Module sandbox 

Extension trust & sandbox model (EPIC 12.3).

Every plugin subprocess (hooks + manifest tools) runs under a SandboxPolicy derived from the plugin’s declared [trust] section. The model is least-privilege by default and splits cleanly into two honest categories so we never claim enforcement we do not perform:

• Enforced, deterministically — environment isolation (the child gets a scrubbed env containing only a fixed allowlist, so host secrets in env do not leak), working-directory jail (cwd pinned to the plugin dir), and a per-call timeout (in super::executor).
• Declared (consent surface) — network / fs_write. These cannot be blocked portably without OS namespaces/seccomp, so they are declared capabilities surfaced to the user (and /v1/capabilities) for informed trust, not silent OS-level blocks.

Granting env_passthrough opts a plugin out of env scrubbing (it then sees the full host environment) — an explicit elevation a user can audit.

Structs

SandboxPolicy

The resolved, enforceable sandbox for a plugin subprocess. The derived Default is least privilege (all false): scrubbed env, nothing declared.

TrustSpec

Declarative [trust] section of a plugin manifest. Absent ⇒ least privilege.

Enums

Permission

A single capability a plugin may request in its [trust] section.

Constants

ENV_ALLOWLIST

Host environment variables a scrubbed child is still allowed to see. Chosen to let normal programs run (binary resolution, locale, temp dir) without exposing secrets that tend to live in the ambient environment.