Expand description
Declared capability model for addons (P1 — platform keystone).
An addon’s optional [capabilities] block tells lean-ctx exactly what the
addon needs: outbound network, filesystem writes, and which host environment
variables it may receive. The declaration is secure-by-default — an
addon that declares a [capabilities] block but omits a field gets the most
restrictive value (no network, read-only filesystem, scrubbed environment).
A declared block drives two real, enforced controls at the single gateway
spawn point (crate::core::mcp_catalog::client):
- the per-addon OS sandbox profile (
super::sandbox) — network egress and filesystem writes are wrapped viasandbox-exec(macOS) /bwrap(Linux), - the environment allowlist — host secrets never reach the child unless the addon explicitly lists the variable name,
and is surfaced to the user for explicit consent at install time
(crate::cli::addon_cmd). Child processes inherit the OS sandbox, so a
subprocess an addon spawns is bound by the same network/filesystem limits;
the declared exec capability is therefore disclosed + audited rather than
OS-enforced (see super::sandbox).
Unlike the legacy blanket addons.sandbox mode, this is per addon and
bound to the manifest, so a marketplace addon is granted exactly what it
asked for — no more. Addons without a [capabilities] block keep the
legacy behaviour (governed by addons.sandbox) so existing installs do not
change.
Re-exports§
pub use crate::core::plugins::sandbox::ENV_ALLOWLIST as BASE_ENV_ALLOWLIST;
Structs§
- Addon
Capabilities [capabilities]— what an addon is permitted to do. A present-but-empty block resolves to the strictest profile (see module docs). Secure-by-default.
Enums§
- Exec
Access - Subprocess-execution capability a stdio addon declares.
- Exec
Mode - The two bare exec modes (the non-allowlist forms of
ExecAccess). - Filesystem
Access - Filesystem capability a stdio addon declares.
- Network
Access - Outbound-network capability a stdio addon declares.