Wolly
WOLLY stands for Web-ready, OpenBSD-first, Linear, Lean, Yours. Odd, loud and lovable.
Wolly is a web framework written in Hilde. A Wolly application is a FastCGI responder on a Unix socket behind the web server Hiawatha; the loop is Hilde's Standard.FcgiServer, and Wolly adds what a handler needs. Wolly has no unsafe module of its own. Source: github.com/heikozim/hilde-wolly; the language: github.com/heikozim/hilde.
The name
Like Hilde, Wolly is a real house cat, a European Shorthair, brown and white; more on the about page.
Why a single binary
The recent security problems in PHP and Node.js stacks have strengthened my conviction that a single binary with linear types and contracts is worth it: one that rules out errors such as a double free by its design, instead of following what has often counted as the state of the art. — Heiko Zimmermann
By that I mean PHP2Shell, CVE-2026-109618 and CVE-2026-109619, and Node2Shell, CVE-2026-111497. Hilde rules out a double free and a write past a buffer by its design: a linear value is ended exactly once, and every index is checked. This is not a judgement on PHP or Node.js; it is the reason I build Wolly the way it is.
What Wolly brings
| Module | What it does |
|---|---|
Wolly.Server, Wolly.Request, Wolly.Response | the life of the process and the socket; method, path and query; the answer, with a header holding a control byte refused |
Wolly.Router, Wolly.Middleware | routes by method and pattern, 404, 405 and 400; steps before and after the router, one access-log line per request with a request ID |
Wolly.Auth, Wolly.Totp, Wolly.Bearer, Wolly.Role, Wolly.Limit | sign-in with Argon2id, session rotation and throttling, the __Host- cookie and an audit log; TOTP as a second factor; bearer tokens; roles; limits with 429 |
Wolly.Passkey | passkeys (WebAuthn, the server's half): a challenge good once in 300 seconds, ES256 or EdDSA in COSE, the counter, user present and verified |
Wolly.Guard, Wolly.FormGuard, Wolly.Passphrase | protection against request forgery, a public form against robots, passphrase rules after NIST SP 800-63B-4 |
Wolly.Rambo | the client for RAMBO: OpenID Connect with PKCE, ID tokens checked against ML-DSA keys |
Wolly.Gif, Wolly.Jpeg, Wolly.Webp | images read in Hilde, every length checked |
Wolly.Feed, Wolly.Highlight, Wolly.Qr, Wolly.Asset | Atom feeds, syntax highlighting, QR codes as data URIs, versions of static files |
Wolly.Bunti | BUNTI, a colour code a camera reads |
Charts
Wolly.Chart holds the arithmetic of a bar chart in whole numbers: a readable number such as 1.2 k, the median, the height of a bar, the change against the median in tenths. It draws nothing. Wolly.Svg draws bars, lines and tiles as SVG on the server, without a script, with currentColor for light and dark, a <title> and an aria-label; Wolly.Dashboard is built on it.
Markdown
Wolly.Markdown turns Markdown into a tree and into HTML, and the HTML passes the sanitizer of Standard.Html once more. What the code and the tests hold today:
- CommonMark 0.31.2: blocks, lists up to 16 levels, fenced code with a language, link reference definitions, emphasis by the algorithm of the specification, entities; and tables after GFM.
- Raw HTML is shown as text; links are allowed only with http, https, mailto,
/or#. - The tests run 519 examples of the CommonMark specification 0.31.2 and of the GFM tables, and 16 deliberate deviations: 535 checks in 29 test functions. The sections on HTML blocks and raw HTML are left out.
- Not there yet, and tested as deviations: GFM strikethrough, task lists and autolinks without angle brackets.
Wolly.TextLayout measures the width of a text on a terminal by grapheme clusters and East Asian width; its behaviour follows the text viewer of go-lea.
Built with Wolly
- RAMBO, the sign-in service.
- ROXIE, a log collector: an agent on each machine, the collector as FastCGI behind Hiawatha, full-text search, a dashboard, sign-in through RAMBO.