This only happened if the Finish message indicating cancellation and the Return message happened to cross paths. If the Finish arrived before the Return was sent, then the server would send an empty response. If the Return was received before the Finish was sent, the client would properly record caps in the response. But if they crossed paths, the server would send back a full response with caps, but the client would never bother to inspect that response, thus leaking the caps. Fix is to set the flag to release all returned caps in the Finish message when cancelling.

Bug 1
-----

If a Resolve message indicated that the promise had been rejected, the code would see the error cap as a local cap and erroneously believe that the promise had resolved back to a local capability, thereby requiring a Disembargo to be sent. The peer, on receiving the nonsensical Disembargo, would throw an exception and close the connection.

The error message seen was: "expected target->getBrand() == this; 'Disembargo' of type 'senderLoopback' sent to an object that does not point back to the sender."

Bug 2
-----

Disembargos are sent not only in response to Resolves, but also Returns, since capabilities in a returned message were previously accessible as PromisedAnswers. This means that we must apply the same rule that states that once a promise has been resolved, the promise must from then on forward all messages it receives strictly to the object to which it resolved, even if that object is itself a promise which later resolves to somewhere else. The code which sends Resolve messages was doing this correctly, but the code sending Return messages was not. They now both operate correctly. I've also added more explanation to the documentation in rpc.capnp.

The error message seen was: "expected redirect == nullptr; 'Disembargo' of type 'senderLoopback' sent to an object that does not appear to have been the object of a previous 'Resolve' message."

For portions currently copyright by Kenton (most of it), transfer copyright to Sandstorm Development Group, Inc. (Kenton's company).

The license change is practically meaningless, as MIT and BSD 2-clause are legally equivalent. However, the BSD 2-clause license is sometimes confused for its ugly siblings, BSD 3-clause and BSD 4-clause. The MIT license is more immediately recognizeable for what it is.

Rémy Blank and Jason Choy (the two non-trivial contributors) are on record as approving this change:

https://groups.google.com/d/msg/capnproto/xXDd2HUOCcc/gbe_COIuXKYJ

Cleaner disconnect handling.  Better fix for issue #71, and also simplifies the interface and improves robustness.

Fix bug where receiving EOF on the RPC connection could cause RpcConnectionState to go into an infinite promise loop.  Strange that this did not cause trouble earlier.  Also some minor tweaks.

Eliminate the concept of imbuing messages in favor of the simpler concept of setting a cap table directly on MessageReader / getting one from MessageBuilder.  This eliminates capability-context entirely.  This was made possible by the earlier change which moved capabilities to a separate table rather than storing CapDescriptors inline, but I didn't realize it at the time.

Define additional type aliases AnswerId and ImportId.  In the RPC protocol, always use the type corresponding to the sender's point of view.  In the implementation, always use the type corresponding to the local point of view.

Lift requirement that releaseParams() be called before tailCall() or allowCancellation() -- this is no longer necessary given the protocol simplification that allowed cap descriptors to be interpreted immediately upon receipt.

Extend totalSizeInWords() to also return a count of capabilities, which helps when a separate capability table needs to be allocated as well.  Use this in the RPC system.

Change capability pointers to be indexes into a separate cap list so that CapDescriptors can be interpreted on receipt rather than delaying until the application actually traverses the message.  This massively simplifies a lot of things.

Make all Promise methods consistently consume the promise (returning a new promise when it makes sense), rename daemonize -> detach, and make eagerlyEvaluate() require an error handler (this caught several places where I forgot to use one).

Revamp concurrency model, part 1:  EventLoop no longer allows cross-thread event queuing, simplifying many things.  Capability clients are no longer thread-safe, so they don't have to be so const.  In the future, explicit ways to communicate between threads will be re-added, but threads will be treated more like separate vats that just happen to have a particularly fat pipe.  Upcoming:  Remove mutexes.

Implement opt-in cancellation for local calls.  (Previously, cancellation would happen whether or not the callee had opted in.)

Don't rely on default assignment operators for cap clients since they break with double virtual inheritance.

Tail calls half-implemented, but I think it's time to delete all the cancellation code before continuing because it will simplify things.

Oops, don't need to use embargoes if the resolution is on the same machine as the promise, since the network path of calls is unchanged in that case.