feat: add support for readonly dir mounting

extism.go

@@ -12,6 +12,7 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/tetratelabs/wazero"
@@ -382,8 +383,12 @@ func NewPlugin(
 	fs := wazero.NewFSConfig()
 
 	for host, guest := range manifest.AllowedPaths {
-		// TODO: wazero supports read-only mounting, do we want to support that too?
-		fs = fs.WithDirMount(host, guest)
+		if strings.HasPrefix(host, "ro:") {
+			trimmed := strings.TrimPrefix(host, "ro:")
+			fs = fs.WithReadOnlyDirMount(trimmed, guest)
+		} else {
+			fs = fs.WithDirMount(host, guest)
+		}
 	}
 
 	moduleConfig := config.ModuleConfig

extism_test.go

@@ -614,6 +614,32 @@ func TestFS(t *testing.T) {
 	}
 }
 
+func TestReadOnlyMount(t *testing.T) {
+	manifest := manifest("read_write.wasm")
+	manifest.AllowedPaths = map[string]string{
+		"ro:testdata": "/mnt",
+	}
+
+	if plugin, ok := plugin(t, manifest); ok {
+		defer plugin.Close()
+		plugin.Config["path"] = "/mnt/test.txt"
+
+		exit, output, err := plugin.Call("try_read", []byte{})
+
+		if assertCall(t, err, exit) {
+			actual := string(output)
+			expected := "hello world!"
+
+			assert.Equal(t, expected, actual)
+		}
+
+		_, _, err = plugin.Call("try_write", []byte("hello hello!"))
+
+		assert.NotNil(t, err, "Write must fail")
+		assert.Contains(t, err.Error(), "Failed to write file")
+	}
+}
+
 func TestCountVowels(t *testing.T) {
 	manifest := manifest("count_vowels.wasm")