feat(ast): minimal WASI env for native plugins

[the-wondersmith]

PR builds from #44, correcting a too-narrow contract for native plugin imports.

Under the initial ABI defined in the base machinery PR, plugins written in languages like Go would be a major pain to write or build. Using Node's built-in WASI support ameliorates that issue while still maintaining the existing zero-dependency standard.

[the-wondersmith]

@Houseofmvps AI Context update failed, but I don't think it's anything to do with the branch/PR specifically

[the-wondersmith]

Just to keep track of the remaining follow-ups:

Each branch builds directly on the previous -

1. feat/wasi-plugin-host (this PR)

2. feat/native-ast-generalization (+4 commits) — makes dispatch language-driven rather than hardcoded. Plugins self-describe via a describe() export (languageId + file extensions); a registry routes files by extension; the built-in detectors fold into a single generic pass with additive-vs-authoritative merge and --native-ast=all|none|<ids>. Net result: any user-declared language works, not just the existing built-ins.

3. wip/initial-wasm-ast-plugins (+4 commits) — actual working plugins for Rust, Python, and Go (under plugins/ast/), plus a CI workflow that builds them, shrinks them with wasm-opt, smoke-tests each against the host ABI, and publishes the .wasm + checksums as release assets on plugins-v* tags. The npm package neither builds nor ships them.

Intended merge order: this PR → feat/native-ast-generalization → wip/initial-wasm-ast-plugins.

And again, the last one (wip/initial-wasm-ast-plugins) completes the "picture" of the whole chain of PRs/branches, but details will need to be worked out about where/how plugins live, are built, and delivered and so will require the most scrutiny/conversation.

[Houseofmvps]

Merged and shipped in codesight@1.17.0 on npm. 🚀

Genuinely top-tier contribution, thank you. A few things that stood out on review:

• Right diagnosis, minimal fix. Widening the ABI from "no imports" to "minimal WASI" is exactly the smallest change that unblocks full-runtime languages (Go //go:wasmexport reactors) without touching the per-kind contract. No over-reach.
• Security-conscious by construction. new WASI({ version: "preview1" }) with no preopens means no filesystem, preview1 has no socket-create so no outbound network, and args/env stay empty. The sandbox stays as tight as the empty-imports version for everything that matters — verified that here before merging.
• Constraint-aware. Reaching for the built-in node:wasi to keep the zero-dependency guarantee intact, lazy-loading it so it's never pulled in when native AST is off, and scoping the emitWarning filter to only the WASI ExperimentalWarning (every other warning passes through) — that's the kind of detail most PRs miss.
• Single instantiation path that both no-import (Rust/AS) and reactor (Go) modules flow through, with _initialize handled correctly. Clean.
• The roadmap comment laying out the stacked chain, intended merge order, and an honest "the last one needs the most scrutiny" call-out is excellent maintainer communication.

Looking forward to feat/native-ast-generalization next — open it whenever you're ready and I'll review on the same terms.

[the-wondersmith]

@Houseofmvps

Merged and shipped in codesight@1.17.0 on npm. 🚀

Genuinely top-tier contribution, { ... }

{ ... } Looking forward to feat/native-ast-generalization next — open it whenever you're ready and I'll review on the same terms.

Opened 🎉