recover(launcher): 14a.5b libgossamer bridges (re-targets PR #29 at main)

[hyperpolymath]

Why this PR exists

PR #29 ("feat(cli/launcher): libgossamer bridges + eager-grant caps (14a.5b)") shows as MERGED on GitHub but its commits never landed on main. The PR was stacked on the 14a.5a feature branch (`feat/cli-launcher-mvp-14a5a`); when the GitHub UI's "Merge pull request" button was clicked, the merge commit landed on that feature branch — which was then deleted, orphaning the work.

Same trap affected PRs #30, #33, #34. Recovery sequence is four separate PRs each based on main; this is PR 1 of 4.

What this PR lands

File	Change
`cli/launcher/src/bridges.zig` (new, ~470 LOC)	29 `env::gossamer_*` host imports + `env::cap_token` + the marshalling helpers + the Imports table + `grantCaps`
`cli/launcher/src/main.zig`	Makes `HostEnv` / `ImportSpec` / `guestSlice` / `c` `pub`; adds `cap_tokens: [6]u64` field; registers `bridges.Imports` + calls `grantCaps`
`cli/launcher/build.zig`	Links libgossamer dynamically (`addLibraryPath` + `linkSystemLibrary("gossamer")`)
`cli/launcher/src/hello-bridges.wat` (new)	Smoke wat — calls `gossamer_version_to` + `print_string`
`cli/launcher/README.adoc`	Documents the 29 bridges + new smoke test

Bridge coverage

Family	Symbols
String-out	`gossamer_version_to`, `gossamer_build_info_to`, `gossamer_last_error_to`
Webview lifecycle	`gossamer_create_ex`, `gossamer_navigate`, `gossamer_load_html`, `gossamer_channel_open`, `gossamer_set_csp`, `gossamer_set_title`, `gossamer_registry_add`, `gossamer_run`
Groove	`gossamer_groove_discover`, `gossamer_groove_status`
Watcher	`gossamer_watcher_start`, `gossamer_watcher_stop`
Shell	`gossamer_shell_spawn`, `gossamer_shell_kill`
Filesystem	`gossamer_fs_read_text`, `gossamer_fs_write_text`, `gossamer_fs_exists`, `gossamer_fs_mkdir_p`, `gossamer_fs_copy_file`
Conf	`gossamer_conf_load` + `get_string` / `get_int` / `get_bool` / `has` / `free`
Capability tokens	`cap_token`

ABI conventions

• Inputs: strings cross as `(ptr: i32, len: i32)` pairs. Bridge dupes into host-side null-terminated buffer, calls libgossamer, frees.
• Outputs: strings use WASI-style write-into-caller-buffer (`buf_ptr, buf_len`) → bytes written or -1.
• Opaque handles (watcher, shell child, conf): cross as `i64` (bit-cast u64 = host pointer).
• Capability tokens: eager-granted at launcher startup for ResourceKind 0/1/2 (FileSystem/Network/Shell). Guest reads via `env::cap_token(kind)` rather than calling `gossamer_cap_grant` itself.

NOT in this PR (intentionally — will land in PRs 2/3/4 of 4)

• Build integration / cli.wasm compile (PR 2)
• Main.eph subcommand dispatcher (PR 3)
• Ephapax String FFI bridges + argv[0]-name dispatch (PR 4)

Verification

• `git rebase origin/main` — clean, only the 14a.5b delta commit applied.
• `zig ast-check` on `main.zig`, `bridges.zig`, `build.zig` — clean.
• Identical content to original PR feat(cli/launcher): libgossamer bridges + eager-grant caps (14a.5b) #29 except for the rebase target.
• Reviewer: `zig build` succeeds with libwasmtime + libgossamer installed. (Local WSL env doesn't have GTK3 dev headers.)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 31 issues detected

Severity	Count
🔴 Critical	11
🟠 High	4
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/upload-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/download-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/IPCDispatch.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/ResourceCleanup.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/GrooveTermination.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/HandleLinearity.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/gossamer/gossamer/src/interface/abi/WindowStateMachine.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence