kobako 0.28.0 → 0.30.0

data/lib/kobako/payload/arguments.rb

@@ -8,7 +8,7 @@ module Kobako
       def initialize(args: [], kwargs: {})
         raise ArgumentError, "payload args must be Array" unless args.is_a?(Array)
 
-        validate_kwargs!(kwargs)
+        validate_kwargs(kwargs)
         super
       end
 
@@ -32,7 +32,7 @@ module Kobako
 
       private
 
-      def validate_kwargs!(kwargs)
+      def validate_kwargs(kwargs)
         raise ArgumentError, "payload kwargs must be Hash" unless kwargs.is_a?(Hash)
 
         kwargs.each_key do |key|

data/lib/kobako/pool.rb

@@ -20,7 +20,7 @@ module Kobako
     # Raises ArgumentError when +slots+ is not a positive Integer or
     # +checkout_timeout+ is not a positive finite number.
     def initialize(slots:, checkout_timeout: DEFAULT_CHECKOUT_TIMEOUT_SECONDS, **sandbox_options, &setup)
-      validate_slots!(slots)
+      validate_slots(slots)
       @slots = slots
       @checkout_timeout = normalize_checkout_timeout(checkout_timeout)
       @sandbox_options = sandbox_options
@@ -69,13 +69,13 @@ module Kobako
           return [:build, nil]
         end
 
-        await_slot!(deadline)
+        await_slot(deadline)
         [:retry, nil]
       end
     end
 
     # Must run while holding +@mutex+.
-    def await_slot!(deadline)
+    def await_slot(deadline)
       remaining = deadline && (deadline - monotonic_now)
       if remaining && remaining <= 0
         raise PoolTimeoutError,
@@ -94,7 +94,7 @@ module Kobako
       done = true
       sandbox
     ensure
-      release_capacity! unless done
+      release_capacity unless done
     end
 
     def checkin(sandbox)
@@ -104,7 +104,7 @@ module Kobako
       end
     end
 
-    def release_capacity!
+    def release_capacity
       @mutex.synchronize do
         @constructed -= 1
         @slot_freed.signal
@@ -117,7 +117,7 @@ module Kobako
       Process.clock_gettime(Process::CLOCK_MONOTONIC)
     end
 
-    def validate_slots!(slots)
+    def validate_slots(slots)
       return if slots.is_a?(Integer) && slots.positive?
 
       raise ArgumentError, "slots must be a positive Integer, got #{slots.inspect}"

data/lib/kobako/sandbox.rb

@@ -24,7 +24,8 @@ module Kobako
     # readable on the Sandbox itself, as in #timeout.
     attr_reader :options
 
-    def_delegators :@options, :timeout, :memory_limit, :stdout_limit, :stderr_limit, :profile, :gvl
+    def_delegators :@options, :timeout, :setup_timeout, :memory_limit, :stdout_limit, :stderr_limit,
+                   :open_file_limit, :profile, :gvl
 
     # Build a Sandbox on the Guest Binary at +wasm_path+, the one bundled
     # with the gem by default. The other keywords are the options
@@ -40,8 +41,9 @@ module Kobako
       @snippets = Catalog::Snippets.new
       @flags = Catalog::Flags.new
       @extensions = Catalog::Extensions.new
+      @grants = Catalog::Grants.new
       @sealed = false
-      @runtime = build_runtime!
+      @runtime = build_runtime
     end
 
     # Make +object+ reachable from the guest as the constant at +path+, a
@@ -56,10 +58,11 @@ module Kobako
     # the constant, and Context#bind supplies the object for each invocation.
     # A call to one left unfilled fails as a ServiceError.
     #
-    # Raises ArgumentError for a malformed path, a path that collides with an
-    # existing binding, or a call after the first invocation.
+    # Raises ArgumentError for a malformed path, a path under the reserved
+    # +Kobako+ namespace, a path that collides with an existing binding, or a
+    # call after the first invocation.
     def bind(path, object = Unresolved)
-      refuse_once_invoked!("bind")
+      refuse_once_invoked("bind")
       @services.bind(path, object)
       self
     end
@@ -71,12 +74,37 @@ module Kobako
     # Raises ArgumentError for a malformed Extension, a call after the first
     # invocation, or, at the first invocation, a missing dependency.
     def install(*extensions)
-      refuse_once_invoked!("install")
+      refuse_once_invoked("install")
 
       extensions.each { |extension| @extensions.install(extension, snippets: @snippets, services: @services) }
       self
     end
 
+    # Mount +filesystem+, a Kobako::Filesystem, at the absolute guest path
+    # +at+, where the guest's +File+ reaches it. +access+ is +:read+ or
+    # +:read_write+; a write beneath a read-only mount fails as
+    # <tt>Errno::EROFS</tt> in the guest. Returns +self+.
+    #
+    # A given block judges each open and each change +access+ allows, asked
+    # with the guest path and +:read+ or +:read_write+, and can only refuse
+    # more; an open that may create asks +:read_write+ first, then what it
+    # opens for. A falsy answer,
+    # or a StandardError, fails that call as <tt>Errno::EACCES</tt> in the
+    # guest and leaves the script running.
+    #
+    # A path may sit beneath another mount, and the guest reaches the
+    # innermost one.
+    #
+    # Raises TypeError for a path that is no String or something other than
+    # a Filesystem, and ArgumentError for a malformed or duplicate path, an
+    # unknown access, or a call after the first invocation.
+    def mount(at, filesystem, access: :read, &policy)
+      refuse_once_invoked("mount")
+      Runtime.validate_mount(at, access, filesystem)
+      @grants.register(Catalog::Mount.new(at: at, access: access, filesystem: filesystem, policy: policy))
+      self
+    end
+
     # Register a snippet that every invocation runs, in the order registered,
     # before its own code. Returns +self+.
     #
@@ -90,7 +118,7 @@ module Kobako
     # after the first invocation. A snippet that fails to load fails every
     # invocation with SandboxError, or BytecodeError for bytecode.
     def preload(code: nil, name: nil, binary: nil)
-      refuse_once_invoked!("preload")
+      refuse_once_invoked("preload")
 
       @snippets.register(code: code, name: name, binary: binary)
       self
@@ -106,7 +134,7 @@ module Kobako
     # Raises ArgumentError for a malformed or duplicate flag, or a call after
     # the first invocation.
     def flag(name, value = "", advisory: false)
-      refuse_once_invoked!("flag")
+      refuse_once_invoked("flag")
 
       @flags.register(name, value, advisory: advisory)
       self
@@ -121,7 +149,7 @@ module Kobako
     # Handle or a non-Symbol keyword. A failed run raises as #eval does.
     def run(target, *args, **kwargs, &block)
       request = Transport::Run.new(entrypoint: target, args: args, kwargs: kwargs)
-      new_invocation.run(request, &block)
+      Codec.within_value_budget(@options.value_budget) { begin_invocation.run(request, &block) }
     end
 
     # Evaluate +code+, mruby source as a String, and return the Execution,
@@ -136,42 +164,42 @@ module Kobako
     def eval(code, &block)
       raise SandboxError, "code must be a String, got #{code.class}" unless code.is_a?(String)
 
-      new_invocation.eval(code, &block)
+      Codec.within_value_budget(@options.value_budget) { begin_invocation.eval(code, &block) }
     end
 
     private
 
     # A runtime whose declared posture falls below the request never runs
     # guest code.
-    def build_runtime!
-      runtime = Kobako::Runtime.from_path(@wasm_path, @options.timeout, @options.memory_limit,
-                                          @options.stdout_limit, @options.stderr_limit, @options.profile,
-                                          @options.gvl)
-      @options.enforce_floor!(runtime.profile)
+    def build_runtime
+      runtime = Kobako::Runtime.from_path(@wasm_path, **@options.to_h)
+      @options.enforce_floor(runtime.profile)
       runtime
     end
 
-    # Per-invocation state lives on the Context, so nothing an invocation
-    # does is written back onto the shared config.
-    def new_invocation
-      begin_invocation!
-      Context.new(runtime: @runtime, services: @services, snippets: @snippets, flags: @flags,
-                  extensions: @extensions)
+    # The one place the Preamble's parts are put together, for a compile
+    # and for every invocation alike.
+    def preamble(snippets)
+      [@services.paths, snippets, @flags.entries]
     end
 
     # Registration closes at the first invocation, so every invocation ships
-    # the same Services, snippets, flags and Extensions.
-    def refuse_once_invoked!(verb)
+    # the same Services, snippets, flags, Extensions and mounts.
+    def refuse_once_invoked(verb)
       raise ArgumentError, "cannot #{verb} after first Sandbox invocation" if @sealed
     end
 
     # Sealing before the dependency check keeps a Sandbox whose check failed
     # closed to further registration. The sealed snippets are compiled once,
-    # before the first invocation replays them.
-    def begin_invocation!
+    # before the first invocation replays them. Per-invocation state lives on
+    # the Context it answers, so nothing an invocation does is written back
+    # onto the shared config.
+    def begin_invocation
       @sealed = true
-      @extensions.assert_dependencies!
-      @snippets.compile { |entries| @runtime.compile(@services.paths, entries, @flags.entries) }
+      @extensions.assert_dependencies
+      @snippets.compile { |entries| @runtime.compile(preamble(entries)) }
+      Context.new(runtime: @runtime, services: @services, extensions: @extensions, grants: @grants,
+                  preamble: preamble(@snippets.entries))
     end
   end
 end

data/lib/kobako/sandbox_options.rb

@@ -8,25 +8,38 @@ module Kobako
   # default, and +nil+ switches it off.
   #
   # [+timeout+]       Float seconds one invocation may run.
+  # [+setup_timeout+] Float seconds the Guest Binary may take to be set up
+  #                   the first time its path is loaded.
   # [+memory_limit+]  Integer bytes one invocation may grow guest memory by.
   # [+stdout_limit+, +stderr_limit+]
   #                   Integer bytes kept from each output channel.
+  # [+open_file_limit+]
+  #                   Integer descriptors one invocation may hold open, the
+  #                   standard ones and each Mount's included.
   # [+profile+]       The isolation the runtime must provide, one of PROFILES.
   # [+gvl+]           How an invocation holds Ruby's GVL, one of GVL_MODES.
   #
   # Raises ArgumentError for a value outside these shapes, and SetupError
   # when the runtime provides less isolation than +profile+ asks for.
-  class SandboxOptions < Data.define(:timeout, :memory_limit, :stdout_limit, :stderr_limit, :profile, :gvl)
+  class SandboxOptions < Data.define(:timeout, :setup_timeout, :memory_limit, :stdout_limit, :stderr_limit,
+                                     :open_file_limit, :profile, :gvl)
     # The default +timeout+: 60 seconds.
     DEFAULT_TIMEOUT_SECONDS = 60.0
 
-    # The default +memory_limit+: 1 MiB of growth past the guest's starting
-    # memory.
-    DEFAULT_MEMORY_LIMIT = 1 << 20
+    # The default +setup_timeout+: 10 seconds.
+    DEFAULT_SETUP_TIMEOUT_SECONDS = 10.0
+
+    # The default +memory_limit+: 4 MiB of growth past the guest's starting
+    # memory, sized for a guest whose every value takes 16 bytes.
+    DEFAULT_MEMORY_LIMIT = 4 << 20
 
     # The default +stdout_limit+ and +stderr_limit+: 1 MiB each.
     DEFAULT_OUTPUT_LIMIT = 1 << 20
 
+    # The default +open_file_limit+: 1024, the soft limit Linux gives a
+    # process.
+    DEFAULT_OPEN_FILE_LIMIT = 1024
+
     # The isolation profiles, weakest first. +:hermetic+ denies the guest the
     # clock and entropy; +:permissive+ leaves them live.
     PROFILES = %i[permissive hermetic].freeze
@@ -42,23 +55,36 @@ module Kobako
     DEFAULT_GVL = :hold
 
     def initialize(timeout: DEFAULT_TIMEOUT_SECONDS,
+                   setup_timeout: DEFAULT_SETUP_TIMEOUT_SECONDS,
                    memory_limit: DEFAULT_MEMORY_LIMIT,
                    stdout_limit: DEFAULT_OUTPUT_LIMIT,
                    stderr_limit: DEFAULT_OUTPUT_LIMIT,
+                   open_file_limit: DEFAULT_OPEN_FILE_LIMIT,
                    profile: DEFAULT_PROFILE,
                    gvl: DEFAULT_GVL)
-      timeout = normalize_timeout(timeout)
-      memory_limit = normalize_byte_limit(memory_limit, "memory_limit")
-      stdout_limit = normalize_byte_limit(stdout_limit, "stdout_limit")
-      stderr_limit = normalize_byte_limit(stderr_limit, "stderr_limit")
+      timeout = normalize_timeout(timeout, "timeout")
+      setup_timeout = normalize_timeout(setup_timeout, "setup_timeout")
+      memory_limit = normalize_limit(memory_limit, "memory_limit")
+      stdout_limit = normalize_limit(stdout_limit, "stdout_limit")
+      stderr_limit = normalize_limit(stderr_limit, "stderr_limit")
+      open_file_limit = normalize_limit(open_file_limit, "open_file_limit")
       profile = normalize_choice(profile, PROFILES, "profile")
       gvl = normalize_choice(gvl, GVL_MODES, "gvl")
       super
     end
 
+    # The least guest memory one value occupies, so a guest payload may hold
+    # one value for each of these bytes of +memory_limit+.
+    VALUE_BYTES = 16
+    private_constant :VALUE_BYTES
+
+    def value_budget # :nodoc:
+      memory_limit&./(VALUE_BYTES)
+    end
+
     # Both fallbacks fail closed: an unknown declaration ranks below every
     # request, and an unknown request refuses every declaration.
-    def enforce_floor!(declared) # :nodoc:
+    def enforce_floor(declared) # :nodoc:
       return if (PROFILES.index(declared) || -1) >= (PROFILES.index(profile) || PROFILES.size)
 
       raise Kobako::SetupError, "runtime declares isolation profile #{declared.inspect}, " \
@@ -69,17 +95,17 @@ module Kobako
 
     # A zero or negative timeout would either fire instantly or never, both
     # more surprising than an early ArgumentError.
-    def normalize_timeout(timeout)
+    def normalize_timeout(timeout, name)
       return nil if timeout.nil?
-      raise ArgumentError, "timeout must be Numeric or nil, got #{timeout.class}" unless timeout.is_a?(Numeric)
+      raise ArgumentError, "#{name} must be Numeric or nil, got #{timeout.class}" unless timeout.is_a?(Numeric)
 
       seconds = timeout.to_f
-      raise ArgumentError, "timeout must be > 0 (got #{timeout})" unless seconds.positive? && seconds.finite?
+      raise ArgumentError, "#{name} must be > 0 (got #{timeout})" unless seconds.positive? && seconds.finite?
 
       seconds
     end
 
-    def normalize_byte_limit(limit, name)
+    def normalize_limit(limit, name)
       return nil if limit.nil?
       unless limit.is_a?(Integer) && limit.positive?
         raise ArgumentError, "#{name} must be a positive Integer or nil, got #{limit.inspect}"

data/lib/kobako/snippet/{binary.rb → bytecode.rb}

@@ -2,9 +2,9 @@
 
 module Kobako
   module Snippet
-    class Binary < Data.define(:body) # :nodoc:
+    class Bytecode < Data.define(:body) # :nodoc:
       # Names the snippet form the guest replays this entry as. The wire's
-      # discriminant byte is assigned by the core envelope, not here.
+      # discriminant byte is assigned by the Envelope, not here.
       KIND = :bytecode
     end
   end

data/lib/kobako/snippet/source.rb

@@ -4,7 +4,7 @@ module Kobako
   module Snippet
     class Source < Data.define(:name, :body) # :nodoc:
       # Names the snippet form the guest replays this entry as. The wire's
-      # discriminant byte is assigned by the core envelope, not here.
+      # discriminant byte is assigned by the Envelope, not here.
       KIND = :source
     end
   end

data/lib/kobako/snippet.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "snippet/binary"
+require_relative "snippet/bytecode"
 require_relative "snippet/source"
 
 module Kobako

data/lib/kobako/transport/block_failure.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Kobako
+  module Transport
+    # The newest failure a guest block raised to a Service during one
+    # invocation, whichever open Call carried that block: a Service may run
+    # a block stored from an earlier Call, and its failure is still the
+    # guest's own.
+    class BlockFailure # :nodoc:
+      def initialize
+        @raised = nil
+      end
+
+      # Only the newest is kept: a Service that rescued an earlier one and
+      # yielded again has already handled it.
+      def remember(error)
+        @raised = error
+      end
+
+      # Identity rather than class: a Service that rescued the block's
+      # failure and raised its own has reported something else, and the
+      # guest must hear about that instead.
+      #
+      # The class travels with the message because not every block failure
+      # is an exception the guest holds — a block value the guest refused
+      # has a class to raise under and no object to continue.
+      def fault_text(error)
+        raised = @raised
+        return if raised.nil? || !error.equal?(raised)
+
+        "#{raised.klass}: #{raised.message}"
+      end
+    end
+  end
+end

data/lib/kobako/transport/dispatcher.rb

@@ -3,18 +3,20 @@
 require_relative "../codec"
 require_relative "../errors"
 require_relative "../payload"
+require_relative "block_failure"
 require_relative "call"
 require_relative "reflection"
 require_relative "yielder"
 
 module Kobako
   module Transport
-    # Answers a routed Call with +[true, body, nil]+ or
-    # +[false, message, fault_type]+ and never raises, so every failure
-    # reaches the guest as a fault.
+    # Answers a routed Call with one arm per Reply variant: +[:ok, body, nil]+,
+    # +[:fault, message, fault_type]+, or +[:break, "", nil]+ — a block
+    # exit the guest kept carries nothing. It never raises, so every
+    # failure reaches the guest as a fault.
     module Dispatcher # :nodoc:
-      # Throw tag for the Yielder's break unwind back to the
-      # dispatcher's +catch+ frame. +private_constant+ is a
+      # Thrown rather than raised, so a Service unwound by a block exit runs
+      # its +ensure+ and cannot +rescue+ the exit. +private_constant+ is a
       # convention boundary — not a defence.
       BREAK_THROW = :__kobako_break__
       private_constant :BREAK_THROW
@@ -23,15 +25,18 @@ module Kobako
 
       class UnreadableRequestError < Kobako::Codec::Error; end # :nodoc:
 
-      # The category kobako's own refusals answer under, keyed by the class
-      # each is raised as and ordered most specific first. A class absent
-      # here is the Service's own exception, which answers under +runtime+
-      # wearing the +<class>: <message>+ shape that says so.
+      # The category each failure answering with its message alone takes,
+      # keyed by the class raised and ordered most specific first. kobako's
+      # own refusals are worded so none reads as a Service's exception, and
+      # +ArgumentError+, raised by a Service and by a call that will not
+      # bind alike, is named by +argument+ already. A class absent here is
+      # the Service's own exception, which answers under +runtime+ wearing
+      # the +<class>: <message>+ shape that names it.
       #
       # +Kobako::Codec::Error+ is the floor rather than a path of its own:
       # a codec fault reaching the boundary unnamed is the exchange failing,
       # and must not be dressed as something a Service raised.
-      OWN_FAULTS = {
+      BARE_FAULTS = {
         HandleExhaustedError => "internal",
         UndefinedTargetError => "undefined",
         ArgumentError => "argument",
@@ -40,23 +45,24 @@ module Kobako
         Kobako::Codec::Error => "internal",
         Kobako::SandboxError => "runtime"
       }.freeze
-      private_constant :OWN_FAULTS
+      private_constant :BARE_FAULTS
 
       # The per-invocation state arrives as arguments so the Dispatcher
       # stays stateless and neither the resolver nor the Context publishes
       # accessors for it.
-      def self.dispatch(call, resolver, handles, guest_yielder)
-        yielder = Yielder.new(guest_yielder, BREAK_THROW, handles) if call.block_given
-        [true, encode_ok(run(call, resolver, handles, yielder), handles), nil] # : [bool, String, String?]
+      def self.dispatch(call, resolver, handles, failure, guest_yielder)
+        yielder = Yielder.new(guest_yielder, BREAK_THROW, handles, failure) if call.block_given
+        catch(BREAK_THROW) { return [:ok, encode_ok(run(call, resolver, handles, yielder), handles), nil] }
+        [:break, "", nil] # : [Symbol, String, String?]
       # StandardError is the boundary by intent: a Service method's
       # application fault folds into a guest-rescuable fault, while a
       # host-process failure (NoMemoryError, SignalException, a bare Exception)
       # stays uncaught and traps the invocation rather than being masked as a
       # rescuable fault.
       rescue StandardError => e
-        [false, *caught_fault(e, yielder)] # : [bool, String, String?]
+        [:fault, *fault_of(e, failure)] # : [Symbol, String, String?]
       ensure
-        yielder&.invalidate!
+        yielder&.invalidate
       end
 
       class << self
@@ -66,7 +72,7 @@ module Kobako
           arguments, carried_handle = decode_arguments(call.payload)
           exposure = resolve_target(call.target, resolver, handles)
           args, kwargs = resolve_call_args(arguments, handles, carried_handle)
-          catch(BREAK_THROW) { invoke(exposure, call.method_name, args, kwargs, yielder) }
+          invoke(exposure, call.method_name, args, kwargs, yielder)
         end
 
         # A codec fault here is a request that never became a call, restated
@@ -84,21 +90,19 @@ module Kobako
            arguments.kwargs.transform_values { |v| resolve_arg(v, handles) }]
         end
 
-        # The class prefix marks a Service's own exception and nothing else:
-        # it is the +<class>: <message>+ shape a Host App is told to keep
-        # secrets out of, so wearing it says the Service raised. kobako's own
-        # refusals answer under their own wording instead of borrowing that
-        # shape.
+        # The class prefix marks a Service's own exception that its category
+        # does not name: it is the +<class>: <message>+ shape a Host App is
+        # told to keep secrets out of, so wearing it says the Service raised.
         #
         # The guest's own block failing is not the Service's to report at
         # all, so the Yielder that raised it is asked first — it recognises
         # its own by identity and words the failure the guest's way.
-        def caught_fault(error, yielder)
-          block_failure = yielder&.fault_text(error)
+        def fault_of(error, failure)
+          block_failure = failure.fault_text(error)
           return fault("block", block_failure) if block_failure
 
-          own = OWN_FAULTS.find { |klass, _| error.is_a?(klass) }
-          return fault(own.last, error.message) if own
+          bare = BARE_FAULTS.find { |klass, _| error.is_a?(klass) }
+          return fault(bare.last, error.message) if bare
 
           fault("runtime", "#{error.class}: #{error.message}")
         end
@@ -107,7 +111,7 @@ module Kobako
         # unsplatted for methods that take no keywords.
         def invoke(exposure, method, args, kwargs, yielder)
           name = method.to_sym
-          reject_unreachable!(exposure, name)
+          reject_unreachable(exposure, name)
           target = exposure.object
           block = yielder&.to_proc
           if kwargs.empty?
@@ -120,7 +124,7 @@ module Kobako
         # Both the ambient-surface floor and the reference's Exposure answer
         # through Reflection, so a rejected name discloses nothing about
         # which of the two refused.
-        def reject_unreachable!(exposure, name)
+        def reject_unreachable(exposure, name)
           reason = Reflection.refusal(exposure, name)
           raise UndefinedTargetError, reason if reason
         end
@@ -159,7 +163,7 @@ module Kobako
         # Service can change — so it is named here, where the direction is
         # known, instead of falling to the boundary's codec floor.
         def encode_ok(value, handles)
-          Kobako::Codec::Nesting.assert_within_bound!(value)
+          Kobako::Codec::Nesting.assert_within_bound(value)
           Kobako::Codec::Encoder.encode(value)
         rescue Kobako::Codec::UnsupportedTypeError
           encode_ok(handles.alloc(value), handles)

data/lib/kobako/transport/exposure.rb

@@ -32,7 +32,7 @@ module Kobako
       # once (a Handle table), so two objects of one class enumerate it once.
       def self.of(object, surfaces = {})
         klass = CLASS_OF.bind_call(object)
-        names = narrows_itself?(object, klass) ? nil : default_names(object, klass, surfaces)
+        names = narrows_itself?(object, klass) ? nil : resolve_default_names(object, klass, surfaces)
         new(object: object, names: names)
       end
 
@@ -59,7 +59,7 @@ module Kobako
 
         # A callable keeps its callable names; a class-level surface or a
         # forwarder has no surface of its own to expose.
-        def default_names(object, klass, surfaces)
+        def resolve_default_names(object, klass, surfaces)
           case object
           when Proc, Method then CALLABLE
           when Module, Delegator then NOTHING
@@ -68,7 +68,7 @@ module Kobako
         end
 
         def class_names(object, klass)
-          names = authored(klass)
+          names = authored_names(klass)
           case object
           when Struct, Data then names.concat(object.members)
           end
@@ -78,15 +78,13 @@ module Kobako
         def with_singleton(object, names)
           return names if SINGLETON_METHODS.bind_call(object, false).empty?
 
-          names.union(authored(SINGLETON_CLASS_OF.bind_call(object))).freeze
+          names.union(authored_names(SINGLETON_CLASS_OF.bind_call(object))).freeze
         end
 
-        # The public methods +owner+ itself defines in source. A method with
-        # no source, or whose source is the platform's own, is built in.
-        def authored(owner)
+        # The public methods +owner+ itself defines in Ruby source.
+        def authored_names(owner)
           owner.public_instance_methods(false).select do |name|
-            file, = owner.instance_method(name).source_location
-            file && !file.start_with?("<internal:")
+            Reflection.authored?(owner.instance_method(name))
           end
         end
       end