kobako 0.28.0 → 0.29.0

data/crates/kobako-wasmtime/CHANGELOG.md

@@ -1,5 +1,124 @@
 # Changelog
 
+## [0.19.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.18.0...kobako-wasmtime-v0.19.0) (2026-10-26)
+
+
+### ⚠ BREAKING CHANGES
+
+* **io:** File.open raises ArgumentError for a mode such as bw, where b leads, or wbt, holding both b and t, as CRuby does, instead of opening the file.
+* **wasmtime:** a call through a directory descriptor answers ENOENT when the directory at its path is not the one it opened, where it used to reach that directory.
+* **wasmtime:** a struct literal no longer builds the wasmtime driver's Config outside its crate; start from `Config::default()` and assign each field.
+* **runtime:** a struct literal no longer builds OpenOptions, Metadata, DirEntry, Snapshot, Capture, or Usage outside kobako-runtime; use their `new` or `Default` and assign each field.
+* the wasmtime Config and the SDK Options gain a setup_timeout field, so a struct literal that names every field must add it; one built from Options::default() is unaffected.
+* **wasmtime:** a Service answer past 16 MiB now raises a Service failure in the guest where it used to raise the transport error, and an answer the host cannot write into guest memory now traps the invocation.
+* the Guest ABI is version 5, so a Guest Binary built against version 4 is refused at Sandbox construction until rebuilt. The Yielder trait of kobako-runtime gains frame and takes the frame in yield_to_block; the Guest trait of kobako-core and the MrbGuest trait of kobako-mruby take the frame in yield_to_block; Downcall::Yield carries frame and args.
+* **io:** putc, IO#read and SystemCallError.new raise RangeError for those numbers instead of writing, refusing or ignoring them.
+* **guest:** the default memory_limit is now 4 MiB. JSON.parse in the guest answers an Integer for every integer within 64 bits, where it used to answer a Float past 32 bits. An integer past 64 bits now raises
+* **wasmtime:** a struct literal building the wasmtime driver's Config must set the new `open_file_limit` field.
+* **io:** a script writing to a file through `IO#write` beneath a Mount now raises on a failed write where it used to go on.
+* **io:** a script rescuing IOError for a failed read or write beneath a Mount must rescue the EIO error class, or SystemCallError, instead.
+* **guest:** a Service or Extension backend bound at the path File fails its first invocation, naming the segment the Guest Binary now defines.
+* **runtime:** the Runtime trait's invoke takes the invocation's Grants as a fourth argument, so every engine implementing it must accept them.
+
+### Features
+
+* check what a rename moves as it moves, refusing a directory beneath a Policy ([23794bf](https://github.com/elct9620/kobako/commit/23794bfcb54e148126e29873fa9b52d9e3de8d8c))
+* **guest:** carry mruby-bigint so an Integer has no width of its own ([a74266d](https://github.com/elct9620/kobako/commit/a74266d3e7b1295b75770b62894b232195f9b3bb))
+* **guest:** ship File in the default Guest Binary over the filesystem Grants ([535527b](https://github.com/elct9620/kobako/commit/535527b2c6beb82fe37758df62c3804ce5c7191a)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+* **guest:** widen the guest Integer to 64 bits ([7236a26](https://github.com/elct9620/kobako/commit/7236a26285dfdef175048f659c1094dd3bbb5b4d))
+* **io:** create a file only where nothing is through File.open's wx ([56c5665](https://github.com/elct9620/kobako/commit/56c5665e4c87ac30b8035aaed207ce840efad25c))
+* **io:** open a file by an Integer mode of File::Constants flags ([e1f484c](https://github.com/elct9620/kobako/commit/e1f484c713df4d894744833836cf9a29ba9677ee))
+* **io:** open a file through wasi-libc so a create needs no write ([6d50ca4](https://github.com/elct9620/kobako/commit/6d50ca4d79b70956d113f0798255300aa8a7fe92))
+* let a Host App bound how long a Guest Binary takes to be set up ([2addab0](https://github.com/elct9620/kobako/commit/2addab002550539e3ebb24bdd599dd424c2dc3d9))
+* **runtime:** hand each invocation its Grants and let an engine declare the kinds it supports ([cba90ee](https://github.com/elct9620/kobako/commit/cba90eed09c8afcb23080cef1c9cbb3650648472)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+* **runtime:** keep a directory descriptor's identity its own while open ([6267642](https://github.com/elct9620/kobako/commit/6267642ea831917be76a0101e8d206ccfa8834c1))
+* **runtime:** let a dispatch handler abandon its invocation ([179da9e](https://github.com/elct9620/kobako/commit/179da9ee1f31fed9e6d0c149faee0ad55f8db487))
+* **runtime:** let a Filesystem's file refuse its close ([af16007](https://github.com/elct9620/kobako/commit/af1600797b098796dd6f329672c7d04e2e1cd2fa)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+* **runtime:** let a Mount decide its own access as the one kind of Grant ([5c9189e](https://github.com/elct9620/kobako/commit/5c9189eea8ac61cf165dca1b38e459c4f14acdd0)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+* **runtime:** let a Mount's Policy judge the spelling the host stores ([5281057](https://github.com/elct9620/kobako/commit/52810573f22d2a3edfae9b34b7767a5f440fba15))
+* **runtime:** let the records a Filesystem or an engine builds gain fields ([c0ef88d](https://github.com/elct9620/kobako/commit/c0ef88d0b6df16d651e4c49226e41667307d772f))
+* **runtime:** name a file grown past what a Filesystem keeps ([7bac3e6](https://github.com/elct9620/kobako/commit/7bac3e65534097b85d93f5967b6c73a979869a78))
+* **runtime:** name each code a Filesystem may fail with ([1d980fa](https://github.com/elct9620/kobako/commit/1d980fa4328bad42e8a8665adfec9fc844690e97))
+* **runtime:** refuse a Mount at a path that is no absolute guest path ([a525758](https://github.com/elct9620/kobako/commit/a5257589f9d831b9a3b6d1952df6e5c8469630e1))
+* **wasmtime:** answer a Filesystem out of space as ENOSPC ([c648ebf](https://github.com/elct9620/kobako/commit/c648ebf63a871b7d4417110de00decf1738a19d6))
+* **wasmtime:** cap the descriptors one invocation holds open ([03409c1](https://github.com/elct9620/kobako/commit/03409c1437f71312c584a92e22054b90241535a3))
+* **wasmtime:** let Config gain a cap without breaking a frontend ([55d8093](https://github.com/elct9620/kobako/commit/55d80933b958bab67f1b94deb7633272dc56f972))
+* **wasmtime:** present each filesystem Grant to the guest as a preopen ([68149a7](https://github.com/elct9620/kobako/commit/68149a7adc912172b72e7a34bd39082a3b2a9e95)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+
+
+### Bug Fixes
+
+* append through a Filesystem's file only in one step ([0509ca7](https://github.com/elct9620/kobako/commit/0509ca70d2d5a832303973ba0f7280be0731fd3d))
+* ask a mount's block once for a read ([f89bd16](https://github.com/elct9620/kobako/commit/f89bd16c1a71ed1d385ab9d3ac5974ac3f0a9103))
+* follow no link swapped in after a Policy judges a path ([ed93213](https://github.com/elct9620/kobako/commit/ed9321303dd45e113fc413e99e1240118cc4bbe4))
+* hold an Overlay's lock across each call, waiting without the GVL ([b8e7342](https://github.com/elct9620/kobako/commit/b8e734273fdc577a40be97c43c46d9548d66c625))
+* **io:** build Errno and IOError as CRuby does ([da77c47](https://github.com/elct9620/kobako/commit/da77c4725d3701ba982f5425b1fcf2fb0038ac89))
+* **io:** give File::Constants CRuby's Linux values ([14cadd8](https://github.com/elct9620/kobako/commit/14cadd88ac5a5dcb8f73b252b68c493488b3e78a))
+* **io:** keep the number a SystemCallError is built with ([5fd327a](https://github.com/elct9620/kobako/commit/5fd327add59173cd5756fecb41d97aebcba7b881))
+* **io:** raise each code the engine answers as its own Errno ([eb6382e](https://github.com/elct9620/kobako/commit/eb6382e506a30e82576fa12ab9859e7d35be2b17))
+* **io:** raise Errno::EIO for a file failure no other code names ([8a0447d](https://github.com/elct9620/kobako/commit/8a0447d2d09ea83e6f7771cf0411bfd6deec3d1a)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+* **io:** raise RangeError for a number past what putc, read and errno take ([6f87cc0](https://github.com/elct9620/kobako/commit/6f87cc08dff7146415f80ca25cd75ddbec4391c0))
+* **io:** raise the error a failed file write names ([bcc8e00](https://github.com/elct9620/kobako/commit/bcc8e00662741fcac3b91f58c0b60f4a79d2ab9f))
+* **io:** write a file to the end when its Filesystem takes it in parts ([029b439](https://github.com/elct9620/kobako/commit/029b43939a3a48bc2925057df69bfcb85b1a0548))
+* keep a link within the directory a descriptor opened ([952dd05](https://github.com/elct9620/kobako/commit/952dd0556969683f44798da94f9fc7a17c1f6d55))
+* run a stored block as the block of the Call that carried it ([bf33dc1](https://github.com/elct9620/kobako/commit/bf33dc1fd40c83498c6c12b0be52b3a835a144cf))
+* **runtime:** make every Filesystem answer the methods that keep a guarantee ([00f5af6](https://github.com/elct9620/kobako/commit/00f5af63f34ac7722249746d0b0eb566da618803))
+* **runtime:** report a merged directory's identity alike through an Overlay's lstat ([ded3b4a](https://github.com/elct9620/kobako/commit/ded3b4aba78efa678318c38b139b5c9c76b5d3fd))
+* **wasmtime:** answer a Call the host cannot serve with the reason ([cf60dcc](https://github.com/elct9620/kobako/commit/cf60dccc63a0d0cfc959f701b7212c78beafa528))
+* **wasmtime:** answer a path past Linux's limits as NAMETOOLONG ([af43917](https://github.com/elct9620/kobako/commit/af43917e30a634d6c1bd70813044967bd1057ba3))
+* **wasmtime:** answer a stat that follows no link with the link itself ([ad0072e](https://github.com/elct9620/kobako/commit/ad0072e03ecc363487598a507de20a8f7aec2927))
+* **wasmtime:** answer a wait to write a file by what its Mount permits ([bf863db](https://github.com/elct9620/kobako/commit/bf863db998edeab60f9276fc53e8adcf8cf98364))
+* **wasmtime:** answer an offset past the largest signed offset as EINVAL ([b94788e](https://github.com/elct9620/kobako/commit/b94788e1c1fc9d86f647da4396bcba3eaec16242))
+* **wasmtime:** answer an unlink with a trailing slash by the name itself ([94e7250](https://github.com/elct9620/kobako/commit/94e72505cfc027319c2139e15488eb2682268d49))
+* **wasmtime:** answer descriptor flags, advice, and clock waits as preview1 does ([c1aec63](https://github.com/elct9620/kobako/commit/c1aec632445c3bf216be6375552c799d7877670f))
+* **wasmtime:** answer dot paths, creates, and far seeks as Linux does ([68c234e](https://github.com/elct9620/kobako/commit/68c234e06859b93fb986bdbab92cca944ce39700))
+* **wasmtime:** answer EINVAL for a guest path holding a NUL ([1c681d6](https://github.com/elct9620/kobako/commit/1c681d6e723f259ab2b3acc5e3a33d85499a2ef5))
+* **wasmtime:** answer ENOENT for an open of a missing path that makes nothing ([48e3944](https://github.com/elct9620/kobako/commit/48e3944c64d7ef410fcc4595d80ba0284f257a09))
+* **wasmtime:** answer every preview1 call that reads a descriptor from kobako's own table ([d0e39ae](https://github.com/elct9620/kobako/commit/d0e39aebd6d729d49111340af7f2af4e37aa7909)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+* **wasmtime:** answer fd_allocate beneath a Mount as unsupported ([e3d2071](https://github.com/elct9620/kobako/commit/e3d20713e4474cd637dacfece99e52b80d7ad2f6))
+* **wasmtime:** answer what stands at a path before a Mount refuses an open ([81e02dc](https://github.com/elct9620/kobako/commit/81e02dc5e7d500b2971ab5d4a670d38601f89389))
+* **wasmtime:** ask a Policy once for an open that may create ([a4613cb](https://github.com/elct9620/kobako/commit/a4613cb8cff89af51f55ce090433c61268105789))
+* **wasmtime:** bound a buffer outside memory before a file's access is checked ([8b76f76](https://github.com/elct9620/kobako/commit/8b76f764a6336d2e77baa2ca6fe63dfd7663ce19))
+* **wasmtime:** bound reads, writable waits, and a FIFO's names as preview1 hosts do ([6d89e55](https://github.com/elct9620/kobako/commit/6d89e55541f3366815dd7ed271e813a6ba41bcb3))
+* **wasmtime:** bound what one preview1 call copies to wasmtime's hostcall fuel ([097c554](https://github.com/elct9620/kobako/commit/097c55426c1e71467bb1e372abc190331dd3e601))
+* **wasmtime:** check path_open's flags as wasmtime-wasi does ([22eb494](https://github.com/elct9620/kobako/commit/22eb4944117260831e92fe616b02888078c02b0c))
+* **wasmtime:** close the file fd_renumber moves a descriptor onto ([0f6148d](https://github.com/elct9620/kobako/commit/0f6148d536ed3e9e96749c2e4a60bf6275332655))
+* **wasmtime:** give each writer of a cached artifact its own temp file ([995a46e](https://github.com/elct9620/kobako/commit/995a46e99dc1c485a303bb7f023b4e668a2801a3))
+* **wasmtime:** grant the compile instance no ambient authority ([c3edc71](https://github.com/elct9620/kobako/commit/c3edc71ab99dac57cbabfc685a7cc60a5a5c06ac))
+* **wasmtime:** hold the whole invocation to its deadline ([231e325](https://github.com/elct9620/kobako/commit/231e32592699008adf3105050bee8b5528ea27a8))
+* **wasmtime:** judge the cache directory itself, not where a link leads ([6baf6fd](https://github.com/elct9620/kobako/commit/6baf6fd2ad845cea83049c4b2bb51174aa205cd0))
+* **wasmtime:** keep a write and its file position within the largest signed offset ([29d4c34](https://github.com/elct9620/kobako/commit/29d4c341fc5a47ee43fdd249918e1f3e68120f86))
+* **wasmtime:** key the compiled-artifact cache by the engine that compiles it ([b43bad2](https://github.com/elct9620/kobako/commit/b43bad2fe176c153ed82a3a8825698414df78dfa))
+* **wasmtime:** leave a link named with a trailing slash in place ([9b3cdea](https://github.com/elct9620/kobako/commit/9b3cdea6dc00353c5c4896ec29b88eebdaddc8ab))
+* **wasmtime:** list a directory once for each listing a guest reads ([c333001](https://github.com/elct9620/kobako/commit/c3330011725c3dba01ea248ed7d1dfea31085af0))
+* **wasmtime:** look up what stands before a dot path as Linux does ([0898eaf](https://github.com/elct9620/kobako/commit/0898eafb55397c84ca9007561ddb35dd007ed2b8))
+* **wasmtime:** place an append at the end as the file stands when it lands ([d7291c4](https://github.com/elct9620/kobako/commit/d7291c4f32fb1f5f2494c69c76796476bbcf4d43))
+* **wasmtime:** reach the artifact cache through the directory it checked ([462fe91](https://github.com/elct9620/kobako/commit/462fe918d516cd639e405b06a5e280a9e58624df))
+* **wasmtime:** refuse a `..` that steps out of a host link ([4599386](https://github.com/elct9620/kobako/commit/45993868c7334376f5d1a455afbd15fe4a2146bc))
+* **wasmtime:** refuse a directory made in an opened directory's place ([5e67d4c](https://github.com/elct9620/kobako/commit/5e67d4cd2a52e3aa37bdd615fe1ae101a618db88))
+* **wasmtime:** refuse a link an open asks not to follow ([123a01b](https://github.com/elct9620/kobako/commit/123a01b01f59cc69c0e3a23f9aeb01aa89132c07))
+* **wasmtime:** refuse a link beneath a Policy before the Policy judges the path ([0e08e7b](https://github.com/elct9620/kobako/commit/0e08e7b463344ae34b5feb1787f8af8a6c719063))
+* **wasmtime:** refuse a link to a directory an open asks not to follow ([eec218f](https://github.com/elct9620/kobako/commit/eec218fdd5584f641070032cf1110ef1683eaae5))
+* **wasmtime:** refuse a path climbing above the directory it is opened through ([ae52746](https://github.com/elct9620/kobako/commit/ae52746761624249b7ff1e1fa09ece4ea8130ced))
+* **wasmtime:** refuse a path through a link beneath a Mount with a Policy ([3da1641](https://github.com/elct9620/kobako/commit/3da16416692ade01db2d9cf366d54d3ec5f50605))
+* **wasmtime:** refuse a rename of a file onto a path ending in a slash ([486a0ab](https://github.com/elct9620/kobako/commit/486a0ab3584772b58e181d5de57ef505e610eb78))
+* **wasmtime:** refuse an argument preview1 cannot hold in wasmtime-wasi's order ([9c76e21](https://github.com/elct9620/kobako/commit/9c76e2181a0dabd81f02723154cc4290215fcf70))
+* **wasmtime:** refuse to remove or move a Mount's root ([9f2e000](https://github.com/elct9620/kobako/commit/9f2e000115a4dd4aecfcc4b1cd39b23f6f20fe05))
+* **wasmtime:** report a host FIFO or device as of an unknown filetype ([5a212e7](https://github.com/elct9620/kobako/commit/5a212e7a7c0f069ffdcc56b850fab3778863d9ee))
+* **wasmtime:** require wasmtime 49.0.4 for the aarch64 br_table fix ([390e30b](https://github.com/elct9620/kobako/commit/390e30ba51ed4175820f2bb230e3ad5b0ad1e9a5))
+* **wasmtime:** resolve a `..` and a trailing slash as a host does ([d2d04c1](https://github.com/elct9620/kobako/commit/d2d04c1fff24d8829b2cf4fcbf628565f35eeadc))
+* **wasmtime:** resolve a final dot through the name before it ([7a0d3d8](https://github.com/elct9620/kobako/commit/7a0d3d8b23d47d4ba5c942682841434e74d6bf6a))
+* **wasmtime:** resolve a link a stat names with a trailing slash ([6da98fa](https://github.com/elct9620/kobako/commit/6da98facbccaa9bf6d8f8280a56841e19a7c879b))
+* **wasmtime:** size a file opened only to read as wasmtime-wasi and Linux answer ([810f5c8](https://github.com/elct9620/kobako/commit/810f5c8e863dc5bdbe82f8a19c7559fd7eee03f9))
+* **wasmtime:** sync a cached artifact before renaming it into place ([097efc7](https://github.com/elct9620/kobako/commit/097efc77599545bb2a5e729c75d23082470ed8f4))
+* **wasmtime:** take wasmtime 49.0.3 for its sandbox advisories ([7672592](https://github.com/elct9620/kobako/commit/76725923cac50473c7e3a21cc5121e3cbba0cba5))
+* **wasmtime:** trap a guest field address past the address space ([de5d47e](https://github.com/elct9620/kobako/commit/de5d47e10aa5d978573e46a7cb3453ff248d006e))
+
+
+### Performance Improvements
+
+* **io:** answer IO#read with a length in one read the file holds ([e9161a2](https://github.com/elct9620/kobako/commit/e9161a2018c1617157025de275f77890e865b7d1)), closes [#78](https://github.com/elct9620/kobako/issues/78)
+
 ## [0.18.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.17.0...kobako-wasmtime-v0.18.0) (2026-10-13)
 
 

data/crates/kobako-wasmtime/Cargo.toml

@@ -15,7 +15,7 @@
 
 [package]
 name = "kobako-wasmtime"
-version = "0.18.0"
+version = "0.19.0"
 edition = "2021"
 # wasmtime's own floor.
 rust-version = "1.96"
@@ -30,17 +30,19 @@ categories = ["wasm", "virtualization"]
 # The engine-neutral contract this crate implements. The version pin
 # rides the linked release group; the path keeps in-tree builds (and
 # the Ruby gem, which ships both crates) resolving locally.
-kobako-runtime = { version = "0.18.0", path = "../kobako-runtime" }
+kobako-runtime = { version = "0.19.0", path = "../kobako-runtime" }
 # The fixed tier: the core envelope this driver shuttles and the ABI
 # values it drives the exports against.
-kobako-transport = { version = "0.18.0", path = "../kobako-transport" }
+kobako-transport = { version = "0.19.0", path = "../kobako-transport" }
 # wasmtime — host-side embedder for kobako.wasm. We disable default-features
 # and opt back in only what kobako needs: a Cranelift-backed runtime that can
 # compile a pre-built wasm32-wasip1 module on the host triple, plus the `wat`
 # feature so test fixtures can be expressed as text.
-# `cache` / `parallel-compilation` / `pooling` / `component-model` / `async`
-# are intentionally off — kobako runs short-lived synchronous sandboxes.
-wasmtime = { version = "49.0.2", default-features = false, features = [
+# `cache` / `parallel-compilation` / `pooling` are intentionally off —
+# kobako runs short-lived synchronous sandboxes. `component-model` and
+# `async` still arrive through wasmtime-wasi's `p1`, which builds on `p2`;
+# kobako loads only core Modules, so none of that code is reached.
+wasmtime = { version = "49.0.4", default-features = false, features = [
     "cranelift",
     "runtime",
     "gc",
@@ -49,19 +51,22 @@ wasmtime = { version = "49.0.2", default-features = false, features = [
     "demangle",
     "wat",
 ] }
-# wasmtime-wasi provides WASI preview1 support for routing guest stdout/stderr
-# into in-memory buffers. The `p1` feature enables the
-# WasiCtxBuilder + preview1 adapter which wires fd 1/2 to pipes. We omit
-# `p2` (component-model) and `p0`/`p3` (async) because kobako runs
-# synchronous sandboxes only.
-wasmtime-wasi = { version = "49.0.2", default-features = false, features = ["p1"] }
+# wasmtime-wasi answers the preview1 calls that read no descriptor
+# (args, environ, clocks, random) and supplies the memory pipes the
+# capture channels write into; kobako answers every call that reads its
+# own descriptor table. `p1` is the only feature kobako asks for; it
+# enables `p2` itself, while `p0` and `p3` stay off.
+wasmtime-wasi = { version = "49.0.4", default-features = false, features = ["p1"] }
+# bytes is the buffer type wasmtime-wasi's stream traits take, for the
+# capture pipes kobako's own preview1 imports write into.
+bytes = "1.11"
 # sha2 keys the on-disk compiled-module cache by Guest Binary content
 # (see cache.rs); a collision would load the wrong artifact, so the
 # hash must be cryptographic.
 sha2 = "0.11"
 
-# libc supplies geteuid for the cache-directory ownership check gating
-# the unsafe artifact deserialize (see cache.rs); std exposes a file's
-# owner but not the process's effective uid.
+# rustix reaches the cache directory through one descriptor, checked by
+# owner, so the unsafe artifact deserialize reads only what that
+# directory holds (see cache.rs); std has no `*at` calls.
 [target.'cfg(unix)'.dependencies]
-libc = "0.2"
+rustix = { version = "1.1.4", features = ["fs", "process"] }

data/crates/kobako-wasmtime/README.md

@@ -10,10 +10,12 @@ contract surface.
 
 | Mechanic | What the driver holds |
 |---|---|
-| Compilation | process-wide Engine and compiled-Module caches, with an on-disk AOT (`.cwasm`) artifact cache keyed by Guest Binary content |
+| Compilation | process-wide Engine and compiled-Module caches |
+| Disk cache | AOT `.cwasm` artifacts on Unix, keyed by Guest Binary content and engine |
 | Instantiation | a pre-linked `InstancePre` per guest path; every invocation runs on a fresh instance and discards its Store afterwards |
-| Bounds | the epoch-based wall-clock timeout and the per-invocation linear-memory cap |
+| Bounds | epoch-based wall-clock deadlines on setup and on each invocation, and the per-invocation linear-memory cap |
 | Ambient denial | under the default hermetic profile, frozen clocks and a constant RNG |
+| Filesystems | a preopen per Mount, and its own capped descriptor table |
 
 The kobako Ruby gem's native ext is the first frontend; a Rust host
 SDK consumes the same surface.
@@ -22,7 +24,7 @@ SDK consumes the same surface.
 
 ```toml
 [dependencies]
-kobako-wasmtime = "0.18.0" # x-release-please-version
+kobako-wasmtime = "0.19.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-wasmtime/src/abi.rs

@@ -5,44 +5,41 @@
 //! alongside the `InstancePre` it guards (`crate::instance_pre`) and is
 //! amortised with it, rather than once per `Driver::new`.
 
+use std::time::Duration;
+
 use wasmtime::{AsContextMut, InstancePre, Store as WtStore};
 
 use crate::cache::shared_engine;
-use crate::config::Config;
 use crate::invocation::Invocation;
-use crate::{io, trap};
-use kobako_runtime::error::SetupError;
-use kobako_runtime::profile::Profile;
+use crate::trap;
+use crate::wasi::Wasi;
+use kobako_runtime::error::{SetupError, Trap};
 use kobako_transport::abi::ABI_VERSION;
 
-/// Caps for the throwaway probe instance. Instantiation runs the
-/// artifact's start section, so the capture pipes are sized to keep
-/// nothing — the probe reads neither — and the strongest isolation rung
-/// is taken, since reading an artifact's version grants no ambient
-/// authority. The timeout and memory caps stay off because both arm per
-/// invocation and there is none here.
-const PROBE_CONFIG: Config = Config {
-    timeout: None,
-    memory_limit: None,
-    stdout_limit: Some(0),
-    stderr_limit: Some(0),
-    profile: Profile::Hermetic,
-};
-
 /// An absent or unequal version is a deterministic artifact fault, so
-/// every failure is a `SetupError`. The probe's own WASI context keeps a
-/// guest whose start section touches WASI on that path instead of
-/// panicking in `Invocation::wasi_mut`.
-pub(crate) fn verify(pre: &InstancePre<Invocation>) -> Result<(), SetupError> {
-    let mut store = WtStore::new(shared_engine()?, Invocation::new(None));
-    // Epoch interruption is on engine-wide and a fresh Store's deadline
-    // has already elapsed, so the probe must name one it cannot reach.
-    store.set_epoch_deadline(trap::NO_TIMEOUT_EPOCH_DELTA);
-    io::install_wasi(&mut store, &PROBE_CONFIG, &[])
-        .map_err(|t| SetupError::Dead(t.to_string()))?;
+/// every failure is a `SetupError`. `setup_timeout` bounds instantiating
+/// the artifact and reading its version, so a start function that never
+/// returns fails construction instead of hanging it.
+pub(crate) fn verify(
+    pre: &InstancePre<Invocation>,
+    setup_timeout: Option<Duration>,
+) -> Result<(), SetupError> {
+    let wasi = Wasi::for_probe().map_err(|t| SetupError::Dead(t.to_string()))?;
+    // The memory cap stays off: it arms per invocation, and the probe is
+    // none.
+    let mut store = WtStore::new(shared_engine()?, Invocation::new(None, wasi));
+    trap::arm_deadline(&mut store, setup_timeout);
+    let past_deadline = |err: &wasmtime::Error| {
+        matches!(trap::cap_trap(err), Some(Trap::Timeout(_))).then(|| {
+            SetupError::Dead(format!(
+                "the Guest Binary did not finish being set up within {:?}",
+                setup_timeout.unwrap_or_default()
+            ))
+        })
+    };
     let instance = pre
         .instantiate(store.as_context_mut())
-        .map_err(trap::instantiate_err)?;
+        .map_err(|e| past_deadline(&e).unwrap_or_else(|| trap::instantiate_err(e)))?;
     let probe = instance
         .get_typed_func::<(), u32>(store.as_context_mut(), "__kobako_abi_version")
         .map_err(|_| {
@@ -52,9 +49,11 @@ pub(crate) fn verify(pre: &InstancePre<Invocation>) -> Result<(), SetupError> {
             ))
         })?;
     let reported = probe.call(store.as_context_mut(), ()).map_err(|e| {
-        SetupError::Dead(format!(
-            "failed to read the Guest Binary's ABI version: {e}"
-        ))
+        past_deadline(&e).unwrap_or_else(|| {
+            SetupError::Dead(format!(
+                "failed to read the Guest Binary's ABI version: {e}"
+            ))
+        })
     })?;
     if reported != ABI_VERSION {
         return Err(SetupError::Dead(format!(
@@ -65,3 +64,38 @@ pub(crate) fn verify(pre: &InstancePre<Invocation>) -> Result<(), SetupError> {
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use std::path::Path;
+    use std::time::Duration;
+
+    use kobako_runtime::error::SetupError;
+    use kobako_runtime::profile::Profile;
+
+    use crate::{Config, Driver};
+
+    // @behavior RT-112
+    #[test]
+    fn a_guest_binary_that_never_finishes_instantiating_fails_construction() {
+        const FIXTURE: &str = concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/../../test/fixtures/minimal_spinning_start.wat"
+        );
+        let config = Config {
+            timeout: None,
+            setup_timeout: Some(Duration::from_millis(300)),
+            memory_limit: None,
+            stdout_limit: None,
+            stderr_limit: None,
+            open_file_limit: None,
+            profile: Profile::Hermetic,
+        };
+        let built = Driver::new(Path::new(FIXTURE), config);
+        assert!(
+            matches!(&built, Err(SetupError::Dead(message)) if message.contains("within 300ms")),
+            "a Guest Binary whose start never returns through Driver::new must fail construction \
+             once the setup deadline passes, saying so"
+        );
+    }
+}

data/crates/kobako-wasmtime/src/ambient.rs

@@ -1,6 +1,7 @@
-//! Denial of guest ambient authority at the WASI layer — the one grant
-//! that separates the hermetic rung from permissive;
-//! `io::install_wasi` wires these sources on `Hermetic` only.
+//! The guest's time and entropy at the WASI layer — the one ambient
+//! authority that separates the hermetic rung from permissive. `Wasi::new`
+//! wires the frozen sources on `Hermetic` and the live clock on
+//! `Permissive`; `Clocks` is what the guest's waits pass on under either.
 //!
 //! `wasmtime-wasi`'s `WasiCtxBuilder` defaults the guest's `wasi:clocks` to
 //! the host wall / monotonic clock and `wasi:random` to a fresh per-context
@@ -16,7 +17,7 @@
 //! wasmtime epoch interruption against a host `Instant`, never the guest's
 //! frozen `wasi:clocks/monotonic-clock`.
 
-use std::time::Duration;
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use wasmtime_wasi::random::Deterministic;
 use wasmtime_wasi::{HostMonotonicClock, HostWallClock};
@@ -53,6 +54,64 @@ pub(crate) fn deterministic_rng() -> Deterministic {
     Deterministic::new(vec![0])
 }
 
+/// The host's monotonic clock read from a fixed origin. The guest's
+/// `clock_time_get` and a wait it subscribes to share it, so both agree on
+/// what an instant means.
+#[derive(Clone, Copy)]
+pub(crate) struct LiveMonotonicClock {
+    origin: Instant,
+}
+
+impl LiveMonotonicClock {
+    pub(crate) fn new() -> Self {
+        Self {
+            origin: Instant::now(),
+        }
+    }
+}
+
+impl HostMonotonicClock for LiveMonotonicClock {
+    fn resolution(&self) -> u64 {
+        1
+    }
+
+    fn now(&self) -> u64 {
+        u64::try_from(self.origin.elapsed().as_nanos()).unwrap_or(u64::MAX)
+    }
+}
+
+/// The clocks the guest observes. A wait it subscribes to passes on the
+/// same clocks: frozen ones never advance, so the wait ends at once.
+#[derive(Clone, Copy)]
+pub(crate) enum Clocks {
+    Frozen,
+    Live(LiveMonotonicClock),
+}
+
+impl Clocks {
+    pub(crate) fn monotonic_now(&self) -> u64 {
+        match self {
+            Self::Frozen => FrozenMonotonicClock.now(),
+            Self::Live(clock) => clock.now(),
+        }
+    }
+
+    pub(crate) fn wall_now(&self) -> u64 {
+        let since_epoch = match self {
+            Self::Frozen => FrozenWallClock.now(),
+            Self::Live(_) => SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap_or(Duration::ZERO),
+        };
+        u64::try_from(since_epoch.as_nanos()).unwrap_or(u64::MAX)
+    }
+
+    /// Whether a wait on these clocks takes host time.
+    pub(crate) fn advances(&self) -> bool {
+        matches!(self, Self::Live(_))
+    }
+}
+
 #[cfg(test)]
 mod tests {
     //! Pin the frozen-clock contract: the guest must observe no real wall