[syrusakbary]

Builds on #107, now in main: stopping an environment from another thread only helps if the running environment does not hold a process-wide lock. This branch is rebased onto main and targets it.

Problem

Native env ids and owner-scope ids were allocated per NapiEnv, that is, per Wasmer store. Every guest import resolved them only through the caller's store. A WASIX application with worker threads has one store per thread, all sharing one linear memory. As a result:

• Two stores hand out the same ids: each thread's first env is 1. An id stored in shared guest memory then names a different environment depending on which thread reads it.
• A scope token from another store can alias the caller's own scope, so release_env with another thread's token can release the caller's own environment.
• A guest cannot stop an environment owned by another store of its own application, for example the main thread stopping a runaway Worker. Only the host could, through NapiRuntimeControl::terminate_all(), which stops everything.

Change

Rust only: src/env.rs, src/ctx.rs, src/guest/napi.rs.

• Application-wide ids. The application's env registry, shared by all its stores, now allocates native env ids. Ids are unique across those stores and never reused. Each env has one owner scope, so its native scope id equals its env id. The host-JS (wasm32 + js) backend keeps its current allocation.
• Cross-store terminate. unofficial_napi_terminate_execution resolves its target through that registry (NapiEnv::terminate_app_env), so any store of the application can terminate any of its environments.
  • The registry lock is held only while the request is handed to the bridge.
  • Registered pointers are retained, so the target cannot be released or reused meanwhile.
  • Terminate runs no guest code.
• Everything else stays store-local. All other imports, including interrupt, cancel and release, still resolve only through the caller's own store; a foreign id gets napi_invalid_arg. An interrupt runs a guest function the caller picks (a table index) in the target's instance. Allowing that across stores is only sound when every store sharing a NapiCtx is a thread of the same module, and nothing guarantees that.
• Trust model. NapiRuntimeHooks now documents it: one NapiCtx per application, and separate contexts for unrelated untrusted guests. Different NapiCtxs keep separate registries and cannot reach each other's environments.

Tests

tests/concurrent_stores.rs reuses the WAT guest from #107.

• env_ids_are_unique_per_application. It checks that:

  • two stores get different env ids and scope ids;
  • a scope token from another store cannot release the caller's env;
  • retired ids are not reused;
  • a guest in another application cannot terminate these envs.

• another_store_can_terminate_but_not_interrupt_or_use_an_env. A worker store on its own thread interrupts its own env (the callback runs in its own store), waits in Atomics.wait, then spins. Meanwhile the main store, on the test thread:

  • gets napi_invalid_arg for napi_get_undefined, interrupt, cancel and release on the worker's env;
  • keeps running scripts and serializing messages while the worker is inside JavaScript;
  • terminates the spinning script.

  Afterwards the retired id is rejected, and the main env was never stopped.

Both tests fail on main without these commits, because the two stores get the same env id 1. The interrupt check also fails on the first commit, which let another store interrupt. This branch adds the suite to the CI job from #107.

After rebasing onto main (with #121, #122 and #123): lib tests 54/54, concurrent_envs 10/10, concurrent_stores 2/2 and guest_callbacks 4/4; clippy shows no warnings.

Before the rebase (macOS arm64, Rust 1.96.1, V8 11.9.9 prebuilt):

• concurrent_stores: 2/2, plus 20/20 repeated runs of the whole binary.
• concurrent_envs: 10/10, plus 20/20 repeated runs.
• v8_host_control: 3/3.
• Lib tests: 46/46.
• Manifest programs: all 36, natively and as WASIX.
• Host-JS node test: 14/14.
• snapi_js wasm-bindgen tests: 6/6.
• cargo fmt is clean, and clippy shows no new warnings.

Behavior changes

• A guest can now terminate any environment of its own application by id, not just those in its own store.
• Native env ids come from one application-wide counter. A guest that assumed its first env id is 1 will see other values; the API never guaranteed that.
• Running out of the 2^32 native id space panics instead of handing out duplicate ids. The third commit releases the registry lock before that panic, so it doesn't poison the registry for the application's other stores.

Known follow-up (not changed here)

Message ids are process-wide, sequential and carry no owner check. This is already the case on main; see #107.

Relation to #93

#93 changes neither id allocation nor cross-store control: its terminate and interrupt imports still resolve through the caller's store. This PR does not depend on #93's other fixes (fatal-error exits, callback exit propagation, external-buffer ownership, reentrant release rejection). It needs only one thing from the bridge: accepting a terminate from another thread while the target runs JavaScript. #107 provides that, and #93's terminate path would too.

Size: 5 files, +274/−46 against main:

Area	Lines
Rust (env.rs +80/−32, ctx.rs +14/−10, guest/napi.rs +2/−2)	+96/−44
test	+174
CI	+4/−2

🤖 Generated with Claude Code