From e980b68990a4bc6a0e269f4406863f4e455309a8 Mon Sep 17 00:00:00 2001
From: Arshia Ghafoori <arshia001@live.com>
Date: Fri, 7 Aug 2026 12:36:33 +0000
Subject: [PATCH 1/2] fix(wasix): don't inherit a dependency's entrypoint over
 the root's own commands

`resolve_package` walked the whole dependency graph looking for an
entrypoint whenever the root package didn't declare one, so a dependency
that declares an entrypoint would win over the root package's own
commands. `wasmer/anybuild` depends on `wasmer/bash`, which declares
`entrypoint = "bash"`, so it ran bash instead of anybuild.

Only let a command-less root inherit an entrypoint from a dependency.
This also makes the existing "root package's only command" fallback
reachable, which it previously wasn't whenever any dependency declared
an entrypoint.

Fixes #6870

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 lib/wasix/src/runtime/resolver/resolve.rs | 69 +++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/lib/wasix/src/runtime/resolver/resolve.rs b/lib/wasix/src/runtime/resolver/resolve.rs
index 67ad8a21d1c1..52b2e37f6ec1 100644
--- a/lib/wasix/src/runtime/resolver/resolve.rs
+++ b/lib/wasix/src/runtime/resolver/resolve.rs
@@ -797,6 +797,12 @@ fn resolve_package(dependency_graph: &DependencyGraph) -> Result<ResolvedPackage
 
     let mut entrypoint = dependency_graph.root_info().entrypoint.clone();
 
+    // A package that ships commands of its own must resolve to one of them, so
+    // only a command-less root may inherit an entrypoint from a dependency.
+    // Otherwise a dependency like wasmer/bash, which declares an entrypoint,
+    // would hijack the root package's own commands.
+    let may_inherit_entrypoint = dependency_graph.root_info().commands.is_empty();
+
     for index in petgraph::algo::toposort(dependency_graph.graph(), None).expect("acyclic") {
         let node = &dependency_graph[index];
         let id = &node.id;
@@ -804,6 +810,7 @@ fn resolve_package(dependency_graph: &DependencyGraph) -> Result<ResolvedPackage
 
         // update the entrypoint, if necessary
         if entrypoint.is_none()
+            && may_inherit_entrypoint
             && let Some(entry) = &pkg.entrypoint
         {
             tracing::trace!(
@@ -2091,6 +2098,68 @@ mod tests {
         );
     }
 
+    /// A root with commands of its own and no explicit entrypoint must not fall
+    /// back to a dependency's entrypoint.
+    ///
+    /// See https://github.com/wasmerio/wasmer/issues/6870.
+    #[tokio::test]
+    async fn entrypoint_is_not_inherited_when_root_has_its_own_commands() {
+        let root_id = PackageId::new_named("anybuild", "1.0.0".parse().unwrap());
+        let mut builder = RegistryBuilder::new();
+        builder
+            .register("anybuild", "1.0.0")
+            .with_command("anybuild")
+            .with_command("shipit")
+            .with_dependency("bash", "=1.0.0");
+        builder
+            .register("bash", "1.0.0")
+            .with_command("bash")
+            .with_entrypoint("bash");
+        let registry = builder.finish();
+        let root = builder.get(&root_id);
+
+        let resolution = resolve(&root.package_id(), &root.pkg, &registry)
+            .await
+            .unwrap();
+
+        // Ambiguous between "anybuild" and "shipit", but never "bash".
+        assert_ne!(
+            resolution.package.entrypoint.as_deref(),
+            Some("bash"),
+            "the entrypoint must not come from a dependency when the root has \
+             commands of its own",
+        );
+    }
+
+    /// Same as above, but with a single root command, so the "root package's
+    /// only command" fallback has an unambiguous answer to give.
+    #[tokio::test]
+    async fn root_package_only_command_wins_over_dependency_entrypoint() {
+        let root_id = PackageId::new_named("anybuild", "1.0.0".parse().unwrap());
+        let mut builder = RegistryBuilder::new();
+        builder
+            .register("anybuild", "1.0.0")
+            .with_command("anybuild")
+            .with_dependency("bash", "=1.0.0");
+        builder
+            .register("bash", "1.0.0")
+            .with_command("bash")
+            .with_entrypoint("bash");
+        let registry = builder.finish();
+        let root = builder.get(&root_id);
+
+        let resolution = resolve(&root.package_id(), &root.pkg, &registry)
+            .await
+            .unwrap();
+
+        assert_eq!(
+            resolution.package.entrypoint.as_deref(),
+            Some("anybuild"),
+            "the root package's own only command should win over a dependency's \
+             entrypoint",
+        );
+    }
+
     #[tokio::test]
     async fn entrypoint_is_inherited() {
         let root_id = PackageId::new_named("root", "1.0.0".parse().unwrap());

From 381a8c7369fff62ad57ad225bac59cdc5f4d0ccc Mon Sep 17 00:00:00 2001
From: Arshia Ghafoori <arshia001@live.com>
Date: Fri, 7 Aug 2026 13:27:57 +0000
Subject: [PATCH 2/2] review: tighten the multi-command assertion and reword
 the gate comment

Assert the exact `None` the 2+ command case is supposed to produce, so
the test also fails if the resolver starts guessing between the root's
own commands, and stop implying a root with commands always resolves to
one of them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 lib/wasix/src/runtime/resolver/resolve.rs | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/lib/wasix/src/runtime/resolver/resolve.rs b/lib/wasix/src/runtime/resolver/resolve.rs
index 52b2e37f6ec1..3846939ba8e2 100644
--- a/lib/wasix/src/runtime/resolver/resolve.rs
+++ b/lib/wasix/src/runtime/resolver/resolve.rs
@@ -797,10 +797,11 @@ fn resolve_package(dependency_graph: &DependencyGraph) -> Result<ResolvedPackage
 
     let mut entrypoint = dependency_graph.root_info().entrypoint.clone();
 
-    // A package that ships commands of its own must resolve to one of them, so
-    // only a command-less root may inherit an entrypoint from a dependency.
+    // Only a command-less root may inherit an entrypoint from a dependency.
     // Otherwise a dependency like wasmer/bash, which declares an entrypoint,
-    // would hijack the root package's own commands.
+    // would hijack a root package that ships commands of its own. A root with
+    // commands falls through to the "only command" fallback below instead, and
+    // is left without an entrypoint if that can't pick one unambiguously.
     let may_inherit_entrypoint = dependency_graph.root_info().commands.is_empty();
 
     for index in petgraph::algo::toposort(dependency_graph.graph(), None).expect("acyclic") {
@@ -2122,13 +2123,10 @@ mod tests {
             .await
             .unwrap();
 
-        // Ambiguous between "anybuild" and "shipit", but never "bash".
-        assert_ne!(
-            resolution.package.entrypoint.as_deref(),
-            Some("bash"),
-            "the entrypoint must not come from a dependency when the root has \
-             commands of its own",
-        );
+        // "anybuild" and "shipit" are equally good candidates and neither is
+        // declared as the entrypoint, so the caller has to error out rather
+        // than guess -- and it certainly must not reach for "bash".
+        assert_eq!(resolution.package.entrypoint, None);
     }
 
     /// Same as above, but with a single root command, so the "root package's