@yourrealm/sdk 0.0.0-alpha.1378.ce03c8dc → 0.0.0-alpha.1380.bdd09a9f

package/dist/cli.js

@@ -1543,14 +1543,20 @@ var gateResultSchema = z2.discriminatedUnion("kind", [
   })
 ]);
 var asyncModulePromise = null;
+var asyncModule = null;
 function loadAsyncModule() {
   if (!asyncModulePromise) {
     const pending = newQuickJSAsyncWASMModuleFromVariant(
       import("@jitl/quickjs-wasmfile-release-asyncify")
     );
-    pending.catch(() => {
-      if (asyncModulePromise === pending) asyncModulePromise = null;
-    });
+    pending.then(
+      (mod) => {
+        asyncModule = mod;
+      },
+      () => {
+        if (asyncModulePromise === pending) asyncModulePromise = null;
+      }
+    );
     asyncModulePromise = pending;
   }
   return asyncModulePromise;
@@ -1558,9 +1564,20 @@ function loadAsyncModule() {
 async function createVmInstance(opts) {
   const QuickJS = await loadAsyncModule();
   const suspends = Object.keys(opts.hostFns ?? {}).length > 0;
-  const runtime = suspends ? null : QuickJS.newRuntime();
-  const vm = runtime ? runtime.newContext() : QuickJS.newContext();
+  const runtime = QuickJS.newRuntime();
+  const vm = runtime.newContext();
   vm.runtime.setMemoryLimit(32 * 1024 * 1024);
+  const hostFnNames = Object.keys(opts.hostFns ?? {});
+  function freeVm() {
+    if (hostFnNames.length > 0) {
+      const names = [...hostFnNames, "__app", "__realm_module__"];
+      const release = vm.evalCode(names.map((n) => `globalThis.${n} = undefined;`).join("\n"));
+      if (release.error) release.error.dispose();
+      else release.value.dispose();
+    }
+    vm.dispose();
+    runtime.dispose();
+  }
   for (const [name, fn] of Object.entries(opts.hostFns ?? {})) {
     const hostFn = vm.newAsyncifiedFunction(
       name,
@@ -1577,8 +1594,7 @@ async function createVmInstance(opts) {
   if (init.error) {
     const err = vm.dump(init.error);
     init.error.dispose();
-    vm.dispose();
-    runtime?.dispose();
+    freeVm();
     throw new RealmCompileError({
       kind: "eval",
       message: typeof err === "string" ? err : JSON.stringify(err)
@@ -1625,8 +1641,7 @@ async function createVmInstance(opts) {
       disposing = true;
       await queue.catch(() => {
       });
-      vm.dispose();
-      runtime?.dispose();
+      freeVm();
     }
   };
 }

package/dist/test.js

@@ -1257,14 +1257,20 @@ var gateResultSchema = z.discriminatedUnion("kind", [
   })
 ]);
 var asyncModulePromise = null;
+var asyncModule = null;
 function loadAsyncModule() {
   if (!asyncModulePromise) {
     const pending = newQuickJSAsyncWASMModuleFromVariant(
       import("@jitl/quickjs-wasmfile-release-asyncify")
     );
-    pending.catch(() => {
-      if (asyncModulePromise === pending) asyncModulePromise = null;
-    });
+    pending.then(
+      (mod) => {
+        asyncModule = mod;
+      },
+      () => {
+        if (asyncModulePromise === pending) asyncModulePromise = null;
+      }
+    );
     asyncModulePromise = pending;
   }
   return asyncModulePromise;
@@ -1272,9 +1278,20 @@ function loadAsyncModule() {
 async function createVmInstance(opts) {
   const QuickJS = await loadAsyncModule();
   const suspends = Object.keys(opts.hostFns ?? {}).length > 0;
-  const runtime = suspends ? null : QuickJS.newRuntime();
-  const vm = runtime ? runtime.newContext() : QuickJS.newContext();
+  const runtime = QuickJS.newRuntime();
+  const vm = runtime.newContext();
   vm.runtime.setMemoryLimit(32 * 1024 * 1024);
+  const hostFnNames = Object.keys(opts.hostFns ?? {});
+  function freeVm() {
+    if (hostFnNames.length > 0) {
+      const names = [...hostFnNames, "__app", "__realm_module__"];
+      const release = vm.evalCode(names.map((n) => `globalThis.${n} = undefined;`).join("\n"));
+      if (release.error) release.error.dispose();
+      else release.value.dispose();
+    }
+    vm.dispose();
+    runtime.dispose();
+  }
   for (const [name, fn] of Object.entries(opts.hostFns ?? {})) {
     const hostFn = vm.newAsyncifiedFunction(
       name,
@@ -1291,8 +1308,7 @@ async function createVmInstance(opts) {
   if (init.error) {
     const err = vm.dump(init.error);
     init.error.dispose();
-    vm.dispose();
-    runtime?.dispose();
+    freeVm();
     throw new RealmCompileError({
       kind: "eval",
       message: typeof err === "string" ? err : JSON.stringify(err)
@@ -1339,8 +1355,7 @@ async function createVmInstance(opts) {
       disposing = true;
       await queue.catch(() => {
       });
-      vm.dispose();
-      runtime?.dispose();
+      freeVm();
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yourrealm/sdk",
-  "version": "0.0.0-alpha.1378.ce03c8dc",
+  "version": "0.0.0-alpha.1380.bdd09a9f",
   "description": "The Realm SDK: createApp, the r.* permission factories, the ui surface, the realm-sdk CLI and test harness.",
   "license": "AGPL-3.0-only WITH Classpath-exception-2.0",
   "repository": {

package/src/compile.ts

@@ -20,6 +20,7 @@ export {
   sweepExecuteCache,
   runAppGate,
   disposeAllVms,
+  sandboxArenaBytes,
   stitchLoaderRequests,
   snapshot,
   nestByPaths,

package/src/sandbox.ts

@@ -759,6 +759,19 @@ interface VmInstance {
 }
 
 let asyncModulePromise: ReturnType<typeof newQuickJSAsyncWASMModuleFromVariant> | null = null;
+let asyncModule: Awaited<ReturnType<typeof newQuickJSAsyncWASMModuleFromVariant>> | null = null;
+
+/**
+ * Bytes of WebAssembly linear memory the QuickJS module holds, or `null` before
+ * the first eval loads it. This is the sandbox's true footprint: every runtime
+ * mallocs out of this one arena, and the arena only ever grows - Emscripten
+ * cannot hand pages back - so the number is the peak concurrent demand plus
+ * anything a dispose failed to free. V8 does not count it under `external`, so
+ * it is otherwise invisible in `Deno.memoryUsage()`.
+ */
+export function sandboxArenaBytes(): number | null {
+  return asyncModule ? asyncModule.getWasmMemory().buffer.byteLength : null;
+}
 
 // Memoize the async WASM module load (shared by runInSandbox + the gate), but
 // never cache a rejection: a transient load failure must not permanently wedge
@@ -773,9 +786,14 @@ function loadAsyncModule(): ReturnType<typeof newQuickJSAsyncWASMModuleFromVaria
     const pending = newQuickJSAsyncWASMModuleFromVariant(
       import("@jitl/quickjs-wasmfile-release-asyncify"),
     );
-    pending.catch(() => {
-      if (asyncModulePromise === pending) asyncModulePromise = null;
-    });
+    pending.then(
+      (mod) => {
+        asyncModule = mod;
+      },
+      () => {
+        if (asyncModulePromise === pending) asyncModulePromise = null;
+      },
+    );
     asyncModulePromise = pending;
   }
   return asyncModulePromise;
@@ -802,22 +820,41 @@ async function createVmInstance(opts: {
   const QuickJS = await loadAsyncModule();
   const suspends = Object.keys(opts.hostFns ?? {}).length > 0;
 
-  // Creation and disposal differ by mode, and the two must match:
-  //  - Sync VMs (no host fns: the cold extracts + widget prefill) own their
-  //    runtime explicitly so dispose() can call `runtime.dispose()` and RECLAIM
-  //    the WASM heap. The shorthand `QuickJS.newContext()` + `context.dispose()`
-  //    does NOT reclaim the runtime in quickjs-emscripten 0.32: every
-  //    create/dispose leaks ~5MB, which over a control plane's recompute
-  //    bursts climbs into gigabytes until `WebAssembly.Memory.grow()` fails
-  //    and every eval OOMs.
-  //  - Asyncify VMs (host fns: the gate's `stableSecret`) must use
-  //    `QuickJS.newContext()`, whose single `vm.dispose()` frees the host fn's
-  //    runtime-scoped HostRef in the right order; disposing an explicit runtime
-  //    there double-frees the HostRef and throws. These are warm-pooled and
-  //    disposed rarely, so the (unreclaimed) heap doesn't accumulate.
-  const runtime = suspends ? null : QuickJS.newRuntime();
-  const vm = runtime ? runtime.newContext() : QuickJS.newContext();
+  // Every VM owns its runtime explicitly, whichever eval mode it runs in. The
+  // shorthand `QuickJS.newContext()` leaves its runtime alive after
+  // `context.dispose()` in quickjs-emscripten 0.32, and the WASM arena those
+  // runtimes sit in never shrinks: each create/dispose then pins ~5MB for the
+  // life of the process. Home's gate VMs churned through that path once per
+  // idle-out and grew the arena by ~700MB in a day and a half (on a 2GB
+  // ceiling, past which every eval OOMs). See `freeVm` for the dispose order
+  // the explicit runtime needs when host fns are bound.
+  const runtime = QuickJS.newRuntime();
+  const vm = runtime.newContext();
   vm.runtime.setMemoryLimit(32 * 1024 * 1024); // 32 MB
+  const hostFnNames = Object.keys(opts.hostFns ?? {});
+
+  // Free the context and its runtime, in the order the host fns need. A bound
+  // host fn is a QuickJS function object whose finalizer calls back into the
+  // module to free its HostRef, looked up by runtime. When that object is still
+  // reachable while `vm.dispose()` tears the context down, the lookup fails
+  // ("QuickJSRuntime not found when trying to free HostRef"), the dispose throws
+  // half-way and the runtime is never freed. Dropping every global that can
+  // reach a host fn first lets the refcount hit zero and the finalizer run while
+  // the runtime is still registered; then both disposes complete. If
+  // `vm.dispose()` still throws, the runtime is deliberately left alone - a
+  // `runtime.dispose()` over a half-freed context aborts the whole Emscripten
+  // module - so that path leaks one VM rather than wedging every later eval.
+  function freeVm(): void {
+    if (hostFnNames.length > 0) {
+      const names = [...hostFnNames, "__app", "__realm_module__"];
+      const release = vm.evalCode(names.map((n) => `globalThis.${n} = undefined;`).join("\n"));
+      if (release.error) release.error.dispose();
+      else release.value.dispose();
+    }
+    vm.dispose();
+    runtime.dispose();
+  }
+
   for (const [name, fn] of Object.entries(opts.hostFns ?? {})) {
     const hostFn = vm.newAsyncifiedFunction(name, async (argHandle) =>
       vm.newString(await fn(vm.getString(argHandle))),
@@ -836,8 +873,7 @@ async function createVmInstance(opts: {
   if (init.error) {
     const err = vm.dump(init.error);
     init.error.dispose();
-    vm.dispose();
-    runtime?.dispose();
+    freeVm();
     throw new RealmCompileError({
       kind: "eval",
       message: typeof err === "string" ? err : JSON.stringify(err),
@@ -891,8 +927,7 @@ async function createVmInstance(opts: {
       // dispose mid-call (an eviction during a suspended host fn) would otherwise
       // resume the asyncified eval into a freed context and hang.
       await queue.catch(() => {});
-      vm.dispose();
-      runtime?.dispose();
+      freeVm();
     },
   };
 }