CI check: capi mounts + cancellation branch - #1
Open
tersePrompts wants to merge 8 commits into
Open
Conversation
Bring the C API to parity with the JS/Python bindings' real filesystem
mounts, behind the same safety model:
- config v1 gains optional mounts: [{path, root, writable}] and
allowed_mount_paths; mounts are applied after build via the live
Bash::mount API (RealFs wrapped in PosixFs), and readonly_filesystem
continues to wrap mounted filesystems
- new bashkit_mount / bashkit_unmount exports attach and detach host
directories on a running session, preserving shell state
- every mount root must resolve under an allowed_mount_paths prefix;
roots are canonicalized before the prefix check so '..' segments and
symlinks cannot escape, and comparison is case-folded on Windows
- capabilities_json gains the realfs-mounts feature marker so embedders
can feature-detect support
- bashkit.def and include/bashkit.h extended additively; ABI v1
signatures are unchanged
- three new ABI tests: read-only mounts (host file provably absent after
denied writes), runtime mount/unmount round trip, and allowlist
enforcement (missing allowlist and out-of-prefix roots rejected)
- expose bashkit::is_sensitive_mount_path as a public free function so embedder-side mount policies share one denylist with the builder - validate_mount_root now applies that denylist on the canonical root for both config-time mounts and bashkit_mount: a sensitive root (home trees, /etc, .ssh, ...) is only mountable when an allowlist entry names it exactly — a broad parent entry such as the home directory is not consent to expose credential stores - suppress the RealFs::new deprecation at both C-API call sites with the same justification as apply_real_mounts (synchronous FFI boundary) - replace the unregistered THREAT[TM-SBX-XXX] comment with TM-FS-013 and extend the threat-model row plus the C-API knowledge entry - regression tests: sensitive subdir refused at config time and runtime under a broad allowlist entry; exact-entry consent still mounts
Adds bashkit_cancel / bashkit_clear_cancel backed by the interpreter's shared cancellation token, kept outside the state mutex so cancel stays lock-free while bashkit_execute is blocked. A cancelled execution reports the new BASHKIT_CANCELLED (7) status, and the capabilities JSON gains a "cancellation" feature so bindings can feature-detect. Tests cancel a pending sleep: the request budget polls the token while the command is in flight, whereas loop-based scripts race the profile's command/iteration caps before the flag lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The re-landed mounts work dropped the workflow_dispatch lib builder that Bashkit4j packaging uses; upstream's c-api-binaries workflow only builds from release tags. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Cancellation only lands at command boundaries, so a cancelled sleep is not interrupted until the profile deadline ends it 30s later. Loop over 1-second sleeps instead: a boundary every second, negligible budget. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The worker closure is lexically nested under the test's unsafe block, so its own unsafe block triggers clippy's unused_unsafe under --all-targets.
Duplicates c-api-binaries.yml, uses unpinned action tags, and exists to drive the external Bashkit4j packaging pipeline; it needs its own justification (SHA pinning, permissions block, upstream-hosting decision). A copy is preserved on the fork's fork-main-backup branch.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork-internal PR to run the pull_request CI suite against
capi-host-mounts-pr(upstream PR everruns#2371, whose fork runs need maintainer approval). Scratch PR — close when CI is green.