Skip to content

CHANGELOG.md

Latest commit

 

History

History
203 lines (154 loc) · 16.9 KB

CHANGELOG.md

File metadata and controls

203 lines (154 loc) · 16.9 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

  • Add fetch, Request, Headers, and Response to available vat endowments (#942)
    • Add VatConfig.network: { allowedHosts: string[] }; requesting 'fetch' without it rejects initVat
  • Integrate Snaps attenuated endowment factories into vat globals (#937)
    • Add setInterval, clearInterval, crypto, SubtleCrypto, and Math (crypto-backed Math.random) to the default vat endowments
    • BREAKING: setTimeout now enforces a 10 ms minimum delay (upstream Snaps MINIMUM_TIMEOUT); shorter delays are silently coerced to 10 ms
    • BREAKING: Date.now() is attenuated — each read adds up to 1 ms of random jitter, clamped monotonic non-decreasing; precise sub-millisecond timing no longer leaks through
    • BREAKING: clearTimeout/clearInterval only clear handles created by the same vat's setTimeout/setInterval; passing a host-format handle is a no-op
    • BREAKING: replace exported DEFAULT_ALLOWED_GLOBALS constant with createDefaultEndowments() factory and VatEndowments type; VatSupervisor now accepts makeAllowedGlobals in place of allowedGlobals
  • Make vat global allowlist configurable and expand available endowments (#933)
    • Export DEFAULT_ALLOWED_GLOBALS with URL, URLSearchParams, atob, btoa, AbortController, and AbortSignal in addition to the existing globals
    • Accept optional allowedGlobals on VatSupervisor for custom allowlists
    • Log a warning when a vat requests an unknown global
  • Export OcapURLIssuerService and OcapURLRedemptionService types so vats can type the corresponding kernel-service endowments (#952)

Changed

  • BREAKING: Remove VatConfig.platformConfig.fetch — migrate to globals: ['fetch', ...] + network.allowedHosts (#942)
  • BREAKING: MakeAllowedGlobals now takes a { logger } options bag (#942)
  • BREAKING: Type VatConfig.globals and Kernel.make's allowedGlobalNames as AllowedGlobalName[] (a literal union) instead of string[]; unknown names are now rejected at the initVat RPC boundary (#941)
    • Exports: AllowedGlobalName, AllowedGlobalNameStruct, MakeAllowedGlobals, VatEndowmentsStruct
  • Bound relay hints in OCAP URLs to a maximum of 3 and cap the relay pool at 20 entries with eviction of oldest non-bootstrap relays (#929)

Fixed

  • Deserialize CapData rejections in Kernel.queueMessage so vat errors surface as plain Error objects to all callers (#928)
  • Detect peer restart across receiver state loss so the receiving kernel no longer silently drops a restarted peer's seq=1 messages (#948)
    • Persist the peer's last-observed incarnation and compare it on every successful handshake; on a detected restart, clear the peer's c-list contributions and reject the promises it was deciding before the new incarnation reuses any erefs
  • Accept liveslots-allocated durable, virtual, and faceted vrefs (e.g. o+d10/1, o+v3/4:0) in isVRef / insistERef / EndpointMessageStruct validation (#949)
    • Previously the regex only matched plain [op][+-]N, so any vat using defineDurableKind failed outgoing-send validation and persisted-slot reads
  • Regenerate incarnationId when resetStorage=true clears the rest of kernel state, completing the #948 peer-restart detection on browser/extension kernel reloads (#950)
    • The previous except-list preserved incarnationId across resetStorage wipes, so a restarted sender signalled the same incarnation it had before the wipe and the matching receiver's handshake decided "no restart" — leaving stale highestReceivedSeq in place and silently dropping the sender's fresh seq=1 messages
  • Register a new vat with its subcluster before awaiting runVat, so a garbage-collection pass during bundle load cannot delete the still-empty subcluster out from under the in-progress vat creation (#952)
  • Use length-prefixed framing for remote messages so payloads larger than the underlying transport's per-frame cutoff (e.g. @libp2p/webrtc's 16 KB datachannel limit) are reassembled correctly on the receiver (#957)
    • Replace byteStream with lpStream on every remote channel; the byte-oriented stream did not preserve write() boundaries, so any message the transport split into multiple frames was parsed from the first frame only, silently dropped without acknowledgement, and the sender retried until giving up after MAX_RETRIES
    • Surface receiver-side framing-cap violations (InvalidDataLengthError, InvalidDataLengthLengthError) as ResourceLimitError with limitType: 'messageSize' so size errors look the same whether they tripped on the sender's validateMessageSize or the receiver's framing decoder
  • Restore IO channels for persisted subclusters at kernel init so re-incarnated vats find their IOService references live (#963)
    • SubclusterManager.restorePersistedIOChannels() walks every persisted subcluster, finds those whose config declares io, and re-creates the channels via IOManager before initializeAllVats runs
    • Without this, any vat that opened an IO channel via launchSubcluster lost its channel across daemon stop / daemon start and silently held a dead IOService reference

0.7.0

Added

  • Add various configurable timeouts for remote communications (#906)
  • Propagate relay hints from redeemed ocap URLs (#887)
  • Add allowedWsHosts parameter to initializeRemoteComms() (#878)

Changed

  • BREAKING: Adopt branded string types for kernel identifiers (#917, #921)
  • Standardize vat-observable kernel errors (#913)
  • Upgrade libp2p to v3 and improve remote communication reliability (#900, #915)
  • Auto-extract allowedWsHosts from plain ws:// relay multiaddrs in ConnectionFactory (#881)
  • Use E() for kernel service invocation to support remote presences as services (#872)

Fixed

  • Attempt to reconnect to unreachable relays on startup (#918)
  • Restore single-delivery guarantee per crank and prevent rollback cache staleness (#879)

0.6.0

Added

  • Add TextEncoder, TextDecoder, setTimeout, and clearTimeout to vat globals allowlist (#856)
  • Add IOManager and IO kernel service for vat I/O streams (#840)
  • Add system subclusters and kernel facet service (#803)
    • Restrict kernel services to system subclusters only (#833)
    • Return generic "no registered kernel service" error for system-only services requested by non-system subclusters (#838)
  • Buffer vat outputs to make cranks transactional (#794)
    • Enqueue async vat syscalls immediately when outside a crank (#848)
  • Add caplet vat type for lightweight vat configurations (#753)
  • Add CapTP infrastructure for kernel-to-kernel communication (#751)
  • Prevent vat endowment names from being overridden (#619)
  • Add kernel-to-kernel remote communication via libp2p (#578)
    • Add remoteComms status to Kernel.getStatus() output (#637)
    • Add relays parameter to initRemoteComms for configuring relay servers (#638)
    • Add location hint support to OCAP URL handling (#666)
    • Fix kernel restart with open remote connections (#677)
    • Add automatic reconnection with exponential backoff for remote comms (#678)
    • Fix remote endpoint initialization to occur during registration rather than construction (#681)
    • Fix shutdown handling to properly sequence crank completion, stream closing, and remote comms teardown (#692)
    • Fix remote message queueing during connection establishment (#697)
    • Add explicit connection management for intentional disconnects (#699)
    • Reject pending promises on connection loss (#706)
    • Refactor remote location hint handling and add registerLocationHints platform service (#712)
    • Add timeout handling for remote message sends and URL redemptions (#713)
    • Add resource limits for remote communications (#714)
    • Add message sequencing and acknowledgment to remote messaging (#744)
    • Persist pending messages and sequence state in RemoteHandle across restarts (#760)
    • Add rate limiting for remote messages and connections (#776)
    • Add BIP39 mnemonic support for kernel identity seed recovery (#780)
    • Add kernel incarnation detection protocol for identifying peer restarts (#788)
    • Add permanent failure detection for reconnection attempts (#789)
    • Add incarnation ID infrastructure and handshake module (#800)
    • Handle reconnection to restarted peers with incarnation ID detection (#807)
    • Complete Ken protocol implementation for reliable remote message delivery (#811)
    • Implement distributed garbage collection protocol for remote references (#814)
    • Add cross-incarnation wake detection to reset backoffs on peer restart (#822)
    • Enable OCAP URL issuance and redemption without active remote comms (#823)
    • Add direct transport support (QUIC + TCP) for Node.js peer connections (#839)
    • Add initRemoteComms and registerLocationHints RPC methods for kernel control (#849)
    • Fix trailing comma in OCAP URLs when no relays are known (#850)
    • Allow plain ws:// connections for relay dialing (#855)
    • Restrict plain ws:// relay dialing to private and explicitly allowed addresses (#857)
    • Accept allowedWsHosts parameter in initRemoteComms RPC (#858)
    • Re-dial relays on connection close with exponential backoff (#860)

Changed

  • BREAKING: Drop Node 20 support (#837)
  • Close database in Kernel.stop() (#845)
  • Remove reloadConfig and reloadSubcluster methods from Kernel (#836)
  • Export Baggage and VatPowers types (#801)
  • Load vat bundles via Vite instead of @endo/import-bundle (#763)
  • Extract VatManager and SubclusterManager from Kernel class (#651)
    • Extract RemoteManager and KernelServiceManager from Kernel class (#653)
  • Migrate kernel service dispatch from Far to makeExo (#612)

Fixed

  • Disable cache for default bundle fetch (#802)
  • Clean up orphan messages during recovery (#769)
  • Fix message delivery to terminated vats (#617)
  • Handle messages remaining in queue after kernel restart (#611)
  • Fix kernel initialization and operation with persistent storage (#604)

0.5.0

Changed

  • Dual-license package under MIT and/or Apache 2.0 (#601)

0.4.0

Added

  • Add kernel service object support (#563)

Changed

  • Wait for crank to run kernel actions (#595)
  • Bump Endo and Agoric dependencies (#590)
  • Throw if subcluster launch fails (#566)
  • Use @metamask/logger (#559)

Fixed

  • Remove redundant kernel promise ref count increment (#565)

0.3.0

Added

  • Add revoke kernel command (#544)
  • Support multiple subclusters (#530)

Removed

  • Remove support for launching vats outside a subcluster (#535)

Fixed

  • Throwing from remotable method rejects result (#545)

0.2.0

Added

  • Make export paths compatible with Browserify (#533)
  • Properly handle syscall failures (#520)
  • Add Kernel.getStatus() (#522)
  • Use JSON-RPC notifications for vat syscalls (#528)

Removed

  • Remove waitForSyscallsToComplete() (#527)

0.1.0

Added

  • Initial release.