Add RustPython generated WASM WS module

.dockerignore

@@ -8,6 +8,7 @@
 **/target/
 **/.DS_Store
 services/ws-wasm-agent/pkg/
+services/ws-modules/pywasm1/pkg/
 services/ws-server/static/models/
 **/.zig-cache/
 **/zig-out/

.editorconfig

@@ -79,3 +79,12 @@ max_line_length = unset
 # The generator is the source of truth; we don't edit its output by hand.
 [generated/zig-rest/**]
 max_line_length = unset
+
+# config/upstream-cache/data.toml stores per-asset metadata including the canonical
+# download URL (`https://github.com/edge-toolkit/core/releases/download/<tag>/<long-asset-name>`)
+# and the upstream project URL. Both routinely exceed 120 chars and can't be
+# meaningfully line-wrapped in TOML (a string value can't span lines without
+# multi-line-string syntax that would change the parsed value). Loosen to 200.
+[config/upstream-cache/data.toml]
+max_line_length = 200
+

.github/actions/install-mise-tools/action.yaml

@@ -0,0 +1,90 @@
+---
+name: Install mise tools
+description: >-
+  Install mise (via install-mise), then trust the .mise config, and install
+  the toolchain named by the workflow's MISE_ENV (with one retry on transient
+  HTTP flakes). Shared by check.yaml and test.yaml; the caller must run
+  `actions/checkout` before this so .mise/config*.toml exists for `mise trust`.
+
+inputs:
+  github-token:
+    description: >-
+      GitHub token forwarded as `$GITHUB_TOKEN` to the mise/preinstall steps.
+      Raises the api.github.com rate-limit ceiling on aqua's attestation
+      lookups + tool-asset fetches.
+    required: true
+  extra-tools:
+    description: >-
+      Comma-separated tools to co-install via taiki-e/install-action in the
+      same step as mise. Forwarded to install-mise's `extra-tools` input.
+      NOT used for `aube` -- install-action's manifest expects an `aubr`
+      binary that recent aube releases don't ship, so the install resolves
+      to a cargo source-build that flakes on crates.io SSL. The aube path
+      below uses the original `mise run setup-aube` (npm-backed, allowed
+      to fail) which has been the reliable install method.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install mise binary
+      uses: ./.github/actions/install-mise
+      with:
+        extra-tools: ${{ inputs.extra-tools }}
+
+    - name: Show MISE_ENV
+      shell: bash
+      run: echo "MISE_ENV=$MISE_ENV"
+
+    # Optional npm backend, installed before the main `mise install`.
+    # Only useful when js env is loaded (it's the backend for npm:* tools, all
+    # of which live in config.js.toml); skip otherwise to avoid the install
+    # cost on workflows that don't need any npm: install.
+    # See [tasks.setup-aube] in .mise/config.toml for the full rationale.
+    - name: Install aube (optional npm backend, allowed to fail)
+      if: contains(env.MISE_ENV, 'js')
+      continue-on-error: true
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: mise run setup-aube
+
+    - name: Install mise tools
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: |
+        mise run preinstall
+        # Retry once on transient api.github.com 5xx during the aqua attestation
+        # / asset fetches: the first attempt re-uses what's already on disk, so
+        # the retry usually clears single-tool HTTP flakes in seconds.
+        mise install || { echo "::warning::mise install failed, retrying once"; mise install; }
+
+    # Delete the self-recursive `mise.cmd` shim mise generates on Windows.
+    # Captured contents:
+    #     @echo off
+    #     setlocal
+    #     mise x -- mise %*
+    # `mise x -- mise %*` invokes `mise` via cmd's PATH search; with the shims
+    # dir prepended (by install-mise), that lookup resolves back to mise.cmd
+    # itself, which does the same lookup, recursing inside cmd.exe and blowing
+    # the setlocal stack with `Maximum setlocal recursion level reached. /
+    # The syntax of the command is incorrect.` Every OTHER .cmd shim whose
+    # body invokes `mise` (cargo.cmd, rclone.cmd, ...) trips the same loop:
+    # cargo.cmd → mise → mise.cmd → mise → mise.cmd → ... Removing mise.cmd
+    # + the extensionless `mise` companion lets cmd's PATH search fall
+    # through to the real `mise.exe` at `~/.cargo/bin/mise.exe` (staged by
+    # taiki-e/install-action) which spawns each tool directly via mise's
+    # own tool registry. Must run AFTER `mise install` -- that's the step
+    # that creates the shims. Observed in
+    #   https://github.com/edge-toolkit/core/actions/runs/27758913526/job/82127840771
+    # on 524633c8d80e8867d (the prefetch:rust diagnostic dump printed the
+    # cargo.cmd / mise.cmd shim contents verbatim).
+    - name: Remove self-recursive mise.cmd shim on Windows
+      if: runner.os == 'Windows'
+      shell: bash
+      run: |
+        shims="$LOCALAPPDATA/mise/shims"
+        rm -fv "$shims/mise.cmd" "$shims/mise"
+        ls "$shims" | grep -i '^mise' || true

.github/actions/install-mise/action.yaml

@@ -0,0 +1,49 @@
+---
+name: Install mise
+description: >-
+  Install the mise binary (and cargo-binstall as its source-build backend)
+  via taiki-e/install-action, and on Windows add mise's file-shim dir to
+  PATH so subsequent steps can resolve mise-managed tools by bare name.
+  Shared by every workflow that runs `mise` on the runner. For the heavier
+  "also install everything named by MISE_ENV" flow, use install-mise-tools.
+
+inputs:
+  extra-tools:
+    description: >-
+      Comma-separated tools to co-install via taiki-e/install-action in the
+      same step as mise (cheaper than a second install-action call). Use the
+      same syntax as install-action's `tool:` input.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install mise (and any extra tools)
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-binstall,mise@2026.6.5${{ inputs.extra-tools && ',' || '' }}${{ inputs.extra-tools }}
+
+    # taiki-e/install-action's mise manifest stages only `mise.exe`; mise's
+    # per-tool `.cmd` "file" shims under `%LOCALAPPDATA%\mise\shims` aren't
+    # on PATH by default, so tool lookups inside `mise run` fail with
+    # `'dart' / 'mvn' / 'recur' / 'wasm-pack' / 'zig' is not recognized…`.
+    # We append the shims dir for subsequent steps. The companion
+    # `mise-shim.exe` (single-binary shim) ALSO ships in the Windows zip,
+    # but staging it triggers a CreateProcess `ERROR_FILENAME_EXCED_RANGE`
+    # (os error 206) when mise-shim re-execs mise.exe with the runner's
+    # already-long PATH inherited -- the file-shim fallback doesn't have
+    # this problem (each .cmd shim invokes `mise exec --` plainly via cmd).
+    - name: Add mise shims dir to PATH on Windows
+      if: runner.os == 'Windows'
+      shell: bash
+      run: echo "$LOCALAPPDATA\mise\shims" >> "$GITHUB_PATH"
+
+    # Marks the checked-out .mise/config*.toml as trusted so subsequent mise
+    # invocations don't error out with "Config files are not trusted". The
+    # caller must run actions/checkout BEFORE this composite action so the
+    # config files are on disk.
+    - name: Trust mise config
+      shell: bash
+      run: mise trust
+

.github/workflows/check.yaml

@@ -16,10 +16,17 @@ concurrency:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+env:
+  MISE_ENV: dart,dotnet,java,js,python,rust,zig
 
 jobs:
   check:
+    # TEMPORARY: `if: false` parks the job (shows as skipped, no runner time)
+    # so all PR-runner capacity goes to the Windows cygheap-fork investigation
+    # in test.yaml. Drop this line once the prefetch-hang root cause lands.
+    if: false
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
@@ -29,35 +36,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Install mise
-        uses: taiki-e/install-action@v2
+      - name: Install mise + tools
+        uses: ./.github/actions/install-mise-tools
         with:
-          tool: cargo-binstall,mise@2026.6.5
-
-      - name: Select all language envs
-        run: echo "MISE_ENV=$(mise run print-all-langs)" >> "$GITHUB_ENV"
-
-      # Optional npm backend, installed before the main `mise install`.
-      # See [tasks.setup-aube] in .mise/config.toml for the full rationale.
-      - name: Install aube (optional npm backend, allowed to fail)
-        continue-on-error: true
-        run: |
-          mise settings experimental=true
-          mise run setup-aube
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          MISE_HTTP_TIMEOUT: "120"
-
-      - name: Install mise tools
-        run: |
-          mise run preinstall
-          mise install
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          # GitHub release downloads occasionally take longer than mise's
-          # default 30s HTTP timeout; bump it so transient network slowness
-          # doesn't fail the whole `mise install` step.
-          MISE_HTTP_TIMEOUT: "120"
+          github-token: ${{ github.token }}
 
       - name: Prefetch Rust dependencies
         run: mise run prefetch:rust

.github/workflows/dependencies.yaml

@@ -10,6 +10,7 @@ name: dependencies
       - config/deny.toml
       - config/osv-scanner.toml
       - .github/workflows/dependencies.yaml
+      - .github/actions/install-mise/**
   workflow_dispatch:
 
 permissions:
@@ -21,10 +22,23 @@ concurrency:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+env:
+  MISE_ENV: dart,dotnet,java,js,python,rust,zig
 
 jobs:
   dependencies:
+    # TEMPORARY: `if: false` parks the job (shows as skipped, no runner time)
+    # so all PR-runner capacity goes to the Windows cygheap-fork investigation
+    # in test.yaml. Drop this line once the prefetch-hang root cause lands.
+    if: false
+    # `ubuntu-latest`, not `ubuntu-slim`: although every step in this workflow
+    # is metadata/network-bound (no Rust compile), `taiki-e/install-action`
+    # itself assumes a standard runner-image FHS (e.g. ~/.cargo/bin) and
+    # fails on slim's bare container with `I/O Error: No such file or
+    # directory` while staging cargo-unmaintained. Slim only fits workflows
+    # whose first step doesn't need that scaffolding.
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
@@ -34,13 +48,13 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Install tools
-        uses: taiki-e/install-action@v2
+      - name: Install mise + dependency-scan tools
+        uses: ./.github/actions/install-mise
         with:
-          tool: cargo-deny,cargo-unmaintained,coreutils,mise@2026.6.5,osv-scanner,ripgrep
+          extra-tools: cargo-deny,cargo-unmaintained,coreutils,osv-scanner,ripgrep
 
-      - name: Trust mise config
-        run: mise trust
+      - name: Show MISE_ENV
+        run: echo "MISE_ENV=$MISE_ENV"
 
       - name: Generate config/osv-scanner.toml from config/deny.toml
         run: mise run gen:osv-scanner