refactor(fspy-shared): make the channel allocator-generic

channel(), Receiver, and sender() are now generic over an
allocator-api2 allocator instead of hardcoding the global allocator and
an internal pooled bump:

- channel() threads the caller's allocator through the shared-memory
  backing path and the ShmKeeper; the supervisor instantiates with
  Global.
- sender() takes the allocator for its transient shm-path decode from
  the caller, so the choice of preload-safe memory — the preloads pass
  a pooled bump — lives at the call site instead of inside fspy_shared.
- The lock file path is now generated absolute: temp_dir() reflects
  TMPDIR verbatim, which may be relative, and the path travels to
  processes with other working directories.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wan9chi

Cargo.lock

@@ -6,6 +6,7 @@ license.workspace = true
 publish = false
 
 [dependencies]
+allocator-api2 = { workspace = true, features = ["alloc"] }
 wincode = { workspace = true }
 bstr = { workspace = true, features = ["alloc", "std"] }
 bumpalo = { workspace = true }

crates/fspy/Cargo.toml

@@ -1,5 +1,6 @@
 use std::io;
 
+use allocator_api2::alloc::Global;
 use fspy_shared::ipc::{
     PathAccess,
     channel::{Receiver, ReceiverLockGuard},
@@ -14,19 +15,19 @@ pub const SHM_CAPACITY: usize = 4 * 1024 * 1024 * 1024;
 #[ouroboros::self_referencing]
 pub struct OwnedReceiverLockGuard {
     /// Owns the shared memory
-    receiver: Receiver,
+    receiver: Receiver<Global>,
     /// Borrows the shared memory and owns the file lock
     #[borrows(receiver)]
     #[covariant]
     lock_guard: ReceiverLockGuard<'this>,
 }
 
 impl OwnedReceiverLockGuard {
-    pub fn lock(receiver: Receiver) -> io::Result<Self> {
+    pub fn lock(receiver: Receiver<Global>) -> io::Result<Self> {
         Self::try_new(receiver, fspy_shared::ipc::channel::Receiver::lock)
     }
 
-    pub async fn lock_async(receiver: Receiver) -> io::Result<Self> {
+    pub async fn lock_async(receiver: Receiver<Global>) -> io::Result<Self> {
         spawn_blocking(move || Self::lock(receiver)).await.expect("lock task panicked")
     }
 

crates/fspy/src/ipc.rs

@@ -79,8 +79,8 @@ impl SpyImpl {
         let supervisor = supervise::<SyscallHandler>().map_err(SpawnError::Supervisor)?;
 
         #[cfg(not(target_env = "musl"))]
-        let (ipc_channel_conf, ipc_receiver) =
-            channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
+        let (ipc_channel_conf, ipc_receiver) = channel(SHM_CAPACITY, allocator_api2::alloc::Global)
+            .map_err(SpawnError::ChannelCreation)?;
 
         let payload = Payload {
             #[cfg(not(target_env = "musl"))]

crates/fspy/src/unix/mod.rs

@@ -86,8 +86,8 @@ impl SpyImpl {
 
         command.creation_flags(CREATE_SUSPENDED);
 
-        let (channel_conf, receiver) =
-            channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
+        let (channel_conf, receiver) = channel(SHM_CAPACITY, allocator_api2::alloc::Global)
+            .map_err(SpawnError::ChannelCreation)?;
 
         let mut spawn_success = false;
         let spawn_success = &mut spawn_success;

crates/fspy/src/windows/mod.rs

@@ -53,7 +53,11 @@ impl Client {
     pub fn from_env(envs: impl Iterator<Item = fspy_nostd::env::Entry>) -> Self {
         let encoded_payload = decode_payload_from_env(envs).unwrap();
 
-        let ipc_sender = match encoded_payload.payload.ipc_channel_conf.sender() {
+        let ipc_sender = match encoded_payload
+            .payload
+            .ipc_channel_conf
+            .sender(fspy_nostd_alloc::pooled_bump())
+        {
             Ok(sender) => Some(sender),
             Err(err) => {
                 // This can happen if the process starts after the root target

crates/fspy_client_unix/src/lib.rs

@@ -13,6 +13,7 @@ wincode = { workspace = true }
 constcat = { workspace = true }
 fspy_detours_sys = { workspace = true }
 fspy_nostd = { workspace = true }
+fspy_nostd_alloc = { workspace = true }
 fspy_shared = { workspace = true }
 ntapi = { workspace = true }
 smallvec = { workspace = true }

crates/fspy_preload_windows/Cargo.toml

@@ -16,7 +16,7 @@ impl<'a> Client<'a> {
     pub fn from_payload_bytes(payload_bytes: &'a [u8]) -> Self {
         let payload: Payload<'a> = wincode::deserialize_exact(payload_bytes).unwrap();
 
-        let ipc_sender = match payload.channel_conf.sender() {
+        let ipc_sender = match payload.channel_conf.sender(fspy_nostd_alloc::pooled_bump()) {
             Ok(sender) => Some(sender),
             Err(err) => {
                 // this can happen if the process is started after the root target process has exited.

crates/fspy_preload_windows/src/windows/client.rs

@@ -4,7 +4,7 @@ mod shm_io;
 
 use std::{env::temp_dir, ffi::OsStr, fs::File, io, ops::Deref, path::PathBuf};
 
-use allocator_api2::alloc::Global;
+use allocator_api2::alloc::Allocator;
 use fspy_nostd::Fat;
 use fspy_nostd_alloc::OsCString;
 use fspy_shm::Mapping;
@@ -33,11 +33,17 @@ pub struct ChannelConf {
 
 /// Creates a mpsc IPC channel with one receiver and a `ChannelConf` that can be passed around processes and used to create multiple senders
 #[expect(clippy::missing_errors_doc, reason = "non-vt crate: cannot use vt_str/vt_path types")]
-pub fn channel(capacity: usize) -> io::Result<(ChannelConf, Receiver)> {
-    // Initialize the lock file with a unique name.
-    let lock_file_path = temp_dir().join(format!("fspy_ipc_{}.lock", Uuid::new_v4()));
-
-    let shm_c_path = os_c_string(shm_backing_path()?.as_os_str())?;
+pub fn channel<A: Allocator>(
+    capacity: usize,
+    allocator: A,
+) -> io::Result<(ChannelConf, Receiver<A>)> {
+    // Initialize the lock file with a unique name. `temp_dir` reflects
+    // `TMPDIR` verbatim, which may be relative; the path travels to processes
+    // with other working directories, so resolve it first.
+    let lock_file_path =
+        std::path::absolute(temp_dir())?.join(format!("fspy_ipc_{}.lock", Uuid::new_v4()));
+
+    let shm_c_path = os_c_string(shm_backing_path()?.as_os_str(), allocator)?;
     let handle =
         fspy_shm::create(shm_c_path.as_c_str().as_thin(), capacity).map_err(shm_error_to_io)?;
     // The keeper exists from here on, so every error path below cleans up.
@@ -54,27 +60,27 @@ pub fn channel(capacity: usize) -> io::Result<(ChannelConf, Receiver)> {
 }
 
 /// Encodes `path` as an owned NUL-terminated platform C string.
-fn os_c_string(path: &OsStr) -> io::Result<OsCString<Fat, Global>> {
-    let mut units = os_units(path);
+fn os_c_string<A: Allocator>(path: &OsStr, allocator: A) -> io::Result<OsCString<Fat, A>> {
+    let mut units = os_units(path, allocator);
     units.push(0);
     OsCString::from_vec_with_nul(units)
         .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "path contains NUL"))
 }
 
 #[cfg(unix)]
-fn os_units(path: &OsStr) -> allocator_api2::vec::Vec<u8> {
+fn os_units<A: Allocator>(path: &OsStr, allocator: A) -> allocator_api2::vec::Vec<u8, A> {
     use std::os::unix::ffi::OsStrExt as _;
 
-    let mut units = allocator_api2::vec::Vec::with_capacity(path.len() + 1);
+    let mut units = allocator_api2::vec::Vec::with_capacity_in(path.len() + 1, allocator);
     units.extend_from_slice(path.as_bytes());
     units
 }
 
 #[cfg(windows)]
-fn os_units(path: &OsStr) -> allocator_api2::vec::Vec<u16> {
+fn os_units<A: Allocator>(path: &OsStr, allocator: A) -> allocator_api2::vec::Vec<u16, A> {
     use std::os::windows::ffi::OsStrExt as _;
 
-    let mut units = allocator_api2::vec::Vec::with_capacity(path.len() + 1);
+    let mut units = allocator_api2::vec::Vec::with_capacity_in(path.len() + 1, allocator);
     for unit in path.encode_wide() {
         units.push(unit);
     }
@@ -128,11 +134,11 @@ fn to_verbatim_if_long(path: PathBuf) -> io::Result<PathBuf> {
 ///
 /// Removal is cleanup, not a stop signal: later opens fail, but existing
 /// handles and mappings keep reading and writing; see [`fspy_shm::remove`].
-struct ShmKeeper {
-    path: OsCString<Fat, Global>,
+struct ShmKeeper<A: Allocator> {
+    path: OsCString<Fat, A>,
 }
 
-impl Drop for ShmKeeper {
+impl<A: Allocator> Drop for ShmKeeper<A> {
     fn drop(&mut self) {
         let _ = fspy_shm::remove(self.path.as_c_str().as_thin());
     }
@@ -146,15 +152,13 @@ impl ChannelConf {
         clippy::missing_errors_doc,
         reason = "error conditions are self-evident from return type"
     )]
-    pub fn sender(&self) -> io::Result<Sender> {
+    pub fn sender<A: Allocator>(&self, allocator: A) -> io::Result<Sender> {
         let lock_file = File::open(self.lock_file_path.to_cow_os_str())?;
         lock_file.try_lock_shared()?;
 
-        // The arena never touches the process heap, so this stays safe in
-        // the preload contexts that create senders (pre-`main` constructors,
-        // the Windows loader lock).
-        let arena = fspy_nostd_alloc::pooled_bump();
-        let shm_path = self.shm_id.to_os_c_string_in(&arena).ok_or_else(|| {
+        // The allocation is transient: the decoded path only has to outlive
+        // the open call below.
+        let shm_path = self.shm_id.to_os_c_string_in(allocator).ok_or_else(|| {
             io::Error::new(io::ErrorKind::InvalidData, "invalid shared-memory path")
         })?;
         let mapping = fspy_shm::open(shm_path.as_c_str().as_thin())
@@ -200,31 +204,31 @@ unsafe impl Sync for Sender {}
 
 /// The unique receiver side of an IPC channel.
 /// Owns the lock file and removes it on drop.
-pub struct Receiver {
+pub struct Receiver<A: Allocator> {
     lock_file_path: PathBuf,
     lock_file: File,
     /// Keeps the shared memory's backing file alive for as long as senders
     /// may attach.
-    _keeper: ShmKeeper,
+    _keeper: ShmKeeper<A>,
     mapping: Mapping,
 }
 
 /// SAFETY: `Receiver` doesn't read or write `shm`. It only passes it to `ReceiverLockGuard` under the lock.
-unsafe impl Send for Receiver {}
+unsafe impl<A: Allocator + Send> Send for Receiver<A> {}
 
 /// SAFETY: `Receiver` doesn't read or write `shm`. It only passes it to `ReceiverLockGuard` under the lock.
-unsafe impl Sync for Receiver {}
+unsafe impl<A: Allocator + Sync> Sync for Receiver<A> {}
 
-impl Drop for Receiver {
+impl<A: Allocator> Drop for Receiver<A> {
     fn drop(&mut self) {
         if let Err(err) = std::fs::remove_file(&self.lock_file_path) {
             debug!("Failed to remove IPC lock file {}: {}", self.lock_file_path.display(), err);
         }
     }
 }
 
-impl Receiver {
-    fn new(lock_file_path: PathBuf, keeper: ShmKeeper, mapping: Mapping) -> io::Result<Self> {
+impl<A: Allocator> Receiver<A> {
+    fn new(lock_file_path: PathBuf, keeper: ShmKeeper<A>, mapping: Mapping) -> io::Result<Self> {
         let lock_file = File::create(&lock_file_path)?;
         Ok(Self { lock_file_path, lock_file, _keeper: keeper, mapping })
     }
@@ -269,6 +273,7 @@ impl<'a> Deref for ReceiverLockGuard<'a> {
 mod tests {
     use std::{ffi::OsString, fs, num::NonZeroUsize, str::from_utf8};
 
+    use allocator_api2::alloc::Global;
     use bstr::B;
     use subprocess_test::command_for_fn;
 
@@ -279,12 +284,12 @@ mod tests {
     /// must still attach.
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn sender_ignores_changed_temp_and_working_directory() {
-        let (conf, receiver) = channel(100).unwrap();
+        let (conf, receiver) = channel(100, Global).unwrap();
         let changed_cwd = temp_dir().join(format!("fspy-ipc-changed-cwd-{}", Uuid::new_v4()));
         fs::create_dir(&changed_cwd).unwrap();
 
         let mut command = command_for_fn!(conf, |conf: ChannelConf| {
-            let sender = conf.sender().unwrap();
+            let sender = conf.sender(Global).unwrap();
             let frame_size = NonZeroUsize::new(2).unwrap();
             let mut frame = sender.claim_frame(frame_size).unwrap();
             frame.copy_from_slice(&[4, 2]);
@@ -303,9 +308,9 @@ mod tests {
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn smoke() {
-        let (conf, receiver) = channel(100).unwrap();
+        let (conf, receiver) = channel(100, Global).unwrap();
         let cmd = command_for_fn!(conf, |conf: ChannelConf| {
-            let sender = conf.sender().unwrap();
+            let sender = conf.sender(Global).unwrap();
             let frame_size = NonZeroUsize::new(2).unwrap();
             let mut frame = sender.claim_frame(frame_size).unwrap();
             frame.copy_from_slice(&[4, 2]);
@@ -324,11 +329,11 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     #[expect(clippy::print_stdout, reason = "test diagnostics")]
     async fn forbid_new_senders_after_locked() {
-        let (conf, receiver) = channel(42).unwrap();
+        let (conf, receiver) = channel(42, Global).unwrap();
         let _lock = receiver.lock().unwrap();
 
         let cmd = command_for_fn!(conf, |conf: ChannelConf| {
-            print!("{}", conf.sender().is_ok());
+            print!("{}", conf.sender(Global).is_ok());
         });
         let output = std::process::Command::from(cmd).output().unwrap();
         assert_eq!(B(&output.stdout), B("false"));
@@ -337,22 +342,22 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     #[expect(clippy::print_stdout, reason = "test diagnostics")]
     async fn forbid_new_senders_after_receiver_dropped() {
-        let (conf, receiver) = channel(42).unwrap();
+        let (conf, receiver) = channel(42, Global).unwrap();
         drop(receiver);
 
         let cmd = command_for_fn!(conf, |conf: ChannelConf| {
-            print!("{}", conf.sender().is_ok());
+            print!("{}", conf.sender(Global).is_ok());
         });
         let output = std::process::Command::from(cmd).output().unwrap();
         assert_eq!(B(&output.stdout), B("false"));
     }
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn concurrent_senders() {
-        let (conf, receiver) = channel(8192).unwrap();
+        let (conf, receiver) = channel(8192, Global).unwrap();
         for i in 0u16..200 {
             let cmd = command_for_fn!((conf.clone(), i), |(conf, i): (ChannelConf, u16)| {
-                let sender = conf.sender().unwrap();
+                let sender = conf.sender(Global).unwrap();
                 let data_to_send = i.to_string();
                 sender
                     .claim_frame(NonZeroUsize::new(data_to_send.len()).unwrap())

crates/fspy_shared/src/ipc/channel/mod.rs

@@ -674,7 +674,9 @@ mod tests {
 
         let shm_path = crate::ipc::channel::shm_backing_path().unwrap();
         let shm_name = shm_path.to_str().expect("test temp dir is UTF-8").to_owned();
-        let c_path = crate::ipc::channel::os_c_string(shm_path.as_os_str()).unwrap();
+        let c_path =
+            crate::ipc::channel::os_c_string(shm_path.as_os_str(), allocator_api2::alloc::Global)
+                .unwrap();
         let handle = fspy_shm::create(c_path.as_c_str().as_thin(), SHM_SIZE).unwrap();
         let _keeper = crate::ipc::channel::ShmKeeper { path: c_path };
         // Map before the children run. Windows keeps views coherent while they
@@ -687,9 +689,11 @@ mod tests {
                 let cmd = command_for_fn!(
                     (shm_name.clone(), child_index),
                     |(shm_name, child_index): (String, usize)| {
-                        let c_path =
-                            crate::ipc::channel::os_c_string(std::ffi::OsStr::new(&shm_name))
-                                .unwrap();
+                        let c_path = crate::ipc::channel::os_c_string(
+                            std::ffi::OsStr::new(&shm_name),
+                            allocator_api2::alloc::Global,
+                        )
+                        .unwrap();
                         let mapping =
                             fspy_shm::open(c_path.as_c_str().as_thin()).unwrap().map().unwrap();
                         // SAFETY: `mapping` is a freshly mapped shared memory region with a