Repository navigation
build(deps): bump the cargo group across 1 directory with 22 updates - #2844
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps the cargo group with 22 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aes-gcm](https://github.com/RustCrypto/AEADs) | `0.11.0` | `0.11.1` | | [async-compression](https://github.com/Nullus157/async-compression) | `0.4.50` | `0.4.51` | | [getrandom](https://github.com/rust-random/getrandom) | `0.3.4` | `0.4.3` | | [google-cloud-auth](https://github.com/googleapis/google-cloud-rust) | `1.17.0` | `1.18.0` | | [google-cloud-storage](https://github.com/googleapis/google-cloud-rust) | `1.20.0` | `1.21.0` | | [jaq-all](https://github.com/01mf02/jaq) | `0.3.0` | `0.4.0` | | [libc](https://github.com/rust-lang/libc) | `0.2.190` | `0.2.191` | | [opentelemetry-otlp](https://github.com/open-telemetry/opentelemetry-rust) | `0.33.0` | `0.33.1` | | [russh](https://github.com/warp-tech/russh) | `0.64.1` | `0.65.0` | | [size](https://github.com/neosmart/prettysize-rs) | `0.5.0` | `0.6.0` | | [smallvec](https://github.com/servo/rust-smallvec) | `1.16.3` | `1.16.4` | | [sysinfo](https://github.com/GuillaumeGomez/sysinfo) | `0.39.6` | `0.40.0` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.3` | `1.54.1` | | [tonic](https://github.com/grpc/grpc-rust) | `0.14.6` | `0.14.9` | | [tonic-prost](https://github.com/grpc/grpc-rust) | `0.14.6` | `0.14.9` | | [tonic-prost-build](https://github.com/grpc/grpc-rust) | `0.14.6` | `0.14.9` | | [unicode-width](https://github.com/unicode-rs/unicode-width) | `0.2.2` | `0.2.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.28.0` | `1.29.0` | | [zeroize](https://github.com/RustCrypto/utils) | `1.9.0` | `1.9.1` | | [globset](https://github.com/BurntSushi/ripgrep) | `0.4.20` | `0.4.21` | | [rustls-native-certs](https://github.com/rustls/rustls-native-certs) | `0.8.4` | `0.8.5` | | [tokio-rustls](https://github.com/rustls/tokio-rustls) | `0.26.5` | `0.26.6` | Updates `aes-gcm` from 0.11.0 to 0.11.1 - [Commits](RustCrypto/AEADs@aes-gcm-v0.11.0...aes-gcm-v0.11.1) Updates `async-compression` from 0.4.50 to 0.4.51 - [Release notes](https://github.com/Nullus157/async-compression/releases) - [Commits](Nullus157/async-compression@async-compression-v0.4.50...async-compression-v0.4.51) Updates `getrandom` from 0.3.4 to 0.4.3 - [Changelog](https://github.com/rust-random/getrandom/blob/master/CHANGELOG.md) - [Commits](rust-random/getrandom@v0.3.4...v0.4.3) Updates `google-cloud-auth` from 1.17.0 to 1.18.0 - [Release notes](https://github.com/googleapis/google-cloud-rust/releases) - [Commits](https://github.com/googleapis/google-cloud-rust/commits) Updates `google-cloud-storage` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/googleapis/google-cloud-rust/releases) - [Commits](https://github.com/googleapis/google-cloud-rust/commits) Updates `jaq-all` from 0.3.0 to 0.4.0 - [Release notes](https://github.com/01mf02/jaq/releases) - [Commits](https://github.com/01mf02/jaq/commits) Updates `libc` from 0.2.190 to 0.2.191 - [Release notes](https://github.com/rust-lang/libc/releases) - [Changelog](https://github.com/rust-lang/libc/blob/0.2.191/CHANGELOG.md) - [Commits](rust-lang/libc@0.2.190...0.2.191) Updates `opentelemetry-otlp` from 0.33.0 to 0.33.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-otlp-0.33.0...opentelemetry-otlp-0.33.1) Updates `russh` from 0.64.1 to 0.65.0 - [Release notes](https://github.com/warp-tech/russh/releases) - [Commits](Eugeny/russh@v0.64.1...v0.65.0) Updates `size` from 0.5.0 to 0.6.0 - [Release notes](https://github.com/neosmart/prettysize-rs/releases) - [Commits](neosmart/prettysize-rs@0.5.0...0.6.0) Updates `smallvec` from 1.16.3 to 1.16.4 - [Release notes](https://github.com/servo/rust-smallvec/releases) - [Commits](smallvec/smallvec@v1.16.3...v1.16.4) Updates `sysinfo` from 0.39.6 to 0.40.0 - [Changelog](https://github.com/GuillaumeGomez/sysinfo/blob/main/CHANGELOG.md) - [Commits](GuillaumeGomez/sysinfo@v0.39.6...v0.40.0) Updates `tokio` from 1.53.3 to 1.54.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.3...tokio-1.54.1) Updates `tonic` from 0.14.6 to 0.14.9 - [Release notes](https://github.com/grpc/grpc-rust/releases) - [Changelog](https://github.com/grpc/grpc-rust/blob/master/CHANGELOG.md) - [Commits](grpc/grpc-rust@tonic-v0.14.6...tonic-v0.14.9) Updates `tonic-prost` from 0.14.6 to 0.14.9 - [Release notes](https://github.com/grpc/grpc-rust/releases) - [Changelog](https://github.com/grpc/grpc-rust/blob/master/CHANGELOG.md) - [Commits](grpc/grpc-rust@tonic-prost-v0.14.6...tonic-prost-v0.14.9) Updates `tonic-prost-build` from 0.14.6 to 0.14.9 - [Release notes](https://github.com/grpc/grpc-rust/releases) - [Changelog](https://github.com/grpc/grpc-rust/blob/master/CHANGELOG.md) - [Commits](grpc/grpc-rust@tonic-prost-build-v0.14.6...tonic-prost-build-v0.14.9) Updates `unicode-width` from 0.2.2 to 0.2.3 - [Commits](unicode-rs/unicode-width@v0.2.2...v0.2.3) Updates `uuid` from 1.28.0 to 1.29.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.28.0...v1.29.0) Updates `zeroize` from 1.9.0 to 1.9.1 - [Commits](RustCrypto/utils@zeroize-v1.9.0...zeroize-v1.9.1) Updates `globset` from 0.4.20 to 0.4.21 - [Release notes](https://github.com/BurntSushi/ripgrep/releases) - [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md) - [Commits](BurntSushi/ripgrep@globset-0.4.20...globset-0.4.21) Updates `rustls-native-certs` from 0.8.4 to 0.8.5 - [Release notes](https://github.com/rustls/rustls-native-certs/releases) - [Commits](rustls/rustls-native-certs@v/0.8.4...v/0.8.5) Updates `tokio-rustls` from 0.26.5 to 0.26.6 - [Release notes](https://github.com/rustls/tokio-rustls/releases) - [Commits](rustls/tokio-rustls@v/0.26.5...v/0.26.6) --- updated-dependencies: - dependency-name: aes-gcm dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: async-compression dependency-version: 0.4.51 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: getrandom dependency-version: 0.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: google-cloud-auth dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: google-cloud-storage dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: jaq-all dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: libc dependency-version: 0.2.191 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: opentelemetry-otlp dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: russh dependency-version: 0.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: size dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: smallvec dependency-version: 1.16.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: sysinfo dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: tokio dependency-version: 1.54.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: tonic dependency-version: 0.14.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: tonic-prost dependency-version: 0.14.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: tonic-prost-build dependency-version: 0.14.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: unicode-width dependency-version: 0.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: uuid dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: zeroize dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: globset dependency-version: 0.4.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: rustls-native-certs dependency-version: 0.8.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: tokio-rustls dependency-version: 0.26.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Reviewed: 1 finding, none blocking at Address the comments on the diff. Clobber: not found, but the diff is too large to confirm that. If that was not intentional, restore the earlier change. |
* fix(deps): bump pulldown-cmark to 0.13.6 for RUSTSEC-2026-0433 (#2846) Claude-Session: https://claude.ai/code/session_01NSAwDroXL6KqsSxUzdbZGw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(minimald): hand a reaped name over in one manager step (#2842) A reap read the records and then sent the handover as a second message. A removal that began between the two left the name with no row while another retained box still had it. The manager now releases the reaped box's row, picks the successor among boxes not being removed, and registers it in one message. The reap and the prune return after both. The daemon log names the release (name-released) before the handover (name-handed-over), both with box ids. Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T126 — A host-address box's port that collides on the host is shown at session start and in `min ls` (#2830) * feat(minvmd): answer a node's collided mirror ports over control The host control socket answers a read-only mirror_collisions verb with the node's mirrored ports that collided with a holder on the host. The node mirror keeps the time each port first collided. * feat(minimal): show collided mirror ports in min ls and activate min ls prints a MIRROR PORTS row per VM whose host_ip box ports are held by another program on the host, and --json carries mirror_collisions per VM. min session activate of a host_ip box on a VM host prints the same sentence per port when it does not attach. * fix(minimal): show an unread VM's mirror ports as null in min ls Read each VM's collided mirror ports concurrently, and keep a failed read apart from an empty one: --json writes null for a VM with no answer and [] only for an answered empty read. * fix(minimal): name a VM host whose mirror ports were not read min ls printed nothing for a running VM host that gave no answer, so it looked the same as one with no collisions. It now prints one MIRROR PORTS row that says the VM did not report its ports. * fix(minimal): skip the mirror-port read on a native host A native host has no VM host daemon. The fallback listing's control socket there is minimald's, which does not serve the collided-port read, so min ls printed a false MIRROR PORTS row on every native host. * fix(minimal): name an unread VM host at activate, enter the span min session activate now prints the unread sentence that min ls prints when the VM host daemon gives no answer. The ListSessions span wraps the collided-port reads, and a native host's --json carries no mirror_collisions field. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T42 — Start every box's entrypoint from its spec through one launcher (#2841) * feat(mfile): carry entrypoint and lifetime in the box spec The spec gains an [execution] table with the box's lifetime and, for a box that does not run its login shell, its entrypoint argv. A v0 spec stored before the table existed reads with the entrypoint its type implies. * feat(minimald): start each box's entrypoint from its spec One launcher decision, LaunchSpec::entrypoint, reads the first process from the box's stored spec: the login shell, or the spec's argv. The actor reads the stored spec once, keeps its hold, and hands it to every launcher. A launch minted for an exec keeps the shell, because the exec runs the box's command. Each launch logs its entrypoint in a box.launch span. * fix(minimald): keep the shell on every launch of an exec-run box A task's run arrives over the exec channel. A hook launch or an attach can come before or after that exec, and a hook launch's gated first process starts at the next attach. Only the exec-minted launch held the shell, so a task box could run its task twice, and an attach got the task, not a shell. Every launch now says an exec carries the run, and the launcher starts the shell for it. * refactor(mfile): write box.lifetime and execution.exec in the spec Rename Lifetime::Persistent to UntilStopped, move the lifetime to [box] with a until_complete default for v0 specs, and serialize the entrypoint as execution.exec. List the argv shape as a v0 exception. * fix(minimald): refuse a launch whose stored spec cannot be read held_spec returns an error for unreadable spec bytes or a failed store read, and launch_host refuses with SpawnFailed instead of starting the shell. Mark run_by_exec as an interim that T43 (#2405) removes. * test(minimald): store a readable spec in the stopped-box record test A launch now refuses a stored spec it cannot read, so the test's placeholder bytes failed its ensure_host. Store a session spec instead. * docs(mfile): say that no launch reads the spec's lifetime yet A box ends when its entrypoint returns, whatever box.lifetime says. * fix(minimald): keep entrypoint arguments out of the launch log The box.launch span and its info event printed every argument of an argv entrypoint. An argument can carry a secret, so they now name the program (or the login shell) and the argument count only. A test pins that a secret-looking argument does not reach the log. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev> * T30 — Run a command in a box with a terminal or detached, under an exec id (#2843) * feat(minimald-rpc): carry exec mode, timeout and exec id on the wire min://exec carries an argv with its mode (attached, tty or detached) and an optional timeout. min://exec/attach, min://exec/output and min://exec/wait name an exec by its UUIDv7 id. The box store places each exec's transcript beside the record and appends events by path. * feat(minimald): run box execs under an id, with a terminal or detached Every command for a box gets a UUIDv7 exec id, and a box that is not running refuses it with exit 2 naming its state. min://exec runs an argv with no shell: attached, on a daemon terminal, or detached with stdin closed. Tty and detached execs answer with their id at once, capture their output beside the box record, and keep their exit for min://exec/wait. An exec's own timeout stops it and records an exec_exited event with reason timeout, and the box keeps running. * style(minimald-rpc): format the exec id parse and its tests * fix(minimald): bound the wait after an exec timeout; drop reaped execs A command that survives the stop at its timeout no longer holds its wait open: the wait after the stop is bounded, then SIGKILLed and recorded as a timeout. Ended execs of a reaped box leave the exec map. * fix(minimald): exit 124 on exec timeout; wait reads stored exit An exec that its own timeout ends now exits 124, attached or detached. A wait on an exec that this daemon holds no entry for reads the box's stored exec_exited event, so a detached exec's exit code outlives a daemon restart. * fix(minimald): cap exec transcripts at 8 MiB and stream reads A detached exec now writes through a pipe and a pump, as a tty exec does, so the daemon can cap its transcript. Past the cap the transcript keeps a mark and the newest half of the cap, and the command keeps running. The output read and the attach replay copy the transcript in 64 KiB chunks, up to its length at the open, and the attach takes the terminal lock only to open the file and subscribe. * fix(minimald): bound tty exec input; no deadline past the clock A tty exec's terminal input went through an unbounded channel, so a program that never reads stdin let the daemon queue grow without limit. The terminal now holds typed input in a HeldInput with the attached path's bounds (EXEC_INPUT_HELD_MAX per exec, EXEC_INPUT_HELD_DAEMON_MAX for the daemon). Past either bound the chunk is dropped and the log says so once per exec. The exec's end releases what it held. An attached exec's timeout too large for the clock panicked after the spawn. timeout_deadline now uses checked_add and gives no deadline. Tests: unread tty input stays within the cap, a timeout of u64::MAX seconds runs the exec to its end, and an exec id from one box finds no exec, output or exit in another. * fix(minimald): wait on exec terminals in the runtime, not a thread The tty feed wrote to the terminal from a blocking thread. When the program never read its input, that write never returned, and each such exec left a blocking thread behind for good. The terminal and the detached pipe are now non-blocking and watched through AsyncFd, so the supervisor can stop the pump and the feed at the exec's end. Both stop on a closed state too, because tokio never clears it and a wait for it returns at once. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Karl Godard <karl@minimal.dev> * fix(minimald): hand a destroyed box's name to the next holder (#2849) A destroy removed the box that held a name's row and left the name with no row, while another retained box still had that name. The destroy now runs the same handover as a reap: the row goes to the running box with the name, else to the most recent creation. The destroy answers after the handover. The daemon log names the destroyed box and the successor, and the destroy span records the successor id or "none". Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T114 — `min ls` and the box commands tell the truth, end to end (#2839) * test(e2e): prove min ls and the box commands across two VMs Adds the ls_and_box_commands_tell_the_truth case: a stopped VM's boxes in min ls, the ADDRESS and EGRESS cells against min session policy, policy and forward without --vm, the unknown-box and stopped-VM refusals, both proxy ports after the preferred port frees, and the --public and out-of-range expose refusals. * test(e2e): record ls_and_box gates as NOT RUN, check declared rules The four gates of ls_and_box_commands_tell_the_truth now call not_run, so the lane summary names the case. A 'declared rules' EGRESS cell is now checked against the subnets rule row that min session policy prints, not only against an egress heading. * test(e2e): read the expose address past a trailing carriage return The ls_and_box case read the box's address from the in-box expose reply with an end-of-line anchor. A reply over the exec channel can end in a carriage return, which left the address empty. * test(e2e): brace lt_port before a bracket class in the expose read shellcheck reads $lt_port[[:space:]] as an array index (SC1087). The braces keep the same match and make the script lint-clean again. * fix(minimal): poll the owning VM in min net forward A forward to a box on another VM polled the selected VM for its session. That VM does not hold the box, so the forward closed on the first tick. Reconnect the poll to the owning VM, version-gated. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> Co-authored-by: Norrie Taylor <91171431+norrietaylor@users.noreply.github.com> * docs(spec): specify dns steering and the host_ip lane for spec 24 (#2851) * docs(spec): specify dns steering and the host_ip lane for spec 24 Add BEP-080 to BEP-087 so the default `dns` steering works for own_ip and host_ip boxes on a VM host, as architecture D6 and networking §5.4 require. - BEP-080, BEP-081: direct TLS to the proxy on port 443, routed by SNI, and admitting dns and both on a VM host (#2805). - BEP-082 to BEP-087: the host_ip lane: a host-side box id, the cohort proxy lane, cohort-attributed delivery with the named box's egress and audit subject, the in-effect rule, per-box steering, and the live proof. - BEP-015 gains a host_ip proxy_env case. - Security considerations states the cohort lane and per-box steering. * docs(spec): keep the first slice paragraph unchanged and move the host_ip e2e checks to BEP-087 * docs(spec): address review on the host_ip lane requirements - BEP-083: the cohort lane also admits TCP 443 at the proxy's address, the direct TLS path dns steering uses. - BEP-084: refuse and audit a cohort-attributed value that names no live host_ip box of this host. - BEP-086: cite NET-003's VM-backed resolver requirement, not NET-079. - BEP-087: the proxy_env case is its own sub-requirement. - Security considerations: BEP-083 and BEP-084 join the redemption invariant, and BEP-084 the egress invariant. * T10 — Log a box's output from its start, out of the box's reach (#2852) * feat(boxes): name a box's output log beside its record Adds LOG_FILE and BoxDir, the box's directory as code outside the store sees it: the log path, a lookup by id through the index, a log read by offset, and an event append for a writer that holds no DiskBox. * feat(minimald-rpc): add a streamed read of a box's output log * feat(minimald): log a box's output from its start The host appends every read from the box's terminal to its output log before it hands the bytes to an attached client, so the client is a second reader. A binding whose client closes its channel, drops its connection or is shed records a detached event, and the box runs on. * feat(minimald): serve a box's output log by its id ReadLog streams the log from a byte offset, and with follow sends new output until the box is reaped. A test shows that files written into the box's own directories reach neither the log nor the record. * fix(minimald): read a box's log on the blocking pool The followed log read polled the store with blocking std::fs calls on an async task. The find, the chunk reads and the retained check now run through spawn_blocking, so a slow disk does not hold a runtime worker. * fix(boxes): cap a box's output log and read it across a drop The log keeps a drop mark and the newest half past 8 MiB. A reader keeps its file open and moves to the replaced file with no byte sent twice. The read refuses a link or a file that is not regular. * fix(minimald): start no store box without its output log BoxOutputLog::open returns the open's error for a box in the store, and Host::build stops before the launch. The log writes through the capped store writer, and ReadLog keeps one reader for the whole stream. * fix(minimald): run detach hooks when a PTY client is lost A lost client already records a detached event. Its on_detach hooks now run too, so the event and the hooks agree. A test drives a box past the log cap. * style: format the log cap tests * docs(boxes): mark the 8 MiB log cap as not yet in the design The cap drops the start of a box's output past 8 MiB. That departs from architecture.md line 473. gominimal/arch#159 decides the bound. * docs(specs): record the interim 8 MiB box log cap in BOX The decision that logs a box's output from its start now states the 8 MiB cap, what the log keeps past it, and the arch#159 decision that removes the cap or changes BOX-155. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * T9 — End a box when its entrypoint returns, never for idleness or client loss (#2850) * feat(minimald): end an until_complete box when its entrypoint returns The host loop now says whether a kill ended it. The actor watches each launch's loop and, when the entrypoint returned on its own and the spec sets lifetime = "until_complete", sets the record to exited with the exit code and records an exited event with reason "exit". The daemon does this whether or not a client is attached. Such a box raises no shell-exit prompt (BOX-038). A client that goes away never stops a box (BOX-015). * test(minimald): pin box ends on entrypoint return, not client loss Adds the actor tests for BOX-038 and BOX-015. The shell round trip now expects no prompt and an exited record. Tests about a box kept after its shell exits now create an until_stopped box. The rpc shutdown test no longer answers a prompt. * fix(minimald): retry the exited-record write when an entrypoint ends The host and the watch are gone by the time the write runs, so a single failed write left the box running with nothing in it. Retry it with a short backoff, and pin the retry with a test seam. * test(e2e): expect an exited box, not a prompt, when a shell exits The session-exit prompt is gone: exiting the shell ends the box, which stays listed as exited. The pty driver no longer answers a prompt. Each leg that exited a shell now checks the box is exited with code 0, and destroys it where it used to answer Delete. * docs(minimald): put the launch-record seam doc back on its module * test(e2e): resume the exited kept box before the exec into it An exec runs only in a running box. After the shell exits and the row is withdrawn, the leg now resumes the box with a pty 'min session attach', checks that it runs under the same id and that its row is back, and then runs the exec as before. * test(minimald): fail when the channel stays open after shell exit The wait loop ended on a timeout as well as on close, so the test passed even if the channel never closed. Panic on the timeout. * fix(minimald): end an exited box before a queued attach or exec A message queued beside a returned entrypoint ran first and launched a new host, so the entrypoint ran again and its exit was lost. Now only a stop or a destroy goes ahead of the exit, and ensure_host refuses a stopped or exited box. --------- Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com> * build(deps): bump sysinfo to 0.40 sysinfo 0.40 makes System construction fallible (System::new returns Result<System, sysinfo::Error>). The three callers keep their 0.39 behaviour on an unsupported platform: minvmd's metrics sample and minimald's resource-pool probe return None, and minvmd's host capacity probe reports zero memory. Unblocks the dependabot cargo group (#2844), which bumped sysinfo without migrating the callers. --------- Co-authored-by: Karl Godard <karl@minimal.dev> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: minimal-foundry[bot] <327719912+minimal-foundry[bot]@users.noreply.github.com>
Spec lint
Advisory. None of this blocks the merge; the review decides. Advisory, and never a merge gate. Linter: |
| # (`cargo hack check --rust-version`). Every crate inherits this via | ||
| # `rust-version.workspace = true`; bump here, in one place, when the floor moves. | ||
| # 1.95 is the dependency-driven floor (sysinfo 0.39 requires rustc 1.95); no | ||
| # 1.95 is the dependency-driven floor (sysinfo 0.40 requires rustc 1.95); no |
There was a problem hiding this comment.
MEDIUM · correctness · confidence 0.70
This dependency bump carries unrelated feature work. The diff has about 8000 added lines in crates/boxes, crates/minimald, crates/minimald-rpc, crates/minimal, crates/minvmd, the specs and scripts/session-e2e.sh. The head commit squashes other PRs (#2842, #2846) under a sysinfo title. The base 2d06816e is behind main. Rebase the branch so the PR holds only the Cargo.toml and Cargo.lock changes. The mixed diff cannot be reviewed as a dependency bump, and a revert of the bump would also revert the other work.
What the reviewer checked
pr.diff: store.rs +784/-30, exec/bridge.rs +722, exec/tests.rs +790, session-e2e.sh +721/-96. HEAD 12e12ad 'build(deps): bump sysinfo to 0.40 (#2866)' body lists #2846 and #2842.
Hand this to an agent
Act on a code-review finding.
File: Cargo.toml
Lines: 48-48
Category: correctness
Severity: medium (reviewer confidence 0.70)
Finding:
This dependency bump carries unrelated feature work. The diff has about 8000 added lines in `crates/boxes`, `crates/minimald`, `crates/minimald-rpc`, `crates/minimal`, `crates/minvmd`, the specs and `scripts/session-e2e.sh`. The head commit squashes other PRs (#2842, #2846) under a sysinfo title. The base `2d06816e` is behind main. Rebase the branch so the PR holds only the `Cargo.toml` and `Cargo.lock` changes. The mixed diff cannot be reviewed as a dependency bump, and a revert of the bump would also revert the other work.
First verify this against the code yourself. It is model output and
may be wrong. If it is wrong, or the tradeoff was deliberate, say so
and change nothing.
👍 useful · 👎 noise — react to tell the reviewer. Replying works too, and says more.
There was a problem hiding this comment.
Scope does not match the title. The open bot thread on Cargo.toml:48 already says this, so this review does not raise it again. New fact for that thread: git log origin/main shows that the squashed PRs in the head commit are on main as their own commits, for example #2850 and #2852. #2866 is not on main. A rebase on main leaves the dependency bump and the three sysinfo caller changes.
Clobber none found. The merge base is 2d06816e. The diff adds to that base and reverts no fix. main moved on after that base, so the merge result was not checked.
Correctness The sysinfo 0.40 migration covers all three System::new callers. The findings below are in the feature code that the head commit carries. Because that code is on main, fix each finding on main, not on this branch. The two medium findings are the refusal with no next step and the OOM kill recorded as a plain exit. I checked a race between the entrypoint watch and has_live_host, and a leak of output.log into min bug bundles. Both checks came back clean.
Dependencies The diff has no code change for size 0.6, jaq-all 0.4, russh 0.65 or getrandom 0.4. Cargo.lock has sysinfo 0.40.1 and async-compression 0.4.52, and the PR body says 0.40.0 and 0.4.51.
Not checked No build ran, by rule. The sources of these crates are not in the local cargo registry, so their API compatibility is not proved. trivy and gh pr checks were denied in this sandbox, so there is no advisory scan and no CI result. gitleaks was not run, and a targeted rg over the diff stood in for it. The new session-e2e.sh case was read and not run.
Outside the diff AGENTS.md:145 still says that only a tty can answer the session-exit prompt. docs/specs/18-spec-box-networking lines 224 and 1145 still say "subject to the exit prompt".
| /// The refusal for a command sent to a box that is not running. | ||
| pub(crate) fn not_running_message(box_label: &str, status: boxes::BoxState) -> String { | ||
| format!( | ||
| "box {box_label} is {}. Only a running box can run a command.\n", |
There was a problem hiding this comment.
medium · This refusal states why but gives no next step. min session exec prints it to a person. Since BOX-038, every exit from a session's shell leaves the box exited, so a person meets it in ordinary use. For a stopped or exited box, min session attach <name> resumes the box, and the e2e leg eib_vm_kept_box_resumes_leg proves that. Add that command for those two states. A pending or materializing box needs other words, because an attach is not the remedy there. The same sentence is copied at crates/minimald/src/box_actor/host.rs:1281, and exec/tests.rs pins the text. Change them together.
| // The host is gone and the watch is cleared, so this is the one | ||
| // chance to record the exit: a failed write is retried with a short | ||
| // backoff before the box is left running with nothing in it. | ||
| let ending = boxes::core::record::ExitEnding::Exit { exit_code }; |
There was a problem hiding this comment.
medium · end_on_entrypoint_return records every end without a daemon kill as ExitEnding::Exit. An entrypoint that an OOM kill ends has requested = false, so its record says reason exit with the kill's status. ExitEnding::Oom documents that case, and rg finds no production code in minimald that writes it. This line is the only production writer of an exited record there. The person then reads a plain exit and not an out-of-memory end. Confidence is limited because I did not prove what ExitReason holds for such a kill, and a later task may own this.
| ), | ||
| 2, | ||
| )); | ||
| } |
There was a problem hiding this comment.
low · This refusal is unreachable. Line 1266 returns SessionPending for every status other than Active, and RecordState::from_stored gives Stopped or Exited only for those two statuses. So a stopped or exited box gets the pending error, not this message with exit 2. The test until_complete_ends_on_entrypoint_return_without_client_before_queued_ensure_host asserts only is_err(), so it does not see this. No relaunch happens, but an exec that loses the race reads a wrong reason. Move this check above the status check, and pin the error in the test.
| }; | ||
| if entry.mode != ExecMode::Tty { | ||
| let message = format!( | ||
| "exec {id} has no terminal to attach to. Read its output with min://exec/output {id}.\n" |
There was a problem hiding this comment.
low · This instruction names the wire verb min://exec/output, which is not a command that a person can run. rg finds no ExecMode or ExecSpec use in crates/minimal/src, so no CLI command reads an exec's output at this head. No CLI path reaches this message yet, so it is low. State the situation and stop, or name the real command when it exists. This is the one instruction of this kind in the new exec messages.
| /// When the box's run is over. Serialized as `box.lifetime`. | ||
| /// | ||
| /// The spec stores and round-trips this value, but no launch reads it | ||
| /// yet. A box ends when its entrypoint returns, whatever it says. |
There was a problem hiding this comment.
low · This comment describes a state that the same diff ended. box_actor::host::ends_with_entrypoint reads spec.lifetime, and end_on_entrypoint_return and the shell-exit prompt depend on it. So UntilStopped has an effect today. The enum doc at line 114 repeats the claim: "Nothing enforces this yet" and "has no effect today". The two docs came from the entrypoint PR and the end-of-box PR changed the behaviour. Update both.
| pub fn append_event_at( | ||
| events_path: &camino::Utf8Path, | ||
| event: &BoxEvent, | ||
| ) -> Result<(), std::io::Error> { |
There was a problem hiding this comment.
low · append_event_at repeats the body of append_event_line in the same file line for line: the open, the lock, the torn-line cut, the write and the sync. Its doc says that the same lock, cut and sync apply, but only the copy keeps that true. A later fix to one will miss the other. Make one function the body and let the other call it, with event.box_id for the log field. crates/minimald/src/exec/process.rs:1079 is the only caller of this copy.
| file: std::fs::File, | ||
| len: u64, | ||
| cap: u64, | ||
| } |
There was a problem hiding this comment.
low · CappedTranscript repeats boxes::store::LogWriter (crates/boxes/src/store.rs): the same 8 MiB cap, the same log.next file and rename, and the same keep-the-newest-half rule. TRANSCRIPT_DROPPED has the same bytes as boxes::store::LOG_DROPPED, so the printed line now has two definitions. The two differ in one detail: LogWriter appends first, and CappedTranscript folds the chunk in. Use one writer for both, or at least reuse LOG_DROPPED.
| self.attrs.stdout_last = Some(SystemTime::now()); | ||
| // The log first: a client is a second reader, and | ||
| // the log has these bytes whatever the client does. | ||
| self.output_log.write(b); |
There was a problem hiding this comment.
low · The host loop calls output_log.write synchronously on a runtime worker for each read from the terminal. Past the cap, LogWriter::drop_oldest reads and rewrites about 4 MiB in that same call. So a slow disk stalls this box's terminal and the other tasks on that worker. The read side of the same log moved to spawn_blocking for this reason, as read_log_stream says. ExecEntry::record_output has the same shape and also holds the terminal lock during the write. Nothing is observed to fail yet.
| // argument reaches the daemon log. The name extends the T42 test line's | ||
| // filter, so that line runs this test too. | ||
| #[test] | ||
| fn launcher_starts_session_and_task_entrypoints_from_spec_without_logging_args() { |
There was a problem hiding this comment.
low · The test name says that the launcher starts session and task entrypoints, but the test starts nothing. It checks only what launch_span logs. The comment says why: the name exists to match a task's test filter. That is narration about the plan, and it means nothing to the next reader. Name the test for the log behaviour and remove the sentence. If a filter needs it, change the filter.
| .iter() | ||
| .map(|(port, since)| (*port, *since)) | ||
| .collect() | ||
| } |
There was a problem hiding this comment.
nit · collisions_since has one caller, a test at crates/minvmd/src/control.rs:8331. The mirror_collisions reply carries ports only. So the Instant in MirrorState::collided and this public method serve no reader yet. Keep a BTreeSet until something reads the time, or name the reader.
There was a problem hiding this comment.
Second pass on the same commit as my Nov 4 review: six additional findings inline. The summary and earlier findings there still stand.
| self.attrs.stdout_last = Some(SystemTime::now()); | ||
| // The log first: a client is a second reader, and | ||
| // the log has these bytes whatever the client does. | ||
| self.output_log.write(b); |
There was a problem hiding this comment.
medium · The output log can lose the last bytes of an entrypoint. The host loop calls try_wait at each loop head and breaks at once when the process has exited. Nothing drains the terminal first, and line 1908 is the only write to the log. Each step reads at most 8 KiB. So output still in the terminal buffer at exit never reaches the log, and that contradicts the doc on BoxOutputLog. A wake from another source can also lose a short last line. This is one instance: pump_output for a managed exec reads to the end of its output. Drain the master into output_log before the try_wait arm breaks. The loss grows when T43 starts argv entrypoints, because a failed task prints its error last.
| ExecRequest::Exec(spec) => Some(spec.mode), | ||
| _ => None, | ||
| }; | ||
| let exec_id = if let Some(mode) = mode { |
There was a problem hiding this comment.
medium · Every min session exec gets an exec id that goes nowhere. The Shell and Argv forms mint the id here, but run_in_session does not take it, and it writes no exec_started or exec_exited event. Only run_attached_exec and the managed path write events, and no CLI code sends those forms at this head. BOX-152 requires the events when an exec starts or exits. So the box's events have no record of the commands that people run, and a later fix cannot restore that history. ExecBox::write_event also omits the principal and the argv that BOX-152 names. main changed write_event since this base, so check that part again after a rebase.
| command | ||
| .stdin(Stdio::from(slave.try_clone()?)) | ||
| .stdout(Stdio::from(slave.try_clone()?)) | ||
| .stderr(Stdio::from(slave)); |
There was a problem hiding this comment.
low · A tty exec gets the terminal as its stdio, but the terminal never becomes its controlling terminal. No setsid or TIOCSCTTY call is on this path, and the shim only calls setpgid(0, 0). So Ctrl-C typed through min://exec/attach signals nothing, and an interactive shell starts with no job control. No CLI command reaches this mode at this head, so nothing fails yet. The fix is local to this exec path.
| // The client sends no more input, but it still reads. | ||
| Some(russh::ChannelMsg::Eof) => typing = false, | ||
| Some(russh::ChannelMsg::Close) | None => return Ok(AttachEnd::ClientGone), | ||
| Some(_) => {} |
There was a problem hiding this comment.
low · relay_terminal drops ChannelMsg::WindowChange in its Some(_) arm, and serve_exec_attach ignores the size on the attach channel's terminal. The start request's size, or 24 by 80, stays for the life of the exec. A full-screen program then draws at the wrong size after an attach or a resize. The session path handles this through set_winsize at box_runtime.rs:2251. ExecEntry keeps no way to reach the master, so the fix needs a resize path on ExecTerminal. No CLI command reaches this at this head.
| }; | ||
| // One reader for the whole stream, so a drop of the log's oldest | ||
| // bytes during the read sends no byte twice (see `LogReader`). | ||
| let mut reader = Some(boxes::store::LogReader::new(&dir, req.offset)); |
There was a problem hiding this comment.
low · The requested offset is not checked against the log file. After a drop the file is at most 4 MiB, so a Done offset from before the drop can be past its end. A followed read from that offset then sends nothing until the file grows past it. An offset inside the new file skips bytes silently. In both cases the client gets no LOG_DROPPED mark. ReadLogRequest documents that the old offset names another byte, but a client cannot detect that case. When the offset is past the end, start from byte 0, so the mark shows the gap. An offset inside the new file needs a generation value or a similar check. No CLI code calls this RPC at this head.
| { | ||
| command.env("PS1", prompt); | ||
| } | ||
| command |
There was a problem hiding this comment.
nit · The body of the LaunchEntrypoint::Shell arm keeps its old indentation, level with the arm, and the closing command sits deeper. rustfmt probably leaves the whole statement alone because the write_all(format!(..)) line is 102 columns. So just fmt will not correct it. Split that line, and rustfmt can then format the arm. Moving the arm's body into a helper is also an option.
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
Bumps the cargo group with 22 updates in the / directory:
0.11.00.11.10.4.500.4.510.3.40.4.31.17.01.18.01.20.01.21.00.3.00.4.00.2.1900.2.1910.33.00.33.10.64.10.65.00.5.00.6.01.16.31.16.40.39.60.40.01.53.31.54.10.14.60.14.90.14.60.14.90.14.60.14.90.2.20.2.31.28.01.29.01.9.01.9.10.4.200.4.210.8.40.8.50.26.50.26.6Updates
aes-gcmfrom 0.11.0 to 0.11.1Commits
2eff6ccCut releases that replacesubtlewithctutils(#880)c90047fReplacesubtlewithctutils(#879)da2169eocb3: remove unusedctrandzeroizedependencies (#876)f5374f3Add missing crates to the root readme table (#877)e946770eax v0.6.0 (#875)88ceb7ddeoxys v0.2.0 (#874)7d22c81belt-dwp v0.1.0 (#873)09308efascon-aead128 v0.1.0 (#872)e1b1e6eaes-siv v0.8.0 (#871)303c27fccm v0.6.0 (#869)Updates
async-compressionfrom 0.4.50 to 0.4.51Release notes
Sourced from async-compression's releases.
Commits
f2559fdchore: release (#503)c259d25feature(zstd): addmzstdv0.2.5 (#505)a9de8cachore: add keywords to compression crates (#502)e548b13ci: run compression-core tests under Miri (#498)Updates
getrandomfrom 0.3.4 to 0.4.3Changelog
Sourced from getrandom's changelog.
... (truncated)
Commits
5e7cd57Release v0.4.3 (#853)1ea268aUse manual bindings for WASIp2/3 (#830)f7290b0Update Cargo.lock (#852)16ce801Update Cargo.lock (#850)e5adfcaAddwasm64-unknown-unknownsupport forwasm_jsbackend (#848)626df8dUpdate Cargo.lock (#846)4a01cb2Update Cargo.lock (#841)f87bf39Update Cargo.lock (#836)eadb879ci: re-enable build job for x86_64-pc-cygwin (#832)d715d73CI: Reduce the number of packages that are updated for wasip2 MSRV test (#825)Updates
google-cloud-authfrom 1.17.0 to 1.18.0Commits
Updates
google-cloud-storagefrom 1.20.0 to 1.21.0Commits
Updates
jaq-allfrom 0.3.0 to 0.4.0Commits
Updates
libcfrom 0.2.190 to 0.2.191Release notes
Sourced from libc's releases.
Changelog
Sourced from libc's changelog.
Commits
ccc2ff4libc: Release 0.2.191bce6efbapple: Addmach_task_selfandmach_task_self_to semver checksecf4fd4apple: Re-restrictmach_vm_mapto MacOS-onlyb0e0423Revert "apple: Disablemach.hAPI on Apple mobile OSs"9c7f568apple: addifaliasreqandin6_aliasreq018c7e9wasi: Add pthread_condattr_{get,set}clock2c77185openbsd: add sensordev structuree10813churd: Add missingPOSIX_SPAWN_*flags2ea4bc1Fix FreeBSD/aarch646d666fddragonfly: Parse version from headers rather than CLIUpdates
opentelemetry-otlpfrom 0.33.0 to 0.33.1Commits
372ebbcchore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)5582e71docs(logs): polish design doc and fill perf numbers (#3566)7ce1269fix(sdk): log when the periodic metrics reader panics (#3777)b547036fix(prometheus): keep resource labels when scope info is disabled (#3751)e8480dbchore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)0fdfc48feat(proto): Add support for protobuffer descriptor output (#3675)87929d7ci: install markdown-link-check from npm (#3661)ff2ab2ddocs(trace): explain async context propagation (#3759)2595432fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...952bdeefix: accept optional whitespace in TraceState (#3761)Updates
russhfrom 0.64.1 to 0.65.0Release notes
Sourced from russh's releases.
... (truncated)
Commits
183a22ev0.65.039cb9dbreject zero max packet size69e4b55limit pageant message sizes62db6e7call Agent::confirmb33e93blimit ext_info messages730d663check certificate nesting23aa5d2dedupe agent constraintsd65823ffeat(client): support OpenSSH agent session binding (#794)d507707feat(server): expose the publickey algorithms to Handler (#785)13c94f0Fix channel window accounting on window adjust (#790)Updates
sizefrom 0.5.0 to 0.6.0Release notes
Sourced from size's releases.
Commits
5eb283fBump to version 0.6.09f9849aAddSize::ubytes()to get size as au64f4787f1Clarify Size formatting restrictions inno_stdmodedad0c82Re-enable some doc tests under no_std now that formatting is possible1a3fb31Allow using fmt::Display without std (#17)9578e89Explicitly denote elided lifetimefe453c3AddSize::const_new()andSize::new()aliases/helpers66f6e87Reject some edge cases when parsing sizes from strings1ac08deAddress lint about redundant/superseded Cargo.toml package property01990ffFix errantly splitting on non-ascii byte boundariesUpdates
smallvecfrom 1.16.3 to 1.16.4Release notes
Sourced from smallvec's releases.
Commits
- See full diff in compare view
8000eab7746chore: bump version (#779)bb9e44bPort fuzzer changes from PR #737 to v1 (#753)Updates
sysinfofrom 0.39.6 to 0.40.0Changelog
Sourced from sysinfo's changelog.
Commits
48972c4Merge pull request #1784 from GuillaumeGomez/updatef412287Update crate version to0.40.0f158d77Improve wording8b0fd35Update migration guide for0.40355bd2dUpdate changelog for0.40.079cff2dMerge pull request #1783 from pkubaj/be-fbsd-fixdf67344FreeBSD: check sysctl value sizes and use the kernel's C types936a010Merge pull request #1782 from GuillaumeGomez/components-cleanup457cc92RemoveComponents::list[_mut]methodsedd9ae6Merge pull request #1780 from GuillaumeGomez/cleanup-networkUpdates
tokiofrom 1.53.3 to 1.54.1Release notes
Sourced from tokio's releases.
... (truncated)
Commits
b53b200chore: prepare Tokio v1.54.1 (#8693)5ed619btime: revert "remove the runtime handle from timers" (#8692)66d34e4chore: prepare Tokio v1.54.0 (#8667)0d322ceio: support vectored writes in sink (#8663)4167c56codec: expose I/O sources from codec errors (#8665)cdd9daefs: propagate iouring stress test failures (#8644)52ac781ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)4890d02stream: implementFusedStreamforJoinSetStream(#8629)a6bd8e1wasm: check Emscripten version when using JSPI (#8627)9dd749dMerge 'tokio-1.53.3' into 'master' (#8641)Updates
tonicfrom 0.14.6 to 0.14.9Release notes
Sourced from tonic's releases.
... (truncated)
Commits
4c0f455chore: release v0.14.9 (#2979)4ee0483fix(server): set a timer on HTTP/1 connections so hyper's header read timeout...a47b608feat(transport): expose h2 reset stream settings on Endpoint (#2972)349166egrpc/load_balancing: Add address-checked subchannel helpers to TestEnv. (#2938)78a8f2dfeat(tonic-xds): expose ADS keepalive knob in config (#2973)954d6d7xds-client: align ADS keepalive defaults with other gRPC languages (#2970)4b61ef9xds-client: add grpc crate transport implementation (#2920)5413799chore: release v0.14.8 (#2966)b8282b9fix(tonic-web): fix dropped trailers in combined streaming call. (#2474)818532dchore: release v0.14.7 (#2800)Updates
tonic-prostfrom 0.14.6 to 0.14.9Release notes
Sourced from tonic-prost's releases.
... (truncated)
Commits
4c0f455chore: release v0.14.9 (#2979)4ee0483fix(server): set a timer on HTTP/1 connections so hyper's header read timeout...a47b608feat(transport): expose h2 reset stream settings on Endpoint (#2972)349166egrpc/load_balancing: Add address-checked subchannel helpers to TestEnv. (#2938)78a8f2dfeat(tonic-xds): expose ADS keepalive knob in config (#2973)954d6d7xds-client: align ADS keepalive defaults with other gRPC languages (#2970)4b61ef9xds-client: add grpc crate transport implementation (#2920)5413799chore: release v0.14.8 (#2966)b8282b9fix(tonic-web): fix dropped trailers in combined streaming call. (#2474)818532dchore: release v0.14.7 (#2800)Updates
tonic-prost-buildfrom 0.14.6 to 0.14.9Release notes
Sourced from tonic-prost-build's releases.
Commits
4c0f455chore: release v0.14.9 (#2979)4ee0483fix(server): set a timer on HTTP/1 connections so hyper's header read timeout...a47b608feat(transport): expose h2 reset stream settings on Endpoint (#2972)349166egrpc/load_balancing: Add address-checked subchannel helpers to TestEnv. (#2938)78a8f2dfeat(tonic-xds): expose ADS keepalive knob in config (#2973)954d6d7xds-client: align ADS keepalive defaults with other gRPC languages (#2970)4b61ef9xds-client: add grpc crate transport implementation (#2920)5413799chore: release v0.14.8 (#2966)b8...Description has been truncated