refactor(fspy-shared): make the payload a borrowed view

The payload and its channel configuration are now views over storage
their producer owns, the model the Windows preload already had with its
static Detours page:

- ChannelConf borrows its two paths; channel() returns only the
  Receiver, and Receiver::conf() derives the configuration from
  receiver-owned C strings (the lock path now stored beside the keeper
  path, and generated absolute like the shm path already was).
- The unix Payload and EncodedPayload borrow every path and the encoded
  string. The supervisor lends its session paths per spawn instead of
  cloning boxes. seccomp_payload stays owned until fspy_seccomp_unotify
  grows borrowed types.
- fspy_shared is allocator-agnostic: channel(), Receiver, and sender()
  are generic over the allocator, and decode_payload_from_env leaks its
  allocations into whichever allocator the caller passes, whose
  lifetime bounds the payload. The supervisor instantiates with the
  global allocator.
- The unix preload attaches with one page-backed bump from
  fspy_nostd_alloc::page_bump(), held in ManuallyDrop from the start:
  the payload storage lands at its base, the sender's temporary path
  decode runs inside Bump::scoped so the same chunk is reused and
  reclaimed, and the never-dropped bump gives one mapping for the whole
  attach unless the payload outgrows the chunk, nothing from the global
  allocator, and no borrows into the mutable process environment.
  assume_process_lifetime documents the single unsafe step that names
  the leak.
- The Windows preload deserializes its payload zero-copy from the
  static page and forwards those original bytes to children instead of
  re-serializing per spawn.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wan9chi

Cargo.lock

@@ -6,6 +6,7 @@ license.workspace = true
 publish = false
 
 [dependencies]
+allocator-api2 = { workspace = true, features = ["alloc"] }
 wincode = { workspace = true }
 bstr = { workspace = true, features = ["alloc", "std"] }
 bumpalo = { workspace = true }

crates/fspy/Cargo.toml

@@ -1,5 +1,6 @@
 use std::io;
 
+use allocator_api2::alloc::Global;
 use fspy_shared::ipc::{
     PathAccess,
     channel::{Receiver, ReceiverLockGuard},
@@ -14,19 +15,19 @@ pub const SHM_CAPACITY: usize = 4 * 1024 * 1024 * 1024;
 #[ouroboros::self_referencing]
 pub struct OwnedReceiverLockGuard {
     /// Owns the shared memory
-    receiver: Receiver,
+    receiver: Receiver<Global>,
     /// Borrows the shared memory and owns the file lock
     #[borrows(receiver)]
     #[covariant]
     lock_guard: ReceiverLockGuard<'this>,
 }
 
 impl OwnedReceiverLockGuard {
-    pub fn lock(receiver: Receiver) -> io::Result<Self> {
+    pub fn lock(receiver: Receiver<Global>) -> io::Result<Self> {
         Self::try_new(receiver, fspy_shared::ipc::channel::Receiver::lock)
     }
 
-    pub async fn lock_async(receiver: Receiver) -> io::Result<Self> {
+    pub async fn lock_async(receiver: Receiver<Global>) -> io::Result<Self> {
         spawn_blocking(move || Self::lock(receiver)).await.expect("lock task panicked")
     }
 

crates/fspy/src/ipc.rs

@@ -11,11 +11,9 @@ use fspy_seccomp_unotify::supervisor::supervise;
 use fspy_shared::ipc::PathAccess;
 #[cfg(not(target_env = "musl"))]
 use fspy_shared::ipc::{IpcStr, channel::channel};
-#[cfg(target_os = "macos")]
-use fspy_shared_unix::payload::Artifacts;
 use fspy_shared_unix::{
     exec::ExecResolveConfig,
-    payload::{Payload, encode_payload},
+    payload::{EncodedPayload, Payload, encode_payload},
     spawn::handle_exec,
 };
 use futures_util::FutureExt;
@@ -29,9 +27,15 @@ use crate::ipc::{OwnedReceiverLockGuard, SHM_CAPACITY};
 use crate::{ChildTermination, Command, TrackedChild, arena::PathAccessArena, error::SpawnError};
 
 #[derive(Debug)]
+#[cfg_attr(
+    target_os = "macos",
+    expect(clippy::struct_field_names, reason = "each field names a distinct injected path")
+)]
 pub struct SpyImpl {
     #[cfg(target_os = "macos")]
-    artifacts: Artifacts,
+    bash_path: Box<IpcStr>,
+    #[cfg(target_os = "macos")]
+    coreutils_path: Box<IpcStr>,
 
     #[cfg(not(target_env = "musl"))]
     preload_path: Box<IpcStr>,
@@ -58,15 +62,19 @@ impl SpyImpl {
             #[cfg(not(target_env = "musl"))]
             preload_path,
             #[cfg(target_os = "macos")]
-            artifacts: {
-                let coreutils_path =
-                    macos_artifacts::COREUTILS_BINARY.materialize().executable().at(dir)?;
-                let bash_path = macos_artifacts::OILS_BINARY.materialize().executable().at(dir)?;
-                Artifacts {
-                    bash_path: bash_path.as_path().into(),
-                    coreutils_path: coreutils_path.as_path().into(),
-                }
-            },
+            bash_path: macos_artifacts::OILS_BINARY
+                .materialize()
+                .executable()
+                .at(dir)?
+                .as_path()
+                .into(),
+            #[cfg(target_os = "macos")]
+            coreutils_path: macos_artifacts::COREUTILS_BINARY
+                .materialize()
+                .executable()
+                .at(dir)?
+                .as_path()
+                .into(),
         })
     }
 
@@ -79,24 +87,30 @@ impl SpyImpl {
         let supervisor = supervise::<SyscallHandler>().map_err(SpawnError::Supervisor)?;
 
         #[cfg(not(target_env = "musl"))]
-        let (ipc_channel_conf, ipc_receiver) =
-            channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
+        let ipc_receiver = channel(SHM_CAPACITY, allocator_api2::alloc::Global)
+            .map_err(SpawnError::ChannelCreation)?;
 
         let payload = Payload {
             #[cfg(not(target_env = "musl"))]
-            ipc_channel_conf,
-
-            #[cfg(target_os = "macos")]
-            artifacts: self.artifacts.clone(),
+            ipc_channel_conf: ipc_receiver.conf(),
+            #[cfg(target_env = "musl")]
+            ipc_channel_conf: core::marker::PhantomData,
 
             #[cfg(not(target_env = "musl"))]
-            preload_path: self.preload_path.clone(),
+            preload_path: &self.preload_path,
+
+            #[cfg(target_os = "macos")]
+            artifacts: fspy_shared_unix::payload::Artifacts {
+                bash_path: &self.bash_path,
+                coreutils_path: &self.coreutils_path,
+            },
 
             #[cfg(target_os = "linux")]
             seccomp_payload: supervisor.payload().clone(),
         };
 
-        let encoded_payload = encode_payload(payload);
+        let encoded_string = encode_payload(&payload);
+        let encoded_payload = EncodedPayload { payload, encoded_string: encoded_string.as_ref() };
 
         let mut exec = command.get_exec();
         let mut exec_resolve_accesses = PathAccessArena::default();

crates/fspy/src/unix/mod.rs

@@ -86,8 +86,8 @@ impl SpyImpl {
 
         command.creation_flags(CREATE_SUSPENDED);
 
-        let (channel_conf, receiver) =
-            channel(SHM_CAPACITY).map_err(SpawnError::ChannelCreation)?;
+        let receiver = channel(SHM_CAPACITY, allocator_api2::alloc::Global)
+            .map_err(SpawnError::ChannelCreation)?;
 
         let mut spawn_success = false;
         let spawn_success = &mut spawn_success;
@@ -107,7 +107,7 @@ impl SpyImpl {
                 }
 
                 let payload = Payload {
-                    channel_conf: channel_conf.clone(),
+                    channel_conf: receiver.conf(),
                     ansi_dll_path_with_nul: ansi_dll_path_with_nul.to_bytes(),
                 };
                 let payload_bytes = wincode::serialize(&payload).unwrap();

crates/fspy/src/windows/mod.rs

@@ -21,7 +21,7 @@ use raw_exec::RawExec;
 use wincode::Serialize as _;
 
 pub struct Client {
-    encoded_payload: EncodedPayload,
+    encoded_payload: EncodedPayload<'static>,
     ipc_sender: Option<Sender>,
 }
 
@@ -51,17 +51,28 @@ impl Client {
         reason = "the client intentionally reports an unavailable supervisor channel"
     )]
     pub fn from_env(envs: impl Iterator<Item = fspy_nostd::env::Entry>) -> Self {
-        let encoded_payload = decode_payload_from_env(envs).unwrap();
-
-        let ipc_sender = match encoded_payload.payload.ipc_channel_conf.sender() {
-            Ok(sender) => Some(sender),
-            Err(err) => {
-                // This can happen if the process starts after the root target
-                // has exited and the receiver has closed the channel.
-                eprintln!("fspy: failed to create ipc sender: {err}");
-                None
+        // One page-backed bump serves the whole attach: the payload's
+        // process-lifetime storage first, then the scoped temporaries below —
+        // one mapping unless the payload outgrows the first chunk. The
+        // `ManuallyDrop` is never taken apart, so the bump is never dropped.
+        let mut bump = core::mem::ManuallyDrop::new(fspy_nostd_alloc::page_bump());
+        let encoded_payload = decode_payload_from_env(envs, &*bump).unwrap();
+        // SAFETY: `bump` is `ManuallyDrop` and never dropped, so the storage
+        // the payload borrows from is never freed, and the scoped temporaries
+        // below reset only down to this point.
+        let encoded_payload = unsafe { encoded_payload.assume_process_lifetime() };
+
+        let ipc_sender = bump.scoped(|scope| {
+            match encoded_payload.payload.ipc_channel_conf.sender(&*scope) {
+                Ok(sender) => Some(sender),
+                Err(err) => {
+                    // This can happen if the process starts after the root target
+                    // has exited and the receiver has closed the channel.
+                    eprintln!("fspy: failed to create ipc sender: {err}");
+                    None
+                }
             }
-        };
+        });
 
         Self { encoded_payload, ipc_sender }
     }
@@ -143,7 +154,7 @@ impl Client {
         // SAFETY: mode contains a valid pointer (if ModeStr) or a plain value,
         // as provided by the caller.
         let mode = unsafe { mode.to_access_mode() };
-        let arena = fspy_nostd_alloc::arena();
+        let arena = fspy_nostd_alloc::pooled_bump();
         let Some(abs_path) = path.to_absolute_path(&arena)? else {
             return Ok(());
         };

crates/fspy_client_unix/src/lib.rs

@@ -53,7 +53,7 @@ impl RawExec {
         // execs), where malloc's lock may be held by a thread that no longer
         // exists. A per-call arena has exactly this lifetime, and hands back
         // the memory when the call ends.
-        let arena = fspy_nostd_alloc::arena();
+        let arena = fspy_nostd_alloc::pooled_bump();
         let mut ptr_vec = allocator_api2::vec::Vec::with_capacity_in(strs.len() + 1, &arena);
         for s in &mut strs {
             s.push(0);