computer: Pass isolate capability calls as native RPC values

[mattzcarey]

Stacked on #172, after #182 merged into it.

The Dynamic Worker already gets a real RPC object, the runtime bridge. Even so, every node:fs and host module call was JSON-encoded on top of it:

// before, inside the isolate
const request = JSON.stringify(args.map(encode));       // bytes → { __workspace_codec__: { type: "bytes", data: [255, 255, …] } }
const raw = await host.call(name, request);             // string in
return decode(JSON.parse(raw).result);                  // string out

Bytes travelled as arrays of numbers, about four times their real size against maxCapabilityBytes, and both sides carried an encoder and a decoder.

Values now cross as Workers RPC values:

// after
const payload = await host.call(name, args);            // real values in
if (payload.error) throw rebuild(payload.error);         // { message, code, path }
return payload.result;                                   // real values out

sequenceDiagram
  participant Code as Isolate code
  participant Bridge as Host bridge (proxy)
  participant Host as node:fs / host module
  Code->>Bridge: call("fs.writeFile", ["/a.bin", Uint8Array])
  Note over Bridge: cancelled? concurrency, call count,<br/>measure bytes, reject non-plain data
  Bridge->>Host: run with deadline and abort signal
  Host-->>Bridge: value
  Note over Bridge: measure response, response budget
  Bridge-->>Code: { result } or { error }

Loading

The bridge stays the one proxy every call goes through, so its controls are unchanged:

• cancellation
• concurrent and total call counts
• per-call deadlines with an abort signal
• draining accepted calls before an execution ends, so a late write can't land after exit

Byte budgets now measure the values themselves: UTF-8 bytes of strings and keys, raw bytes of byte arrays, and a fixed cost per scalar. The same walk rejects anything that is not plain data, including cycles. That includes functions and RPC stubs, which Workers RPC would otherwise carry into the Durable Object as live callbacks. The isolate keeps a rough size check so an obviously oversized request skips the round trip.

What changes for callers: bytes count at their real size, so a 900-byte write now fits under a 1024-byte limit where it used to be rejected. A new script runner test shows this; it fails on the old codec with "capability request exceeds 1024 bytes". Host module arguments and results are still JSON-compatible plain data, normalized as JSON would: an undefined object field is left out and an undefined array item becomes null.

Every response counts against the per-execution response budget, errors included. An error keeps its code and path only if the whole error still fits maxPayloadBytes. Every value costs at least one byte, so a request of many empty strings or objects is bounded by the byte limit too. Allowing byte arrays or streams there, for example to stream ws:container output, is now a small follow-up rather than a codec change.

The script runner suite runs every path through a real Dynamic Worker: node:fs bytes and errors with codes, host modules, the call, concurrency, and byte limits, and oversized errors. The bridge unit tests add plain-value pass-through, rejection of functions, class instances, and cycles, and UTF-8 sizing.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 039f65c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@cloudflare/computer	Patch
@cloudflare/dofs	Patch
@cloudflare/computer-rpc	Patch
@cloudflare/computerd	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/computer@183

commit: 2aa11a6