raise Error, "server already started" if @started
 
-      @id, @port = Native.server_start(
-        bind: @bind, port: @requested_port,
-        queue_depth: @queue_depth, queue_timeout_ms: @queue_timeout_ms,
-        request_timeout_ms: @request_timeout_ms,
-        max_connections: @max_connections,
-        max_body_size: @max_body_size,
-        tokio_threads: @tokio_threads,
-        tls_cert: @tls&.fetch(:cert), tls_key: @tls&.fetch(:key),
-        lanes: @lanes, log_requests: @log_requests
-      )
-      File.write(@pidfile, "#{Process.pid}\n") if @pidfile
+      # Claim the pidfile before binding: refusing to start (another
+      # instance is alive) must not leave a booted native runtime behind.
+      write_pidfile if @pidfile
+      booted = false
+      begin
+        @id, @port = Native.server_start(
+          bind: @bind, port: @requested_port,
+          queue_depth: @queue_depth, queue_timeout_ms: @queue_timeout_ms,
+          request_timeout_ms: @request_timeout_ms,
+          max_connections: @max_connections,
+          max_body_size: @max_body_size,
+          tokio_threads: @tokio_threads,
+          tls_cert: @tls&.fetch(:cert), tls_key: @tls&.fetch(:key),
+          lanes: @lanes, log_requests: @log_requests
+        )
+        booted = true
+      ensure
+        remove_pidfile if @pidfile && !booted
+      end
+      # GC anchor for zero-copy response buffers: held for the server's
+      # lifetime so in-flight buffers survive even a worker ractor crash.
+      @pin_keeper = Native.pin_keeper(@id)
       if @mode == :ractor
         @supervisor = RactorSupervisor.new(@id, @app, workers: @workers, threads: @threads,
           batch: @batch, on_error: @on_error).start
@@ -133,9 +144,12 @@ module Kino
       end
 
       Native.shutdown_runtime(@id, 1_000)
+      # The runtime is gone, so hyper has dropped every pinned buffer;
+      # the keeper (and the strings it marked) may now be collected.
+      @pin_keeper = nil
       @worker_threads.clear
       @started = false
-      File.delete(@pidfile) if @pidfile && File.exist?(@pidfile)
+      remove_pidfile if @pidfile
       nil
     end
 
@@ -241,6 +255,67 @@ module Kino
       [soft * 8 / 10, 64].max
     end
 
+    # Claim the pidfile for this process. O_EXCL creation fails on ANY
+    # existing directory entry (regular file, symlink, even a dangling
+    # one), so a live instance's pidfile is never overwritten and a
+    # symlink is never followed. A leftover entry whose owner is gone is
+    # replaced; one that does not hold a pid is refused, not clobbered.
+    def write_pidfile
+      claim_pidfile
+    rescue Errno::EEXIST
+      refuse_unless_stale
+      begin
+        # Unlink removes the entry itself; a symlink's target is untouched.
+        File.unlink(@pidfile)
+      rescue Errno::ENOENT
+        # Vanished on its own; the claim below settles any remaining race.
+      end
+      begin
+        claim_pidfile
+      rescue Errno::EEXIST
+        raise Error, "lost the race for #{@pidfile}: another instance is starting"
+      end
+    end
+
+    def claim_pidfile
+      File.open(@pidfile, File::WRONLY | File::CREAT | File::EXCL, 0o644) do |file|
+        file.write("#{Process.pid}\n")
+      end
+    end
+
+    # @raise [Kino::Error] when the pidfile's owner is still alive, or the
+    #   file does not look like a pidfile at all
+    def refuse_unless_stale
+      content = begin
+        File.read(@pidfile)
+      rescue Errno::ENOENT
+        return # already gone; nothing to refuse
+      end
+      pid = Integer(content.strip, exception: false)
+      unless pid&.positive?
+        raise Error, "refusing to overwrite #{@pidfile}: does not hold a pid"
+      end
+      raise Error, "already running (pid #{pid}, per #{@pidfile})" if process_alive?(pid)
+    end
+
+    def process_alive?(pid)
+      Process.kill(0, pid)
+      true
+    rescue Errno::ESRCH
+      false
+    rescue Errno::EPERM
+      true # exists, just not ours to signal
+    end
+
+    # Delete only a pidfile that is still ours: by shutdown time the path
+    # may belong to a replacement instance, or an operator may have
+    # repointed it at something that is not a pidfile at all.
+    def remove_pidfile
+      File.unlink(@pidfile) if File.read(@pidfile) == "#{Process.pid}\n"
+    rescue Errno::ENOENT
+      nil
+    end
+
     def join_workers(deadline)
       if @supervisor
         @supervisor.shutdown([deadline - monotonic_now, 0].max)

data/lib/kino/version.rb

@@ -2,5 +2,5 @@
 
 module Kino
   # The gem version (single source of truth; ext/kino/Cargo.toml syncs).
-  VERSION = "0.1.3"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kino
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.2.1
 platform: aarch64-linux
 authors:
 - Yaroslav Markin
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-07-04 00:00:00.000000000 Z
+date: 2026-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger