ART transport core

[SaschaCowley]

Link to issue number:

None

Summary of the issue:

NVDA needs an out-of-process, sandboxed add-on runtime (ART) to help protect against malicious and/or buggy add-ons. Before any feature work can be built, ART needs a generic, feature-agnostic transport layer to carry calls across the NVDA—add-on process boundary.

Description of user facing changes:

None, just plumbing/architecture at this point.

Description of developer facing changes:

New _art package and _art.transport subpackage, which provide the rpyc-over-pipes core that ART will use for IPC:

• Connection: wraps a single bidirectional rpyc connection over a Stream. Exposes a local Service to the peer and reaches the peer's root service via remoteService. Serves peer requests either in the calling thread (eventLoop) or a background thread (bgEventLoop).
• Service: base class for objects exposed across the boundary. Methods are opted-in with @Service.exposed. Owns the lifecycle of dependent connections it opens and dependant services it returns; terminate() cascades teardown to both.
• Proxy: base class for the local-side wrapper that re-presents a remote service through NVDA's normal interface. Usable as a mixin; closes any held connections on destruction.
• PROTOCOL_CONFIG: the shared, deliberately restrictive rpyc protocol config.

Description of development approach:

Harvested the rpyc-over-pipes transport and Service/Proxy model from the synth driver host (_bridge), but rebuilt it feature-generic from the start (nothing synth-specific) and added the explicit lifecycle/teardown discipline from the pyro5-based ART prototype.

Notes:

• _art.transport.config.PROTOCOL_CONFIG sets allow_public_attrs, allow_safe_attrs, allow_all_attrs, allow_setattr, allow_delattr and allow_pickle to False, so only explicitly exposed attributes/methods are available to add-ons, and remote code execution via deserialization is prevented. allow_getattr is True because exposed methods are themselves reached via attribute access; with everything else locked down the exposed allowlist is all that remains reachable. Changing these settings affects the security of ART.
• Importing _art.transport sets rpyc.core.vinegar.exceptions_module = builtins. This is necessary because NVDA has its own level exceptions module, which rpyc would otherwise pick up over builtins, breaking remote exception deserialization. _bridge patches this on the host side, but it's done globally here so it applies to both sides of the connection. The patch is idempotent.

Testing strategy:

tests/unit/test_art/test_artTransport.py exercises the transport over an in-process PipeStream duplex pair:

• round-trip of an exposed method;
• bidirectional callback (a callable passed to the peer invoked back across the connection);
• non-exposed attributes/methods are blocked (AttributeError);
• a terminated service refuses further calls and the exception deserializes correctly (covers the vinegar patch);
• a dependant service returned over the boundary is terminated together with its parent.

Known issues with pull request:

• No real cross-process test yet. Actual IPC is coming in a future PR.
• No NVDA-core integration; nothing is wired up or user-reachable.

Code Review Checklist:

• Documentation:
  • Change log entry
  • User Documentation
  • Developer / Technical Documentation
  • Context sensitive help for GUI changes
• Testing:
  • Unit tests
  • System (end to end) tests
  • Manual testing
• UX of all users considered:
  • Speech
  • Braille
  • Low Vision
  • Different web browsers
  • Localization in other languages / culture than English
• API is compatible with existing add-ons.
• Security precautions taken.

[SaschaCowley]

Converted to draft pending opening an implementation roadmap