Module fs_policy 

Layer 1 phase C1, part 2/2: custom wasi:filesystem host impl that gates open_at (and path-taking siblings) on the FsMatcher.

The host-facing surface:

• PolicyFilesystem is a HasData marker used in place of the default wasmtime_wasi::WasiFilesystem when adding the wasi:filesystem/types and wasi:filesystem/preopens interfaces to the linker.
• PolicyFilesystemCtxView<'a> bundles the default WasiFilesystemCtx, the ResourceTable, the compiled FsMatcher, and a running map of fd → absolute host path. It implements preopens::Host, types::Host, HostDescriptor, and HostDirectoryEntryStream, mostly by delegating to a temp WasiFilesystemCtxView constructed from the same fields.
• Path-taking methods (open_at, stat_at, readlink_at, create_directory_at, remove_directory_at, unlink_file_at, rename_at, link_at, symlink_at, metadata_hash_at, set_times_at) resolve the parent fd’s host path, join the guest-supplied relative path, canonicalise, and consult the matcher. Deny → ErrorCode::NotPermitted; allow → delegate and (for open_at) record the resulting fd’s host path.

fd→path tracking:

• Preopens are recorded at construction (we know their host paths from derive_preopens before calling WasiCtxBuilder::preopened_dir). Their Resource reps aren’t known at that point; we match reps to host paths lazily the first time get_directories() is called.
• New descriptors produced by open_at are recorded with the canonicalised child path.

Structs

FdPathMap

Tracks the host path associated with each open filesystem descriptor, plus the configured preopen list (guest path → host path) used to fill in the map lazily the first time the guest calls get-directories.

PolicyFilesystem

HasData marker for our policy-aware filesystem view.

PolicyFilesystemCtxView

Per-call view bundling all state the policy wrapper needs.

Preopen

A (guest path → host path) pair handed to wasmtime-wasi’s preopened_dir.

ResolvedMount

A resolved mount: concrete guest path + (for binds) an expanded host dir.

Functions

create_mount_dirs

Create missing bind host directories so they can be preopened. root mounts point at the platform root and create nothing.

derive_preopens

Build the preopen list from resolved mounts.

resolve_mounts

Resolve a component’s declared mounts into concrete topology.