mxc 0.1.0

data/Cargo.toml

@@ -0,0 +1,6 @@
+[workspace]
+members = ["./ext/mxc"]
+resolver = "2"
+
+[profile.release]
+strip = "debuginfo"

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carmine Paolino
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/NOTICE

@@ -0,0 +1,34 @@
+MXC for Ruby
+Copyright (c) 2026 Carmine Paolino
+
+This gem is an unofficial Ruby binding to MXC. It is not affiliated with or
+endorsed by Microsoft.
+
+The native extension compiles and links the mxc-sdk crate
+(https://github.com/microsoft/mxc, https://crates.io/crates/mxc-sdk),
+which is distributed under the MIT License:
+
+MIT License
+
+Copyright (c) Microsoft Corporation.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+The native extension also links other open source Rust crates, listed with
+their versions in Cargo.lock. Their licenses are available from crates.io.

data/README.md

@@ -0,0 +1,140 @@
+<div align="center">
+
+# MXC for Ruby
+
+<strong>Run untrusted commands in an OS sandbox, from Ruby</strong>
+
+[Documentation](https://crmne.github.io/mxc/) · [Getting Started](https://crmne.github.io/mxc/getting-started/) · [Running in Docker](https://crmne.github.io/mxc/running-in-docker/)
+
+[![Gem Version](https://badge.fury.io/rb/mxc.svg)](https://badge.fury.io/rb/mxc)
+[![CI](https://github.com/crmne/mxc/actions/workflows/ci.yml/badge.svg)](https://github.com/crmne/mxc/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+</div>
+
+---
+
+Your app runs code it did not write: scripts a model generated, skills users uploaded, build steps from someone else. MXC for Ruby runs them in a sandbox that decides what they can read, write, and reach, and how long they get.
+
+```ruby
+result = MXC.run("python3 build.py", readable: "app/skills", writable: "tmp/out", timeout: 30)
+result.stdout
+result.success?
+```
+
+It is an unofficial Ruby binding to [Microsoft's MXC](https://github.com/microsoft/mxc), the MIT-licensed sandbox library. Not affiliated with or endorsed by Microsoft.
+
+## Installation
+
+```sh
+bundle add mxc
+```
+
+Precompiled gems cover Linux (x86_64 and ARM64, glibc and musl), macOS (Intel and Apple Silicon), and Windows (x64 and ARM64). On Linux, install Bubblewrap:
+
+```sh
+sudo apt-get install bubblewrap
+```
+
+Commands that use the network also need `slirp4netns`, `iptables`, util-linux, and `/dev/net/tun`. macOS and Windows need nothing extra.
+
+## Usage
+
+Run a command. It sees the system's programs read-only, nothing of your home directory or project, and no network:
+
+```ruby
+MXC.run("python3 -c 'print(6 * 7)'").stdout # => "42\n"
+```
+
+One String runs through the shell, like `Kernel#system`. Pass the program and its arguments separately when part of the command comes from users, so each one reaches the program unchanged:
+
+```ruby
+MXC.run("python3", "convert.py", params[:filename])
+```
+
+Build a policy with chainable setters:
+
+```ruby
+sandbox = MXC.sandbox
+  .with_readable("app/skills")
+  .with_writable(Rails.root.join("tmp/skills"))
+  .with_denied("app/skills/secrets")
+  .with_network(allow: ["pypi.org", "*.pythonhosted.org"])
+  .with_env("LANG" => "C.UTF-8")
+  .with_directory("app/skills")
+  .with_timeout(30)
+
+result = sandbox.run("pip download --no-deps -d /tmp/wheels requests")
+result.blocked # => hosts the allow-list refused
+```
+
+Stream output as it arrives:
+
+```ruby
+sandbox.run("python3 train.py") { |chunk| print chunk.content }
+```
+
+Drive an interactive process:
+
+```ruby
+process = sandbox.spawn("python3 -i -q")
+process.write("print(6 * 7)\n")
+process.close_write
+process.each { |chunk| print chunk.content }
+process.wait # => #<MXC::Result exit_code=0 timed_out=false backend=:bubblewrap>
+```
+
+Name a policy you use in several places:
+
+```ruby
+class SkillSandbox < MXC::Sandbox
+  readable "app/skills"
+  writable "tmp/skills"
+  network false
+  timeout 30
+end
+
+SkillSandbox.new.run("python3 app/skills/build.py")
+```
+
+Check the machine before you rely on it:
+
+```ruby
+MXC.supported?                 # starts a real sandbox once and caches the answer
+MXC.availability.remediation   # what to change when it cannot
+MXC.supports?(:network_policy) # host allow-lists work here
+MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
+```
+
+## Platforms
+
+| Platform | Backend | 0.1.0 |
+| --- | --- | --- |
+| Linux | Bubblewrap | Supported and tested |
+| macOS | Seatbelt | Supported and tested |
+| Windows 11 24H2 and later | ProcessContainer | Supported and tested, without host allow-lists |
+
+On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
+
+Docker blocks the namespaces Bubblewrap needs by default. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows the smallest set of changes that makes it work, with a seccomp profile and a Kamal configuration for a job role.
+
+## Documentation
+
+* [Getting Started](https://crmne.github.io/mxc/getting-started/)
+* [Running Commands](https://crmne.github.io/mxc/running-commands/)
+* [Policies](https://crmne.github.io/mxc/policies/)
+* [Checking the Host](https://crmne.github.io/mxc/checking-the-host/)
+* [Running in Docker](https://crmne.github.io/mxc/running-in-docker/)
+
+## Development
+
+```sh
+bin/setup                    # bundle install and compile the extension
+bundle exec rake             # compile, tests, Rust unit tests, RuboCop
+```
+
+Tests that start sandboxes skip on machines that cannot. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT. The native extension bundles Microsoft's MXC, also MIT; see [NOTICE](NOTICE).

data/ext/mxc/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "mxc"
+version = "0.1.0"
+edition = "2021"
+authors = ["Carmine Paolino <carmine@paolino.me>"]
+license = "MIT"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+magnus = "0.8.2"
+mxc-sdk = "=1.0.0"
+rb-sys = { version = "0.9.130", features = ["stable-api-compiled-fallback"] }
+
+[build-dependencies]
+rb-sys-env = "0.2.2"

data/ext/mxc/build.rs

@@ -0,0 +1,28 @@
+use std::env;
+use std::fs;
+use std::path::PathBuf;
+
+pub fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let _ = rb_sys_env::activate()?;
+
+    if env::var("CARGO_CFG_TARGET_OS")? == "windows" && env::var("CARGO_CFG_TARGET_ENV")? != "msvc"
+    {
+        stand_in_for_onecore_apiset()?;
+    }
+
+    Ok(())
+}
+
+// tracelogging, which mxc-sdk uses on Windows, links its ETW functions from
+// OneCore_apiset. The MinGW cross-compilers that build the release gems either
+// lack that import library or name it in lowercase, which a linker on Linux
+// does not match. advapi32 exports the same functions, so an empty archive
+// satisfies the -lOneCore_apiset request and advapi32, linked last, provides
+// them.
+fn stand_in_for_onecore_apiset() -> Result<(), Box<dyn std::error::Error>> {
+    let out_dir = PathBuf::from(env::var("OUT_DIR")?);
+    fs::write(out_dir.join("libOneCore_apiset.a"), b"!<arch>\n")?;
+    println!("cargo:rustc-link-search=native={}", out_dir.display());
+    println!("cargo:rustc-link-arg=-ladvapi32");
+    Ok(())
+}

data/ext/mxc/extconf.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'mkmf'
+require 'rb_sys/mkmf'
+
+create_rust_makefile('mxc/mxc') do |r|
+  if Gem.win_platform?
+    # RubyInstaller builds Ruby with MinGW, so the extension must use Rust's GNU
+    # target even when rustup's default host is MSVC.
+    unless ENV.key?('CARGO_BUILD_TARGET') || ENV.key?('RUST_TARGET')
+      r.target = RbConfig::CONFIG['host_cpu'] == 'aarch64' ? 'aarch64-pc-windows-gnullvm' : 'x86_64-pc-windows-gnu'
+    end
+
+    # mxc-sdk's build script compiles version resources for its own Windows
+    # executables with rc.exe, which it finds only for MSVC targets. This gem
+    # never builds those executables, so a resource compiler that does nothing
+    # lets the extension build without the Windows SDK.
+    unless ENV.key?('RC_PATH')
+      stub = File.expand_path('rc-stub.cmd')
+      File.write(stub, "@exit /b 0\r\n")
+      r.env = { 'RC_PATH' => stub }
+    end
+  end
+end

data/ext/mxc/src/lib.rs

@@ -0,0 +1,384 @@
+use std::ffi::c_void;
+use std::io::{Read, Write};
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+use magnus::{
+    function, method, prelude::*, Error, RArray, RHash, RModule, RString, Ruby, Symbol,
+};
+use mxc_sdk::v1::{
+    self,
+    configs::{ProcessContainerConfig, SeatbeltConfig},
+    Containment, ContainerRequest, FilesystemPolicy, MxcProcess, NetworkAction,
+    NetworkEgressPolicy, NetworkPolicy, NetworkRuntimeConfig, StreamCloser, WaitResult,
+};
+
+mod proxy;
+
+use proxy::{Allowlist, EgressProxy};
+
+const MAX_POLL: Duration = Duration::from_millis(50);
+
+fn without_gvl<F, R>(f: F) -> R
+where
+    F: FnOnce() -> R,
+{
+    struct Payload<F, R> {
+        f: Option<F>,
+        r: Option<std::thread::Result<R>>,
+    }
+    extern "C" fn call<F: FnOnce() -> R, R>(data: *mut c_void) -> *mut c_void {
+        let payload = unsafe { &mut *(data as *mut Payload<F, R>) };
+        let f = payload.f.take().unwrap();
+        payload.r = Some(std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)));
+        std::ptr::null_mut()
+    }
+    let mut payload = Payload { f: Some(f), r: None };
+    unsafe {
+        rb_sys::rb_thread_call_without_gvl(
+            Some(call::<F, R>),
+            &mut payload as *mut _ as *mut c_void,
+            None,
+            std::ptr::null_mut(),
+        );
+    }
+    match payload.r.unwrap() {
+        Ok(r) => r,
+        Err(panic) => std::panic::resume_unwind(panic),
+    }
+}
+
+fn native_module(ruby: &Ruby) -> Result<RModule, Error> {
+    let mxc: RModule = ruby.class_object().const_get("MXC")?;
+    mxc.const_get("Native")
+}
+
+fn mxc_error(ruby: &Ruby, e: v1::Error) -> Error {
+    let build = || -> Result<magnus::Exception, Error> {
+        let kw = ruby.hash_new();
+        kw.aset(ruby.to_symbol("code"), ruby.to_symbol(e.code.as_str()))?;
+        kw.aset(ruby.to_symbol("remediation"), e.remediation.clone())?;
+        kw.aset(ruby.to_symbol("operation"), e.operation.clone())?;
+        kw.aset(ruby.to_symbol("native_code"), e.native_code.clone())?;
+        native_module(ruby)?.funcall("error", (e.message.clone(), magnus::KwArgs(kw)))
+    };
+    match build() {
+        Ok(exc) => Error::from(exc),
+        Err(err) => err,
+    }
+}
+
+fn io_error(ruby: &Ruby, e: std::io::Error) -> Error {
+    Error::new(ruby.exception_io_error(), e.to_string())
+}
+
+fn arg_error(ruby: &Ruby, message: String) -> Error {
+    Error::new(ruby.exception_arg_error(), message)
+}
+
+fn opt<T: magnus::TryConvert>(ruby: &Ruby, h: RHash, key: &str) -> Result<Option<T>, Error> {
+    h.lookup::<_, Option<T>>(ruby.to_symbol(key))
+}
+
+fn deny_all() -> NetworkEgressPolicy {
+    NetworkEgressPolicy {
+        default: Some(NetworkAction::Deny),
+        ..Default::default()
+    }
+}
+
+fn build_request(
+    ruby: &Ruby,
+    command: String,
+    opts: RHash,
+) -> Result<(ContainerRequest, Option<EgressProxy>), Error> {
+    let mut req = ContainerRequest::new(command);
+    req.timeout_ms = opt::<u32>(ruby, opts, "timeout_ms")?;
+    req.working_directory = opt::<String>(ruby, opts, "working_directory")?;
+    if let Some(env) = opt::<RHash>(ruby, opts, "environment")? {
+        let mut pairs = Vec::new();
+        env.foreach(|k: String, v: String| {
+            pairs.push((k, v));
+            Ok(magnus::r_hash::ForEach::Continue)
+        })?;
+        req.environment = Some(pairs);
+    }
+    req.filesystem = Some(FilesystemPolicy {
+        readonly_paths: opt::<Vec<String>>(ruby, opts, "readonly")?.unwrap_or_default(),
+        readwrite_paths: opt::<Vec<String>>(ruby, opts, "readwrite")?.unwrap_or_default(),
+        denied_paths: opt::<Vec<String>>(ruby, opts, "denied")?.unwrap_or_default(),
+        ..Default::default()
+    });
+
+    let mut egress_proxy = None;
+    let egress = match opt::<Vec<String>>(ruby, opts, "allow")? {
+        Some(hosts) => {
+            let allowlist = Allowlist::parse(&hosts).map_err(|m| arg_error(ruby, m))?;
+            let started = EgressProxy::start(allowlist).map_err(|e| io_error(ruby, e))?;
+            let runtime_config = NetworkRuntimeConfig {
+                network_proxy: Some(started.url()),
+            };
+            egress_proxy = Some(started);
+            NetworkPolicy {
+                egress: Some(deny_all()),
+                runtime_config: Some(runtime_config),
+                ..Default::default()
+            }
+        }
+        None if opt::<bool>(ruby, opts, "network")?.unwrap_or(false) => NetworkPolicy {
+            egress: Some(NetworkEgressPolicy {
+                default: Some(NetworkAction::Allow),
+                ..Default::default()
+            }),
+            ..Default::default()
+        },
+        None => NetworkPolicy {
+            egress: Some(deny_all()),
+            ..Default::default()
+        },
+    };
+    req.network = Some(egress);
+
+    if let Some(backend) = opt::<Symbol>(ruby, opts, "backend")? {
+        req.containment = match backend.name()?.as_ref() {
+            "auto" => Containment::Process,
+            "bubblewrap" => Containment::Bubblewrap,
+            "seatbelt" => Containment::Seatbelt(SeatbeltConfig::default()),
+            "process_container" => {
+                Containment::ProcessContainer(ProcessContainerConfig::default())
+            }
+            other => return Err(arg_error(ruby, format!("unknown backend :{other}"))),
+        };
+    }
+    Ok((req, egress_proxy))
+}
+
+fn outcome_hash(ruby: &Ruby, outcome: WaitResult) -> Result<RHash, Error> {
+    let h = ruby.hash_new();
+    match outcome {
+        WaitResult::Exited(code) => {
+            h.aset(ruby.to_symbol("timed_out"), false)?;
+            h.aset(ruby.to_symbol("exit_code"), code)?;
+        }
+        WaitResult::TimedOut => {
+            h.aset(ruby.to_symbol("timed_out"), true)?;
+            h.aset(ruby.to_symbol("exit_code"), ruby.qnil())?;
+        }
+    }
+    Ok(h)
+}
+
+fn snake_case(name: &str) -> String {
+    let mut out = String::new();
+    for (i, c) in name.chars().enumerate() {
+        if c.is_ascii_uppercase() {
+            if i > 0 {
+                out.push('_');
+            }
+            out.push(c.to_ascii_lowercase());
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
+
+fn backends(ruby: &Ruby) -> Result<RArray, Error> {
+    let found = without_gvl(v1::available_backends);
+    let arr = ruby.ary_new();
+    for b in found {
+        let h = ruby.hash_new();
+        h.aset(ruby.to_symbol("name"), ruby.to_symbol(&b.backend))?;
+        h.aset(ruby.to_symbol("tier"), b.tier)?;
+        let capabilities = ruby.ary_new();
+        for c in &b.capabilities {
+            capabilities.push(ruby.to_symbol(snake_case(&format!("{c:?}"))))?;
+        }
+        h.aset(ruby.to_symbol("capabilities"), capabilities)?;
+        h.aset(ruby.to_symbol("warnings"), b.warnings)?;
+        arr.push(h)?;
+    }
+    Ok(arr)
+}
+
+fn run(ruby: &Ruby, command: String, opts: RHash) -> Result<RHash, Error> {
+    let (req, mut egress_proxy) = build_request(ruby, command, opts)?;
+    let result = without_gvl(move || v1::run(req, Default::default()));
+    let blocked = egress_proxy.as_mut().map(|p| {
+        p.stop();
+        p.blocked()
+    });
+    let r = result.map_err(|e| mxc_error(ruby, e))?;
+    let h = outcome_hash(ruby, r.outcome)?;
+    h.aset(ruby.to_symbol("stdout"), ruby.str_from_slice(&r.stdout))?;
+    h.aset(ruby.to_symbol("stderr"), ruby.str_from_slice(&r.stderr))?;
+    h.aset(ruby.to_symbol("warnings"), r.warnings)?;
+    h.aset(ruby.to_symbol("blocked"), blocked.unwrap_or_default())?;
+    Ok(h)
+}
+
+type Reader = Mutex<Option<Box<dyn Read + Send>>>;
+
+#[magnus::wrap(class = "MXC::Native::Process", free_immediately, size)]
+struct Process {
+    pid: u32,
+    deadline: Option<Instant>,
+    child: Mutex<Option<MxcProcess>>,
+    stdin: Mutex<Option<Box<dyn Write + Send>>>,
+    stdout: Reader,
+    stderr: Reader,
+    stdout_closer: Option<StreamCloser>,
+    stderr_closer: Option<StreamCloser>,
+    egress_proxy: Mutex<Option<EgressProxy>>,
+}
+
+fn spawn(ruby: &Ruby, command: String, opts: RHash) -> Result<Process, Error> {
+    let (req, egress_proxy) = build_request(ruby, command, opts)?;
+    let timeout = req.timeout_ms.map(|ms| Duration::from_millis(ms.into()));
+    let mut child = without_gvl(move || v1::spawn(req, Default::default()))
+        .map_err(|e| mxc_error(ruby, e))?;
+    Ok(Process {
+        pid: child.id(),
+        deadline: timeout.map(|t| Instant::now() + t),
+        stdin: Mutex::new(child.take_stdin()),
+        stdout: Mutex::new(child.take_stdout()),
+        stderr: Mutex::new(child.take_stderr()),
+        stdout_closer: child.stdout_closer(),
+        stderr_closer: child.stderr_closer(),
+        child: Mutex::new(Some(child)),
+        egress_proxy: Mutex::new(egress_proxy),
+    })
+}
+
+fn read_from(ruby: &Ruby, stream: &Reader, max: usize) -> Result<Option<RString>, Error> {
+    let res = without_gvl(|| {
+        let mut guard = stream.lock().unwrap();
+        match guard.as_mut() {
+            None => Ok(None),
+            Some(r) => {
+                let mut buf = vec![0u8; max];
+                let n = r.read(&mut buf)?;
+                buf.truncate(n);
+                if n == 0 {
+                    guard.take();
+                }
+                Ok(Some(buf))
+            }
+        }
+    });
+    match res {
+        Ok(Some(buf)) if !buf.is_empty() => Ok(Some(ruby.str_from_slice(&buf))),
+        Ok(_) => Ok(None),
+        Err(e) => Err(io_error(ruby, e)),
+    }
+}
+
+impl Process {
+    fn pid(&self) -> u32 {
+        self.pid
+    }
+
+    fn read_stdout(ruby: &Ruby, rb_self: &Self, max: usize) -> Result<Option<RString>, Error> {
+        read_from(ruby, &rb_self.stdout, max)
+    }
+
+    fn read_stderr(ruby: &Ruby, rb_self: &Self, max: usize) -> Result<Option<RString>, Error> {
+        read_from(ruby, &rb_self.stderr, max)
+    }
+
+    fn write(ruby: &Ruby, rb_self: &Self, data: RString) -> Result<usize, Error> {
+        let bytes = unsafe { data.as_slice() }.to_vec();
+        let res = without_gvl(|| {
+            let mut guard = rb_self.stdin.lock().unwrap();
+            match guard.as_mut() {
+                None => Err(std::io::Error::other("stdin is closed")),
+                Some(w) => w
+                    .write_all(&bytes)
+                    .and_then(|_| w.flush())
+                    .map(|_| bytes.len()),
+            }
+        });
+        res.map_err(|e| io_error(ruby, e))
+    }
+
+    fn close_stdin(&self) {
+        self.stdin.lock().unwrap().take();
+    }
+
+    fn kill(ruby: &Ruby, rb_self: &Self) -> Result<(), Error> {
+        let mut guard = rb_self.child.lock().unwrap();
+        match guard.as_mut() {
+            Some(c) => c.kill().map_err(|e| io_error(ruby, e)),
+            None => Ok(()),
+        }
+    }
+
+    // MxcProcess::kill and ::wait both need the handle exclusively, so waiting
+    // polls and releases the lock between polls to let kill in.
+    fn await_exit(&self) -> std::io::Result<(WaitResult, Vec<String>)> {
+        let mut nap = Duration::from_millis(1);
+        loop {
+            {
+                let mut guard = self.child.lock().unwrap();
+                let child = guard
+                    .as_mut()
+                    .ok_or_else(|| std::io::Error::other("the process was already waited for"))?;
+                let expired = self.deadline.is_some_and(|d| Instant::now() >= d);
+                if expired || child.try_wait()?.is_some() {
+                    let outcome = child.wait()?;
+                    let warnings = child.warnings();
+                    guard.take();
+                    return Ok((outcome, warnings));
+                }
+            }
+            let mut sleep = nap;
+            if let Some(deadline) = self.deadline {
+                sleep = sleep.min(deadline.saturating_duration_since(Instant::now()));
+            }
+            std::thread::sleep(sleep);
+            nap = (nap * 2).min(MAX_POLL);
+        }
+    }
+
+    fn wait(ruby: &Ruby, rb_self: &Self) -> Result<RHash, Error> {
+        let res = without_gvl(|| rb_self.await_exit());
+        let blocked = match rb_self.egress_proxy.lock().unwrap().take() {
+            Some(mut p) => {
+                p.stop();
+                p.blocked()
+            }
+            None => Vec::new(),
+        };
+        let (outcome, warnings) = res.map_err(|e| io_error(ruby, e))?;
+        if !matches!(outcome, WaitResult::Exited(_)) {
+            if let Some(c) = &rb_self.stdout_closer {
+                c.close();
+            }
+            if let Some(c) = &rb_self.stderr_closer {
+                c.close();
+            }
+        }
+        let h = outcome_hash(ruby, outcome)?;
+        h.aset(ruby.to_symbol("warnings"), warnings)?;
+        h.aset(ruby.to_symbol("blocked"), blocked)?;
+        Ok(h)
+    }
+}
+
+#[magnus::init]
+fn init(ruby: &Ruby) -> Result<(), Error> {
+    let mxc = ruby.define_module("MXC")?;
+    let native = mxc.define_module("Native")?;
+    native.define_singleton_method("backends", function!(backends, 0))?;
+    native.define_singleton_method("run", function!(run, 2))?;
+    native.define_singleton_method("spawn", function!(spawn, 2))?;
+    let process = native.define_class("Process", ruby.class_object())?;
+    process.define_method("pid", method!(Process::pid, 0))?;
+    process.define_method("read_stdout", method!(Process::read_stdout, 1))?;
+    process.define_method("read_stderr", method!(Process::read_stderr, 1))?;
+    process.define_method("write", method!(Process::write, 1))?;
+    process.define_method("close_stdin", method!(Process::close_stdin, 0))?;
+    process.define_method("kill", method!(Process::kill, 0))?;
+    process.define_method("wait", method!(Process::wait, 0))?;
+    Ok(())
+}