Enforce script timeout in Hyperlight runner

src/wxc_common/Cargo.toml

@@ -21,7 +21,7 @@ getrandom = { workspace = true }
 semver = "1"
 
 [target.'cfg(target_arch = "x86_64")'.dependencies]
-hyperlight-unikraft-host = { git = "https://github.com/hyperlight-dev/hyperlight-unikraft", tag = "v0.5.0", optional = true }
+hyperlight-unikraft-host = { git = "https://github.com/hyperlight-dev/hyperlight-unikraft", tag = "v0.6.0", optional = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows = { workspace = true }

src/wxc_common/src/hyperlight_runner.rs

@@ -201,7 +201,7 @@ pub fn setup(force: bool, logger: &mut Logger) -> Result<PathBuf, String> {
     let opts = pyhl::InstallOptions {
         home: &home,
         source: pyhl::InstallSource::Ghcr {
-            tag: Some("v0.5.0"),
+            tag: Some("v0.6.0"),
         },
         mounts: &[],
         network: None,
@@ -536,7 +536,18 @@ impl ScriptRunner for HyperlightScriptRunner {
             }
         };
 
-        match rt.run_code(&request.script_code) {
+        let result = if request.script_timeout > 0 {
+            let timeout = std::time::Duration::from_millis(u64::from(request.script_timeout));
+            logger.log_line(&format!(
+                "hyperlight: timeout set to {}ms",
+                request.script_timeout
+            ));
+            rt.run_code_with_timeout(&request.script_code, timeout)
+        } else {
+            rt.run_code(&request.script_code)
+        };
+
+        match result {
             Ok(timing) => {
                 logger.log_line(&format!(
                     "hyperlight: run ok (restore={:.1}ms call={:.1}ms exit={})",

src/wxc_e2e_tests/tests/e2e_windows.rs

@@ -622,6 +622,12 @@ fn hyperlight_suite() {
             expected_exit: 0,
             output_contains: Some("BLOCKED"),
         },
+        HyperlightCase {
+            config: "hyperlight_timeout.json",
+            description: "time.sleep(120) killed by 1s timeout",
+            expected_exit: -1,
+            output_contains: Some("timed out"),
+        },
     ];
 
     let mut failures = Vec::new();

test_configs/hyperlight_timeout.json

@@ -0,0 +1,7 @@
+{
+    "process": {
+        "commandLine": "import time; time.sleep(120); print('should not reach here')",
+        "timeout": 1000
+    },
+    "containment": "hyperlight"
+}