Module workspace 

A project directory moved between a host and a VM: the manifest, the diff, one incremental sync pass, and the guarded download of a remote tree (#260).

The daemon extracts uploads; the client extracts only what the caller chose

The trust boundary is asymmetric and the code follows it. On the way in, the archive is built on the host from a tree the caller owns, and the daemon, whose openat2 confinement is the extraction surface this workspace hardened (crates/agentd/src/fs.rs), unpacks it. On the way out, the archive describes the VM’s filesystem, and the VM is where untrusted work runs, so LocalTree::extract writes only the members the caller’s globs selected, only when they’re regular files, never under .git, and never outside the destination. A workload that appends ../../.ssh/authorized_keys, a symlink or .git/hooks/pre-commit to the archive gets it skipped rather than written.

The same holds for the guest’s manifest: it’s read from the VM, so a deletion it orders is executed only when deletable finds a plain relative path in it.

What lives here and what lives in the edges

This module is the rules: which directories never travel, the daemon’s budgets, what a manifest is, what a diff between two manifests orders, which deletion paths are safe, and the sync pass that composes them over a Session. It reads no file (ARCH-7). The walk, the hashing, the tar packing and the extraction are LocalTree’s, the port microvms-edges implements over the real filesystem, so a test can hand the pass a tree of its own.

Structs

Artifact

One member LocalTree::extract wrote.

Delta

What an incremental sync has to do.

Manifest

What one sync left in the guest: every member’s identity, keyed by relative path.

Packed

A packed archive and how many members it holds.

SyncPass

What one sync pass did.

WorkspaceError

A local tree that couldn’t be packed, hashed or written to.

Constants

DEFAULT_SYNC_DELETE_TIMEOUT

The in-guest rm’s timeout_sec when a caller names none: microvm sync --timeout‘s default, and the bindings’ sync_dir’s.

MANIFEST_NAME

The manifest’s member name relative to the workspace. It never travels and never appears in a Delta, so the manifest can’t order its own deletion.

MANIFEST_PATH

Where the incremental manifest lives in the guest: inside the workspace, deliberately.

MANIFEST_VERSION

The manifest format this build writes.

MAX_PACK_BYTES

The pack’s byte budget: the daemon’s max_body_bytes (512 MiB), checked on file sizes during the walk, so an over-budget tree is refused before its archive is allocated.

MAX_PACK_MEMBERS

The pack’s member budget: the daemon’s max_tar_members.

REMOTE_WORKDIR

Where a synced tree lands in the guest, and the working directory of what runs in it.

SKIPPED_DIRS

Directory names never packed or hashed, whole.

SYNC_DELETE_GRACE

How long past the in-guest rm’s own timeout_sec a sync pass waits for its answer.

Traits

LocalTree

A local directory tree, packed, hashed and written to: the port microvms-edges implements over the real filesystem.

Functions

deletable

Whether a deletion path from the guest manifest is safe to hand to an in-guest rm.

diff

What changed between the tree as it is (local) and as the last sync left it (remote).

within_byte_budget

Whether a walk’s running byte total is still within MAX_PACK_BYTES: at the budget is within it, one byte past isn’t.

within_member_budget

Whether a walk’s running member count is still within MAX_PACK_MEMBERS.