Native host: wasmtime producers behind a Tauri webview receiver - #16
Merged
Conversation
host/stream-dom-host runs producers on wasmtime 47 with per-store memory and epoch limits and an empty WASI context; each guest write is forwarded to a HostBridge and completes only when the receiver acks it, so "queries observe every committed batch" holds on this tier with no buffering. host/desktop is a Tauri 2 app whose webview runs the existing receiver driver over IPC (pull with implicit ack), under a strict CSP and a navigation refusal; a WebDriver smoke test drives TodoMVC under Xvfb. Receiver: desktopPolicy(), the first concrete embedder policy — allowlists for tags, attributes, properties and event names, asset-only URL attributes with parsed (not prefix-matched) relative/external href opt-ins, and node, listener and string budgets. createDriver gains defaultPreventDefault, which cancels unlistened submits and off-page link clicks at the mount root. Design record: native-host transports column, trust inversion, what a policy cannot see.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A fourth transport: producers run in wasmtime in a native process, the receiver runs in a Tauri webview, and the two meet over IPC. Semantically it is the worker tier (option C events only, no imperative
preventDefault), plus what a wasm sandbox adds: per-producer memory and CPU limits and a host-chosen WASI capability surface. Producers are treated as untrusted; the webview is the privileged principal, so this PR also ships the receiver's first concrete policy.host/stream-dom-host— wasmtime 47 host (component-model async,StoreLimits, epoch yielding, WASI with no preopens/sockets). One actor per producer owns the store;handle-eventcalls are serialized. The mutation stream is piped into an ack-gatedStreamConsumer: each guest write completes only afterHostBridge::applyresolves, so queries observe every committed batch holds structurally with no receiver-side buffering. Headless integration test drives the Dioxus TodoMVC component: wire shape, ack gating (mutation-tested), an event round trip, shutdown, and a too-small memory cap failing loudly.host/desktop— Tauri 2 app. Pull with implicit ack:read_chunkreturns raw bytes and the nextread_chunkacks the previous one; events are oneinvokewith the payload as raw body; queries ride aChannel. Strict CSP, explicit command capabilities,on_navigationrefuses everything off-origin. WebDriver smoke test (tauri-driver + WebKitWebDriver under Xvfb) mounts TodoMVC, adds and completes a todo, and reports IPC latency (~60–100 ms per read round trip vs single-digit ms DOM apply).desktopPolicy(): allowlists (not denylists) for tags, attributes, properties, event names; URL-kind attributes takeassetvalues only, withrelativeHref/externalLinksopt-ins judged by URL parsing;maxNodes/maxListeners/maxStringBytesbudgets;bindMarkerdenied.createDriver({ defaultPreventDefault })installs root capture listeners cancelling unlistenedsubmits and off-page link clicks (hash routes still work). In-page mount unchanged (just e2egreen).Independent review round on the policy applied (parser-based same-origin check, DOM-clobbering
name, invoker/formtargetattributes, passive-listener and no-listener default-action gaps).Gates
just check,just test(host: 5, receiver: 134),just e2e,just desktop-smoke— all green locally. CI gains the webkit2gtk dev libs,webkit2gtk-driver, Xvfb andtauri-driver(binstall) for the desktop crate and its smoke test.Automerge is armed (merge commit).