Repository navigation
ADR 0014 phase 3: wasi:http, octosense:host, compile at install, Pulley, Windows - #451
Merged
Merged
Conversation
…orage quota The shell's wasm service loads components from fns/ beside modules, keeps one instance per component between calls, gives it the app's storage folder by the engines' rules, and charges what each write adds against what is left of the app's quota (wasm-host component/files.rs). Writes run on the worker thread. Typed JSON accepts a one-item positional array. Measurements, docs (en, zh-CN) and tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
App Hub #186 admits WebAssembly components when the manifest requires wasm-components-v1, validates their imports (only the WASI packages a host scopes to the app) and tells reviewers what each reaches. With the store on it, a component shipped as a system app goes through admission, and the new service test calls it as the app's script would: typed JSON, the instance's state from one request to the next, no folder without storage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Components may import wasi:http (wasmtime-wasi-http 49.0.2, p2, rustls with ring as the shell's). Requests go only to the app's network.hosts under net, by a script's rule (exact host, any case, any port), and over HTTPS except to this device. A request's timeouts are clamped to the call's deadline, which is 10 s for a component that may reach the network. Refused requests are logged with the reason. Tests: a fetch component against a local server, a server that never answers, the service's hosts from the admitted manifest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rvices A component may import octosense:host/services@0.1.0 (wit/octosense-host.wit): request(service, args) -> result<string, string>. The runtime knows no services; the shell's wasm service gives each instance its app's: the families its admitted manifest grants (a system app's own namespace too), dispatched on the UI thread (host_tools::pump) as its script's host.request would be, but never with a sheet or a prompt, so only the methods a background surface may call. wasm.* is refused (the app's worker is busy with the call). The call's deadline bounds the wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…st call When App Hub completes an install or an update, the shell compiles the app's admitted fns/*.wasm (modules and components) into the disk cache in the background (wasm_service::warm, Runtime::precompile): one app at a time, on a thread of its own, never in a worker's place, and only with the wasm grant. The first call then loads from the cache instead of waiting for Cranelift (ADR 0011 measured about 0.4 s for a 433 KiB module on a mid-range phone). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…Windows, docs Pulley, Wasmtime's interpreter, runs app functions where an app may not generate code: wasm-host's pulley feature, on by itself for iOS and OpenHarmony, selected elsewhere with OCTOSENSE_WASM_PULLEY for tests (phone.yml runs the runtime's tests in it too; about 32 times Cranelift's code). The wasm service now runs on OpenHarmony (Home's OpenHarmony release build compiled with it; no device run) and on Windows, whose new wasm-windows.yml runs the runtime's tests and compiles the shell with the service on windows-2022. iOS stays out until a build with it is compiled. A full disk is ENOSPC on Unix and StorageFull elsewhere. Docs (en, zh-CN): the components' network and host services, compiling at install, the platforms, the tests; ADR 0014's phase 3 status and the Pulley figures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A component's wasi:http no longer reaches the device itself, even when the app lists localhost or 127.0.0.1: an app that lists one would otherwise reach every local service (the shell's remote control, a developer's servers), over plain HTTP too. Loopback, private, link-local and similar addresses, localhost, single-label and .local/.lan/.internal names are refused, as makepad's public_https_host refuses them. Grants::http_local lets tests and a developer's runs use a local server; the shell never sets it (its own tests do). Scripts still allow a listed loopback host; that is reported, not changed here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The ruling of 8 October 2026 removes the per-app runtime gates: an app's network declarations (net, network.hosts) are shown at install and not enforced while it runs, and the OS and the host's API surface are the boundary. A component's wasi:http therefore reaches any host, and the public-HTTPS rule of the previous commit goes with the host list. What stays: a request's timeouts are clamped to the call's deadline, and a component that imports wasi:http gets the network deadline (decided by its imports now, not by a grant). wasm.describe says "network": true for such a component instead of listing hosts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ymote
marked this pull request as ready for review
October 10, 2026 01:35
Contributor
Author
|
Local CI passed on 40a5dea ( GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.
Skipped (these did NOT pass; (!) marks a skip that blocks tools/ci-local-merge.sh):
Notes:
Native GitHub acceptance passed on the same head: embedded-browser.yml. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR 0014 phase 3, including phase 2 from #445. Phase 1 (#436) is merged, and this PR now targets main. App Hub #188 is merged through #190; this branch pins its exact commit
371f51aeb6ba90e9a214c5ddb6ccfc40a2e2a339, which admitswasi:httpandoctosense:host. Shared-component loading (phase 4) is separate.What it adds
wasi:http(crates/wasm-host/src/component/net.rs).net,network.hosts) are shown at install and not enforced while it runs.wasi:httpgets the 10 s network deadline instead of 2 s, andwasm.describesays"network": truefor it.octosense:host(component/host.rs,wit/octosense-host.wit).request(service, args)reaches the host services the app is granted, dispatched on the UI thread as the app's script'shost.requestis.wasm.*is refused.Runtime::precompile,wasm_service::warm). An installed or updated app's functions are compiled into the disk cache in the background, so its first call skips Cranelift.pulley). It is not on iOS, which stays out of this ("no iOS for now")..github/workflows/wasm-windows.ymlruns the runtime's tests.docs/wasm.md(English and Chinese) and ADR 0014 (English and Chinese) are updated.Checks (macOS)
cargo test --locked -p octosense-wasm-host: component 13, guest 7, runtime 14 and unit tests 1, all pass. That includeshttp_reaches_any_host,a_request_that_never_answers_ends_at_the_deadlineand the clamp test.OCTOSENSE_WASM_PULLEY=1 cargo test --locked -p octosense-wasm-host --features pulley: pass.phone/:cargo test --locked --features mobile-apps -p octosense-shell wasm_service::tests: 9 passed. That includesa_components_requests_reach_any_host, where an app with neithernetnor hosts reaches a local server as 127.0.0.1 and as localhost.Not verified
Any device. A Windows run outside CI. A real app installed through App Hub with these imports.
🤖 Generated with Claude Code