wasi: a task's named grants as preopens, and the two faults that hid every preopen on Kore

[SnowCheetos]

Summary

Lets an embedder offer a task's named grants to a WASI guest as preopens, and fixes two faults in kore-wasi's filesystem host that kept a guest from ever seeing its preopens on Kore. Together they let CPython 3.12, run by kore's wasm command as a wasi:cli/command component, find its stdlib beside its own executable. The kore half is MicroPerceptron/kore#1273, which pins this branch's head, 7afc2d0.

Changes

• Named grants as preopens (90f5fa8). A guest's one preopen was ., the task root, walked a containment step at a time and never through a named grant, by design. On Kore the app store seeds programs and their data under shared, a grant the shell's walk resolves by name, so CPython launched as shared/wasm/python.wasm could stat neither itself nor shared/wasm/lib/python312.zip. Filesystem::with_named_grants lets the embedder opt in: each named grant becomes a preopen under its store name beside ., opened with the widest rights the service answers. The private root and unnamed grants are left out, a guest still never reaches a grant through ., and an embedder that says nothing offers nothing, as before.
• A descriptor reopens from its own preopen (7010ac6). open-at of . reopens a directory by its path from the preopen, which was always the root; beneath a grant that named a different object, or none. A descriptor now carries its origin (the root or its grant) and reopens from there.
• A refused preopen traps with the refusal (acad200). get-directories has no error to return. It answered an empty list when the root was refused and silently left out a refused grant, so a guest read "no files" where the service had said why. It now traps, naming what was refused.
• A completed op's result is handed back; each preopen is opened once (d2fcddb). FsHost::exec drives the task's one filesystem op through a single slot. Its last arm, reached when an op installed on an earlier turn finishes, returned None unconditionally, dropping the result whenever the op had queued no view to close. That is always the case for get-directories, whose opens return their views owned, so every call answered an empty preopen list. It now hands back what the op produced. And get-directories reopened every preopen on each call (the preview1 adapter asks once at start and again per name); the preopens are now opened once and shared for the filesystem's life.
• Regression tests for the slot driver (eb94cfe). Two tests drive FsHost::exec over a host with no face, with ops that park once: an op is answered with its result on the turn it finishes, and a caller dropped mid-op leaves its op to finish on the next caller's turn, which still gets its own result. Both fail against the old arm, which answered Ready(None).
• A named grant of one file is not a preopen (daee213, from review). open_grant enters a granted file as readily as a subtree root, and every named grant opened was published as a directory preopen. A grant whose root is not a directory is now closed and left out. It is not refused, because a refused preopen traps the guest, and this guest asked for nothing it lacks.
• alpha merged in (7afc2d0): Lua 5.5 (lua: Lua 5.5 as a crate, with io, os and kore.fs #23, lua: add bounded read-only worker policy #25) and the Wasmtime 48.0.3/48.0.5 RUSTSEC bumps. kore main had pinned 3f82da8, the head of lua: add bounded read-only worker policy #25, whose tree alpha holds as 7a76d19; with this merge one libkore revision carries both that and this branch's kore-wasi, so kore can pin kore-std, kore-wasi and kore-lua together. The merge changes nothing of alpha's: against alpha, this branch differs only in the three crates/wasi files above.

The two d2fcddb faults show only where a filesystem call parks and is driven to completion across turns, which never happens under a host Wasmtime's blocking calls; that is why no host test saw them. They were found on Kore under QEMU with a small C probe guest (clang wasm32-wasi, the preview1 adapter) that lists its preopens and stats what it is handed. The origin fix (7010ac6) and the file-grant rule (daee213) have no unit tests: each turns on an open_root/open_grant round trip that needs a real Kore face, and libkore does not mock its owners. The kore keytest below covers the directory-grant path end to end; no keytest holds a named file grant.

Verification

• On 7afc2d0: cargo fmt --check, cargo clippy --workspace --all-targets --all-features -- -D warnings, cargo test --workspace --all-features (75 passed, alpha's Lua suite included), cargo doc --no-deps under -D warnings, check-owners and check-native: pass locally with Zig 0.16.0. CI was green on daee213.
• Not run locally: miri (excludes kore-wasi), cross and bindings-check (they cover only kore-std, kore-ffi and kore-entry, which this branch's own commits do not touch).
• On Kore under QEMU with 8 GiB, MicroPerceptron/kore#1273's keytest-python-x86 runs CPython importing sys, json and decimal through zipimport and requires the computed line kore 3 97, with libkore pinned at 7afc2d0: pass. Not yet run on real hardware.

Landing

Merge this first, with a merge commit (as #21 and #23 were), so 7afc2d0 stays reachable from alpha and kore's pin names an accepted alpha commit with no follow-up. If this is squashed instead, MicroPerceptron/kore#1273's pin has to move to the squash commit before it merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TmEMGSFqb56Tcsvuk9PQPx

[Copilot]

🟡 Changes recommended

Named file grants can be published as directory preopens, violating the WASI interface contract.

1 open finding

• Reject file grants before publishing directory preopens · New

What changed in this PR

Adds opt-in named-grant preopens to kore-wasi, enabling guests such as CPython to find files outside the task root while preserving containment.

Changes:

• Exposes and caches named grants as preopens.
• Preserves descriptor origins and reports preopen refusals as traps.
• Fixes delayed filesystem results and adds regression tests.

File	Description
crates/​wasi/​src/​filesystem/​walk.rs	Documents containment for named-grant preopens.
crates/​wasi/​src/​filesystem/​mod.rs	Tracks descriptor origins and publishes cached preopens.
crates/​wasi/​src/​filesystem/​host.rs	Opens and caches grants; fixes and tests delayed results.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.