feat(golang): both guests record the full error behind every failing export, with a leak test

The crypto and credential guests now run every export through
`stack_guest_abi::abi::export`, so each exports `se_last_error` and every
failing export leaves an error for it. Every place that maps an error to a
status also records it: `status::fail_error`, `fail_dynamic`, `fail_auth`
and `fail_profile` record the stack-encrypt, stack-kms, stack-auth or
stack-profile error with its fields and return the status the old mapping
gave. Where a guest refuses input before any library sees it (bytes that
are not the codec, a malformed options object or config, a call out of
order) it records a `GuestError` naming what it refused, and the config
error names the key, never its value. The status numbers are unchanged
and so are their tests.

The credential guest's `status_for_auth` matches stack-auth's variants
instead of hand-typed `error_code()` strings, so a renamed code can no
longer fall through to "other auth failure"; a test pins that every
variant gets the status the string table gave it. The crypto guest no
longer copies eql-bindings' JSON parser message into a stored-value
refusal: serde_json quotes the input it refused, and the input is stored
ciphertext.

The leak tests (`tests/leak.rs` in each guest) drive every error path a
native test can reach with marker values where a caller's data would be —
plaintext, contexts, ciphertext, a client key, an access token or access
key, a ZeroKMS response body — and assert no marker appears in any
encoded error, at any depth, keys included. Each pins the codes it
reached, so a path that stops being driven fails there. Reverting either
the context-descriptor rule or the JSON-message rule makes them fail.

The credential guest's lockfile moves `vitaminc-aead-value` from 0.5.0 to
0.5.1, the version stack-guest-abi builds against and the crypto guest
already uses.

Refs #1100

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01URtfKsTToFUCRwq3g7gCUf

Author: claude

languages/golang/auth/guest/Cargo.lock

@@ -25,9 +25,8 @@
 
 use std::panic::{catch_unwind, AssertUnwindSafe};
 
-use stack_guest_abi::abi::{err_status, input, ok_buffer};
-use stack_guest_abi::buffers;
-use stack_guest_abi::status::STATUS_INTERNAL;
+use stack_guest_abi::abi::{export, input};
+use stack_guest_abi::{buffers, last_error};
 
 use crate::{auth, ops};
 
@@ -42,27 +41,25 @@ type Op1 = fn(&[u8]) -> Result<Vec<u8>, u32>;
 type Op2 = fn(&[u8], &[u8]) -> Result<Vec<u8>, u32>;
 
 /// Run a two-input operation as an export: validate both pairs, run,
-/// pack. A panic is `STATUS_INTERNAL` (wasm32-wasip1 aborts on panic; the
-/// catch is belt-and-braces for an unwinding build).
+/// pack, through the shared [`export`] wrapper — which clears the last
+/// error first, records one for any failure, and makes a panic
+/// `STATUS_INTERNAL` (wasm32-wasip1 aborts on panic; the catch is
+/// belt-and-braces for an unwinding build).
 fn export2(a_ptr: *const u8, a_len: u32, b_ptr: *const u8, b_len: u32, op: Op2) -> u64 {
-    catch_unwind(AssertUnwindSafe(|| {
+    export(|| {
         // SAFETY: host-owned ranges the export was handed; the borrows end
         // when `op` returns, inside the call, and nothing here writes to
         // linear memory while they are live.
         let a = unsafe { input(a_ptr, a_len)? };
         let b = unsafe { input(b_ptr, b_len)? };
         op(a, b)
-    }))
-    .unwrap_or(Err(STATUS_INTERNAL))
-    .map_or_else(err_status, ok_buffer)
+    })
 }
 
 /// [`export2`] for a one-input operation.
 fn export1(a_ptr: *const u8, a_len: u32, op: Op1) -> u64 {
     // SAFETY: as in `export2`.
-    catch_unwind(AssertUnwindSafe(|| op(unsafe { input(a_ptr, a_len)? })))
-        .unwrap_or(Err(STATUS_INTERNAL))
-        .map_or_else(err_status, ok_buffer)
+    export(|| op(unsafe { input(a_ptr, a_len)? }))
 }
 
 /// The current workspace id of the store at `dir`. See
@@ -241,5 +238,6 @@ pub unsafe extern "C" fn sa_auth_free(ptr: *const u8, len: u32) -> u64 {
 #[no_mangle]
 pub extern "C" fn sa_shutdown() {
     let _ = catch_unwind(AssertUnwindSafe(auth::clear));
+    let _ = catch_unwind(AssertUnwindSafe(last_error::clear));
     let _ = catch_unwind(AssertUnwindSafe(buffers::wipe_all));
 }

languages/golang/auth/guest/src/abi.rs

@@ -16,10 +16,10 @@ use stack_profile::ProfileStore;
 use zeroize::Zeroizing;
 
 use crate::host::{HostOidcProvider, WasiAuthTransport};
-use crate::status::{
-    status_for_auth, status_for_profile, STATUS_AUTH_CONFIG, STATUS_AUTH_REFRESH_REQUIRED,
-    STATUS_ENCODING, STATUS_STATE,
-};
+use stack_auth::AuthError;
+use stack_guest_abi::last_error::{malformed, out_of_order};
+
+use crate::status::{fail_auth, fail_profile, STATUS_AUTH_REFRESH_REQUIRED};
 
 #[derive(Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
@@ -62,13 +62,16 @@ thread_local! {
 
 fn parse_base_url(value: Option<String>) -> Result<Option<url::Url>, u32> {
     value
-        .map(|v| v.parse::<url::Url>().map_err(|_| STATUS_ENCODING))
+        .map(|v| {
+            v.parse::<url::Url>()
+                .map_err(|_| malformed("the strategy config's base_url is not a URL"))
+        })
         .transpose()
 }
 
 pub fn validate_crn(bytes: &[u8]) -> Result<Vec<u8>, u32> {
-    let text = std::str::from_utf8(bytes).map_err(|_| STATUS_ENCODING)?;
-    let _: Crn = text.parse().map_err(|_| STATUS_AUTH_CONFIG)?;
+    let text = std::str::from_utf8(bytes).map_err(|_| malformed("the CRN is not UTF-8"))?;
+    let _: Crn = text.parse().map_err(|e| fail_auth(&AuthError::from(e)))?;
     Ok(Vec::new())
 }
 
@@ -78,29 +81,34 @@ pub fn validate_crn(bytes: &[u8]) -> Result<Vec<u8>, u32> {
 // JSON envelope itself.
 
 pub fn create(config: &[u8]) -> Result<Vec<u8>, u32> {
-    let config: Config = serde_json::from_slice(config).map_err(|_| STATUS_ENCODING)?;
+    // Never serde_json's message: it can quote the config, which carries
+    // the access key.
+    let config: Config = serde_json::from_slice(config)
+        .map_err(|_| malformed("the strategy config is not a JSON object of the expected shape"))?;
     let strategy = match config {
         Config::AccessKey {
             crn,
             access_key,
             base_url,
         } => {
             let access_key = Zeroizing::new(access_key);
-            let crn: Crn = crn.parse().map_err(|_| STATUS_AUTH_CONFIG)?;
-            let key: AccessKey = access_key.parse().map_err(|_| STATUS_AUTH_CONFIG)?;
+            let crn: Crn = crn.parse().map_err(|e| fail_auth(&AuthError::from(e)))?;
+            let key: AccessKey = access_key
+                .parse()
+                .map_err(|e| fail_auth(&AuthError::from(e)))?;
             let mut builder = AccessKeyStrategy::builder(crn, key).transport(WasiAuthTransport);
             if let Some(url) = parse_base_url(base_url)? {
                 builder = builder.base_url(url);
             }
-            Strategy::AccessKey(builder.build().map_err(|e| status_for_auth(&e))?)
+            Strategy::AccessKey(builder.build().map_err(|e| fail_auth(&e))?)
         }
         Config::Oidc {
             crn,
             provider,
             base_url,
             cache_capacity,
         } => {
-            let crn: Crn = crn.parse().map_err(|_| STATUS_AUTH_CONFIG)?;
+            let crn: Crn = crn.parse().map_err(|e| fail_auth(&AuthError::from(e)))?;
             let mut builder = OidcFederationStrategy::builder(crn, HostOidcProvider(provider))
                 .transport(WasiAuthTransport);
             if let Some(url) = parse_base_url(base_url)? {
@@ -109,14 +117,14 @@ pub fn create(config: &[u8]) -> Result<Vec<u8>, u32> {
             if let Some(capacity) = cache_capacity {
                 builder = builder.cache_capacity(capacity);
             }
-            Strategy::Oidc(builder.build().map_err(|e| status_for_auth(&e))?)
+            Strategy::Oidc(builder.build().map_err(|e| fail_auth(&e))?)
         }
         Config::DeviceSession {
             workspace_dir,
             base_url,
         } => {
             if workspace_dir.is_empty() {
-                return Err(STATUS_ENCODING);
+                return Err(malformed("the strategy config's workspace_dir is empty"));
             }
             Strategy::DeviceSession {
                 workspace_dir,
@@ -136,22 +144,23 @@ pub fn create(config: &[u8]) -> Result<Vec<u8>, u32> {
 }
 
 fn parse_handle(bytes: &[u8]) -> Result<u32, u32> {
-    let text = std::str::from_utf8(bytes).map_err(|_| STATUS_ENCODING)?;
-    text.parse::<u32>().map_err(|_| STATUS_ENCODING)
+    let refuse = || malformed("a strategy handle is not a decimal number");
+    let text = std::str::from_utf8(bytes).map_err(|_| refuse())?;
+    text.parse::<u32>().map_err(|_| refuse())
 }
 
 pub fn token(handle: &[u8]) -> Result<Vec<u8>, u32> {
     let id = parse_handle(handle)?;
     STRATEGIES.with(|items| {
         let items = items.borrow();
-        let strategy = items.get(&id).ok_or(STATUS_STATE)?;
+        let strategy = items.get(&id).ok_or_else(no_strategy)?;
         match strategy {
             Strategy::AccessKey(strategy) => block_on(strategy.get_token())
                 .map(|token| token.as_str().as_bytes().to_vec())
-                .map_err(|e| status_for_auth(&e)),
+                .map_err(|e| fail_auth(&e)),
             Strategy::Oidc(strategy) => block_on(strategy.get_token())
                 .map(|token| token.as_str().as_bytes().to_vec())
-                .map_err(|e| status_for_auth(&e)),
+                .map_err(|e| fail_auth(&e)),
             Strategy::DeviceSession {
                 workspace_dir,
                 base_url,
@@ -165,12 +174,12 @@ pub fn token(handle: &[u8]) -> Result<Vec<u8>, u32> {
 fn cached_device_token(workspace_dir: &str, base_url: &Option<url::Url>) -> Result<Vec<u8>, u32> {
     let token: Token = ProfileStore::new(workspace_dir)
         .load_profile()
-        .map_err(|e| status_for_profile(&e))?;
+        .map_err(|e| fail_profile(&e))?;
     if token.region().is_none() || token.client_id().is_none() {
-        return Err(stack_guest_abi::status::STATUS_AUTH_NOT_AUTHENTICATED);
+        return Err(fail_auth(&stack_auth::NotAuthenticated.into()));
     }
     if base_url.is_none() {
-        let _ = token.issuer().map_err(|e| status_for_auth(&e))?;
+        let _ = token.issuer().map_err(|e| fail_auth(&e))?;
     }
     if token.is_expired() {
         return Err(STATUS_AUTH_REFRESH_REQUIRED);
@@ -187,30 +196,35 @@ pub fn refresh(handle: &[u8]) -> Result<Vec<u8>, u32> {
         let Strategy::DeviceSession {
             workspace_dir,
             base_url,
-        } = items.get(&id).ok_or(STATUS_STATE)?
+        } = items.get(&id).ok_or_else(no_strategy)?
         else {
-            return Err(STATUS_STATE);
+            return Err(out_of_order("only a device session strategy refreshes"));
         };
         let store = ProfileStore::new(workspace_dir);
         let mut builder =
             DeviceSessionStrategy::with_workspace_store(store).transport(WasiAuthTransport);
         if let Some(url) = base_url {
             builder = builder.base_url(url.clone());
         }
-        let strategy = builder.build().map_err(|e| status_for_auth(&e))?;
-        let token = block_on(strategy.get_token()).map_err(|e| status_for_auth(&e))?;
+        let strategy = builder.build().map_err(|e| fail_auth(&e))?;
+        let token = block_on(strategy.get_token()).map_err(|e| fail_auth(&e))?;
         Ok(token.as_str().as_bytes().to_vec())
     })
 }
 
 pub fn free(handle: &[u8]) -> Result<Vec<u8>, u32> {
     let id = parse_handle(handle)?;
     STRATEGIES.with(|items| {
-        let _removed = items.borrow_mut().remove(&id).ok_or(STATUS_STATE)?;
+        let _removed = items.borrow_mut().remove(&id).ok_or_else(no_strategy)?;
         Ok(Vec::new())
     })
 }
 
+/// A handle that names no live strategy: never created, or already freed.
+fn no_strategy() -> u32 {
+    out_of_order("no strategy has this handle: it was never created, or was freed")
+}
+
 pub fn clear() {
     STRATEGIES.with(|items| items.borrow_mut().clear());
 }

languages/golang/auth/guest/src/auth.rs

@@ -12,10 +12,11 @@
 //!
 //! # Errors
 //!
-//! Every function reports a [`crate::status`] code, never a message. A
-//! directory, id or filename that is not UTF-8, or an empty directory, is
-//! [`STATUS_ENCODING`]; everything else is `stack-profile`'s verdict
-//! ([`status_for_profile`]).
+//! Every function reports a [`crate::status`] code, and records the error
+//! behind it for `se_last_error`. A directory, id or filename that is not
+//! UTF-8, or an empty directory, is
+//! [`STATUS_ENCODING`](crate::status::STATUS_ENCODING); everything else is
+//! `stack-profile`'s verdict ([`fail_profile`]).
 //!
 //! # Copies
 //!
@@ -33,7 +34,9 @@ use stack_profile::{DeviceIdentity, ProfileStore};
 use vitaminc_aead_value::{transport as codec, FfiValue};
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
-use crate::status::{status_for_profile, STATUS_ENCODING, STATUS_INTERNAL};
+use stack_guest_abi::last_error::{internal, malformed};
+
+use crate::status::fail_profile;
 
 /// The file `secretkey.json`, as `stack-auth`'s device client writes it
 /// and `stack-kms`'s `SecretKey` reads it: the ZeroKMS client id and the
@@ -64,13 +67,13 @@ const AUTH_FILENAME: &str = "auth.json";
 pub fn store(dir: &[u8]) -> Result<ProfileStore, u32> {
     let dir = text(dir)?;
     if dir.is_empty() {
-        return Err(STATUS_ENCODING);
+        return Err(malformed("the store directory is empty"));
     }
     Ok(ProfileStore::new(dir))
 }
 
 fn text(bytes: &[u8]) -> Result<&str, u32> {
-    std::str::from_utf8(bytes).map_err(|_| STATUS_ENCODING)
+    std::str::from_utf8(bytes).map_err(|_| malformed("an input is not UTF-8"))
 }
 
 fn string(value: impl Into<String>) -> FfiValue {
@@ -83,7 +86,7 @@ fn optional(value: Option<&str>) -> FfiValue {
 
 fn encode(value: FfiValue) -> Result<Vec<u8>, u32> {
     let mut out = Vec::new();
-    codec::encode_value(value, &mut out).map_err(|_| STATUS_INTERNAL)?;
+    codec::encode_value(value, &mut out).map_err(|_| internal("an output did not encode"))?;
     Ok(out)
 }
 
@@ -92,7 +95,7 @@ pub fn current_workspace(dir: &[u8]) -> Result<Vec<u8>, u32> {
     store(dir)?
         .current_workspace()
         .map(String::into_bytes)
-        .map_err(|e| status_for_profile(&e))
+        .map_err(|e| fail_profile(&e))
 }
 
 /// Set the current workspace. The workspace must already have a directory;
@@ -101,7 +104,7 @@ pub fn set_current_workspace(dir: &[u8], id: &[u8]) -> Result<Vec<u8>, u32> {
     store(dir)?
         .set_current_workspace(text(id)?)
         .map(|()| Vec::new())
-        .map_err(|e| status_for_profile(&e))
+        .map_err(|e| fail_profile(&e))
 }
 
 /// Remove the current workspace selection. Empty output; nothing to remove
@@ -110,15 +113,15 @@ pub fn clear_current_workspace(dir: &[u8]) -> Result<Vec<u8>, u32> {
     store(dir)?
         .clear_current_workspace()
         .map(|()| Vec::new())
-        .map_err(|e| status_for_profile(&e))
+        .map_err(|e| fail_profile(&e))
 }
 
 /// The workspace ids with profile data on disk, sorted, as a codec array
 /// of strings.
 pub fn list_workspaces(dir: &[u8]) -> Result<Vec<u8>, u32> {
     let ids = store(dir)?
         .list_workspaces()
-        .map_err(|e| status_for_profile(&e))?;
+        .map_err(|e| fail_profile(&e))?;
     encode(FfiValue::Array(ids.into_iter().map(string).collect()))
 }
 
@@ -129,7 +132,7 @@ pub fn list_workspaces(dir: &[u8]) -> Result<Vec<u8>, u32> {
 pub fn workspace_dir(dir: &[u8], id: &[u8]) -> Result<Vec<u8>, u32> {
     let scoped = store(dir)?
         .workspace_store(text(id)?)
-        .map_err(|e| status_for_profile(&e))?;
+        .map_err(|e| fail_profile(&e))?;
     path_bytes(scoped.dir())
 }
 
@@ -139,7 +142,7 @@ pub fn workspace_dir(dir: &[u8], id: &[u8]) -> Result<Vec<u8>, u32> {
 pub fn lock_path(dir: &[u8], filename: &[u8]) -> Result<Vec<u8>, u32> {
     let path = store(dir)?
         .lock_path(text(filename)?)
-        .map_err(|e| status_for_profile(&e))?;
+        .map_err(|e| fail_profile(&e))?;
     path_bytes(&path)
 }
 
@@ -148,7 +151,7 @@ fn path_bytes(path: &std::path::Path) -> Result<Vec<u8>, u32> {
     // this module's bug, not the caller's.
     path.to_str()
         .map(|s| s.as_bytes().to_vec())
-        .ok_or(STATUS_INTERNAL)
+        .ok_or_else(|| internal("a store path is not UTF-8"))
 }
 
 /// `secretkey.json` in this store, as a codec object `{client_id,
@@ -157,7 +160,7 @@ fn path_bytes(path: &std::path::Path) -> Result<Vec<u8>, u32> {
 pub fn secret_key(dir: &[u8]) -> Result<Vec<u8>, u32> {
     let mut file: SecretKeyFile = store(dir)?
         .load(SECRET_KEY_FILENAME)
-        .map_err(|e| status_for_profile(&e))?;
+        .map_err(|e| fail_profile(&e))?;
     // Moved out rather than copied: `SecretKeyFile` wipes on drop, so its
     // fields cannot be moved out of it directly.
     let client_id = std::mem::take(&mut file.client_id);
@@ -180,7 +183,7 @@ pub fn secret_key(dir: &[u8]) -> Result<Vec<u8>, u32> {
 pub fn token(dir: &[u8]) -> Result<Vec<u8>, u32> {
     let token: Token = store(dir)?
         .load(AUTH_FILENAME)
-        .map_err(|e| status_for_profile(&e))?;
+        .map_err(|e| fail_profile(&e))?;
     encode(FfiValue::Object(vec![
         (
             "access_token".to_string(),
@@ -210,7 +213,7 @@ pub fn has_token(dir: &[u8]) -> Result<Vec<u8>, u32> {
 /// `device.json` in this store, read-only, as a codec object
 /// `{device_instance_id, device_name}`. Creating one is the CLI's.
 pub fn device_identity(dir: &[u8]) -> Result<Vec<u8>, u32> {
-    let identity = DeviceIdentity::load(&store(dir)?).map_err(|e| status_for_profile(&e))?;
+    let identity = DeviceIdentity::load(&store(dir)?).map_err(|e| fail_profile(&e))?;
     encode(FfiValue::Object(vec![
         (
             "device_instance_id".to_string(),