refactor(fspy-shared): make the payload a borrowed view

The payload is now a view over one buffer somebody owns, the model the
Windows preload already had with its static Detours page:

- ChannelConf borrows its two paths; channel() returns only the
  Receiver, and Receiver::conf() derives the configuration from
  receiver-owned C strings (the lock path now stored beside the keeper
  path, and generated absolute like the shm path already was).
- The unix Payload borrows every path it carries: preload_path and the
  macOS artifacts join the conf as views. DecodedPayload owns the
  decoded bytes plus the env string, and both the client and the
  supervisor derive transient Payload views instead of retaining owned
  copies — the supervisor lends its session paths, the client re-reads
  views from its buffer per exec. seccomp_payload stays owned until
  fspy_seccomp_unotify grows borrowed types.
- The Windows preload deserializes its payload zero-copy from the
  static page and forwards those original bytes to children instead of
  re-serializing per spawn.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wan9chi

crates/fspy/src/unix/mod.rs

@@ -8,11 +8,10 @@ use std::{io, path::Path};
 
 #[cfg(target_os = "linux")]
 use fspy_seccomp_unotify::supervisor::supervise;
+#[cfg(target_os = "macos")]
 use fspy_shared::ipc::PathAccess;
 #[cfg(not(target_env = "musl"))]
 use fspy_shared::ipc::{IpcStr, channel::channel};
-#[cfg(target_os = "macos")]
-use fspy_shared_unix::payload::Artifacts;
 use fspy_shared_unix::{
     exec::ExecResolveConfig,
     payload::{Payload, encode_payload},
@@ -29,9 +28,12 @@ use crate::ipc::{OwnedReceiverLockGuard, SHM_CAPACITY};
 use crate::{ChildTermination, Command, TrackedChild, arena::PathAccessArena, error::SpawnError};
 
 #[derive(Debug)]
+#[expect(clippy::struct_field_names, reason = "each field names a distinct injected path")]
 pub struct SpyImpl {
     #[cfg(target_os = "macos")]
-    artifacts: Artifacts,
+    bash_path: Box<IpcStr>,
+    #[cfg(target_os = "macos")]
+    coreutils_path: Box<IpcStr>,
 
     #[cfg(not(target_env = "musl"))]
     preload_path: Box<IpcStr>,
@@ -58,15 +60,19 @@ impl SpyImpl {
             #[cfg(not(target_env = "musl"))]
             preload_path,
             #[cfg(target_os = "macos")]
-            artifacts: {
-                let coreutils_path =
-                    macos_artifacts::COREUTILS_BINARY.materialize().executable().at(dir)?;
-                let bash_path = macos_artifacts::OILS_BINARY.materialize().executable().at(dir)?;
-                Artifacts {
-                    bash_path: bash_path.as_path().into(),
-                    coreutils_path: coreutils_path.as_path().into(),
-                }
-            },
+            bash_path: macos_artifacts::OILS_BINARY
+                .materialize()
+                .executable()
+                .at(dir)?
+                .as_path()
+                .into(),
+            #[cfg(target_os = "macos")]
+            coreutils_path: macos_artifacts::COREUTILS_BINARY
+                .materialize()
+                .executable()
+                .at(dir)?
+                .as_path()
+                .into(),
         })
     }
 
@@ -79,31 +85,36 @@ impl SpyImpl {
         let supervisor = supervise::<SyscallHandler>().map_err(SpawnError::Supervisor)?;
 
         #[cfg(not(target_env = "musl"))]
-        let (ipc_channel_conf, ipc_receiver) =
-            channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
+        let ipc_receiver = channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
 
         let payload = Payload {
             #[cfg(not(target_env = "musl"))]
-            ipc_channel_conf,
-
-            #[cfg(target_os = "macos")]
-            artifacts: self.artifacts.clone(),
+            ipc_channel_conf: ipc_receiver.conf(),
+            #[cfg(target_env = "musl")]
+            ipc_channel_conf: core::marker::PhantomData,
 
             #[cfg(not(target_env = "musl"))]
-            preload_path: self.preload_path.clone(),
+            preload_path: &self.preload_path,
+
+            #[cfg(target_os = "macos")]
+            artifacts: fspy_shared_unix::payload::Artifacts {
+                bash_path: &self.bash_path,
+                coreutils_path: &self.coreutils_path,
+            },
 
             #[cfg(target_os = "linux")]
             seccomp_payload: supervisor.payload().clone(),
         };
 
-        let encoded_payload = encode_payload(payload);
+        let encoded_string = encode_payload(&payload);
 
         let mut exec = command.get_exec();
         let mut exec_resolve_accesses = PathAccessArena::default();
         let pre_exec = handle_exec(
             &mut exec,
             ExecResolveConfig::search_path_enabled(None),
-            &encoded_payload,
+            &payload,
+            encoded_string.as_ref(),
             |mode, path| {
                 exec_resolve_accesses.add(PathAccess { mode, path: path.into() });
             },

crates/fspy/src/windows/mod.rs

@@ -86,8 +86,7 @@ impl SpyImpl {
 
         command.creation_flags(CREATE_SUSPENDED);
 
-        let (channel_conf, receiver) =
-            channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
+        let receiver = channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
 
         let mut spawn_success = false;
         let spawn_success = &mut spawn_success;
@@ -107,7 +106,7 @@ impl SpyImpl {
                 }
 
                 let payload = Payload {
-                    channel_conf: channel_conf.clone(),
+                    channel_conf: receiver.conf(),
                     ansi_dll_path_with_nul: ansi_dll_path_with_nul.to_bytes(),
                 };
                 let payload_bytes = wincode::serialize(&payload).unwrap();

crates/fspy_client_unix/src/lib.rs

@@ -14,14 +14,14 @@ use convert::{ToAbsolutePath, ToAccessMode};
 use fspy_shared::ipc::{PathAccess, channel::Sender};
 use fspy_shared_unix::{
     exec::ExecResolveConfig,
-    payload::{EncodedPayload, decode_payload_from_env},
+    payload::{DecodedPayload, decode_payload_from_env},
     spawn::{PreExec, handle_exec},
 };
 use raw_exec::RawExec;
 use wincode::Serialize as _;
 
 pub struct Client {
-    encoded_payload: EncodedPayload,
+    decoded_payload: DecodedPayload,
     ipc_sender: Option<Sender>,
 }
 
@@ -51,9 +51,9 @@ impl Client {
         reason = "the client intentionally reports an unavailable supervisor channel"
     )]
     pub fn from_env(envs: impl Iterator<Item = fspy_nostd::env::Entry>) -> Self {
-        let encoded_payload = decode_payload_from_env(envs).unwrap();
+        let decoded_payload = decode_payload_from_env(envs).unwrap();
 
-        let ipc_sender = match encoded_payload.payload.ipc_channel_conf.sender() {
+        let ipc_sender = match decoded_payload.payload().ipc_channel_conf.sender() {
             Ok(sender) => Some(sender),
             Err(err) => {
                 // This can happen if the process starts after the root target
@@ -63,7 +63,7 @@ impl Client {
             }
         };
 
-        Self { encoded_payload, ipc_sender }
+        Self { decoded_payload, ipc_sender }
     }
 
     fn send(&self, mode: fspy_shared::ipc::AccessMode, path: &Path) -> anyhow::Result<()> {
@@ -119,9 +119,15 @@ impl Client {
         // SAFETY: raw_exec contains valid pointers to C strings and
         // null-terminated arrays, as provided by the caller.
         let mut exec = unsafe { raw_exec.to_exec() };
-        let pre_exec = handle_exec(&mut exec, config, &self.encoded_payload, |mode, path| {
-            self.send(mode, path).unwrap();
-        })?;
+        let pre_exec = handle_exec(
+            &mut exec,
+            config,
+            &self.decoded_payload.payload(),
+            self.decoded_payload.encoded_string.as_ref(),
+            |mode, path| {
+                self.send(mode, path).unwrap();
+            },
+        )?;
         RawExec::from_exec(exec, |raw_command| f(raw_command, pre_exec))
     }
 

crates/fspy_preload_windows/src/windows/client.rs

@@ -9,6 +9,7 @@ use winapi::{shared::minwindef::BOOL, um::winnt::HANDLE};
 
 pub struct Client<'a> {
     payload: Payload<'a>,
+    payload_bytes: &'a [u8],
     ipc_sender: Option<Sender>,
 }
 
@@ -33,7 +34,7 @@ impl<'a> Client<'a> {
             }
         };
 
-        Self { payload, ipc_sender }
+        Self { payload, payload_bytes, ipc_sender }
     }
 
     pub fn send(&self, access: PathAccess<'_>) {
@@ -44,14 +45,15 @@ impl<'a> Client<'a> {
     }
 
     pub unsafe fn prepare_child_process(&self, child_handle: HANDLE) -> BOOL {
-        let payload_bytes = wincode::serialize(&self.payload).unwrap();
+        // The payload propagates to children unchanged, so forward the bytes
+        // this process was given instead of re-serializing.
         // SAFETY: FFI call to DetourCopyPayloadToProcess with valid handle and payload buffer
         unsafe {
             DetourCopyPayloadToProcess(
                 child_handle,
                 &PAYLOAD_ID,
-                payload_bytes.as_ptr().cast(),
-                payload_bytes.len().try_into().unwrap(),
+                self.payload_bytes.as_ptr().cast(),
+                self.payload_bytes.len().try_into().unwrap(),
             )
         }
     }