Grove

Grove is Land’s native Rust and WASM extension host. It provides a sandboxed environment for running WASM-compiled VS Code extensions via Wasmtime, sharing the same VS Code API surface as Cocoon. Grove is implemented and available as an optional build feature; it is not the active extension path for existing VS Code extensions. Cocoon remains the default host for unmodified extension compatibility.

The problem Grove solves

VS Code extensions share a single Node.js process. A malicious or buggy extension can access any file on disk, make arbitrary network requests, and read another extension’s in-memory state. The extension sandbox in VS Code is a policy document enforced by trust, not a technical boundary enforced by the runtime.

Grove makes the sandbox a hardware-enforced boundary. A WASM module running inside Wasmtime has no access to the host OS by default. It can only call functions that the host explicitly exports to it. An extension that requests file access gets exactly the file handles it was granted — nothing more.

Overview

Architecture

Grove is organized into five layers:

+----------------------------------------------------------------+
|                      Grove                                      |
|                                                                |
|  +------------------------+  +------------------------------+  |
|  |    Host Layer          |  |    WASM Layer                |  |
|  |  - ExtensionHost.rs    |  |  - Runtime.rs (Wasmtime)    |  |
|  |  - ExtensionManager.rs |  |  - ModuleLoader.rs           |  |
|  |  - Activation.rs       |  |  - MemoryManager.rs          |  |
|  |  - Lifecycle.rs        |  |  - HostBridge.rs             |  |
|  |  - APIBridge.rs        |  +------------------------------+  |
|  +------------------------+                                     |
|                                                                |
|  +------------------------+  +------------------------------+  |
|  |    Transport Layer     |  |    API Layer                 |  |
|  |  - gRPCTransport.rs    |  |  - VSCode.rs                 |  |
|  |  - IPCTransport.rs     |  |  - Types.rs                  |  |
|  |  - WASMTransport.rs    |  |  - FunctionExports.rs        |  |
|  |  - Strategy.rs         |  +------------------------------+  |
|  +------------------------+                                     |
|                                                                |
|  +------------------------+                                     |
|  |    Protocol Layer      |                                     |
|  |  - SpineConnection.rs  |                                     |
|  |  - SpineActionClient   |                                     |
|  +------------------------+                                     |
+----------------------------------------------------------------+

Module Map

How Grove differs from Cocoon

Transport Strategies

Grove supports three transport strategies for communicating with Mountain:

pub enum TransportStrategy {
    /// gRPC over TCP (default)
    Grpc(GrpcConfig),
    /// Unix domain socket or named pipe
    Ipc(IpcConfig),
    /// Direct WASM host function calls
    Wasm(WasmConfig),
}

The transport strategy is selected at build time via Cargo features. --features all enables all three.

WASM Runtime

Grove uses Wasmtime as its WebAssembly runtime:

Sandbox Properties

Host Function Bridge

The HostBridge registers VS Code API functions as WASM imports:

// HostBridge registers host functions that WASM modules can call
let mut linker = Linker::new(&engine);
linker.func_wrap("vscode", "readFile", |path_ptr: i32, path_len: i32| {
    // Read file through Mountain via gRPC
    let host = HostBridge::current();
    host.read_file(path_ptr, path_len)
})?;

VS Code API Surface

Grove implements a subset of the VS Code API for WASM extensions:

Extension Lifecycle

1. ExtensionManager discovers WASM extension (.wasm file + package.json)
    |
    v
2. ModuleLoader compiles WASM module with Wasmtime
    |  - Validates module structure
    |  - Creates WASM instance with HostBridge
    |
    v
3. Activation.rs calls extension's activate() export
    |  - Passes VS Code API surface via imports
    |  - Extension registers providers and commands
    |
    v
4. Normal operation:
    |  - Extension API calls routed through HostBridge
    |  - HostBridge dispatches to Mountain via transport layer
    |  - Results returned to WASM extension
    |
    v
5. Lifecycle.rs handles deactivation
    |  - Calls extension's deactivate() export
    |  - Unregisters all providers and commands
    |  - Frees WASM module memory

Feature Gates

Grove’s Cargo features control build configuration:

When not enabled, Grove is a compile-time no-op. Mountain links it conditionally:

# Mountain/Cargo.toml
[features]
grove = ["dep:grove"]

Target use cases

Grove is intended for two categories of extensions:

• Performance-critical extensions — parser integrations, language servers, formatters that benefit from near-native execution speed without a JavaScript runtime overhead
• Security-sensitive extensions — extensions that handle credentials, signing operations, or sensitive file access where users need verifiable capability boundaries before installation

Grove is not intended to replace Cocoon for the broad platform of existing VS Code extensions, which are written in TypeScript and depend on full Node.js compatibility.

Current status

Related Documentation

• Common - Shared traits and ActionEffect system
• Mountain - Main backend (Grove integration)
• Cocoon - Primary extension host (Node.js)
• InterComponentProtocol - gRPC protocol specification
• RustInfrastructure - Rust backend components

Project Maintainers: Source Open (Source/[email protected]) | GitHub Repository