fix(ocap-kernel): deserialize CapData rejections in Kernel.queueMessage

Vat rejections are serialized as CapData objects before leaving the vat
runtime. Previously, callers of Kernel.queueMessage (the RPC handler and
SubclusterManager) each had their own isCapData/kunser call-site patches
to convert them back into plain Errors. Consolidate the deserialization
into Kernel.queueMessage itself so all callers see plain Error objects
without needing individual workarounds.

([#928](#928))

Author: grypez

packages/ocap-kernel/CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Deserialize CapData rejections in `Kernel.queueMessage` so vat errors surface as plain `Error` objects to all callers ([#928](https://github.com/MetaMask/ocap-kernel/pull/928))
+
 ## [0.7.0]
 
 ### Added

packages/ocap-kernel/src/Kernel.test.ts

@@ -7,6 +7,7 @@ import type { Mocked, MockInstance } from 'vitest';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 import { Kernel } from './Kernel.ts';
+import { kser } from './liveslots/kernel-marshal.ts';
 import type {
   VatId,
   VatConfig,
@@ -214,6 +215,33 @@ describe('Kernel', () => {
       const result = await kernel.queueMessage('ko1', 'hello', []);
       expect(result).toStrictEqual({ body: '{"result":"ok"}', slots: [] });
     });
+
+    it('deserializes CapData rejections into Errors', async () => {
+      const kernel = await Kernel.make(
+        mockPlatformServices,
+        mockKernelDatabase,
+      );
+      mocks.KernelQueue.lastInstance.enqueueMessage.mockRejectedValueOnce(
+        kser(new Error('vat rejection message')),
+      );
+      await expect(kernel.queueMessage('ko1', 'hello', [])).rejects.toThrow(
+        'vat rejection message',
+      );
+    });
+
+    it('propagates non-CapData rejections as-is', async () => {
+      const kernel = await Kernel.make(
+        mockPlatformServices,
+        mockKernelDatabase,
+      );
+      const internalError = new Error('internal kernel error');
+      mocks.KernelQueue.lastInstance.enqueueMessage.mockRejectedValueOnce(
+        internalError,
+      );
+      await expect(kernel.queueMessage('ko1', 'hello', [])).rejects.toThrow(
+        'internal kernel error',
+      );
+    });
   });
 
   describe('launchSubcluster()', () => {

packages/ocap-kernel/src/Kernel.ts

@@ -1,5 +1,6 @@
 import type { CapData } from '@endo/marshal';
 import type { KernelDatabase } from '@metamask/kernel-store';
+import { isCapData } from '@metamask/kernel-utils';
 import { Logger } from '@metamask/logger';
 
 import { IOManager } from './io/IOManager.ts';
@@ -10,8 +11,8 @@ import { KernelQueue } from './KernelQueue.ts';
 import { KernelRouter } from './KernelRouter.ts';
 import { KernelServiceManager } from './KernelServiceManager.ts';
 import type { KernelService } from './KernelServiceManager.ts';
+import { kslot, kunser } from './liveslots/kernel-marshal.ts';
 import type { SlotValue } from './liveslots/kernel-marshal.ts';
-import { kslot } from './liveslots/kernel-marshal.ts';
 import { OcapURLManager } from './remotes/kernel/OcapURLManager.ts';
 import { RemoteManager } from './remotes/kernel/RemoteManager.ts';
 import type { RemoteCommsOptions } from './remotes/types.ts';
@@ -386,7 +387,14 @@ export class Kernel {
     method: string,
     args: unknown[],
   ): Promise<CapData<KRef>> {
-    return this.#kernelQueue.enqueueMessage(target, method, args);
+    try {
+      return await this.#kernelQueue.enqueueMessage(target, method, args);
+    } catch (rejection) {
+      if (isCapData(rejection)) {
+        throw kunser(rejection as CapData<KRef>);
+      }
+      throw rejection;
+    }
   }
 
   /**

packages/ocap-kernel/src/rpc/kernel-control/queue-message.test.ts

@@ -64,7 +64,7 @@ describe('queueMessageHandler', () => {
     expect(result).toStrictEqual(expectedResult);
   });
 
-  it('should propagate errors from kernel.queueMessage', async () => {
+  it('propagates rejections from kernel.queueMessage', async () => {
     const error = new Error('Queue message failed');
     vi.mocked(mockKernel.queueMessage).mockRejectedValueOnce(error);
 

packages/ocap-kernel/src/vats/SubclusterManager.ts

@@ -1,6 +1,5 @@
 import type { CapData } from '@endo/marshal';
 import { SubclusterNotFoundError } from '@metamask/kernel-errors';
-import { isCapData } from '@metamask/kernel-utils';
 import { Logger } from '@metamask/logger';
 
 import type { IOManager } from '../io/IOManager.ts';
@@ -341,22 +340,10 @@ export class SubclusterManager {
         `Bootstrap vat "${config.bootstrap}" not found in rootIds`,
       );
     }
-    let bootstrapResult: CapData<KRef>;
-    try {
-      bootstrapResult = await this.#queueMessage(rootKref, 'bootstrap', [
-        roots,
-        services,
-      ]);
-    } catch (rejection) {
-      // queueMessage rejects with CapData for rejected kernel promises.
-      // Deserialize to surface the original Error to the caller.
-      // If the rejection isn't CapData (e.g., an internal error before the
-      // kernel promise was created), re-throw as-is.
-      if (isCapData(rejection)) {
-        throw kunser(rejection as CapData<KRef>);
-      }
-      throw rejection;
-    }
+    const bootstrapResult = await this.#queueMessage(rootKref, 'bootstrap', [
+      roots,
+      services,
+    ]);
     const unserialized = kunser(bootstrapResult);
     if (unserialized instanceof Error) {
       throw unserialized;