@agoric/swingset-vat 0.32.3-dev-2b7c650.0 → 0.32.3-dev-31ed402.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/swingset-vat",
-  "version": "0.32.3-dev-2b7c650.0+2b7c650",
+  "version": "0.32.3-dev-31ed402.0+31ed402",
   "description": "Vat/Container Launcher",
   "type": "module",
   "main": "src/index.js",
@@ -27,16 +27,16 @@
     "@types/yargs-parser": "^21.0.0"
   },
   "dependencies": {
-    "@agoric/assert": "0.6.1-dev-2b7c650.0+2b7c650",
-    "@agoric/internal": "0.3.3-dev-2b7c650.0+2b7c650",
-    "@agoric/store": "0.9.3-dev-2b7c650.0+2b7c650",
-    "@agoric/swing-store": "0.9.2-dev-2b7c650.0+2b7c650",
-    "@agoric/swingset-liveslots": "0.10.3-dev-2b7c650.0+2b7c650",
-    "@agoric/swingset-xsnap-supervisor": "0.10.3-dev-2b7c650.0+2b7c650",
-    "@agoric/time": "0.3.3-dev-2b7c650.0+2b7c650",
-    "@agoric/vat-data": "0.5.3-dev-2b7c650.0+2b7c650",
-    "@agoric/xsnap": "0.14.3-dev-2b7c650.0+2b7c650",
-    "@agoric/xsnap-lockdown": "0.14.1-dev-2b7c650.0+2b7c650",
+    "@agoric/assert": "0.6.1-dev-31ed402.0+31ed402",
+    "@agoric/internal": "0.3.3-dev-31ed402.0+31ed402",
+    "@agoric/store": "0.9.3-dev-31ed402.0+31ed402",
+    "@agoric/swing-store": "0.9.2-dev-31ed402.0+31ed402",
+    "@agoric/swingset-liveslots": "0.10.3-dev-31ed402.0+31ed402",
+    "@agoric/swingset-xsnap-supervisor": "0.10.3-dev-31ed402.0+31ed402",
+    "@agoric/time": "0.3.3-dev-31ed402.0+31ed402",
+    "@agoric/vat-data": "0.5.3-dev-31ed402.0+31ed402",
+    "@agoric/xsnap": "0.14.3-dev-31ed402.0+31ed402",
+    "@agoric/xsnap-lockdown": "0.14.1-dev-31ed402.0+31ed402",
     "@endo/base64": "^0.2.34",
     "@endo/bundle-source": "^2.7.0",
     "@endo/captp": "^3.1.4",
@@ -97,5 +97,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "2b7c650eaf3b6616cc37afb3ff9ba4d67779835d"
+  "gitHead": "31ed40207648bb76e2b37cb82dd068fb1837fdd8"
 }

package/src/controller/controller.js

@@ -20,7 +20,7 @@ import engineGC from '@agoric/internal/src/lib-nodejs/engine-gc.js';
 import { startSubprocessWorker } from '@agoric/internal/src/lib-nodejs/spawnSubprocessWorker.js';
 import { waitUntilQuiescent } from '@agoric/internal/src/lib-nodejs/waitUntilQuiescent.js';
 import { makeGcAndFinalize } from '@agoric/internal/src/lib-nodejs/gc-and-finalize.js';
-import { kslot } from '../lib/kmarshal.js';
+import { kslot, krefOf } from '../lib/kmarshal.js';
 import { insistStorageAPI } from '../lib/storageAPI.js';
 import {
   buildKernelBundle,
@@ -360,6 +360,7 @@ export async function makeSwingsetController(
       kernelStorage.emitCrankHashes();
       return result;
     },
+
     vatNameToID(vatName) {
       return kernel.vatNameToID(vatName);
     },
@@ -371,13 +372,15 @@ export async function makeSwingsetController(
      * Queue a method call into the named vat
      *
      * @param {string} vatName
-     * @param {string} method
+     * @param {string|symbol} method
      * @param {unknown[]} args
      * @param {ResolutionPolicy} resultPolicy
      */
     queueToVatRoot(vatName, method, args = [], resultPolicy = 'ignore') {
       const vatID = kernel.vatNameToID(vatName);
-      assert.typeof(method, 'string');
+      if (typeof method !== 'symbol') {
+        assert.typeof(method, 'string');
+      }
       const kref = kernel.getRootObject(vatID);
       const kpid = kernel.queueToKref(kref, method, args, resultPolicy);
       if (kpid) {
@@ -387,6 +390,28 @@ export async function makeSwingsetController(
       return kpid;
     },
 
+    /**
+     * Queue a method call to an object represented by a kmarshal token
+     *
+     * @param {any} target
+     * @param {string|symbol} method
+     * @param {unknown[]} args
+     * @param {ResolutionPolicy} resultPolicy
+     */
+    queueToVatObject(target, method, args = [], resultPolicy = 'ignore') {
+      const targetKref = krefOf(target);
+      assert.typeof(targetKref, 'string');
+      if (typeof method !== 'symbol') {
+        assert.typeof(method, 'string');
+      }
+      const kpid = kernel.queueToKref(targetKref, method, args, resultPolicy);
+      if (kpid) {
+        kernel.kpRegisterInterest(kpid);
+      }
+      kernelStorage.emitCrankHashes();
+      return kpid;
+    },
+
     upgradeStaticVat(vatName, shouldPauseFirst, bundleID, options = {}) {
       const vatID = kernel.vatNameToID(vatName);
       let pauseTarget = null;

package/src/kernel/kernelQueue.js

@@ -84,7 +84,7 @@ export function makeKernelQueueHandler(tools) {
    * by some other vat. This requires a kref as a target.
    *
    * @param {string} kref  Target of the message
-   * @param {string} method  The method name
+   * @param {string|symbol} method  The method name
    * @param {any[]} args  The arguments array
    * @param {ResolutionPolicy} [policy] How the kernel should handle an eventual
    *    resolution or rejection of the message's result promise. Should be

package/src/lib/kmarshal.js

@@ -1,6 +1,6 @@
 import { Far, passStyleOf } from '@endo/far';
 import { makeMarshal } from '@endo/marshal';
-import { assert } from '@agoric/assert';
+import { assert, Fail } from '@agoric/assert';
 
 // Simple wrapper for serializing and unserializing marshalled values inside the
 // kernel, where we don't actually want to use clists nor actually allocate real
@@ -9,10 +9,10 @@ import { assert } from '@agoric/assert';
 // agnostic about the internal details of the serialization encoding.
 
 /**
- * @typedef {{getKref: () => string, iface: () => string}} KCap
+ * @typedef {{getKref: () => string, iface: () => string} | Promise} KCap
  */
 
-const refMap = new WeakMap();
+const { toStringTag } = Symbol;
 
 /**
  * @param {string} kref
@@ -32,21 +32,26 @@ export const kslot = (kref, iface = 'undefined') => {
     kref.startsWith('lp') ||
     kref.startsWith('rp')
   ) {
-    // TODO: temporary hack because smallcaps encodes promise references
-    // differently from remotable object references, and the current version of
-    // the smallcaps decoder annoyingly insists that if the encoded body string
-    // says a slot is a promise, then convertSlotToVal had better by damn return
-    // an actual Promise, even if, as in the intended use case here, we neither
-    // want nor need a promise, nor the overhead of a map to keep track of it
-    // with.  This behavior is in service of defense against a hypothesized
-    // security issue whose exact nature has largely been forgotton in the
-    // months since it was first encountered.  MarkM is currently researching
-    // what the problem was thought to have been, to see if it is real and to
-    // understand it if so.  This will eventually result in either changes to
-    // the smallcaps encoding or to the marshal setup API to support the purely
-    // manipulative use case.  In the meantime, this ugliness...
-    const p = new Promise(() => undefined);
-    refMap.set(p, kref);
+    // Bizarro World hack for attaching a string property to a Promise, courtesy
+    // of MarkM.  Even though the @@toStringTag property nominally *is* a
+    // string, some unfortunate stuff in our hardened JS safety checks blows up
+    // if it actually is.  Eventually that will be fixed and we'll be able to
+    // use the @@toStringTag property directly, but for now we need to use this
+    // weird construct employing a sneaky getter function.  Note that this is
+    // only necessary in the first place because smallcaps encodes promise
+    // references differently from remotable object references, and the current
+    // version of the smallcaps decoder annoyingly insists that if the encoded
+    // body string says a slot is a promise, then convertSlotToVal had better by
+    // damn return an actual Promise, even if, as in the intended use case here,
+    // we neither want nor need a promise nor are capable of making any use of
+    // the fact that it is one.
+    const p = Promise.resolve(`${kref} stand in`);
+    // Bizarro World makes eslint hallucinate
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    Object.defineProperty(p, toStringTag, {
+      get: reveal => (reveal ? kref : NaN),
+      enumerable: false,
+    });
     return harden(p);
   } else {
     const o = Far(iface, {
@@ -62,20 +67,33 @@ export const kslot = (kref, iface = 'undefined') => {
  * @returns {string}
  */
 export const krefOf = obj => {
-  const fromMap = refMap.get(obj);
-  if (fromMap) {
-    return fromMap;
+  switch (passStyleOf(obj)) {
+    case 'promise': {
+      // Other half of Bizarro World hack for handling promises.  Note the
+      // peculiar way the @@toStringTag getter is used.
+      const desc = Object.getOwnPropertyDescriptor(obj, toStringTag);
+      assert(desc !== undefined, 'promise lacks toStringTag getter');
+      const getter = desc.get;
+      assert.typeof(getter, 'function', 'toStringTag getter is not a function');
+      // @ts-expect-error violates the norm that getters have zero parameters
+      const kref = getter(true);
+      assert.typeof(kref, 'string');
+      return kref;
+    }
+    case 'remotable': {
+      const getKref = obj.getKref;
+      assert.typeof(getKref, 'function', 'object lacks getKref function');
+      return getKref();
+    }
+    default:
+      // When krefOf() is called as part of kmarshal.serialize, marshal
+      // will only give it things that are 'remotable' (Promises and the
+      // Far objects created by kslot()).  When krefOf() is called by
+      // kernel code (as part of extractSingleSlot() or the vat-comms
+      // equivalent), it ought to throw if 'obj' is not one of the
+      // objects created by our kslot().
+      return Fail`krefOf requires a promise or remotable`;
   }
-  // When krefOf() is called as part of kmarshal.serialize, marshal
-  // will only give it things that are 'remotable' (Promises and the
-  // Far objects created by kslot()).  When krefOf() is called by
-  // kernel code (as part of extractSingleSlot() or the vat-comms
-  // equivalent), it ought to throw if 'obj' is not one of the Far
-  // objects created by our kslot().
-  assert.equal(passStyleOf(obj), 'remotable', obj);
-  const getKref = obj.getKref;
-  assert.typeof(getKref, 'function', 'object lacking getKref function');
-  return getKref();
 };
 
 const kmarshal = makeMarshal(krefOf, kslot, {

package/tools/bootstrap-relay.js

@@ -2,7 +2,6 @@ import { assert } from '@agoric/assert';
 import { objectMap } from '@agoric/internal';
 import { Far, E } from '@endo/far';
 import { buildManualTimer } from './manual-timer.js';
-import { makePassableEncoding } from './passableEncoding.js';
 
 const { Fail, quote: q } = assert;
 
@@ -13,8 +12,6 @@ export const buildRootObject = () => {
   const devicesByName = new Map();
   const callLogsByRemotable = new Map();
 
-  const { encodePassable, decodePassable } = makePassableEncoding();
-
   return Far('root', {
     bootstrap: async (vats, devices) => {
       vatAdmin = await E(vats.vatAdmin).createVatAdminService(devices.vatAdmin);
@@ -28,17 +25,16 @@ export const buildRootObject = () => {
       }
     },
 
-    getDevice: async deviceName =>
-      encodePassable(devicesByName.get(deviceName)),
+    getDevice: async deviceName => devicesByName.get(deviceName),
 
-    getVatAdmin: async () => encodePassable(vatAdmin),
+    getVatAdmin: async () => vatAdmin,
 
-    getTimer: async () => encodePassable(timer),
+    getTimer: async () => timer,
 
-    getVatRoot: async ({ name, rawOutput = false }) => {
-      const vat = vatData.get(name) || Fail`unknown vat name: ${q(name)}`;
+    getVatRoot: async vatName => {
+      const vat = vatData.get(vatName) || Fail`unknown vat name: ${q(vatName)}`;
       const { root } = vat;
-      return rawOutput ? root : encodePassable(root);
+      return root;
     },
 
     createVat: async ({ name, bundleCapName, vatParameters = {} }) => {
@@ -46,7 +42,7 @@ export const buildRootObject = () => {
       const options = { vatParameters };
       const { adminNode, root } = await E(vatAdmin).createVat(bcap, options);
       vatData.set(name, { adminNode, root });
-      return encodePassable(root);
+      return root;
     },
 
     upgradeVat: async ({ name, bundleCapName, vatParameters = {} }) => {
@@ -60,14 +56,11 @@ export const buildRootObject = () => {
 
     /**
      * Derives a remotable from an object by mapping each object property into a method that returns the value.
-     * This function is intended to be called from testing code outside of the vat environment,
-     * but methods of the returned remotable are intended to be called from *inside* that environment
-     * and therefore do not perform argument/response translation.
      *
      * @param {string} label
-     * @param {Record<string, any>} encodedMethodReturnValues
+     * @param {Record<string, any>} returnValues
      */
-    makeRemotable: (label, encodedMethodReturnValues) => {
+    makeRemotable: (label, returnValues) => {
       const callLogs = [];
       const makeGetterFunction = (value, name) => {
         const getValue = (...args) => {
@@ -76,51 +69,33 @@ export const buildRootObject = () => {
         };
         return getValue;
       };
-      const methodReturnValues = decodePassable(encodedMethodReturnValues);
       // `objectMap` hardens its result, but...
-      const methods = objectMap(methodReturnValues, makeGetterFunction);
+      const methods = objectMap(returnValues, makeGetterFunction);
       // ... `Far` requires its methods argument not to be hardened.
-      const unhardenedMethods = { ...methods };
-      const remotable = Far(label, unhardenedMethods);
+      const remotable = Far(label, { ...methods });
       callLogsByRemotable.set(remotable, callLogs);
-      return encodePassable(remotable);
+      return remotable;
     },
 
     /**
      * Returns a copy of a remotable's logs.
      *
-     * @param {object} encodedRemotable
+     * @param {object} remotable
      */
-    getLogForRemotable: encodedRemotable => {
-      const remotable = decodePassable(encodedRemotable);
-      const decodedLogs =
+    getLogForRemotable: remotable => {
+      const logs =
         callLogsByRemotable.get(remotable) ||
         Fail`logs not found for ${q(remotable)}`;
       // Return a copy so that the original remains mutable.
-      return encodePassable(harden([...decodedLogs]));
-    },
-
-    messageVat: async ({ name, methodName, args = [] }) => {
-      const vat = vatData.get(name) || Fail`unknown vat name: ${q(name)}`;
-      const { root } = vat;
-      const decodedArgs = args.map(decodePassable);
-      const result = await E(root)[methodName](...decodedArgs);
-      return encodePassable(result);
-    },
-
-    messageVatObject: async ({ presence, methodName, args = [] }) => {
-      const object = decodePassable(presence);
-      const decodedArgs = args.map(decodePassable);
-      const result = await E(object)[methodName](...decodedArgs);
-      return encodePassable(result);
+      return harden([...logs]);
     },
 
-    awaitVatObject: async ({ presence, path = [], rawOutput = false }) => {
-      let value = await decodePassable(presence);
+    awaitVatObject: async (presence, path = []) => {
+      let value = await presence;
       for (const key of path) {
         value = await value[key];
       }
-      return rawOutput ? value : encodePassable(value);
+      return value;
     },
   });
 };

package/tools/passableEncoding.js

@@ -1,81 +0,0 @@
-import { assert } from '@agoric/assert';
-import { E } from '@endo/far';
-import { isObject, makeMarshal } from '@endo/marshal';
-
-const { Fail, quote: q } = assert;
-
-const noop = () => {};
-
-// TODO define these somewhere more accessible. https://github.com/endojs/endo/issues/1488
-/**
- * @typedef {import('@endo/eventual-send').FarRef<unknown>} PassByRef
- * Gets transformed by a marshaller encoding.
- * As opposed to pass-by-copy
- */
-
-export const makePassableEncoding = () => {
-  // Represent all data as passable by replacing non-passable values
-  // with special-prefix registered symbols.
-  /** @type {Map<symbol, PassByRef>} */
-  const replaced = new Map();
-  /** @type {Map<PassByRef, symbol>} */
-  const replacements = new Map(); // inverse of 'replaced'
-
-  // This is testing code, so we don't enforce absence of this prefix
-  // from manually created symbols.
-  const replacementPrefix = 'replaced:';
-  const provideReplacement = value => {
-    const extant = replacements.get(value);
-    if (extant) {
-      return extant;
-    }
-
-    const replacement = Symbol.for(`${replacementPrefix}${replaced.size}`);
-    replacements.set(value, replacement);
-    replaced.set(replacement, value);
-
-    // Suppress unhandled promise rejection warnings.
-    void E.when(value, noop, noop);
-
-    return replacement;
-  };
-  const { serialize: encodeReplacements } = makeMarshal(
-    provideReplacement,
-    undefined,
-    {
-      marshalSaveError: () => {},
-      serializeBodyFormat: 'capdata',
-    },
-  );
-  const { unserialize: decodeReplacements } = makeMarshal(
-    undefined,
-    undefined,
-    {
-      serializeBodyFormat: 'capdata',
-    },
-  );
-  const encodePassable = value => decodeReplacements(encodeReplacements(value));
-  const decodePassable = arg => {
-    // Recursively replace our symbols with their non-passable source data.
-    if (Array.isArray(arg)) {
-      return arg.map(decodePassable);
-    } else if (isObject(arg)) {
-      const entries = Object.entries(arg);
-      const decodedEntries = entries.map(([key, value]) => [
-        key,
-        decodePassable(value),
-      ]);
-      return Object.fromEntries(decodedEntries);
-    } else if (
-      typeof arg !== 'symbol' ||
-      !Symbol.keyFor(arg) ||
-      !arg.description?.startsWith(replacementPrefix)
-    ) {
-      return arg;
-    }
-    const value =
-      replaced.get(arg) || Fail`no value for replacement: ${q(arg)}`;
-    return value;
-  };
-  return { encodePassable, decodePassable };
-};