feat: Adds WASM based plugins, replacing Lua

* feat: Moves to wasm plugin architecture
* fix: Fixes permissions on husky scripts
* docs: Adds changeset notes
* docs: Adds note for taskless plugin authoring
* test: Disables WASI warning on test
* chore: Cleans up testing server to use generated config
* chore: Adds runSandbox to simplify hook execution code
* fix: Makes sandbox crashes safe via .allSettled

Author: thecodedrift

.changeset/giant-pillows-taste.md

@@ -0,0 +1,13 @@
+---
+"@taskless/loader": patch
+---
+
+Moves to wasm plugin system (Breaking Change)
+
+Previously, Taskless plugins were small Lua scripts that ran within a [wasmoon](https://github.com/ceifa/wasmoon) VM. Unfortunately, Lua VMs are [not](https://github.com/glejeune/ruby-lua) [consistent](https://github.com/Shopify/go-lua) [across](https://github.com/luaj/luaj) [languages](https://github.com/mlua-rs/rlua). This makes it impossible to gaurentee a plugin you (or we) write will work consistently across all platforms.
+
+Using [Extism](https://extism.org/), we can move the runtime requirement out of the host and into the individual plugins. On a per-plugin basis, this increases the individual sizes significantly, but the tradeoffs are true universal compatibility and compatibility gaurentees via the Extism SDK. This lays the groundwork for much thinner client libraries in Python, PHP, Ruby, and .NET among others.
+
+We're keeping the YAML format for plugins and configurations, as that's served us well. The biggest change is the module key that's now present, containing the wasm compiled plugin. Because wasm does not have host access, the security sandbox doesn't require any changes in order to support the new style.
+
+If you'd like to use Lua plugins, please continue to use a previous version of the Taskless loader.

README.md

@@ -3,6 +3,7 @@
 Take control of your third-party API dependencies with deep, context-aware observability. The Taskless loader provides comprehensive monitoring and telemetry for your external service calls, capturing everything from basic HTTP metrics to service-specific error details that traditional APM tools miss.
 
 Out of the box, you get:
+
 - Zero-config request & response monitoring
 - Service-aware error detection beyond HTTP status codes
 - Automatic correlation of API failures and root causes
@@ -48,6 +49,10 @@ TASKLESS_API_KEY="your api key" node --import="@taskless/loader" start.js
 
 A programatic API is available by importing `taskless` from `@taskless/loader/core`. It's signature is `taskless(secret: string, options: Options):API`. We encourage you to explore the TypeScript types to see what's available.
 
+# Writing Taskless Plugins
+
+(coming soon)
+
 # License
 
 Apache 2.0

package.json

@@ -15,7 +15,7 @@
     "prepare": "husky",
     "prettier": "prettier",
     "syncpack": "syncpack",
-    "test": "vitest",
+    "test": "NODE_OPTIONS='--no-warnings' vitest",
     "xo": "xo"
   },
   "type": "module",
@@ -46,20 +46,19 @@
     "package.json"
   ],
   "dependencies": {
+    "@extism/extism": "2.0.0-rc9",
     "fets": "^0.8.2",
-    "js-yaml": "^4.1.0",
     "msw": "^2.3.5",
     "ts-dedent": "^2.2.0",
     "uint8array-extras": "^1.4.0",
     "uuid": "^10.0.0",
-    "wasmoon": "^1.16.0"
+    "yaml": "^2.6.0"
   },
   "devDependencies": {
     "@changesets/cli": "^2.27.7",
     "@commitlint/cli": "^19.3.0",
     "@commitlint/config-conventional": "^19.2.2",
     "@hono/node-server": "^1.13.1",
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.12.12",
     "@types/uuid": "^10.0.0",
     "execa": "^9.3.0",