microsandbox-rb 0.17.0 → 0.17.2

data/ext/microsandbox/src/snapshot.rs

@@ -110,7 +110,7 @@ fn create(name: String, opts: RHash) -> Result<RHash, Error> {
         b = b.resumable();
     }
 
-    let snap = block_on(b.create()).map_err(error::to_ruby)?;
+    let snap = block_on(b.create())?.map_err(error::to_ruby)?;
     Ok(snapshot_to_hash(&snap))
 }
 
@@ -119,14 +119,14 @@ fn create(name: String, opts: RHash) -> Result<RHash, Error> {
 /// Hash — the only way to inspect an artifact addressed by path (`get`/`list`
 /// read the local index, which path-addressed artifacts are absent from).
 fn open(path_or_name: String) -> Result<RHash, Error> {
-    let snap = block_on(Snapshot::open(&path_or_name)).map_err(error::to_ruby)?;
+    let snap = block_on(Snapshot::open(&path_or_name))?.map_err(error::to_ruby)?;
     Ok(snapshot_to_hash(&snap))
 }
 
 /// Walk `dir` and parse each subdirectory's `snapshot.json` without touching
 /// the local index — for enumerating external/un-imported snapshot collections.
 fn list_dir(dir: String) -> Result<RArray, Error> {
-    let snaps = block_on(Snapshot::list_dir(Path::new(&dir))).map_err(error::to_ruby)?;
+    let snaps = block_on(Snapshot::list_dir(Path::new(&dir)))?.map_err(error::to_ruby)?;
     let arr = ruby().ary_new();
     for snap in &snaps {
         arr.push(snapshot_to_hash(snap))?;
@@ -145,19 +145,19 @@ fn reindex(dir: Option<String>) -> Result<u64, Error> {
             .map(|l| l.snapshots_dir())
             .unwrap_or_else(|| PathBuf::from(".")),
     };
-    let n = block_on(Snapshot::reindex(&dir)).map_err(error::to_ruby)?;
+    let n = block_on(Snapshot::reindex(&dir))?.map_err(error::to_ruby)?;
     Ok(n as u64)
 }
 
 /// Metadata for one snapshot by name or digest.
 fn get(name_or_digest: String) -> Result<RHash, Error> {
-    let handle = block_on(Snapshot::get(&name_or_digest)).map_err(error::to_ruby)?;
+    let handle = block_on(Snapshot::get(&name_or_digest))?.map_err(error::to_ruby)?;
     Ok(handle_to_hash(&handle))
 }
 
 /// All snapshots as metadata hashes.
 fn list() -> Result<RArray, Error> {
-    let handles = block_on(Snapshot::list()).map_err(error::to_ruby)?;
+    let handles = block_on(Snapshot::list())?.map_err(error::to_ruby)?;
     let arr = ruby().ary_new();
     for h in &handles {
         arr.push(handle_to_hash(h))?;
@@ -167,7 +167,7 @@ fn list() -> Result<RArray, Error> {
 
 /// Remove a snapshot artifact by name or path.
 fn remove(name_or_path: String, force: bool) -> Result<(), Error> {
-    block_on(Snapshot::remove(&name_or_path, force)).map_err(error::to_ruby)
+    block_on(Snapshot::remove(&name_or_path, force))?.map_err(error::to_ruby)
 }
 
 /// Verify a snapshot's recorded upper-layer integrity. Returns
@@ -176,8 +176,14 @@ fn remove(name_or_path: String, force: bool) -> Result<(), Error> {
 /// "verified" (mismatches raise SnapshotIntegrityError), snapshots without
 /// recorded integrity report "not_recorded" with no algorithm/digest keys.
 fn verify(name_or_path: String) -> Result<RHash, Error> {
-    let snap = block_on(Snapshot::open(&name_or_path)).map_err(error::to_ruby)?;
-    let report = block_on(snap.verify()).map_err(error::to_ruby)?;
+    // Open AND verify in ONE `block_on`, so the opened snapshot never sits in
+    // this frame between two calls (`block_on` returns `Err` when an interrupt
+    // is delivered before it starts; one call leaves no such in-between state).
+    let report = block_on(async move {
+        let snap = Snapshot::open(&name_or_path).await?;
+        snap.verify().await
+    })?
+    .map_err(error::to_ruby)?;
     Ok(verify_report_to_hash(&report))
 }
 
@@ -193,7 +199,7 @@ fn save(name_or_path: String, out_path: String, opts: RHash) -> Result<(), Error
         &name_or_path,
         std::path::Path::new(&out_path),
         save_opts,
-    ))
+    ))?
     .map_err(error::to_ruby)
 }
 
@@ -204,7 +210,7 @@ fn load(archive_path: String, dest: Option<String>) -> Result<RHash, Error> {
     let handle = block_on(Snapshot::load(
         std::path::Path::new(&archive_path),
         dest_path.as_deref(),
-    ))
+    ))?
     .map_err(error::to_ruby)?;
     Ok(handle_to_hash(&handle))
 }

data/ext/microsandbox/src/ssh.rs

@@ -52,7 +52,7 @@ impl SshClient {
             let guard = inner.lock().await;
             let client = guard.as_ref().ok_or_else(consumed)?;
             client.exec_with(command, |b| b.tty(tty)).await
-        });
+        })?;
         Ok(ssh_output_to_hash(result.map_err(error::to_ruby)?))
     }
 
@@ -74,7 +74,7 @@ impl SshClient {
                     b
                 })
                 .await
-        });
+        })?;
         result.map_err(error::to_ruby)
     }
 
@@ -85,7 +85,7 @@ impl SshClient {
             let guard = inner.lock().await;
             let client = guard.as_ref().ok_or_else(consumed)?;
             client.sftp().await
-        });
+        })?;
         Ok(SftpClient::from_core(result.map_err(error::to_ruby)?))
     }
 
@@ -101,7 +101,7 @@ impl SshClient {
                 Some(c) => c.close().await,
                 None => Ok(()),
             }
-        });
+        })?;
         result.map_err(error::to_ruby)
     }
 }
@@ -144,7 +144,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.read(path).await.map_err(sftp_str)
-        });
+        })?;
         Ok(ruby().str_from_slice(&result.map_err(error::base_error)?))
     }
 
@@ -158,7 +158,7 @@ impl SftpClient {
             file.write_all(&bytes).await.map_err(sftp_str)?;
             file.shutdown().await.map_err(sftp_str)?;
             Ok(())
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -168,7 +168,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.create_dir(path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -178,7 +178,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.remove_file(path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -188,7 +188,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.remove_dir(path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -198,7 +198,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.rename(old_path, new_path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -208,7 +208,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.symlink(target, link_path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -218,7 +218,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.canonicalize(path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -228,7 +228,7 @@ impl SftpClient {
             let guard = inner.lock().await;
             let sftp = guard.as_ref().ok_or_else(|| sftp_str("session closed"))?;
             sftp.read_link(path).await.map_err(sftp_str)
-        });
+        })?;
         result.map_err(error::base_error)
     }
 
@@ -243,7 +243,7 @@ impl SftpClient {
                 Some(s) => s.close().await.map_err(sftp_str),
                 None => Ok(()),
             }
-        });
+        })?;
         result.map_err(error::base_error)
     }
 }
@@ -276,7 +276,7 @@ impl SshServer {
                 Some(s) => s.serve_connection(SshStdioStream::new()).await,
                 None => Err(consumed()),
             }
-        });
+        })?;
         result.map_err(error::to_ruby)
     }
 
@@ -285,19 +285,23 @@ impl SshServer {
         let inner = Arc::clone(&self.inner);
         block_on(async move {
             inner.lock().await.take();
-        });
+        })?;
         Ok(())
     }
 }
 
 pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     let client = native.define_class("SshClient", ruby.class_object())?;
+    // Resolve the wrapper class now, not on first use (see `preload_class`).
+    crate::runtime::preload_class::<SshClient>(ruby);
     client.define_method("exec", method!(SshClient::exec, 2))?;
     client.define_method("attach", method!(SshClient::attach, 2))?;
     client.define_method("sftp", method!(SshClient::sftp, 0))?;
     client.define_method("close", method!(SshClient::close, 0))?;
 
     let sftp = native.define_class("SftpClient", ruby.class_object())?;
+    // Resolve the wrapper class now, not on first use (see `preload_class`).
+    crate::runtime::preload_class::<SftpClient>(ruby);
     sftp.define_method("read", method!(SftpClient::read, 1))?;
     sftp.define_method("write", method!(SftpClient::write, 2))?;
     sftp.define_method("mkdir", method!(SftpClient::mkdir, 1))?;
@@ -310,6 +314,8 @@ pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     sftp.define_method("close", method!(SftpClient::close, 0))?;
 
     let server = native.define_class("SshServer", ruby.class_object())?;
+    // Resolve the wrapper class now, not on first use (see `preload_class`).
+    crate::runtime::preload_class::<SshServer>(ruby);
     server.define_method("serve_connection", method!(SshServer::serve_connection, 0))?;
     server.define_method("close", method!(SshServer::close, 0))?;
 

data/ext/microsandbox/src/stream.rs

@@ -41,7 +41,7 @@ impl LogStream {
     fn recv(&self) -> Result<Option<RHash>, Error> {
         use futures::StreamExt;
         let inner = Arc::clone(&self.inner);
-        match block_on(async move { inner.lock().await.next().await }) {
+        match block_on(async move { inner.lock().await.next().await })? {
             Some(Ok(entry)) => Ok(Some(log_entry_to_hash(&entry))),
             Some(Err(e)) => Err(error::to_ruby(e)),
             None => Ok(None),
@@ -67,7 +67,7 @@ impl MetricsStream {
     fn recv(&self) -> Result<Option<RHash>, Error> {
         use futures::StreamExt;
         let inner = Arc::clone(&self.inner);
-        match block_on(async move { inner.lock().await.next().await }) {
+        match block_on(async move { inner.lock().await.next().await })? {
             Some(Ok(metrics)) => Ok(Some(metrics_to_hash(&metrics))),
             Some(Err(e)) => Err(error::to_ruby(e)),
             None => Ok(None),
@@ -77,9 +77,13 @@ impl MetricsStream {
 
 pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     let logs = native.define_class("LogStream", ruby.class_object())?;
+    // Resolve the wrapper class now, not on first use (see `preload_class`).
+    crate::runtime::preload_class::<LogStream>(ruby);
     logs.define_method("recv", method!(LogStream::recv, 0))?;
 
     let metrics = native.define_class("MetricsStream", ruby.class_object())?;
+    // Resolve the wrapper class now, not on first use (see `preload_class`).
+    crate::runtime::preload_class::<MetricsStream>(ruby);
     metrics.define_method("recv", method!(MetricsStream::recv, 0))?;
 
     Ok(())

data/ext/microsandbox/src/volume.rs

@@ -3,11 +3,12 @@
 //! Mirrors `sdk/python/src/volume.rs`. Static async CRUD over the volume store;
 //! results are returned as plain Ruby Hashes/Arrays.
 
+use std::path::{Component, Path};
 use std::sync::Arc;
 
 use magnus::{function, method, prelude::*, Error, RArray, RHash, RModule, RString, Ruby};
 use microsandbox::volume::VolumeHandle;
-use microsandbox::Backend;
+use microsandbox::{Backend, MicrosandboxError};
 
 use crate::conv;
 use crate::error;
@@ -67,7 +68,7 @@ fn create(name: String, opts: RHash) -> Result<RHash, Error> {
         builder = builder.label(k, v);
     }
 
-    let vol = block_on(builder.create()).map_err(error::to_ruby)?;
+    let vol = block_on(builder.create())?.map_err(error::to_ruby)?;
     let hash = ruby().hash_new();
     hash.aset("name", vol.name().to_string())?;
     // `path()` is fallible as of v0.5.8 (returns `Unsupported` for cloud
@@ -80,19 +81,19 @@ fn create(name: String, opts: RHash) -> Result<RHash, Error> {
 }
 
 fn get(name: String) -> Result<RHash, Error> {
-    let handle = block_on(microsandbox::Volume::get(&name)).map_err(error::to_ruby)?;
+    let handle = block_on(microsandbox::Volume::get(&name))?.map_err(error::to_ruby)?;
     Ok(handle_to_hash(&handle))
 }
 
 /// The backend's default volume (v0.6.9). Cloud-backend only — the local
 /// backend rejects it (Unsupported) to avoid accidental host access.
 fn get_default() -> Result<RHash, Error> {
-    let handle = block_on(microsandbox::Volume::get_default()).map_err(error::to_ruby)?;
+    let handle = block_on(microsandbox::Volume::get_default())?.map_err(error::to_ruby)?;
     Ok(handle_to_hash(&handle))
 }
 
 fn list() -> Result<RArray, Error> {
-    let handles = block_on(microsandbox::Volume::list()).map_err(error::to_ruby)?;
+    let handles = block_on(microsandbox::Volume::list())?.map_err(error::to_ruby)?;
     let arr = ruby().ary_new();
     for h in handles.iter() {
         arr.push(handle_to_hash(h))?;
@@ -101,7 +102,24 @@ fn list() -> Result<RArray, Error> {
 }
 
 fn remove(name: String) -> Result<(), Error> {
-    block_on(microsandbox::Volume::remove(&name)).map_err(error::to_ruby)
+    block_on(microsandbox::Volume::remove(&name))?.map_err(error::to_ruby)
+}
+
+/// Volume paths are relative to the volume root and never need a `..` segment,
+/// so one is refused before the path reaches the core's resolver (which keeps
+/// its own containment check). Enforced here rather than only in the Ruby
+/// wrapper because `Microsandbox::Native::VolumeFs` is callable directly.
+fn contained(path: &str) -> Result<&str, Error> {
+    if Path::new(path)
+        .components()
+        .any(|part| matches!(part, Component::ParentDir))
+    {
+        return Err(error::to_ruby(MicrosandboxError::SandboxFsOps(
+            "path traversal outside volume root (`..` segments are not allowed in volume paths)"
+                .into(),
+        )));
+    }
+    Ok(path)
 }
 
 /// A host-side filesystem view over a named volume — read/write its contents
@@ -131,26 +149,30 @@ impl VolumeFs {
     }
 
     fn read(&self, path: String) -> Result<RString, Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        let bytes = block_on(fs.read(&path)).map_err(error::to_ruby)?;
+        let bytes = block_on(fs.read(path))?.map_err(error::to_ruby)?;
         Ok(ruby().str_from_slice(bytes.as_ref()))
     }
 
     fn read_text(&self, path: String) -> Result<String, Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        block_on(fs.read_to_string(&path)).map_err(error::to_ruby)
+        block_on(fs.read_to_string(path))?.map_err(error::to_ruby)
     }
 
     fn write(&self, path: String, data: RString) -> Result<(), Error> {
         // Copy the bytes out while the GVL is held (GC.compact could move them).
         let bytes = unsafe { data.as_slice() }.to_vec();
+        let path = contained(&path)?;
         let fs = self.fs();
-        block_on(fs.write(&path, &bytes)).map_err(error::to_ruby)
+        block_on(fs.write(path, &bytes))?.map_err(error::to_ruby)
     }
 
     fn list(&self, path: String) -> Result<RArray, Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        let entries = block_on(fs.list(&path)).map_err(error::to_ruby)?;
+        let entries = block_on(fs.list(path))?.map_err(error::to_ruby)?;
         let arr = ruby().ary_new();
         for entry in &entries {
             arr.push(fs_entry_to_hash(entry))?;
@@ -159,38 +181,47 @@ impl VolumeFs {
     }
 
     fn mkdir(&self, path: String) -> Result<(), Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        block_on(fs.mkdir(&path)).map_err(error::to_ruby)
+        block_on(fs.mkdir(path))?.map_err(error::to_ruby)
     }
 
     fn remove_file(&self, path: String) -> Result<(), Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        block_on(fs.remove(&path)).map_err(error::to_ruby)
+        block_on(fs.remove(path))?.map_err(error::to_ruby)
     }
 
     fn remove_dir(&self, path: String) -> Result<(), Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        block_on(fs.remove_dir(&path)).map_err(error::to_ruby)
+        block_on(fs.remove_dir(path))?.map_err(error::to_ruby)
     }
 
     fn exists(&self, path: String) -> Result<bool, Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        block_on(fs.exists(&path)).map_err(error::to_ruby)
+        block_on(fs.exists(path))?.map_err(error::to_ruby)
     }
 
     fn copy(&self, from: String, to: String) -> Result<(), Error> {
+        let from = contained(&from)?;
+        let to = contained(&to)?;
         let fs = self.fs();
-        block_on(fs.copy(&from, &to)).map_err(error::to_ruby)
+        block_on(fs.copy(from, to))?.map_err(error::to_ruby)
     }
 
     fn rename(&self, from: String, to: String) -> Result<(), Error> {
+        let from = contained(&from)?;
+        let to = contained(&to)?;
         let fs = self.fs();
-        block_on(fs.rename(&from, &to)).map_err(error::to_ruby)
+        block_on(fs.rename(from, to))?.map_err(error::to_ruby)
     }
 
     fn stat(&self, path: String) -> Result<RHash, Error> {
+        let path = contained(&path)?;
         let fs = self.fs();
-        let meta = block_on(fs.stat(&path)).map_err(error::to_ruby)?;
+        let meta = block_on(fs.stat(path))?.map_err(error::to_ruby)?;
         Ok(fs_metadata_to_hash(&meta))
     }
 }
@@ -210,6 +241,8 @@ pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     class.define_singleton_method("fs", function!(fs, 1))?;
 
     let vfs = native.define_class("VolumeFs", ruby.class_object())?;
+    // Resolve the wrapper class now, not on first use (see `preload_class`).
+    crate::runtime::preload_class::<VolumeFs>(ruby);
     vfs.define_method("read", method!(VolumeFs::read, 1))?;
     vfs.define_method("read_text", method!(VolumeFs::read_text, 1))?;
     vfs.define_method("write", method!(VolumeFs::write, 2))?;

data/lib/microsandbox/fs.rb

@@ -27,7 +27,7 @@ module Microsandbox
 
     # @return [Time, nil] last-modified time, if known
     def modified
-      @modified_ms && Time.at(@modified_ms / 1000.0)
+      Microsandbox.time_from_ms(@modified_ms)
     end
 
     def file? = @type == :file
@@ -64,12 +64,12 @@ module Microsandbox
 
     # @return [Time, nil] last-modified time, if known
     def modified
-      @modified_ms && Time.at(@modified_ms / 1000.0)
+      Microsandbox.time_from_ms(@modified_ms)
     end
 
     # @return [Time, nil] creation time, if known
     def created
-      @created_ms && Time.at(@created_ms / 1000.0)
+      Microsandbox.time_from_ms(@created_ms)
     end
 
     def inspect
@@ -188,11 +188,7 @@ module Microsandbox
       sink = FsWriteSink.new(@native.fs_write_stream(path.to_s))
       return sink unless block_given?
 
-      begin
-        yield sink
-      ensure
-        sink.close
-      end
+      Microsandbox.close_after(sink) { yield sink }
     end
   end
 

data/lib/microsandbox/image.rb

@@ -18,12 +18,12 @@ module Microsandbox
 
     # @return [Time, nil]
     def created_at
-      @created_at_ms && Time.at(@created_at_ms / 1000.0)
+      Microsandbox.time_from_ms(@created_at_ms)
     end
 
     # @return [Time, nil]
     def last_used_at
-      @last_used_at_ms && Time.at(@last_used_at_ms / 1000.0)
+      Microsandbox.time_from_ms(@last_used_at_ms)
     end
 
     def inspect

data/lib/microsandbox/log_entry.rb

@@ -22,7 +22,7 @@ module Microsandbox
 
     # @return [Time] wall-clock capture time
     def timestamp
-      Time.at(@timestamp_ms / 1000.0)
+      Microsandbox.time_from_ms(@timestamp_ms)
     end
 
     # @return [String] the captured bytes decoded as UTF-8 (lossy — invalid byte

data/lib/microsandbox/metrics.rb

@@ -53,7 +53,7 @@ module Microsandbox
 
     # @return [Time] when this snapshot was captured
     def timestamp
-      Time.at(@timestamp_ms / 1000.0)
+      Microsandbox.time_from_ms(@timestamp_ms)
     end
 
     def inspect

data/lib/microsandbox/outbound_proxy.rb

@@ -246,6 +246,14 @@ module Microsandbox
       if address.empty?
         raise ArgumentError, "proxy address must be a non-empty \"IP:port\" String (got \"\")"
       end
+      # A URL-style address (`socks5://user:pass@host:1080`) is never valid, and
+      # the core would quote it back in its error. Refuse it by shape, without
+      # echoing it, so the embedded credentials stay out of logs.
+      if address.match?(%r{@|://|\s})
+        raise ArgumentError,
+          "proxy address must be \"IP:port\" with no scheme, credentials or whitespace " \
+          "(pass SOCKS5 credentials as username:/password:)"
+      end
       # Same rules as the Python SDK's OutboundProxy.__post_init__; the address
       # itself is parsed by the core (which reports e.g. "invalid SOCKS5 proxy
       # address" as an InvalidConfigError at create time).