microsandbox-rb 0.17.2 → 0.17.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f76670a6753a6503a0764ed173db3c33a1eff9a62de7a7d9343bc76f8143c1ba
-  data.tar.gz: 80d4d4f1c2bbb3f47dd8f714602e6b01a841d62971b70b5682d3ad0c7dcff904
+  metadata.gz: 6d3b616f0ff13a9961eab2e0cdd3812f859754efd7489d5857db0e49588f2b73
+  data.tar.gz: a172d9b8b62bb19f8b4cc2accfadec90f56b83b0e99112109a42032b7ca9a6f4
 SHA512:
-  metadata.gz: 74429f29417c1b2c2e6aeee35948d3c5201d5ac9d001beba4efceca484dbea53f0041e84f0f7fa0fef5933a89f3e317737fb134d6329267eb5e239fe56d7e297
-  data.tar.gz: d4d5072d1a68079a8bfe199e8c53e0d92e7614515e1326e81333f857c1b53b681575f8df2162abb167ea6228841ffba2631f4d2b8df38552040c946966223c2c
+  metadata.gz: 9357333f88d8061e822da080bdc014438b7ca8bda1b94584a01e89fa1278c9d661b5a5eb2a7e5e36e5879076c2e9f6e82cb067dd6a4aa86023f16360953369ed
+  data.tar.gz: e7b24e0067df67c76a57f5b204f743d9420c4cd9d43f717bd3576e0324023493b68821d65e1c910168ad87a3e76261dcbb825b1476184b6c9318891cb4a99c1a

data/CHANGELOG.md

@@ -8,6 +8,49 @@ wraps, and the README's Versioning section keeps the full gem→runtime map.
 
 ## [Unreleased]
 
+## [0.17.3] - 2026-10-13
+
+Gem-only fix release; the embedded runtime stays at **`v0.6.18`**. A process
+forked after the SDK was used — a Puma, Resque or Solid Queue worker — used to
+hang for 30 s on Linux, or die with `SIGTRAP` on macOS, on its first SDK call.
+The child's first SDK call now builds a fresh backend, and a handle created
+before the fork raises the new `ForkedHandleError` there instead of being used.
+
+### Fixed
+
+- **Forking a process that has used the SDK no longer hangs or kills the
+  child.** A forked child inherited the parent's default backend, whose SQLite
+  worker threads (local) or pooled connections (cloud) do not exist in it: the
+  child's first catalog call waited out a 30 s pool timeout on Linux and then
+  raised a plain `Microsandbox::Error`, and on macOS the child died with
+  `SIGTRAP` — as it did when it merely selected a backend, because destroying
+  the inherited one traps too. The first SDK call in a child now builds a
+  fresh backend the same way the parent's was chosen (`set_default_backend`,
+  an enclosing `with_backend`, or the environment) and leaks the inherited one
+  instead of destroying it; a `with_backend` block entered before the fork can
+  be left in the child, and selecting a backend there works even when the
+  inherited choice no longer resolves. If the backend such a block should
+  restore cannot be chosen again in the child, the block's temporary selection
+  stays in effect and an exception raised by the block is no longer replaced
+  by the restore failure (which is warned about instead). The tokio runtime, already rebuilt after a fork, now
+  keeps its pointer and pid in one atomic cell, without the mutex a fork could
+  capture locked. See the new "Forking" section of
+  [docs/runtime.md](docs/runtime.md#forking-puma-resque-solid-queue) for what
+  is supported and what is not.
+- A handle created before a fork (`Sandbox`, `SandboxHandle`, `ExecHandle`,
+  streams, SSH and agent clients, `VolumeFs`, ...) is refused in the child
+  with `ForkedHandleError` instead of being driven on the parent's dead
+  runtime, and a child that garbage-collects one — at the latest when it
+  exits — no longer runs its destructor. `Sandbox#owns_lifecycle?` is refused
+  the same way; `name`, `id` and the `SandboxHandle` snapshot fields stay
+  readable.
+
+### Added
+
+- `Microsandbox::ForkedHandleError` (`#code` `"forked-handle"`), raised when a
+  handle is used in a process forked from the one that created it. The message
+  names both pids.
+
 ## [0.17.2] - 2026-10-12
 
 Gem-only fix and release-pipeline hardening release; the embedded runtime
@@ -1470,7 +1513,8 @@ microsandbox runtime, aligned with the official Python/Node/Go SDKs.
   core crate has Apple-native deps). Until precompiled gems are published,
   installing from source requires a Rust toolchain (stable >= 1.91).
 
-[Unreleased]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.17.2...HEAD
+[Unreleased]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.17.3...HEAD
+[0.17.3]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.17.2...v0.17.3
 [0.17.2]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.17.1...v0.17.2
 [0.17.1]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.17.0...v0.17.1
 [0.17.0]: https://github.com/ya-luotao/microsandbox-rb/compare/v0.16.0...v0.17.0

data/Cargo.lock

@@ -3660,7 +3660,7 @@ dependencies = [
 
 [[package]]
 name = "microsandbox_rb"
-version = "0.17.2"
+version = "0.17.3"
 dependencies = [
  "chrono",
  "futures",

data/DESIGN.md

@@ -135,6 +135,104 @@ operation after the acquisition.
 extension, driving it with a fake `msb` (`spec/support/fake_runtime/`) whose
 log shows whether a sandbox was stopped, dropped, or left attached.
 
+### Fork safety
+
+`fork(2)` copies only the calling thread. A child of a process that has used
+the SDK therefore inherits native state whose threads are gone: the tokio
+runtime (workers, I/O driver), the core's process-wide default backend (each
+SQLite connection of a `LocalBackend` is served by its own worker thread; a
+`CloudBackend`'s pooled connections belong to the parent's runtime), and every
+wrapped handle built on top of them. Using that state hangs or crashes — the
+child's first catalog read used to wait out the pool's 30 s acquire timeout on
+Linux and die with `SIGTRAP` on macOS — and so does *destroying* it, because
+the destructors wake the same missing threads (on macOS, replacing an
+inherited `LocalBackend` was enough to kill the child). One rule covers all of
+it: **inherited native state is never used and never dropped in the child. It
+is leaked, once per fork, and replaced by state built in the child.** Three
+pieces implement it, all keyed on the pid (`runtime::current_pid`):
+
+- **Runtime cell** (`runtime.rs`). The runtime and the pid it was built under
+  live in one heap cell behind one `AtomicPtr`. `runtime()` returns the cell's
+  runtime when its pid is ours; otherwise it builds a new cell and publishes
+  it with a compare-exchange (a loser of that race in the same process drops
+  its own, never-published runtime). There is no mutex, so nothing can be
+  inherited locked or poisoned, and no window in which pointer and pid
+  disagree. A cell built by a parent process is leaked: `Runtime`'s `Drop`
+  joins worker threads that do not exist.
+- **Backend generation** (`backend.rs`). The binding records how the default
+  backend was chosen — the core's own ladder (environment, profile, config
+  file), or an explicit `set_default_backend`/`with_backend` selection — and
+  the pid it belongs to. `ensure_this_process_backend` runs, with the GVL
+  held, at the start of every `block_on` and of every synchronous entry that
+  reads the backend. In a process whose pid differs from the recorded one it
+  builds a fresh backend from the record, swaps it into the core and
+  `mem::forget`s the inherited one, along with the backends that open
+  `with_backend` scopes had saved for their restore. A scope the parent opened
+  can still be closed in the child: closing it installs a backend rebuilt from
+  how the saved one had been chosen. For the ladder this means the child
+  resolves it again, from its own environment, at its first native call; if
+  that fails, the call raises the configuration error, nothing is changed, and
+  the next call tries again. `set_default_backend` and a `with_backend` push
+  are the exception: they are about to replace the default anyway, so in a
+  child they take over with the backend they were asked for and never rebuild
+  the inherited selection — an explicit selection always gets a child out of
+  an inherited one that no longer resolves. Closing a scope works the same
+  way: a child whose first use of the backend is leaving a block its parent
+  entered takes over directly with what the scope restores, so it never needs
+  the scope's temporary backend (which it may be unable to rebuild). Closing a
+  scope always consumes it: when the backend it should restore cannot be
+  rebuilt in the child, the scope's temporary selection stays in effect and
+  the error is reported (by `with_backend` as a warning when the block itself
+  raised, so that the block's exception is the one that propagates).
+- **`ForkGuarded<T>`** (`runtime.rs`). The payload of every `#[magnus::wrap]`
+  type sits in one, tagged with the creating pid. `get()` is the only way to
+  it for anything that acts on the value, and in another process it returns
+  `Microsandbox::ForkedHandleError` (there is no `Deref`, so an unchecked
+  access does not compile). Its `Drop` runs the payload's destructor only in
+  the creating process; a child that garbage-collects an inherited handle —
+  at the latest when it exits, since Ruby frees every wrapped object then —
+  leaks it. Accessors that only copy plain data out of the value (`name`,
+  `id`, the `SandboxHandle` snapshot fields, `ExecHandle#id`) skip the check
+  through `peek()`, so a child can still read the name it needs to open a
+  handle of its own.
+
+What a child leaks is bounded: one runtime, the inherited default backend, the
+saved backend of each open scope, and each inherited handle it collects; plus
+one backend for each parent-opened scope it closes.
+
+The mutexes involved (`backend.rs`) are only taken with the GVL held, and
+nothing that runs under them calls into Ruby or releases the GVL — Ruby
+exceptions are built after they are released. A Ruby-level `fork` needs the
+GVL, so a child never inherits one of them locked.
+
+Limits, by design:
+
+- **Inherited file descriptors.** A child inherits the parent's open fds,
+  including the parent-watchdog pipe of every sandbox the parent created.
+  While such a child lives, the runtime sees no EOF on that pipe when the
+  parent exits, so the sandbox is not torn down until the child exits too.
+- **Ownership.** A sandbox created before the fork belongs to the parent. The
+  child cannot act on it through the inherited handle; it can open its own by
+  name, with the usual ownership rules.
+- **Threads mid-call.** A thread that is inside a native call when another
+  thread forks (the GVL is released there) may hold a lock in the core at
+  that instant — for example the read guard of the core's default-backend
+  `RwLock`, for the few instructions of an `Arc` clone — and the child's swap
+  then waits on that inherited lock forever. The binding cannot close this
+  window. Forking while another thread is inside a call is unsupported, as
+  with any threaded native library.
+- **Other libraries.** The SDK no longer touches inherited state; code that
+  reaches it some other way can still hang or trap.
+- **Pid reuse.** Process identity is the pid. A descendant that ends up with
+  the pid of an ancestor whose state it inherited without any SDK use in
+  between would be mistaken for that ancestor. This needs the pid counter to
+  wrap onto exactly that value.
+
+`spec/unit/fork_safety_spec.rb` (catalog only, no runtime),
+`spec/fake_runtime/fork_safety_spec.rb` (a live handle over the fake `msb`)
+and `spec/integration/fork_safety_spec.rb` (a real microVM) pin the behaviour;
+each forks from a probe process of its own.
+
 ## Error mapping
 
 The core returns one big `MicrosandboxError` enum. `error.rs` maps each variant

data/README.md

@@ -167,7 +167,7 @@ See [docs/observability.md](docs/observability.md).
 | Guest filesystem, streaming reads/writes, host copies | [docs/filesystem.md](docs/filesystem.md) |
 | Metrics, logs, `ping`/`touch`, live `modify` plans | [docs/observability.md](docs/observability.md) |
 | Image cache, private registries, snapshots | [docs/images.md](docs/images.md) |
-| Runtime binaries gem, `msb` resolution order, backends, environment variables | [docs/runtime.md](docs/runtime.md) |
+| Runtime binaries gem, `msb` resolution order, backends, forking, environment variables | [docs/runtime.md](docs/runtime.md) |
 | Error classes and stable codes | [docs/errors.md](docs/errors.md) |
 | Complete supported surface and what is not yet exposed | [docs/surface.md](docs/surface.md) |
 | Release process, release preflight, binaries gems | [docs/releasing.md](docs/releasing.md) |
@@ -209,7 +209,7 @@ share the upstream tag, but the numbers have diverged since and the gem version
 is **not** an indicator of the embedded runtime. Ask the build instead:
 
 ```ruby
-Microsandbox::VERSION          # => "0.17.2"  (the gem's own version)
+Microsandbox::VERSION          # => "0.17.3"  (the gem's own version)
 Microsandbox.runtime_version   # => "v0.6.18" (the embedded upstream runtime tag)
 ```
 
@@ -247,6 +247,7 @@ constants against this gem's. Every release records its runtime in
 | `0.17.0` | `v0.6.18` | adopts upstream `v0.6.17`+`v0.6.18` step by step: outbound SOCKS4/SOCKS5 proxies (SOCKS5 UDP + credentials), migration-order fix for databases last opened by a `v0.6.15` `msb`, security hardening — plain-HTTP `Host`/`:authority` now checked against domain-rule policies even in non-strict mode, plus fail-closed strict hostname mode. Parity: `proxy:` (`Microsandbox::OutboundProxy` / `SecretSource`), `strict:` |
 | `0.17.1` | `v0.6.18` | gem-only security and hardening release: relative host paths pinned at create time (GHSA-mcw9-9rf6-p4rm), `Volume.fs` path validation, `Cargo.lock` advisory updates, argument-guard and cleanup fixes, `SECURITY.md` |
 | `0.17.2` | `v0.6.18` | gem-only fix and release-pipeline hardening release: an interrupted native call no longer loses its result (a sandbox the call owns is stopped on `Timeout`/`Thread#kill`), release preflight, SHA-pinned workflow actions and `cargo deny` advisory checks, RBS and docs contract specs |
+| `0.17.3` | `v0.6.18` | gem-only fix release, fork safety: a forked child (Puma, Resque, Solid Queue) rebuilds its backend and runtime on its first SDK call instead of hanging or crashing, a handle created before the fork raises `ForkedHandleError` in the child, and nothing inherited from the parent is dropped there |
 
 ## Development
 

data/docs/errors.md

@@ -56,6 +56,7 @@ options) raises a plain `ArgumentError` before the native layer is reached.
 | `UnsupportedOperationError` | `unsupported-operation` | The runtime version does not support the operation |
 | `CloudHttpError` | `cloud-http` | Cloud backend HTTP failure |
 | `UnsupportedError` | `unsupported` | The selected backend does not implement the operation; carries `#operation` (e.g. `"sandbox.kill"`) and `#hint` |
+| `ForkedHandleError` | `forked-handle` | A handle was used in a process forked from the one that created it; open a new one in the child (see [runtime.md](runtime.md#forking-puma-resque-solid-queue)) |
 
 The snapshot classes go beyond the Python SDK (which collapses them into its
 base error) and match the Go SDK's per-variant coverage, so callers can rescue

data/docs/runtime.md

@@ -104,6 +104,91 @@ operations (create/start/stop/remove/get/list, one-shot exec, follow log
 streaming); unsupported operations raise `Microsandbox::UnsupportedError`
 (with `#operation` and `#hint`).
 
+## Forking (Puma, Resque, Solid Queue)
+
+Forking a process that has already used the SDK is supported: preload the
+application, use the SDK in the master, fork workers, use it in the workers.
+The first SDK call in a child sets up its own runtime threads and its own
+backend (a new catalog connection pool, or a new HTTP client for the cloud
+backend), chosen the same way as the parent's: an explicit
+`set_default_backend`, an enclosing `with_backend` block, or — when neither
+was used — the environment and config file as the child sees them at that
+call. Everything addressed by name works in the child from then on:
+`Sandbox.create`/`get`/`list`/`start`, `Volume`, `Image`, `Snapshot`.
+
+If the parent's choice cannot be made again in the child (say the child's
+environment now selects the cloud backend without credentials), SDK calls
+there raise the configuration error until that is repaired. Selecting a
+backend in the child — `set_default_backend`, or entering `with_backend` —
+does not depend on the inherited choice and works regardless.
+
+```ruby
+Microsandbox::Sandbox.list             # the parent has used the SDK
+
+pid = fork do
+  Microsandbox::Sandbox.create("job-#{Process.pid}", image: "alpine") do |sb|
+    puts sb.exec("echo", ["hello from the worker"]).stdout
+  end
+end
+Process.wait(pid)
+```
+
+What does **not** cross a fork is an object created before it. A `Sandbox`,
+`SandboxHandle`, `ExecHandle`, `ExecStdin`, `PullSession`, log/metrics/file
+stream, `SshClient`/`SftpClient`/`SshServer`, `AgentClient` or `VolumeFs`
+belongs to the process that created it. In a forked child, any call that acts
+on one raises `Microsandbox::ForkedHandleError` (the message names both
+pids); the original keeps working in the parent. Reading `name` or `id` — and
+the snapshot fields of a `SandboxHandle` — still works, so a child can open
+its own handle:
+
+```ruby
+sandbox = Microsandbox::Sandbox.create("shared", image: "alpine")
+
+pid = fork do
+  begin
+    sandbox.exec("true")                 # the parent's handle
+  rescue Microsandbox::ForkedHandleError => e
+    warn e.message
+  end
+  mine = Microsandbox::Sandbox.get(sandbox.name).connect_or_start
+  puts mine.exec("echo", ["hello"]).stdout
+end
+Process.wait(pid)
+sandbox.stop
+```
+
+Things to know:
+
+- **Cleanup code inherited by the child.** The block forms
+  (`Sandbox.create(...) { }`, `connect_or_create`) swallow the
+  `ForkedHandleError` their teardown hits when a forked child leaves the
+  block, so the child does not stop the parent's sandbox. An `ensure
+  sandbox.stop` of your own raises it in the child; rescue it there, or run
+  the cleanup only in the process that created the sandbox.
+- **Leaving a `with_backend` block in the child.** When the backend to
+  restore was the parent's — the child was forked inside the block, or the
+  block is the child's first use of the SDK — leaving the block installs a
+  backend chosen the way that one had been. The block's own temporary backend
+  is not needed for that: if only it can no longer be chosen in the child (a
+  cloud profile that is gone there), leaving the block still restores the
+  previous backend. If the choice to restore no longer resolves in the child,
+  the block is closed anyway and its temporary selection stays in effect.
+  `with_backend` then raises the configuration error — unless the block
+  itself raised, in which case the block's exception propagates and the
+  restore failure is reported as a warning.
+- **A child keeps the parent's sandboxes alive.** A child inherits the
+  parent's open file descriptors, among them the pipe through which a sandbox
+  notices that its owner is gone. If the parent exits while such a child is
+  still running, the sandbox is not torn down until that child exits as well.
+  Fork before creating sandboxes, or create them in the children.
+- **Do not fork while another thread is inside an SDK call.** That thread
+  does not exist in the child, and a lock it held at that instant stays
+  locked there.
+- **Memory.** A child leaks, once, the native state it inherited (the
+  parent's runtime, backend and whichever inherited handles it collects)
+  instead of destroying it — destroying it is what used to crash.
+
 ## One runtime line per home
 
 The runtime home (`MSB_HOME`, default `~/.microsandbox`) belongs to one

data/docs/surface.md

@@ -57,6 +57,9 @@ counterpart, and [DESIGN.md](../DESIGN.md) explains how the layers fit.
 - **Registries** — `registry_auth`/`registry_insecure`/`registry_ca_certs` on
   `create`.
 - **Errors** — the typed hierarchy in [errors.md](errors.md).
+- **Process model** — the SDK may be used before and after `fork`; objects
+  created before a fork are refused in the child with `ForkedHandleError`
+  (see [runtime.md](runtime.md#forking-puma-resque-solid-queue)).
 
 Create options span resources (`cpus`/`memory`/`max_cpus`/`max_memory`),
 `env`/`workdir`/`labels`/`user`/`hostname`/`shell`, named `scripts`, the image

data/ext/microsandbox/Cargo.toml

@@ -8,7 +8,7 @@ description = "Ruby SDK native extension for microsandbox — secure, fast micro
 # returns this via env!("CARGO_PKG_VERSION") and version_spec.rb asserts equality.
 # The core-crate dependencies below stay on their own tag, which is
 # Microsandbox::RUNTIME_VERSION and moves independently of this version.
-version = "0.17.2"
+version = "0.17.3"
 authors = ["Super Rad Company <development@superrad.company>"]
 repository = "https://github.com/superradcompany/microsandbox"
 license = "Apache-2.0"

data/ext/microsandbox/src/agent.rs

@@ -14,7 +14,7 @@ use microsandbox::agent::AgentClient as CoreAgentClient;
 use microsandbox::{AgentBridge, BridgeFrame, MicrosandboxError};
 
 use crate::error;
-use crate::runtime::{block_on, ruby};
+use crate::runtime::{block_on, ruby, ForkGuarded};
 
 /// Map an agent-client error onto the Ruby exception hierarchy (via the core
 /// `MicrosandboxError::AgentClient` wrapper, exactly like the Python binding).
@@ -24,13 +24,13 @@ fn to_ruby_agent(err: microsandbox::AgentClientError) -> Error {
 
 #[magnus::wrap(class = "Microsandbox::Native::AgentClient", free_immediately, size)]
 pub struct AgentClient {
-    inner: Arc<AgentBridge>,
+    inner: ForkGuarded<Arc<AgentBridge>>,
 }
 
 impl AgentClient {
     fn from_bridge(bridge: AgentBridge) -> Self {
         Self {
-            inner: Arc::new(bridge),
+            inner: ForkGuarded::new("Microsandbox::AgentClient", Arc::new(bridge)),
         }
     }
 
@@ -60,6 +60,9 @@ impl AgentClient {
 
     /// Resolve a sandbox's agent relay socket path without connecting.
     fn socket_path(name: String) -> Result<String, Error> {
+        // Synchronous, and the core derives the path from the default
+        // backend's config.
+        crate::backend::ensure_this_process_backend()?;
         let path = CoreAgentClient::socket_path(&name).map_err(error::to_ruby)?;
         Ok(path.to_string_lossy().into_owned())
     }
@@ -71,7 +74,7 @@ impl AgentClient {
     /// Send one frame and await a single response frame ({id, flags, body}).
     fn request(&self, flags: u8, body: RString) -> Result<RHash, Error> {
         let body = unsafe { body.as_slice() }.to_vec();
-        let inner = Arc::clone(&self.inner);
+        let inner = Arc::clone(self.inner.get()?);
         let frame =
             block_on(async move { inner.request(flags, body).await })?.map_err(to_ruby_agent)?;
         Ok(frame_to_hash(frame))
@@ -80,7 +83,7 @@ impl AgentClient {
     /// Open a streaming session; returns {id, handle}.
     fn stream_open(&self, flags: u8, body: RString) -> Result<RHash, Error> {
         let body = unsafe { body.as_slice() }.to_vec();
-        let inner = Arc::clone(&self.inner);
+        let inner = Arc::clone(self.inner.get()?);
         let (id, handle) = block_on(async move { inner.stream_open(flags, body).await })?
             .map_err(to_ruby_agent)?;
         let hash = ruby().hash_new();
@@ -91,7 +94,7 @@ impl AgentClient {
 
     /// Pull the next frame from a stream; nil at end-of-stream.
     fn stream_next(&self, handle: u64) -> Result<Option<RHash>, Error> {
-        let inner = Arc::clone(&self.inner);
+        let inner = Arc::clone(self.inner.get()?);
         let frame =
             block_on(async move { inner.stream_next(handle).await })?.map_err(to_ruby_agent)?;
         Ok(frame.map(frame_to_hash))
@@ -99,7 +102,7 @@ impl AgentClient {
 
     /// Close a stream handle. Idempotent.
     fn stream_close(&self, handle: u64) -> Result<(), Error> {
-        let inner = Arc::clone(&self.inner);
+        let inner = Arc::clone(self.inner.get()?);
         block_on(async move { inner.stream_close(handle).await })?;
         Ok(())
     }
@@ -107,19 +110,19 @@ impl AgentClient {
     /// Send a follow-up frame on an existing correlation id.
     fn send(&self, id: u32, flags: u8, body: RString) -> Result<(), Error> {
         let body = unsafe { body.as_slice() }.to_vec();
-        let inner = Arc::clone(&self.inner);
+        let inner = Arc::clone(self.inner.get()?);
         block_on(async move { inner.send(id, flags, body).await })?.map_err(to_ruby_agent)
     }
 
     /// Cached handshake `core.ready` frame body bytes (CBOR).
     fn ready_bytes(&self) -> Result<RString, Error> {
-        let bytes = self.inner.ready_bytes().map_err(to_ruby_agent)?;
+        let bytes = self.inner.get()?.ready_bytes().map_err(to_ruby_agent)?;
         Ok(ruby().str_from_slice(&bytes))
     }
 
     /// Close the connection. Idempotent.
     fn close(&self) -> Result<(), Error> {
-        let inner = Arc::clone(&self.inner);
+        let inner = Arc::clone(self.inner.get()?);
         block_on(async move { inner.close().await })?;
         Ok(())
     }