Repository navigation
lua: add bounded read-only worker policy - #25
Merged
Merged
Conversation
SnowCheetos
marked this pull request as ready for review
October 14, 2026 19:04
SnowCheetos
requested review from
micro-perceptron
and
a balanced review from Copilot
October 14, 2026 19:04
micro-perceptron
approved these changes
Oct 14, 2026
There was a problem hiding this comment.
🟡 Changes recommended
Startup and dispatch policies can diverge, bypassing worker restrictions; result-limit gaps and interactive compatibility regressions also remain.
4 open findings
What changed in this PR
Adds an opt-in bounded, read-only worker policy to the embedded Lua library, alongside the default interactive mode.
Changes:
- Adds restricted libraries, source-only loading, and resource budgets.
- Adds quota, traceback, and adversarial smoke checks with supervised deadlines.
- Documents worker lifecycle requirements and pins dependency examples.
| File | Description |
|---|---|
| README.md | Updates library overview and integration guidance. |
| docs/lua.md | Documents worker policies, budgets, and lifecycle. |
| docs/entry.md | Pins the source dependency example. |
| crates/lua/tests/host_smoke.c | Adds restricted-surface and quota checks. |
| crates/lua/src/vm.rs | Applies VM budgets and classifies outcomes. |
| crates/lua/src/shim.rs | Adds per-VM allocation accounting. |
| crates/lua/src/output.rs | Implements bounded output capture. |
| crates/lua/src/lib.rs | Exposes the extension policy API. |
| crates/lua/src/kore_lua.c | Adds restricted libraries, instruction hooks, and tracebacks. |
| crates/lua/src/files.rs | Adds filesystem-result limits. |
| crates/lua/src/bridge.rs | Enforces policies during host dispatch. |
| crates/lua/build.rs | Supervises smoke tests with deadlines. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+916
to
+918
| serve_require(services, E::POLICY).await; | ||
| } else { | ||
| serve_value(services, extension, op).await; | ||
| serve_value(services, extension, op, E::POLICY).await; |
Comment on lines
+999
to
1000
| let answer = serve_fs(services, op, args, input, policy).await; | ||
| return finish_answer(answer); |
| let reclaim = wanted | ||
| .saturating_sub(self.remaining()) | ||
| .min(self.stdout.len()); | ||
| self.stdout.truncate(self.stdout.len() - reclaim); |
| self.instructions | ||
| .as_ref() | ||
| .is_some_and(|budget| budget.exhausted != 0) | ||
| || self.capture.exhausted |
SnowCheetos
pushed a commit
that referenced
this pull request
Oct 14, 2026
Brings in Lua 5.5 (#23, #25) and the Wasmtime 48.0.3/48.0.5 RUSTSEC bumps, so kore can pin one revision carrying both its kore-lua worker and this branch's kore-wasi changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmEMGSFqb56Tcsvuk9PQPx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add an opt-in
Extension::POLICYfor one-shot read-only Lua workers. The default interactive REPL retains its existing libraries and behavior. The restricted policy exposes pure Lua libraries and read-onlykore.fsqueries, loads source modules only, and rejects native loading or non-read host operations at the bridge. Per-VM Lua allocation, instruction, captured-output, source-module, and filesystem-result budgets bound the worker's local work.The embedder must launch the worker with a delegated read-only filesystem capability. Stop or a wall-time deadline must terminate the entire worker task;
Host::evalborrows the script while its VM thread runs and must not be cancelled by dropping its future.Verification
cargo test --locked -p kore-luapassed (19 Rust tests plus the build-script C engine smoke, including restricted surface and infinite-loop quota checks).cargo clippy --locked -p kore-lua --all-targets --all-features --no-deps -- -D warnings,make fmt,make owners, andRUSTDOCFLAGS='-D warnings' cargo doc --locked -p kore-lua --no-depspassed.make crosspassed all three architecture target compilations and its symbol/entry checks whenLLVM_NMpointed to the installed Rust toolchain binary. The final revised VM also passed a direct x86 Kore-target check.make testandmake checkstop in the unchangedkore-ffibuild script: this Mac has Zig0.16.0-dev.2193, while the script requires release0.16.0.