Rust: load in-process cdylib once per process and never unload it

Fixes a Windows STATUS_ACCESS_VIOLATION (0xc0000005) crash in the Rust e2e
binary: FfiShared::Drop unloaded the cdylib (FreeLibrary/dlclose) when a
connection closed, racing the runtime's still-live worker threads — a late
worker-thread callback into the unmapped module faults on Windows. The crash hit
both Rust transport cells because the in-process smoke test runs regardless of
transport.

Load each cdylib once into a process-global cache and leak it (Box::leak) so its
code stays mapped for the process lifetime, matching the Node host (module-global
load, never unloaded) and the runtime's never-shutdown process-global tokio
runtime. close() still shuts the host down; only the library unload is removed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SteveSandersonMS

rust/src/ffi.rs

@@ -9,11 +9,13 @@
 //! native callback that feeds an async reader. The framing is unchanged — the
 //! same LSP `Content-Length:` frames the stdio transport uses.
 
+use std::collections::HashMap;
 use std::ffi::c_void;
 use std::path::{Path, PathBuf};
 use std::pin::Pin;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, AtomicPtr, AtomicU32, Ordering};
+use std::sync::{Mutex, OnceLock};
 use std::task::{Context, Poll};
 
 use libloading::Library;
@@ -56,11 +58,11 @@ extern "C" fn on_outbound(user_data: *mut c_void, bytes: *const u8, len: usize)
     let _ = state.tx.send(slice.to_vec());
 }
 
-/// Loaded library, bound exports, and connection lifecycle state, shared
-/// between the [`FfiWriter`] and the owning [`Client`]. Kept alive for the
-/// connection's lifetime; dropping it unloads the cdylib.
+/// Bound exports and connection lifecycle state, shared between the
+/// [`FfiWriter`] and the owning [`Client`]. The cdylib itself is loaded
+/// process-globally and never unloaded (see [`load_library`]), so this holds
+/// only the bound fn pointers and connection state.
 pub(crate) struct FfiShared {
-    _lib: Library,
     host_shutdown: HostShutdownFn,
     connection_write: ConnectionWriteFn,
     connection_close: ConnectionCloseFn,
@@ -185,10 +187,10 @@ impl AsyncWrite for FfiWriter {
     }
 }
 
-/// Prepared FFI host: the loaded cdylib plus the spawn arguments needed to
-/// start the runtime worker.
+/// Prepared FFI host: the bound cdylib exports plus the spawn arguments needed
+/// to start the runtime worker. The cdylib is loaded process-globally and never
+/// unloaded (see [`load_library`]).
 pub(crate) struct FfiHost {
-    lib: Library,
     library_path: PathBuf,
     entrypoint: PathBuf,
     environment: Vec<(String, String)>,
@@ -199,8 +201,8 @@ pub(crate) struct FfiHost {
     connection_close: ConnectionCloseFn,
 }
 
-// SAFETY: as for `FfiShared` — the bound exports are plain fn pointers and the
-// library handle is safe to move to the blocking thread that starts the host.
+// SAFETY: as for `FfiShared` — the bound exports are plain fn pointers, safe to
+// move to the blocking thread that starts the host.
 unsafe impl Send for FfiHost {}
 
 impl FfiHost {
@@ -215,29 +217,19 @@ impl FfiHost {
         environment: Vec<(String, String)>,
     ) -> Result<Self, Error> {
         let library_path = resolve_library_path(entrypoint)?;
-        let lib = unsafe { Library::new(&library_path) }.map_err(|e| {
-            Error::with_message(
-                ErrorKind::InvalidConfig,
-                format!(
-                    "failed to load in-process runtime library '{}': {e}",
-                    library_path.display()
-                ),
-            )
-        })?;
+        let lib = load_library(&library_path)?;
 
-        let host_start =
-            *bind::<HostStartFn>(&lib, b"copilot_runtime_host_start\0", &library_path)?;
+        let host_start = *bind::<HostStartFn>(lib, b"copilot_runtime_host_start\0", &library_path)?;
         let host_shutdown =
-            *bind::<HostShutdownFn>(&lib, b"copilot_runtime_host_shutdown\0", &library_path)?;
+            *bind::<HostShutdownFn>(lib, b"copilot_runtime_host_shutdown\0", &library_path)?;
         let connection_open =
-            *bind::<ConnectionOpenFn>(&lib, b"copilot_runtime_connection_open\0", &library_path)?;
+            *bind::<ConnectionOpenFn>(lib, b"copilot_runtime_connection_open\0", &library_path)?;
         let connection_write =
-            *bind::<ConnectionWriteFn>(&lib, b"copilot_runtime_connection_write\0", &library_path)?;
+            *bind::<ConnectionWriteFn>(lib, b"copilot_runtime_connection_write\0", &library_path)?;
         let connection_close =
-            *bind::<ConnectionCloseFn>(&lib, b"copilot_runtime_connection_close\0", &library_path)?;
+            *bind::<ConnectionCloseFn>(lib, b"copilot_runtime_connection_close\0", &library_path)?;
 
         Ok(Self {
-            lib,
             library_path,
             entrypoint: entrypoint.to_path_buf(),
             environment,
@@ -310,7 +302,6 @@ impl FfiHost {
         }
 
         let shared = Arc::new(FfiShared {
-            _lib: self.lib,
             host_shutdown: self.host_shutdown,
             connection_write: self.connection_write,
             connection_close: self.connection_close,
@@ -355,6 +346,44 @@ fn bind<'lib, T>(
     })
 }
 
+/// Loads the runtime cdylib once per process and never unloads it, returning a
+/// `'static` reference. Subsequent loads of the same path reuse the first
+/// handle.
+///
+/// The library is intentionally leaked (never `FreeLibrary`/`dlclose`d), so its
+/// code stays mapped for the process lifetime. This mirrors the Node host
+/// (which loads the cdylib once into a module-global and never unloads it) and
+/// the runtime's own process-global tokio runtime that is never shut down.
+/// Unloading the cdylib while shutting a connection down races the runtime's
+/// worker threads: on Windows, `FreeLibrary` unmaps the code and any late
+/// worker-thread callback into it faults (`STATUS_ACCESS_VIOLATION`). Keeping
+/// the module mapped avoids that while `close()` still tears the host down.
+fn load_library(library_path: &Path) -> Result<&'static Library, Error> {
+    static LIBRARIES: OnceLock<Mutex<HashMap<PathBuf, &'static Library>>> = OnceLock::new();
+    let cache = LIBRARIES.get_or_init(|| Mutex::new(HashMap::new()));
+
+    let mut guard = cache
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    if let Some(lib) = guard.get(library_path) {
+        return Ok(*lib);
+    }
+
+    let lib = unsafe { Library::new(library_path) }.map_err(|e| {
+        Error::with_message(
+            ErrorKind::InvalidConfig,
+            format!(
+                "failed to load in-process runtime library '{}': {e}",
+                library_path.display()
+            ),
+        )
+    })?;
+    // Leak the library so it is never unloaded for the process lifetime.
+    let leaked: &'static Library = Box::leak(Box::new(lib));
+    guard.insert(library_path.to_path_buf(), leaked);
+    Ok(leaked)
+}
+
 /// The natural platform shared-library file name for the runtime cdylib — the
 /// `.node` file renamed to what the Rust cdylib would be called on this OS.
 fn natural_library_name() -> &'static str {