@wasm-oj/server 0.2.0

package/crates/runtime-core/src/output.rs

@@ -0,0 +1,204 @@
+use std::io;
+use std::pin::Pin;
+use std::sync::{Arc, Mutex};
+use std::task::{Context, Poll};
+use tokio::io::{AsyncRead, AsyncSeek, AsyncWrite, ReadBuf};
+use virtual_fs::{FsError, VirtualFile};
+
+#[derive(Clone, Debug)]
+pub struct OutputCapture {
+    state: Arc<Mutex<State>>,
+    budget: OutputBudget,
+}
+
+#[derive(Debug)]
+struct State {
+    bytes: Vec<u8>,
+    exceeded: bool,
+}
+
+#[derive(Clone, Debug)]
+pub struct OutputBudget {
+    state: Arc<Mutex<BudgetState>>,
+}
+
+#[derive(Debug)]
+struct BudgetState {
+    used: usize,
+    limit: usize,
+    exceeded: bool,
+}
+
+impl OutputCapture {
+    pub fn new(budget: OutputBudget, special_fd: u32) -> (Self, CappedOutput) {
+        let capture = Self {
+            state: Arc::new(Mutex::new(State {
+                bytes: Vec::new(),
+                exceeded: false,
+            })),
+            budget,
+        };
+        let file = CappedOutput {
+            state: capture.state.clone(),
+            budget: capture.budget.clone(),
+            special_fd: Some(special_fd),
+        };
+        (capture, file)
+    }
+
+    pub fn bytes(&self) -> Vec<u8> {
+        self.state
+            .lock()
+            .expect("output capture lock poisoned")
+            .bytes
+            .clone()
+    }
+
+    pub fn exceeded(&self) -> bool {
+        self.state
+            .lock()
+            .expect("output capture lock poisoned")
+            .exceeded
+            || self.budget.exceeded()
+    }
+
+    pub fn file(&self, special_fd: u32) -> CappedOutput {
+        CappedOutput {
+            state: self.state.clone(),
+            budget: self.budget.clone(),
+            special_fd: Some(special_fd),
+        }
+    }
+}
+
+impl OutputBudget {
+    pub fn new(limit: usize) -> Self {
+        Self {
+            state: Arc::new(Mutex::new(BudgetState {
+                used: 0,
+                limit,
+                exceeded: false,
+            })),
+        }
+    }
+
+    fn exceeded(&self) -> bool {
+        self.state
+            .lock()
+            .expect("output budget lock poisoned")
+            .exceeded
+    }
+}
+
+#[derive(Debug)]
+pub struct CappedOutput {
+    state: Arc<Mutex<State>>,
+    budget: OutputBudget,
+    special_fd: Option<u32>,
+}
+
+impl AsyncWrite for CappedOutput {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        input: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        let mut budget = self
+            .budget
+            .state
+            .lock()
+            .expect("output budget lock poisoned");
+        let remaining = budget.limit.saturating_sub(budget.used);
+        let mut state = self.state.lock().expect("output capture lock poisoned");
+        if input.len() > remaining {
+            state.bytes.extend_from_slice(&input[..remaining]);
+            state.exceeded = true;
+            budget.used = budget.limit;
+            budget.exceeded = true;
+            return Poll::Ready(Err(io::Error::new(
+                io::ErrorKind::FileTooLarge,
+                "output limit exceeded",
+            )));
+        }
+        state.bytes.extend_from_slice(input);
+        budget.used += input.len();
+        Poll::Ready(Ok(input.len()))
+    }
+
+    fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+
+    fn poll_shutdown(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+}
+
+impl AsyncRead for CappedOutput {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        _buffer: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+}
+
+impl AsyncSeek for CappedOutput {
+    fn start_seek(self: Pin<&mut Self>, _position: io::SeekFrom) -> io::Result<()> {
+        Ok(())
+    }
+
+    fn poll_complete(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<u64>> {
+        Poll::Ready(Ok(0))
+    }
+}
+
+impl VirtualFile for CappedOutput {
+    fn last_accessed(&self) -> u64 {
+        0
+    }
+    fn last_modified(&self) -> u64 {
+        0
+    }
+    fn created_time(&self) -> u64 {
+        0
+    }
+    fn size(&self) -> u64 {
+        0
+    }
+
+    fn set_len(&mut self, _new_size: u64) -> Result<(), FsError> {
+        // stdout/stderr are streams; WASI metadata updates must not allocate.
+        Ok(())
+    }
+
+    fn unlink(&mut self) -> Result<(), FsError> {
+        Ok(())
+    }
+
+    fn get_special_fd(&self) -> Option<u32> {
+        self.special_fd
+    }
+
+    fn poll_read_ready(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<usize>> {
+        Poll::Ready(Ok(0))
+    }
+
+    fn poll_write_ready(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<usize>> {
+        let budget = self
+            .budget
+            .state
+            .lock()
+            .expect("output budget lock poisoned");
+        let remaining = budget.limit.saturating_sub(budget.used);
+        if remaining == 0 {
+            Poll::Ready(Err(io::Error::new(
+                io::ErrorKind::FileTooLarge,
+                "output limit exceeded",
+            )))
+        } else {
+            Poll::Ready(Ok(remaining.min(8_192)))
+        }
+    }
+}

package/crates/runtime-core/src/run/mod.rs

@@ -0,0 +1,208 @@
+use crate::{ResourcePolicy, RunError, RunRequest, RunResult};
+use std::collections::BTreeMap;
+
+pub(crate) const MAX_MOUNTED_FILES: usize = 32_768;
+pub(crate) const MAX_MOUNTED_FILE_BYTES: usize = 256 * 1024 * 1024;
+pub(crate) const MAX_MOUNTED_FILES_BYTES: usize = 512 * 1024 * 1024;
+pub(crate) const MAX_FILESYSTEM_WRITE_BYTES: u64 = 512 * 1024 * 1024;
+pub(crate) const MAX_FILESYSTEM_ENTRIES: u64 = 65_536;
+pub(crate) const MAX_LOGICAL_TIME_LIMIT_MS: u64 = 9_007_199_254;
+pub(crate) const MAX_REALTIME_EPOCH_MS: u64 = 18_446_744_073_000;
+pub(crate) const MAX_CLOCK_STEP_NS: u64 = 1_000_000_000;
+
+#[cfg(not(target_arch = "wasm32"))]
+mod native;
+#[cfg(target_arch = "wasm32")]
+mod web;
+#[cfg(target_arch = "wasm32")]
+pub(crate) mod web_runtime;
+
+pub fn run(request: RunRequest) -> Result<RunResult, RunError> {
+    validate(&request)?;
+    #[cfg(not(target_arch = "wasm32"))]
+    return native::run(request);
+    #[cfg(target_arch = "wasm32")]
+    return web::run(request);
+}
+
+fn validate(request: &RunRequest) -> Result<(), RunError> {
+    validate_resource_policy(&request.resources, "")?;
+    validate_mounted_files(&request.files, "")?;
+    validate_determinism(&request.determinism)?;
+    if request.startup_entropy_bytes > 4_096 {
+        return Err(RunError::InvalidRequest(
+            "startupEntropyBytes must be at most 4096".to_string(),
+        ));
+    }
+    if let Some(cwd) = &request.cwd
+        && !crate::filesystem::is_normalized_guest_path(cwd)
+    {
+        return Err(RunError::InvalidRequest(
+            "cwd must be an absolute normalized guest path".to_string(),
+        ));
+    }
+    if request.output_paths.len() > 256 {
+        return Err(RunError::InvalidRequest(
+            "outputPaths may contain at most 256 entries".to_string(),
+        ));
+    }
+    let mut preceding: Option<&str> = None;
+    for path in &request.output_paths {
+        if !crate::filesystem::is_normalized_guest_path(path) || path == "/" {
+            return Err(RunError::InvalidRequest(format!(
+                "output path must be an absolute normalized file path: {path}"
+            )));
+        }
+        if preceding.is_some_and(|value| value >= path.as_str()) {
+            return Err(RunError::InvalidRequest(
+                "outputPaths must be sorted and unique".to_string(),
+            ));
+        }
+        preceding = Some(path);
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_determinism(determinism: &crate::DeterminismConfig) -> Result<(), RunError> {
+    if determinism.random_seed > u32::MAX as u64 {
+        return Err(RunError::InvalidRequest(
+            "randomSeed must fit an unsigned 32-bit integer".to_string(),
+        ));
+    }
+    if determinism.realtime_epoch_ms > MAX_REALTIME_EPOCH_MS {
+        return Err(RunError::InvalidRequest(format!(
+            "realtimeEpochMs must be in 0..={MAX_REALTIME_EPOCH_MS}"
+        )));
+    }
+    if determinism.clock_step_ns == 0 || determinism.clock_step_ns > MAX_CLOCK_STEP_NS {
+        return Err(RunError::InvalidRequest(format!(
+            "clockStepNs must be in 1..={MAX_CLOCK_STEP_NS}"
+        )));
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_resource_policy(
+    resources: &ResourcePolicy,
+    label: &str,
+) -> Result<(), RunError> {
+    let prefix = if label.is_empty() {
+        String::new()
+    } else {
+        format!("{label} ")
+    };
+    if resources.instruction_budget == 0 || resources.instruction_budget > i64::MAX as u64 {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}instructionBudget must be in 1..=i64::MAX"
+        )));
+    }
+    if resources.logical_time_limit_ms == 0
+        || resources.logical_time_limit_ms > MAX_LOGICAL_TIME_LIMIT_MS
+    {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}logicalTimeLimitMs must be in 1..={MAX_LOGICAL_TIME_LIMIT_MS}"
+        )));
+    }
+    if resources.memory_limit_bytes == 0 || !resources.memory_limit_bytes.is_multiple_of(65_536) {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}memoryLimitBytes must be a positive multiple of 64 KiB"
+        )));
+    }
+    if resources.output_limit_bytes == 0 || usize::try_from(resources.output_limit_bytes).is_err() {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}outputLimitBytes is not representable on this host"
+        )));
+    }
+    if resources.filesystem_write_limit_bytes == 0
+        || resources.filesystem_write_limit_bytes > MAX_FILESYSTEM_WRITE_BYTES
+        || usize::try_from(resources.filesystem_write_limit_bytes).is_err()
+    {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}filesystemWriteLimitBytes must be in 1..={MAX_FILESYSTEM_WRITE_BYTES}"
+        )));
+    }
+    if resources.filesystem_entry_limit == 0
+        || resources.filesystem_entry_limit > MAX_FILESYSTEM_ENTRIES
+        || usize::try_from(resources.filesystem_entry_limit).is_err()
+    {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}filesystemEntryLimit must be in 1..={MAX_FILESYSTEM_ENTRIES}"
+        )));
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_mounted_files(
+    files: &BTreeMap<String, serde_bytes::ByteBuf>,
+    label: &str,
+) -> Result<(), RunError> {
+    let prefix = if label.is_empty() {
+        String::new()
+    } else {
+        format!("{label} ")
+    };
+    if files.len() > MAX_MOUNTED_FILES {
+        return Err(RunError::InvalidRequest(format!(
+            "{prefix}mounted files exceed the {MAX_MOUNTED_FILES}-entry limit"
+        )));
+    }
+    let mut total = 0usize;
+    for (path, contents) in files {
+        if contents.len() > MAX_MOUNTED_FILE_BYTES {
+            return Err(RunError::InvalidRequest(format!(
+                "{prefix}mounted file '{path}' exceeds {MAX_MOUNTED_FILE_BYTES} bytes"
+            )));
+        }
+        total = total.checked_add(contents.len()).ok_or_else(|| {
+            RunError::InvalidRequest(format!("{prefix}mounted file size overflows host range"))
+        })?;
+        if total > MAX_MOUNTED_FILES_BYTES {
+            return Err(RunError::InvalidRequest(format!(
+                "{prefix}mounted files exceed {MAX_MOUNTED_FILES_BYTES} total bytes"
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn canonical_trap_message(message: &str) -> String {
+    let mut root = message.trim().lines().next().unwrap_or_default().trim();
+    loop {
+        let unwrapped = ["RuntimeError: ", "js: ", "user: "]
+            .iter()
+            .find_map(|prefix| root.strip_prefix(prefix));
+        let Some(unwrapped) = unwrapped else {
+            break;
+        };
+        root = unwrapped.trim_start();
+    }
+    if root.is_empty() {
+        "RuntimeError".to_string()
+    } else {
+        format!("RuntimeError: {root}")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::canonical_trap_message;
+
+    #[test]
+    fn removes_native_and_javascript_runtime_wrappers_from_traps() {
+        let root = "WASM-OJ denied nondeterministic capability wasix_32v1.thread_spawn";
+        assert_eq!(
+            canonical_trap_message(&format!("RuntimeError: {root}")),
+            format!("RuntimeError: {root}")
+        );
+        assert_eq!(
+            canonical_trap_message(&format!("RuntimeError: js: RuntimeError: user: {root}")),
+            format!("RuntimeError: {root}")
+        );
+        assert_eq!(
+            canonical_trap_message(&format!(
+                "RuntimeError: {root}\n    at <unnamed> (<module>[4]:0x1a4)"
+            )),
+            format!("RuntimeError: {root}")
+        );
+    }
+}

package/crates/runtime-core/src/run/native.rs

@@ -0,0 +1,260 @@
+use crate::capabilities::attach_capability_denials;
+use crate::deterministic::{VirtualClock, attach_deterministic_imports};
+use crate::filesystem::{read_files_bounded, runtime_project_files};
+use crate::memory::LimitingTunables;
+use crate::meter::{CostPoints, METER_MODEL, instrument_wasm, meter_state, remaining_points};
+use crate::module_imports::attach_imported_memory;
+use crate::module_policy::{DEFERRED_START_EXPORT, defer_start_section, enforce_memory_limit};
+use crate::output::{OutputBudget, OutputCapture};
+use crate::{ExecutionMetrics, ExecutionTermination, RunError, RunRequest, RunResult};
+use std::io::Write;
+use std::sync::{Arc, Mutex};
+use wasmer::sys::{BaseTunables, Cranelift, NativeEngineExt, Target};
+use wasmer::{Engine, Instance, Memory, Module, Pages, Store};
+use wasmer_wasix::{
+    Pipe, WasiEnv, WasiError, WasiModuleInstanceHandles, WasiModuleTreeHandles, wasmer_wasix_types,
+};
+
+pub fn run(request: RunRequest) -> Result<RunResult, RunError> {
+    let runtime = if tokio::runtime::Handle::try_current().is_err() {
+        Some(
+            tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .map_err(|error| {
+                    RunError::Runtime(format!("failed to initialize Tokio: {error}"))
+                })?,
+        )
+    } else {
+        None
+    };
+    let _runtime_guard = runtime.as_ref().map(tokio::runtime::Runtime::enter);
+    run_in_runtime(request)
+}
+
+fn run_in_runtime(request: RunRequest) -> Result<RunResult, RunError> {
+    let limited = enforce_memory_limit(&request.wasm, request.resources.memory_limit_bytes)
+        .map_err(RunError::Compile)?;
+    let metered = instrument_wasm(&limited, request.resources.instruction_budget)
+        .map_err(RunError::Compile)?;
+    let executable = defer_start_section(&metered.wasm).map_err(RunError::Compile)?;
+
+    let pages = u32::try_from(request.resources.memory_limit_bytes / 65_536).map_err(|_| {
+        RunError::InvalidRequest("memory limit exceeds Wasmer page range".to_string())
+    })?;
+    let base = BaseTunables::for_target(&Target::default());
+    let mut engine: Engine = Cranelift::default().into();
+    engine.set_tunables(LimitingTunables::new(base, Pages(pages)));
+    let wasi_engine = engine.clone();
+    let mut store = Store::new(engine);
+    let module = Module::new(&store, &executable.wasm).map_err(|error| {
+        RunError::Compile(format!("failed to compile instrumented module: {error}"))
+    })?;
+
+    let (mut stdin_writer, stdin_reader) = Pipe::channel();
+    stdin_writer
+        .write_all(&request.stdin)
+        .map_err(|error| RunError::Io(error.to_string()))?;
+    drop(stdin_writer);
+
+    let output_limit = usize::try_from(request.resources.output_limit_bytes)
+        .map_err(|_| RunError::InvalidRequest("output limit exceeds host range".to_string()))?;
+    let output_budget = OutputBudget::new(output_limit);
+    let (stdout_capture, stdout_file) = OutputCapture::new(output_budget.clone(), 1);
+    let (stderr_capture, stderr_file) = OutputCapture::new(output_budget, 2);
+
+    let project_filesystem = runtime_project_files(
+        &request.files,
+        &request.output_paths,
+        &request.determinism,
+        &request.resources,
+    )?;
+    let filesystem = project_filesystem.filesystem();
+    let mut builder = WasiEnv::builder("app")
+        .engine(wasi_engine)
+        .args(request.args.clone())
+        .envs(request.env.clone())
+        .stdin(Box::new(stdin_reader))
+        .stdout(Box::new(stdout_file))
+        .stderr(Box::new(stderr_file))
+        .fs(filesystem.clone());
+    builder
+        .add_preopen_build(|directory| directory.directory("/").read(true).write(true).create(true))
+        .map_err(|error| {
+            RunError::InvalidRequest(format!("failed to preopen guest filesystem: {error}"))
+        })?;
+    if let Some(cwd) = &request.cwd {
+        builder.set_current_dir(cwd);
+    }
+    let mut sandbox = builder.finalize(&mut store).map_err(|error| {
+        RunError::Compile(format!("failed to finalize WASI environment: {error}"))
+    })?;
+    let mut imports = sandbox
+        .import_object_for_all_wasi_versions(&mut store, &module)
+        .map_err(|error| RunError::Compile(format!("failed to create WASI imports: {error}")))?;
+    let memory_slot: Arc<Mutex<Option<Memory>>> = Arc::new(Mutex::new(None));
+    let clock = VirtualClock::new(
+        &request.determinism,
+        request.resources.logical_time_limit_ms,
+    );
+    attach_deterministic_imports(
+        &mut store,
+        &mut imports,
+        memory_slot.clone(),
+        &request.determinism,
+        clock.clone(),
+        request.startup_entropy_bytes,
+    );
+    attach_capability_denials(&mut store, &module, &mut imports).map_err(RunError::Compile)?;
+    let imported_memory =
+        attach_imported_memory(&mut store, &module, &mut imports).map_err(RunError::Compile)?;
+
+    let instance = Instance::new(&mut store, &module, &imports)
+        .map_err(|error| RunError::Compile(format!("failed to instantiate module: {error}")))?;
+    let meter = meter_state(&mut store, &instance).map_err(RunError::Runtime)?;
+    let guest_memory = instance
+        .exports
+        .get_memory("memory")
+        .cloned()
+        .ok()
+        .or(imported_memory)
+        .ok_or_else(|| RunError::Compile("module has no guest linear memory".to_string()))?;
+    *memory_slot
+        .lock()
+        .map_err(|error| RunError::Runtime(error.to_string()))? = Some(guest_memory.clone());
+    let handles = WasiModuleTreeHandles::Static(WasiModuleInstanceHandles::new(
+        guest_memory.clone(),
+        &store,
+        instance.clone(),
+        None,
+    ));
+    sandbox
+        .initialize_handles_and_layout(&mut store, instance.clone(), handles, None, true)
+        .map_err(|error| {
+            RunError::Compile(format!("failed to initialize WASI instance: {error}"))
+        })?;
+
+    let start = instance
+        .exports
+        .get_function("_start")
+        .map_err(|error| RunError::Compile(format!("module has no _start function: {error}")))?;
+    let execution = if executable.has_deferred_start {
+        let initializer = instance
+            .exports
+            .get_function(DEFERRED_START_EXPORT)
+            .map_err(|error| {
+                RunError::Runtime(format!("deferred start function is unavailable: {error}"))
+            })?;
+        match initializer.call(&mut store, &[]) {
+            Ok(_) => start.call(&mut store, &[]),
+            Err(error) => Err(error),
+        }
+    } else {
+        start.call(&mut store, &[])
+    };
+
+    let stdout = stdout_capture.bytes();
+    let stderr = stderr_capture.bytes();
+    let mut output_exceeded = stdout_capture.exceeded() || stderr_capture.exceeded();
+    let remaining = remaining_points(&mut store, &meter).map_err(RunError::Runtime)?;
+    let logical_time_exceeded = clock.limit_exceeded()?;
+
+    let mut code = 0;
+    let mut termination = ExecutionTermination::Exited;
+    let mut trap_message = None;
+    if let Err(error) = execution {
+        if let Some(wasi_error) = crate::wasi_error(&error) {
+            match wasi_error {
+                WasiError::Exit(exit) => {
+                    let errno: wasmer_wasix_types::wasi::Errno = (*exit).into();
+                    if errno != wasmer_wasix_types::wasi::Errno::Success {
+                        code = errno as i32;
+                        termination = ExecutionTermination::Exited;
+                    }
+                }
+                WasiError::UnknownWasiVersion => {
+                    return Err(RunError::WasiUnsupported(
+                        "unknown WASI version".to_string(),
+                    ));
+                }
+                WasiError::ThreadExit => {
+                    return Err(RunError::WasiUnsupported("thread exit".to_string()));
+                }
+                WasiError::DeepSleep(_) => {
+                    return Err(RunError::WasiUnsupported("deep sleep".to_string()));
+                }
+                WasiError::DlSymbolResolutionFailed(symbol) => {
+                    return Err(RunError::WasiUnsupported(format!(
+                        "unresolved symbol {symbol}"
+                    )));
+                }
+            }
+        } else {
+            trap_message = Some(super::canonical_trap_message(&error.to_string()));
+            termination = ExecutionTermination::Trap;
+            code = 1;
+        }
+    }
+
+    sandbox.on_exit(
+        &mut store,
+        Some(wasmer_wasix_types::wasi::Errno::Success.into()),
+    );
+    let captured_bytes = stdout.len().saturating_add(stderr.len());
+    let remaining_output = output_limit.saturating_sub(captured_bytes);
+    let (files, file_output_exceeded) =
+        read_files_bounded(&filesystem, &request.output_paths, remaining_output)?;
+    output_exceeded |= file_output_exceeded;
+
+    if project_filesystem.quota_exceeded() {
+        code = 137;
+        termination = ExecutionTermination::FilesystemLimit;
+    } else if output_exceeded {
+        code = 137;
+        termination = ExecutionTermination::OutputLimit;
+    } else if logical_time_exceeded {
+        code = 137;
+        termination = ExecutionTermination::LogicalTimeLimit;
+    } else if matches!(remaining, CostPoints::Exhausted) {
+        code = 137;
+        termination = ExecutionTermination::InstructionLimit;
+    }
+
+    let memory_bytes = u64::from(guest_memory.size(&store).0) * 65_536;
+    if memory_bytes > request.resources.memory_limit_bytes {
+        code = 137;
+        termination = ExecutionTermination::MemoryLimit;
+    }
+    if termination != ExecutionTermination::Trap {
+        trap_message = None;
+    }
+    let cost = match remaining {
+        CostPoints::Remaining(points) => {
+            request.resources.instruction_budget.saturating_sub(points)
+        }
+        CostPoints::Exhausted => request.resources.instruction_budget,
+    };
+
+    let filesystem_metrics = project_filesystem.metrics();
+    Ok(RunResult {
+        code,
+        metrics: ExecutionMetrics {
+            cost,
+            cost_model: METER_MODEL.to_string(),
+            operations: metered.operations,
+            memory_bytes,
+            logical_time_ns: clock.elapsed_ns()?,
+            filesystem_bytes: filesystem_metrics.bytes,
+            filesystem_entries: filesystem_metrics.entries,
+            stdout_bytes: stdout.len() as u64,
+            stderr_bytes: stderr.len() as u64,
+        },
+        stdout,
+        stderr,
+        files,
+        termination,
+        trap_message,
+        determinism: request.determinism,
+        resources: request.resources,
+    })
+}