Merge remote-tracking branch 'origin/main' into HEAD

crates/ocs_plugin_api/ARCHITECTURE.md

@@ -50,10 +50,11 @@ The host and each plugin run in separate OS processes. The host re-executes itse
 - A plugin built against major `N` runs on a host whose major is `>= N` because new vtable entries and enum variants are appended at the end.
 - V4 introduces the **acadrust gate**: plugins targeting API v4 or later must resolve the same `acadrust` source as the host (see [`src/version_info.rs`](src/version_info.rs)).
 
-The runtime enforces two gates:
+The runtime enforces three gates:
 
 1. `ocs_plugin_api_version()` exported by the cdylib must be within `[API_VERSION_MIN_SUPPORTED, effective_max_api_version()]`.
 2. For v4+, `acadrust_sources_compatible(host_acadrust_source(), plugin_acadrust_source)` must be true.
+3. For v4+, the plugin must declare `rustc_version`, and `rustc_versions_compatible(host_rustc_version(), plugin_rustc_version)` must be true.
 
 ---
 
@@ -215,7 +216,7 @@ Broadcasting is V4-gated inside `PluginManager::broadcast_notification`: V2/V3 p
 The crate embeds two JSON blobs at build time:
 
 - **Type registry** (`OUT_DIR/type_registry.json`) — a language-binding-friendly schema for a curated allow-list of `acadrust` types, generated by `serde-reflection` in `build.rs`. See [`src/type_registry.rs`](src/type_registry.rs).
-- **Version info** (`OUT_DIR/version_info.json`) — host version, `ocs_plugin_api` version, `acadrust` version and source, API versions, build timestamp. See [`src/version_info.rs`](src/version_info.rs).
+- **Version info** (`OUT_DIR/version_info.json`) — host version, `ocs_plugin_api` version, `acadrust` version and source, `rustc` version, API versions, build timestamp. See [`src/version_info.rs`](src/version_info.rs).
 
 Both are accessible without enabling the `host` feature.
 
@@ -242,6 +243,7 @@ This is defense-in-depth, not a sandbox: plugins execute native code.
 | Spawn timeout or crash | Spawn fails; plugin not loaded; error surfaced in UI/logs. |
 | Version mismatch | Host refuses plugin before running plugin code. |
 | Acadrust source mismatch (v4+) | Host refuses plugin to avoid binary incompatibilities. |
+| Rustc mismatch (v4+) | Host refuses plugin to avoid cross-compiler ABI crashes. |
 | Unknown notification discriminant | Deserializes to `HostNotification::Unknown`; plugin can ignore. |
 
 ---

crates/ocs_plugin_api/build.rs

@@ -2,6 +2,7 @@ use std::collections::BTreeMap;
 use std::env;
 use std::fs;
 use std::path::{Path, PathBuf};
+use std::process::Command;
 use std::time::SystemTime;
 
 use cargo_lock::Lockfile;
@@ -383,11 +384,26 @@ fn generate_version_info(out_dir: &Path) {
         .find(|p| p.name.as_str() == "acadrust")
         .expect("acadrust package in Cargo.lock");
 
+    let rustc = env::var_os("RUSTC").unwrap_or_else(|| "rustc".into());
+    let rustc_version = Command::new(rustc)
+        .arg("--version")
+        .output()
+        .ok()
+        .and_then(|o| {
+            if o.status.success() {
+                Some(String::from_utf8_lossy(&o.stdout).trim().to_string())
+            } else {
+                None
+            }
+        })
+        .unwrap_or_default();
+
     let info = serde_json::json!({
         "ocs_version": ocs.version.to_string(),
         "ocs_plugin_api_version": env!("CARGO_PKG_VERSION"),
         "acadrust_version": acadrust.version.to_string(),
         "acadrust_source": acadrust.source.as_ref().map(|s| s.to_string()),
+        "rustc_version": rustc_version,
         "api_version": 4,
         "api_version_min_supported": 2,
         "build_timestamp": build_timestamp,

crates/ocs_plugin_api/src/version_info.rs

@@ -11,6 +11,12 @@
 //! `acadrust` source with its own via [`acadrust_sources_compatible`]. Two
 //! sources are considered compatible only when they resolve to the same 40
 //! character git commit hash.
+//!
+//! The rustc version string is also recorded because Rust has no stable ABI:
+//! a plugin built with a different compiler than the host can pass simple calls
+//! and then crash the runner on compound types. For API v4 and later the host
+//! can compare the plugin's declared rustc with its own via
+//! [`rustc_versions_compatible`].
 
 use std::sync::OnceLock;
 
@@ -26,6 +32,7 @@ pub fn get_embedded_version_info_json() -> &'static str {
 #[derive(Debug, Clone)]
 struct VersionInfo {
     acadrust_source: String,
+    rustc_version: String,
 }
 
 pub const ACADRUST_GATE_API_VERSION: u32 = 4;
@@ -48,6 +55,8 @@ fn parsed_version_info() -> &'static VersionInfo {
     INFO.get_or_init(|| VersionInfo {
         acadrust_source: json_string_value(EMBEDDED_VERSION_INFO_JSON, "acadrust_source")
             .unwrap_or_default(),
+        rustc_version: json_string_value(EMBEDDED_VERSION_INFO_JSON, "rustc_version")
+            .unwrap_or_default(),
     })
 }
 
@@ -56,6 +65,30 @@ pub fn host_acadrust_source() -> &'static str {
     &parsed_version_info().acadrust_source
 }
 
+/// Returns the host's `rustc --version` output.
+pub fn host_rustc_version() -> &'static str {
+    &parsed_version_info().rustc_version
+}
+
+/// Returns whether two `rustc --version` outputs are considered compatible.
+///
+/// The full version line (e.g. "rustc 1.98.0 (hash date)") is compared
+/// token-by-token after normalising whitespace. This is intentionally strict:
+/// Rust has no stable ABI, so even the same nominal compiler built in different
+/// environments can produce incompatible layouts.
+pub fn rustc_versions_compatible(a: &str, b: &str) -> bool {
+    if a.is_empty() || b.is_empty() {
+        return false;
+    }
+    let a_tokens: Vec<&str> = a.split_whitespace().collect();
+    let b_tokens: Vec<&str> = b.split_whitespace().collect();
+    a_tokens.len() == b_tokens.len()
+        && a_tokens
+            .iter()
+            .zip(b_tokens)
+            .all(|(a, b)| a.eq_ignore_ascii_case(b))
+}
+
 /// Extracts the full git commit hash from a Cargo source.
 pub fn acadrust_source_hash(source: &str) -> Option<&str> {
     let hash = source.rsplit('#').next()?;
@@ -85,6 +118,7 @@ mod tests {
         let value: serde_json::Value = serde_json::from_str(json).expect("valid JSON");
         assert!(value.get("ocs_version").is_some());
         assert!(value.get("acadrust_source").is_some());
+        assert!(value.get("rustc_version").is_some());
     }
 
     #[test]
@@ -96,6 +130,7 @@ mod tests {
             "ocs_plugin_api_version",
             "acadrust_version",
             "acadrust_source",
+            "rustc_version",
             "api_version",
             "api_version_min_supported",
             "build_timestamp",
@@ -125,6 +160,45 @@ mod tests {
         assert!(!host_acadrust_source().is_empty());
     }
 
+    #[test]
+    fn host_rustc_version_is_non_empty() {
+        assert!(!host_rustc_version().is_empty());
+    }
+
+    #[test]
+    fn rustc_version_comparison_is_strict() {
+        assert!(rustc_versions_compatible(
+            "rustc 1.98.0 (abc123 2026-01-01)",
+            "rustc 1.98.0 (abc123 2026-01-01)"
+        ));
+        assert!(!rustc_versions_compatible(
+            "rustc 1.96.0 (def456 2025-11-01)",
+            "rustc 1.98.0 (abc123 2026-01-01)"
+        ));
+    }
+
+    #[test]
+    fn rustc_version_comparison_normalises_whitespace() {
+        assert!(rustc_versions_compatible(
+            "rustc  1.98.0  (abc123  2026-01-01)",
+            "rustc 1.98.0 (abc123 2026-01-01)"
+        ));
+    }
+
+    #[test]
+    fn rustc_version_comparison_rejects_empty() {
+        assert!(!rustc_versions_compatible("", "rustc 1.98.0"));
+        assert!(!rustc_versions_compatible("rustc 1.98.0", ""));
+        assert!(!rustc_versions_compatible("", ""));
+    }
+
+    #[test]
+    fn rustc_version_comparison_rejects_collapsed_tokens() {
+        // A concatenated version must not accidentally match a spaced one.
+        assert!(!rustc_versions_compatible("rustc 1.98.0", "rustc1.98.0"));
+        assert!(!rustc_versions_compatible("rustc1.98.0", "rustc 1.98.0"));
+    }
+
     #[test]
     fn dependency_gate_starts_at_api_v4() {
         assert!(!uses_acadrust_gate(3));