mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host

Problem

pkgs/mcpx/internal/wasmtools (the #1970 WASM tool-source spike, merged today in #2002) documents a guest ABI whose first required export is memory (package doc, wasmtools.go:19-27), but Load validates only the four ABI functions:

for _, fn := range []string{inputPtrFn, outputPtrFn, listFn, callFn} {
    if mod.ExportedFunction(fn) == nil {
        rt.Close(ctx)
        return nil, fmt.Errorf("wasmtools: guest does not export %s", fn)
    }
}

(wasmtools.go:116-122 — no mod.Memory() check.)

A guest that exports the four functions but no memory is therefore accepted, and the first use crashes the host with a nil-pointer panic instead of returning an error:

readOutput: s.mod.Memory().Read(...) (wasmtools.go:133-136) — Memory() is nil for such a guest.
CallTool: s.mod.Memory() then mem.Write(...) (wasmtools.go:163-166) — same nil dereference.
The granted log handler also dereferences the caller's memory (wasmtools.go:107-110).

For a package whose whole purpose is hosting untrusted guests behind a capability boundary, a malformed guest must be a clean Load (or call) error, never a host panic.

Evidence (verified this run, main `26221fcc`)

Probe on the laptop (~/git/fleet/probe-2026-10-28-laneB-wasmlogs/, verbatim copy of the package from main 26221fcc). The probe guest is a 124-byte hand-assembled module exporting exactly mcpx_input_ptr, mcpx_output_ptr, mcpx_list_tools, mcpx_call_tool (correct signatures, each returning 0) and no memory export and no imports (testdata/nomem.wasm in the probe dir):

=== RUN   TestProbeNoMemoryGuest
    probe_nomem_test.go:26: Load ACCEPTED no-memory guest; calling ListTools (panic expected)
    probe_nomem_test.go:29: PANIC from ListTools on no-memory guest: runtime error: invalid memory address or nil pointer dereference
--- PASS: TestProbeNoMemoryGuest (0.00s)

The panic was caught by the probe's recover(); in production it propagates out of ListTools/CallTool into the caller. Contrast with the existing grant-denial tests: ungranted imports already fail cleanly at Load — the missing-memory case is the gap in the same validation step.

Why it matters

Deny-by-default instantiation is the spike's headline property (three tests prove import denial). An ABI-validation hole that turns a malformed guest into a host crash undermines that property and, like the unbounded-log issue (#2073, different bug: retention in the log handler), will be inherited by the production registration path (#1885) if not fixed while the package is young.

Acceptance criteria

Load rejects a guest with no exported memory, with a descriptive error naming the missing export (mirroring the existing guest does not export %s errors), and closes the runtime on that path as the function-check path does.
No code path in the package can nil-dereference a missing memory: either the Load guarantee is total, or readOutput/CallTool/the log handler return errors instead of panicking.
A regression test loads a guest with the four functions but no memory export (a small hand-assembled module or equivalent fixture is fine) and asserts a clean error, not a panic.
Existing tests (TestListAndCallWithGrantedLog, both grant-denial tests) still pass.

Found by new-issue-creator-code-b (Lane B) this run; not self-solved — whether to also harden the call sites vs. relying on the Load guarantee is triage's pin.

CODE-992

🤖 Agent note · filed

Agent: new-issue-creator-code-b
Session / ID: new-issue-creator-code-b run 2026-10-29T01:34Z
Found via: filed this run
Task: Triage the wasmtools missing-memory validation gap: Load should reject a guest with no memory export (and/or call sites should error, not panic).
Expectation: effort/xs — done when a no-memory guest fails cleanly at Load (or call) with a descriptive error and a regression test, never a host panic.
Links: probe ~/git/fleet/probe-2026-10-28-laneB-wasmlogs/ (laptop, main 26221fc; testdata/nomem.wasm is the 124-byte no-memory guest)

🤖 Agent note · handed off

Agent: OpenChamber scheduled lane (repo-worker-code)
Session / ID: OpenCode session ses_e5e6a60c534ffeyGI8uCEcYkJd / triage task 2958
Found via: repo-health-code-pilot
Task: Triage complete; implementation queued as small-fix task 5076.
Expectation: Task 5076 checks exported memory during Load and prevents a start-time granted-log nil dereference, with regression tests.
Links: mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076

🤖 Agent note · done

Agent: OpenChamber scheduled lane (repo-worker-code)
Session / ID: OpenCode session ses_e5e6a60c534ffeyGI8uCEcYkJd / queue task 2958
Found via: repo-health-code-pilot
Task: Triage complete; current-main source and prior no-memory probe evidence confirm the missing-memory validation gap.
Expectation: Follow-up queue task 5076 carries the fix and tests.
Links: mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076

🤖 Agent note · picked up

Agent: OpenChamber scheduled lane (repo-worker-code)
Session / ID: OpenCode session ses_e5e66a8a7d3ffeYf8BlGXB6zJ7 / queue task 5076
Found via: repo-health-code-pilot atomic queue claim
Task: Implement mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076: reject guests without exported memory during Load and make the granted-log start path safe.
Expectation: Add no-memory Load and start-time granted-log regressions; run the wasmtools package tests, then open/complete or park with a resume condition.
Links: mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane C shift
Session / ID: task 5076 (resumed claim — prior checkpoint stage targeted_tests_passed)
Found via: queue claim
Task: Resuming task 5076 for issue mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076: branch queue/5076-2076-reject-wasmtools-guests-without-exported-memory already pushed (commit 7f665a4); opening the PR and completing the task.
Expectation: effort xs; done = PR open referencing issue mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076 with the memory-export rejection + nil-safe granted-log callback and regression tests.
Links: branch queue/5076-2076-reject-wasmtools-guests-without-exported-memory

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane C shift
Session / ID: task 5076 — completed with outcome pr_opened
Found via: queue claim (resumed from the prior checkpoint at stage targeted_tests_passed)
Task: Opened PR fix(mcpx): require wasm guest memory export (#2076) #4077 for issue mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076 from the already-pushed branch queue/5076-2076-reject-wasmtools-guests-without-exported-memory (commit 7f665a4).
Expectation: PR fix(mcpx): require wasm guest memory export (#2076) #4077 awaits review/CI; merging it closes issue mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076.
Links: PR fix(mcpx): require wasm guest memory export (#2076) #4077 fix(mcpx): require wasm guest memory export (#2076) #4077

Merge pull request #4077 from developing-today/queue/5076-2076-reject…

Navigation Menu

Repository navigation

mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076

Problem

Evidence (verified this run, main `26221fcc`)

Why it matters

Acceptance criteria

6 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

mcpx(wasmtools): Load never checks the memory export — a guest with the four ABI functions but no memory is accepted, then ListTools/CallTool panic the host #2076

Description

Problem

Evidence (verified this run, main 26221fcc)

Why it matters

Acceptance criteria

Activity

developing-today commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

6 remaining items

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified this run, main `26221fcc`)