Module runtime 

Structs

SecretShapedEnvGrant

One credential-shaped entry of capabilities.env.allow that reaches every WASM guest.

StrippedEnvAllowEntry

A capabilities.env.allow entry the credential backstop removes from every guest environment, with the pattern that removes it.

Functions

check_env_allow_reaches_guests

Refuses a capsule whose capabilities.env.allow names a variable the credential backstop strips, naming every such entry at once.

check_no_reserved_tool_names

Refuses the first declared artifact name that collides with a runtime-provided tool.

launch_session

Instantiates the staged capsule and executes it.

launch_session_handling_sigterm

launch_session for a process whose lifetime is this one session.

secret_shaped_env_grants

Pure decision for the capabilities.env.allow secret warning, split out of warn_on_secret_shaped_env_grants on the same terms as [unreachable_shell_completions_warning], so a test can assert it without capturing stderr.

stage_session

Resolves and verifies all artifacts, compiles components, and prepares session state.

stripped_env_allow_entries

Every distinct policy.env_allow name the credential backstop drops, in first-declaration order, each attributed through crate::credential_backstop_match against policy.shell_strip_env. Empty when every declared name reaches the guest, including when env_allow is empty. Judged from names alone.

undeclarable_runtime_pin_role

The manifest text that declares a manage.pull() pin in a role only an operator-declared pin may carry — runtime: hook, runtime: driver, a gateway: block, or inference.system_prompt_artifact naming a skill — or None when the entry asks only for what a pull can produce: a tool or a skill with no gateway, reached as a callable entry.

warn_on_gateway_endpoint_in_network_allow

Warns (non-fatal, once per matching entry) when a capabilities.network.allow entry names the host of an artifact’s gateway.endpoint: a capsule-wide entry against every artifact’s gateway, an entry on an artifact’s own capabilities: against that artifact’s.

warn_on_interpreter_runtime_grants

Warns (non-fatal, once per declared grant) for every capabilities.shell.interpreter_runtime entry. Declaring one narrows an allowlisted binary’s Landlock scope to specific host directories so a path-based interpreter can reach its stdlib — but it couples the capsule to a specific host distro/interpreter-version layout (e.g. /usr/lib/python3.11 stops resolving the moment the host ships Python 3.12), which the operator should see plainly. The durable fix is the still-unbuilt staged runtime bind-mount; this grant only bridges until then.

warn_on_launch_only_gateway_credential

Warns (non-fatal, once per gateway credential) when an artifact’s gateway.api_key can only be read at launch: a literal in the manifest, or a ${NAME} that the global config’s credentials: map does not hold and the environment supplies.

warn_on_secret_shaped_env_grants

Warns (non-fatal, once per distinct credential-shaped capabilities.env.allow entry) that the capsule was handed a host secret murmur does not broker.

warn_on_unmetered_gateways

Warns (non-fatal, once per gateway) when an artifact reaches its upstream through a credential gateway that is not a driver choice’s — the configured transport: http driver’s or an inference.alternates driver’s — and so is not metered.

warn_on_userns_restriction_disabled_host_wide

Warns (non-fatal) when this host’s unprivileged user namespaces are unrestricted because kernel.apparmor_restrict_unprivileged_userns is off, rather than because the shipped mur-sealed AppArmor profile is confining this binary.

warn_on_workdir_exec

Warns (non-fatal, once per session) when a capsule declares capabilities.filesystem.workdir_exec: true.