@agoric/swingset-vat 0.32.3-dev-1f816f9.0 → 0.32.3-dev-d32d6ce.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/swingset-vat",
-  "version": "0.32.3-dev-1f816f9.0+1f816f9",
+  "version": "0.32.3-dev-d32d6ce.0+d32d6ce",
   "description": "Vat/Container Launcher",
   "type": "module",
   "main": "src/index.js",
@@ -27,16 +27,16 @@
     "@types/yargs-parser": "^21.0.0"
   },
   "dependencies": {
-    "@agoric/internal": "0.3.3-dev-1f816f9.0+1f816f9",
-    "@agoric/kmarshal": "0.1.1-dev-1f816f9.0+1f816f9",
-    "@agoric/store": "0.9.3-dev-1f816f9.0+1f816f9",
-    "@agoric/swing-store": "0.9.2-dev-1f816f9.0+1f816f9",
-    "@agoric/swingset-liveslots": "0.10.3-dev-1f816f9.0+1f816f9",
-    "@agoric/swingset-xsnap-supervisor": "0.10.3-dev-1f816f9.0+1f816f9",
-    "@agoric/time": "0.3.3-dev-1f816f9.0+1f816f9",
-    "@agoric/vat-data": "0.5.3-dev-1f816f9.0+1f816f9",
-    "@agoric/xsnap": "0.14.3-dev-1f816f9.0+1f816f9",
-    "@agoric/xsnap-lockdown": "0.14.1-dev-1f816f9.0+1f816f9",
+    "@agoric/internal": "0.3.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/kmarshal": "0.1.1-dev-d32d6ce.0+d32d6ce",
+    "@agoric/store": "0.9.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/swing-store": "0.9.2-dev-d32d6ce.0+d32d6ce",
+    "@agoric/swingset-liveslots": "0.10.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/swingset-xsnap-supervisor": "0.10.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/time": "0.3.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/vat-data": "0.5.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/xsnap": "0.14.3-dev-d32d6ce.0+d32d6ce",
+    "@agoric/xsnap-lockdown": "0.14.1-dev-d32d6ce.0+d32d6ce",
     "@endo/base64": "^1.0.6",
     "@endo/bundle-source": "^3.3.0",
     "@endo/captp": "^4.2.2",
@@ -102,5 +102,5 @@
   "typeCoverage": {
     "atLeast": 75.1
   },
-  "gitHead": "1f816f92e8b4f79c43df9608d7a7b443a3ceca20"
+  "gitHead": "d32d6ce5ab3d9686b29c4ba811b0742fac245cab"
 }

package/src/controller/controller.js

@@ -21,6 +21,7 @@ import { waitUntilQuiescent } from '@agoric/internal/src/lib-nodejs/waitUntilQui
 import { makeGcAndFinalize } from '@agoric/internal/src/lib-nodejs/gc-and-finalize.js';
 import { kslot, krefOf } from '@agoric/kmarshal';
 import { insistStorageAPI } from '../lib/storageAPI.js';
+import { insistCapData } from '../lib/capdata.js';
 import {
   buildKernelBundle,
   swingsetIsInitialized,
@@ -33,6 +34,10 @@ import {
 import { makeStartXSnap } from './startXSnap.js';
 import { makeStartSubprocessWorkerNode } from './startNodeSubprocess.js';
 
+/**
+ * @typedef { import('../types-internal.js').VatID } VatID
+ */
+
 const endoZipBase64Sha512Shape = harden({
   moduleFormat: 'endoZipBase64',
   endoZipBase64: M.string(harden({ stringLengthLimit: Infinity })),
@@ -441,6 +446,48 @@ export async function makeSwingsetController(
       // no emitCrankHashes here because queueToVatRoot did that
       return result;
     },
+
+    /**
+     * terminate a vat by ID
+     *
+     * This allows the host app to terminate any vat. The effect is
+     * equivalent to the holder of the vat's `adminNode` calling
+     * `E(adminNode).terminateWithFailure(reason)`, or the vat itself
+     * calling `vatPowers.exitVatWithFailure(reason)`. It accepts a
+     * reason capdata structure (use 'kser()' to build one), which
+     * will be included in rejection data for the promise available to
+     * `E(adminNode).done()`, just like the internal termination APIs.
+     * Note that no slots/krefs are allowed in 'reason' when
+     * terminating the vat externally.
+     *
+     * This is a superpower available only from the host app, not from
+     * within vats, since `vatID` is merely a string and can be forged
+     * trivially. The host app is responsible for supplying the right
+     * vatID to kill, by looking at the database or logs (note that
+     * vats do not know their own vatID, and `controller.vatNameToID`
+     * only works for static vats, not dynamic).
+     *
+     * This will cause state changes in the swing-store (specifically
+     * marking the vat as terminated, and rejection all its
+     * outstanding promises), which must be committed before they will
+     * be durable. Either call `hostStorage.commit()` immediately
+     * after calling this, or call `controller.run()` and *then*
+     * `hostStorage.commit()` as you would normally do in response to
+     * other I/O or timer activity.
+     *
+     * The first `controller.run()` after this call will delete all
+     * the old vat's state at once, unless you use a
+     * [`runPolicy`](../docs/run-policy.md) to rate-limit cleanups.
+     *
+     * @param {VatID} vatID
+     * @param {SwingSetCapData} reasonCD
+     */
+
+    terminateVat(vatID, reasonCD) {
+      insistCapData(reasonCD);
+      assert(reasonCD.slots.length === 0, 'no slots allowed in reason');
+      kernel.terminateVatExternally(vatID, reasonCD);
+    },
   });
 
   writeSlogObject({ type: 'kernel-init-finish' });

package/src/kernel/kernel.js

@@ -2063,6 +2063,16 @@ export default function buildKernel(
     hooks[hookName] = hook;
   }
 
+  function terminateVatExternally(vatID, reasonCD) {
+    assert(started, 'must do kernel.start() before terminateVatExternally()');
+    insistCapData(reasonCD);
+    assert(reasonCD.slots.length === 0, 'no slots allowed in reason');
+    // this fires a promise when worker is dead, mostly for tests, so don't
+    // give it to external callers
+    void terminateVat(vatID, true, reasonCD);
+    console.log(`scheduled vatID ${vatID} for termination`);
+  }
+
   const kernel = harden({
     // these are meant for the controller
     installBundle,
@@ -2138,6 +2148,7 @@ export default function buildKernel(
     kpStatus,
     kpResolution,
     addDeviceHook,
+    terminateVatExternally,
   });
 
   return kernel;