kobako 0.7.0-x86_64-linux → 0.8.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4727a4af2ea34f43c5f85d4a6d5e1f81850a80aea7d970ae8cd96da4f9076b12
-  data.tar.gz: 4172174ad6017fcf55281235029d61c71919b9154ab597c8e8224db6eb499d93
+  metadata.gz: 1c66fd38850a7eed0502b22a5e420f994c3059fa81efcc012bb4e84c4688fea5
+  data.tar.gz: c9d934c25f4c62ee1c82badfbd7b747bd08eeabb605f1df8e0c49cad479a4873
 SHA512:
-  metadata.gz: 6366dcfbf5128e16563b0f8f04100bb6080c2d723fc9d80daa757b4f35fb2a92abe8dfcb5cebc7eb10432cd858dba18b6167989f493c2cefc7105af77499293d
-  data.tar.gz: 45e0811ae96e3b331d2a867605f5536a0def57c28fc0f377a5ba074d145ee241a4386dc32abee6bbc1c5023bc0c30726659633f33331d7cc0688a04201497291
+  metadata.gz: 884059fc573ed478418759824941303b4e6f18abf6a2c642130301ec32394f92d1c4e6a353987095743ef87de69b5986606b4ce341d725527831fe4258c6403d
+  data.tar.gz: afcc88c2261aee4e61ac22b7243671c1762e94ecfc2d6d6fe98171f7398e8e04e48d3f0eaccb50da131e709ba4565f7f4b727e3dd3649fe691adb2b05b38c807

data/.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.7.0"}
+{".":"0.8.0","wasm/kobako-core":"0.2.0"}

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/v0.7.0...v0.8.0) (2026-06-05)
+
+
+### Features
+
+* validate the Guest Binary ABI version at Sandbox construction ([63f22de](https://github.com/elct9620/kobako/commit/63f22deb88dc8acfeae56dccdbf31a7b3650da0d))
+* **wasm:** turn the Guest ABI into a trait + export_guest! macro ([3532dc2](https://github.com/elct9620/kobako/commit/3532dc20521ca8d9dd55bc39f01ff611d9df0d4b))
+
+
+### Bug Fixes
+
+* **build:** track every wasm workspace member in the rebuild check ([3f042a4](https://github.com/elct9620/kobako/commit/3f042a4fe28aa8d8b70bb313f6158e1865a2cbeb))
+
 ## [0.7.0](https://github.com/elct9620/kobako/compare/v0.6.2...v0.7.0) (2026-06-03)
 
 

data/README.md

@@ -283,6 +283,29 @@ sandbox.run(:Greeter, name: "world") # => "hello, world"
 
 Use the source form for snippets authored in your repo (compile errors fail fast at `#preload`); use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path.
 
+## Security
+
+kobako isolates the guest, but **what it may reach is whatever you `bind`** — and `bind`
+exposes *every* public method of the object. So bind a purpose-built object scoped to the
+task, not a capable one whose other methods leak more than you intend.
+
+```ruby
+class ThemeReader          # only #color is reachable; AppConfig.secret_key is not
+  def color = AppConfig.theme.color
+end
+
+sandbox = Kobako::Sandbox.new
+sandbox.define(:Cfg).bind(:Settings, ThemeReader.new)  # not: bind(:Settings, AppConfig)
+
+sandbox.eval('Cfg::Settings.color')  # => "#3366ff"  — every other method raises NoMethodError
+```
+
+Guest code can name any `<Namespace>::<Member>` path, but a forged name only resolves to
+something you bound — the real authorization gate is this host-side allowlist. Give each
+trust context its own Sandbox, and see [`docs/security.md`](docs/security.md) for the rest
+as security-design concerns: validating untrusted input, default-deny external effects,
+and controlling the return surface.
+
 ## Performance
 
 Order-of-magnitude figures on macOS arm64, Ruby 3.4.7, YJIT off. Absolute values vary by hardware but ratios are stable across machines. Full numbers, methodology, and the +10%-regression gate live in [`benchmark/README.md`](benchmark/README.md).

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 end

data/release-please-config.json

@@ -7,6 +7,17 @@
       "component": "kobako",
       "include-component-in-tag": false,
       "release-type": "ruby"
+    },
+    "wasm/kobako-core": {
+      "component": "kobako-core",
+      "release-type": "rust",
+      "extra-files": [
+        {
+          "type": "toml",
+          "path": "/wasm/Cargo.lock",
+          "jsonpath": "$.package[?(@.name=='kobako-core')].version"
+        }
+      ]
     }
   },
   "extra-files": [

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kobako
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: x86_64-linux
 authors:
 - Aotokitsuruya
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-06-03 00:00:00.000000000 Z
+date: 2026-06-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack