chore: wasmvm dynamic modules & libc support

[NathanFlurry]

• feat: US-001 - CommandRegistry path-based resolution and dynamic registration
• chore: update progress for US-001
• feat: US-002 - On-demand command discovery in kernel
• chore: update progress for US-002
• feat: US-003 - Extract grep library with argv[0] dispatch and create binary crates
• chore: update progress for US-003
• feat: US-004 - Create shell (sh) standalone binary crate
• chore: update progress for US-004
• feat: US-005 - Extract and create text/data processing binary crates
• chore: update progress for US-005
• feat: US-006 - Extract and create file utility binary crates
• chore: update progress for US-006
• feat: US-007 - Extract and create compression binary crates
• chore: update progress for US-007
• feat: US-008 - Create uutils coreutils binary crates - batch 1
• chore: update progress for US-008
• feat: US-009 - Create uutils coreutils binary crates - batch 2
• chore: update progress for US-009
• feat: US-010 - Create builtins, shims, and _stubs multicall binary crates
• chore: update progress for US-010
• feat: US-011 - Build system - cargo-secureexec wrapper, Makefile, and symlinks
• chore: update progress for US-011
• feat: US-012 - ModuleCache with concurrent-compile deduplication
• chore: update progress for US-012
• feat: US-013 - Refactor WasmVmRuntimeDriver for commandDirs and filesystem scan
• chore: update progress for US-013
• feat: US-014 - Worker pre-compiled module transfer via workerData
• chore: update progress for US-014
• feat: US-015 - JS driver integration tests for dynamic module loading
• chore: update progress for US-015
• feat: US-016 - BrowserWasmVmRuntimeDriver with command manifest
• chore: update progress for US-016
• feat: US-017 - Browser caching - Cache API and preload
• chore: update progress for US-017
• feat: US-018 - Per-command permission tiers - type definitions and filesystem enforcement
• chore: update progress for US-018
• feat: US-019 - Per-command permission tiers - process enforcement and wildcard config
• chore: update progress for US-019
• feat: US-020 - Delete multicall crate and final cleanup
• chore: update progress for US-020
• feat: US-021 - C build system - wasi-sdk download and Makefile
• chore: update progress for US-021
• chore: update progress for US-021
• feat: US-022 - Tier 1 C test fixtures - basic I/O (hello, args, env, exitcode, cat)
• chore: update progress for US-022
• feat: US-023 - Tier 1 C test fixtures - data processing (wc, fread, fwrite, sort, sha256)
• chore: update progress for US-023
• feat: US-024 - C test harness - native vs WASM parity testing
• feat: US-025 - patch-wasi-libc.sh script and wasi-libc vendoring
• feat: US-026 - wasi-libc patches - pipe, dup, dup2
• feat: US-027 - wasi-libc patches - spawn, wait, kill, getpid
• feat: US-028 - wasi-libc patches - user identity and isatty
• feat: US-029 - Tier 2 C test fixtures - custom imports (isatty, getpid, userinfo, pipe, dup, sleep)
• feat: US-030 - Tier 3 C test fixtures - custom imports (spawn, pipeline, kill)
• feat: US-031 - Tier 4 C test fixtures - custom imports (c-ls, c-tree, c-find, c-cp)
• feat: US-032 - Tier 5 C test fixture - cJSON (json_parse)
• feat: US-033 - Tier 5 C test fixture - SQLite (sqlite3_mem)
• feat: US-034 - CI integration for C toolchain
• feat: US-035 - Comprehensive node binary integration test suite
• feat: US-036 - Fix Ctrl+C at shell prompt not resetting the input line
• feat: US-037 - Fix fdPwrite permission bypass and gate proc_kill, fd_pipe, fd_dup by tier
• feat: US-038 - Implement proc_getppid and fd_dup2 host imports in kernel-worker and driver
• feat: US-039 - Gate isolated-tier VFS operations and add integration tests
• feat: US-040 - Move FDTable out of test path and fix module compile error handling
• feat: US-041 - Fix isPathInCwd symlink escape and validate unknown tier strings
• feat: US-042 - Fix vfsReadFile SAB overflow guard and lstat fallthrough
• feat: US-043 - Fix posix_spawn file_actions and waitpid return value
• feat: US-044 - C parity test improvements - stderr, sleep_test tier, getpid assertions
• feat: US-045 - C syscall coverage integration test
• feat: US-046 - Fix spawn RPC data race in driver.ts
• feat: US-047 - Fix poll_oneoff clock subscription sleep behavior
• feat: US-048 - Update CLAUDE.md with WasmVM syscall coverage policy

[pkg-pr-new]

Open in StackBlitz

secure-exec

pnpm add https://pkg.pr.new/rivet-dev/secure-exec@16

@secure-exec/browser

pnpm add https://pkg.pr.new/rivet-dev/secure-exec/@secure-exec/browser@16

@secure-exec/core

pnpm add https://pkg.pr.new/rivet-dev/secure-exec/@secure-exec/core@16

@secure-exec/node

pnpm add https://pkg.pr.new/rivet-dev/secure-exec/@secure-exec/node@16

@secure-exec/python

pnpm add https://pkg.pr.new/rivet-dev/secure-exec/@secure-exec/python@16

@secure-exec/typescript

pnpm add https://pkg.pr.new/rivet-dev/secure-exec/@secure-exec/typescript@16

@secure-exec/v8

pnpm add https://pkg.pr.new/rivet-dev/secure-exec/@secure-exec/v8@16

commit: b564e7a