Run plugins in a QuickJS sandbox in the browser

Adds packages/plugin-sandbox: QuickJS-ng compiled to wasm, running in a
dedicated worker, with a runtime shell inside it that loads a plugin bundle
and answers the same InternalEventPayload events the Node runtime answers.
Plugins are unmodified.

Wires the browser host's template function, authentication, cURL import and
template render commands to it, and relaxes TemplateCallback's Send bound on
wasm32 so the engine's renderer can call back out to a plugin.

Cargo.lock

@@ -11775,6 +11775,7 @@ dependencies = [
  "console_error_panic_hook",
  "js-sys",
  "log 0.4.29",
+ "md5 0.7.0",
  "serde",
  "serde-wasm-bindgen",
  "serde_json",

crates/yaak-templates/src/renderer.rs

@@ -8,12 +8,29 @@ use std::future::Future;
 
 const MAX_DEPTH: usize = 50;
 
+/// `Send`, except where nothing can be.
+///
+/// Rendering a template function is a host call, and on a host with one thread
+/// it is a call into JavaScript: the future holds a `JsFuture` and the callback
+/// holds the `Rc` connection pool, neither of which is `Send` nor can be made
+/// so. Every other host spawns rendering onto a thread pool and needs the bound.
+/// So the bound belongs to the targets that can keep it, rather than to the
+/// trait every host must implement.
+#[cfg(not(target_arch = "wasm32"))]
+pub trait MaybeSend: Send {}
+#[cfg(not(target_arch = "wasm32"))]
+impl<T: Send> MaybeSend for T {}
+#[cfg(target_arch = "wasm32")]
+pub trait MaybeSend {}
+#[cfg(target_arch = "wasm32")]
+impl<T> MaybeSend for T {}
+
 pub trait TemplateCallback {
     fn run(
         &self,
         fn_name: &str,
         args: HashMap<String, serde_json::Value>,
-    ) -> impl Future<Output = Result<String>> + Send;
+    ) -> impl Future<Output = Result<String>> + MaybeSend;
 
     fn transform_arg(&self, fn_name: &str, arg_name: &str, arg_value: &str) -> Result<String>;
 }

crates/yaak-wasm/Cargo.toml

@@ -25,6 +25,7 @@ crate-type = ["cdylib", "rlib"]
 log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+md5 = "0.7"
 yaak-lifecycle = { workspace = true }
 yaak-models = { workspace = true }
 # No default features: the template exports belong to @yaakapp-internal/templates, not this module

crates/yaak-wasm/index.ts

@@ -3,4 +3,12 @@
 // This is loaded by the SharedWorker in packages/platform/src/web/worker.ts and
 // nowhere else: it owns a SQLite database, and there must be exactly one of it
 // per origin.
-export { blob_delete, blob_get, blob_put, boot, prepare_http_send, rpc } from "./pkg";
+export {
+  blob_delete,
+  blob_get,
+  blob_put,
+  boot,
+  prepare_http_send,
+  render_template,
+  rpc,
+} from "./pkg";

crates/yaak-wasm/pkg/yaak_wasm.d.ts

@@ -31,10 +31,25 @@ export function boot(): Promise<void>;
  * settings, the cookie jar. Nothing here touches a socket. What comes back is what the tab
  * posts to the Yaak server.
  *
- * Refuses, with a message the user can act on, when the request needs something this host
- * doesn't have: an authentication plugin, or a template function.
+ * `plugins` is the template function bridge — a JavaScript function taking a name and its
+ * JSON arguments and resolving to the rendered string. Passing nothing is allowed and makes
+ * every template function a refusal naming it.
+ *
+ * Authentication is *not* applied here even though it is part of preparing a send. It is
+ * applied to the rendered request by the caller, because the plugin that applies it wants to
+ * see the request as it will be sent, and the caller is the side that knows that.
  */
-export function prepare_http_send(payload: any): Promise<any>;
+export function prepare_http_send(payload: any, plugins: any): Promise<any>;
+
+/**
+ * Render one template string against an environment chain.
+ *
+ * What `cmd_render_template` does on the desktop, for the same callers: the value previews
+ * under an editor, and anywhere the app shows what a template will become. `ignore_error`
+ * picks the same behaviour it picks there — a preview shows an empty string where a send
+ * would refuse, because a half-typed template is not yet a mistake.
+ */
+export function render_template(payload: any, plugins: any): Promise<any>;
 
 /**
  * Run one command as `label` (the calling tab's identity, which stands in for

crates/yaak-wasm/pkg/yaak_wasm_bg.js

@@ -66,15 +66,37 @@ export function boot() {
  * Resolve and render a request for sending, exactly as the desktop does before it puts the
  * request on the network: the environment chain, inherited headers and auth, request
  * settings, the cookie jar. Nothing here touches a socket. What comes back is what the tab
- * posts to the Yaak server.
+ * posts to the send proxy.
  *
- * Refuses, with a message the user can act on, when the request needs something this host
- * doesn't have: an authentication plugin, or a template function.
+ * `plugins` is the template function bridge — a JavaScript function taking a name and its
+ * JSON arguments and resolving to the rendered string. Passing nothing is allowed and makes
+ * every template function a refusal naming it.
+ *
+ * Authentication is *not* applied here even though it is part of preparing a send. It is
+ * applied to the rendered request by the caller, because the plugin that applies it wants to
+ * see the request as it will be sent, and the caller is the side that knows that.
  * @param {any} payload
+ * @param {any} plugins
  * @returns {Promise<any>}
  */
-export function prepare_http_send(payload) {
-    const ret = wasm.prepare_http_send(payload);
+export function prepare_http_send(payload, plugins) {
+    const ret = wasm.prepare_http_send(payload, plugins);
+    return ret;
+}
+
+/**
+ * Render one template string against an environment chain.
+ *
+ * What `cmd_render_template` does on the desktop, for the same callers: the value previews
+ * under an editor, and anywhere the app shows what a template will become. `ignore_error`
+ * picks the same behaviour it picks there — a preview shows an empty string where a send
+ * would refuse, because a half-typed template is not yet a mistake.
+ * @param {any} payload
+ * @param {any} plugins
+ * @returns {Promise<any>}
+ */
+export function render_template(payload, plugins) {
+    const ret = wasm.render_template(payload, plugins);
     return ret;
 }
 
@@ -225,6 +247,10 @@ export function __wbg_call_dfde26266607c996() { return handleError(function (arg
     const ret = arg0.call(arg1, arg2);
     return ret;
 }, arguments); }
+export function __wbg_call_faa0a261f288f846() { return handleError(function (arg0, arg1, arg2, arg3) {
+    const ret = arg0.call(arg1, arg2, arg3);
+    return ret;
+}, arguments); }
 export function __wbg_clear_bb1b3ff877b62598() { return handleError(function (arg0) {
     const ret = arg0.clear();
     return ret;
@@ -669,6 +695,10 @@ export function __wbg_then_837494e384b37459(arg0, arg1) {
     const ret = arg0.then(arg1);
     return ret;
 }
+export function __wbg_then_bd927500e8905df2(arg0, arg1, arg2) {
+    const ret = arg0.then(arg1, arg2);
+    return ret;
+}
 export function __wbg_toString_1dda136fd8f30a5f(arg0) {
     const ret = arg0.toString();
     return ret;
@@ -697,22 +727,22 @@ export function __wbg_warn_b6f36cac66fc96a4(arg0, arg1) {
     console.warn(arg0, arg1);
 }
 export function __wbindgen_cast_0000000000000001(arg0, arg1) {
-    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 1117, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 1140, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
     const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha1c2fa93df0107f3);
     return ret;
 }
 export function __wbindgen_cast_0000000000000002(arg0, arg1) {
-    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("Event")], shim_idx: 212, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("Event")], shim_idx: 229, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
     const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha7903b6e296dd8f4);
     return ret;
 }
 export function __wbindgen_cast_0000000000000003(arg0, arg1) {
-    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("IDBVersionChangeEvent")], shim_idx: 83, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-    const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h4381d8e749fe46cf);
+    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("IDBVersionChangeEvent")], shim_idx: 74, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+    const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h20ab1db2d80221ce);
     return ret;
 }
 export function __wbindgen_cast_0000000000000004(arg0, arg1) {
-    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 210, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 227, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
     const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha1b480b83daa641f);
     return ret;
 }
@@ -765,8 +795,8 @@ function wasm_bindgen__convert__closures_____invoke__ha1c2fa93df0107f3(arg0, arg
     }
 }
 
-function wasm_bindgen__convert__closures_____invoke__h4381d8e749fe46cf(arg0, arg1, arg2) {
-    const ret = wasm.wasm_bindgen__convert__closures_____invoke__h4381d8e749fe46cf(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__h20ab1db2d80221ce(arg0, arg1, arg2) {
+    const ret = wasm.wasm_bindgen__convert__closures_____invoke__h20ab1db2d80221ce(arg0, arg1, arg2);
     if (ret[1]) {
         throw takeFromExternrefTable0(ret[0]);
     }

crates/yaak-wasm/pkg/yaak_wasm_bg.wasm.d.ts

@@ -5,7 +5,8 @@ export const blob_delete: (a: number, b: number) => [number, number];
 export const blob_get: (a: number, b: number) => [number, number, number, number];
 export const blob_put: (a: number, b: number, c: number, d: number) => [number, number];
 export const boot: () => any;
-export const prepare_http_send: (a: any) => any;
+export const prepare_http_send: (a: any, b: any) => any;
+export const render_template: (a: any, b: any) => any;
 export const rpc: (a: number, b: number, c: any, d: number, e: number) => [number, number, number];
 export const rust_sqlite_wasm_abort: () => void;
 export const rust_sqlite_wasm_assert_fail: (a: number, b: number, c: number, d: number) => void;
@@ -18,7 +19,7 @@ export const rust_sqlite_wasm_realloc: (a: number, b: number) => number;
 export const sqlite3_os_end: () => number;
 export const sqlite3_os_init: () => number;
 export const wasm_bindgen__convert__closures_____invoke__ha1c2fa93df0107f3: (a: number, b: number, c: any) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__h4381d8e749fe46cf: (a: number, b: number, c: any) => [number, number];
+export const wasm_bindgen__convert__closures_____invoke__h20ab1db2d80221ce: (a: number, b: number, c: any) => [number, number];
 export const wasm_bindgen__convert__closures_____invoke__h2cf3f4cce3b29948: (a: number, b: number, c: any, d: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__ha7903b6e296dd8f4: (a: number, b: number, c: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__ha1b480b83daa641f: (a: number, b: number) => void;

crates/yaak-wasm/src/lib.rs

@@ -232,6 +232,14 @@ struct PersistSendCookiesReq {
     after: Vec<Cookie>,
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PluginKeyValueReq {
+    plugin_name: String,
+    key: String,
+    value: Option<String>,
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct InsertResponseEventsReq {
@@ -415,6 +423,35 @@ fn dispatch(
             to_json(())
         }
 
+        // A plugin's own storage, namespaced by plugin name exactly as the desktop namespaces
+        // it (`build_shared_reply` in crates/yaak/src/plugin_events.rs), so a plugin that keeps
+        // a token here finds it under the same key on either host.
+        "web_plugin_kv_get" => {
+            let req: PluginKeyValueReq = from_js(payload)?;
+            let found = host.queries.connect().get_plugin_key_value(&req.plugin_name, &req.key);
+            to_json(found.map(|kv| kv.value))
+        }
+
+        "web_plugin_kv_set" => {
+            let req: PluginKeyValueReq = from_js(payload)?;
+            host.queries.connect().set_plugin_key_value(
+                &req.plugin_name,
+                &req.key,
+                &req.value.unwrap_or_default(),
+            );
+            to_json(())
+        }
+
+        "web_plugin_kv_delete" => {
+            let req: PluginKeyValueReq = from_js(payload)?;
+            let deleted = host
+                .queries
+                .connect()
+                .delete_plugin_key_value(&req.plugin_name, &req.key)
+                .map_err(js_error)?;
+            to_json(deleted)
+        }
+
         other => Err(js_error(format!("yaak-web: `{other}` is not a command this host answers"))),
     }
 }
@@ -439,6 +476,10 @@ struct PreparedHttpSend {
     /// The request with inherited headers and authentication applied and every template
     /// rendered. What the proxy sends, and what the response records as its request.
     request: HttpRequest,
+    /// Identifies whichever model the authentication was inherited from, hashed the way the
+    /// desktop hashes it. Plugins key their stored state on it — an OAuth token cache belongs
+    /// to the folder that declared the auth, not to each request under it.
+    auth_context_id: String,
     settings: HttpSendSettings,
     /// The `* Setting name=value` timeline lines the desktop writes at the top of a send,
     /// sources and all. The tab records them before the proxy's own events.
@@ -447,22 +488,51 @@ struct PreparedHttpSend {
     cookie_jar: Option<CookieJar>,
 }
 
-/// A template callback for a host with no plugins. Variables render; a function is a clear
-/// refusal naming the function, so the user knows what the request needs rather than seeing
-/// an empty string sent in its place.
-struct NoPluginsCallback;
+/// A template callback that calls a template function wherever the caller keeps them.
+///
+/// The desktop's equivalent (`PluginTemplateCallback`) reaches a plugin process; this one
+/// reaches a JavaScript function the worker installed, which forwards to the sandbox and back.
+/// Both hand the renderer the same thing — a string, or an error naming what failed — so a
+/// template renders identically on either host or fails for the same reason.
+///
+/// Without a function to call, a template function is a clear refusal naming it, which tells
+/// the user what the request needs rather than sending an empty string in its place.
+struct JsTemplateCallback {
+    call: Option<js_sys::Function>,
+}
 
-impl TemplateCallback for NoPluginsCallback {
+impl TemplateCallback for JsTemplateCallback {
     fn run(
         &self,
         fn_name: &str,
-        _args: HashMap<String, serde_json::Value>,
-    ) -> impl std::future::Future<Output = yaak_templates::error::Result<String>> + Send {
-        let message = format!(
-            "This request uses the template function \"{fn_name}\", which needs plugins. \
-             Plugins aren't available in the browser yet"
-        );
-        async move { Err(yaak_templates::error::Error::RenderError(message)) }
+        args: HashMap<String, serde_json::Value>,
+    ) -> impl std::future::Future<Output = yaak_templates::error::Result<String>> {
+        // Built before the async block so the future holds only owned values.
+        let call = self.call.clone();
+        let fn_name = fn_name.to_string();
+        let args = serde_json::to_string(&args).unwrap_or_else(|_| "{}".into());
+
+        async move {
+            use yaak_templates::error::Error::RenderError;
+
+            let Some(call) = call else {
+                return Err(RenderError(format!(
+                    "This request uses the template function \"{fn_name}\", which needs plugins. \
+                     No plugin provides it"
+                )));
+            };
+
+            let promise = call
+                .call2(&JsValue::NULL, &JsValue::from_str(&fn_name), &JsValue::from_str(&args))
+                .map_err(|e| RenderError(js_message(&e)))?;
+            let value = wasm_bindgen_futures::JsFuture::from(js_sys::Promise::from(promise))
+                .await
+                .map_err(|e| RenderError(js_message(&e)))?;
+
+            value.as_string().ok_or_else(|| {
+                RenderError(format!("Template function \"{fn_name}\" did not return a string"))
+            })
+        }
     }
 
     fn transform_arg(
@@ -475,19 +545,40 @@ impl TemplateCallback for NoPluginsCallback {
     }
 }
 
+/// The message out of a rejected promise or a thrown error, without the `Error:` wrapper.
+fn js_message(value: &JsValue) -> String {
+    if let Some(text) = value.as_string() {
+        return text;
+    }
+    let message = js_sys::Reflect::get(value, &JsValue::from_str("message"))
+        .ok()
+        .and_then(|m| m.as_string());
+    message.unwrap_or_else(|| format!("{value:?}"))
+}
+
+/// The template function bridge, or none when the caller passed nothing.
+fn template_callback(plugins: JsValue) -> JsTemplateCallback {
+    JsTemplateCallback { call: plugins.dyn_into::<js_sys::Function>().ok() }
+}
+
 /// Resolve and render a request for sending, exactly as the desktop does before it puts the
 /// request on the network: the environment chain, inherited headers and auth, request
 /// settings, the cookie jar. Nothing here touches a socket. What comes back is what the tab
 /// posts to the Yaak server.
 ///
-/// Refuses, with a message the user can act on, when the request needs something this host
-/// doesn't have: an authentication plugin, or a template function.
+/// `plugins` is the template function bridge — a JavaScript function taking a name and its
+/// JSON arguments and resolving to the rendered string. Passing nothing is allowed and makes
+/// every template function a refusal naming it.
+///
+/// Authentication is *not* applied here even though it is part of preparing a send. It is
+/// applied to the rendered request by the caller, because the plugin that applies it wants to
+/// see the request as it will be sent, and the caller is the side that knows that.
 #[wasm_bindgen]
-pub async fn prepare_http_send(payload: JsValue) -> Result<JsValue> {
+pub async fn prepare_http_send(payload: JsValue, plugins: JsValue) -> Result<JsValue> {
     let req: PrepareHttpSendReq = from_js(payload)?;
 
     // Everything from the database first, then release the host borrow before rendering.
-    let (request, environment_chain, settings, cookie_jar) = with_host(|host| {
+    let (request, environment_chain, settings, cookie_jar, auth_context_id) = with_host(|host| {
         let db = host.queries.connect();
         let request = db.get_http_request(&req.request_id).map_err(js_error)?;
         let environment_chain = db
@@ -497,7 +588,7 @@ pub async fn prepare_http_send(payload: JsValue) -> Result<JsValue> {
                 req.environment_id.as_deref(),
             )
             .map_err(js_error)?;
-        let (authentication_type, authentication, _auth_context_id) =
+        let (authentication_type, authentication, auth_context_id) =
             db.resolve_auth_for_http_request(&request).map_err(js_error)?;
         let headers = db.resolve_headers_for_http_request(&request).map_err(js_error)?;
         let settings = db.resolve_settings_for_http_request(&request).map_err(js_error)?;
@@ -506,34 +597,21 @@ pub async fn prepare_http_send(payload: JsValue) -> Result<JsValue> {
             None => None,
         };
         let request = HttpRequest { authentication_type, authentication, headers, ..request };
-        Ok((request, environment_chain, settings, cookie_jar))
+        Ok((request, environment_chain, settings, cookie_jar, auth_context_id))
     })?;
 
     let rendered = render_http_request(
         &request,
         environment_chain,
-        &NoPluginsCallback,
+        &template_callback(plugins),
         &RenderOptions::throw(),
     )
     .await
     .map_err(js_error)?;
 
-    // Authentication is applied by a plugin on the desktop. There is no plugin here, and a
-    // request sent without the auth it asked for is worse than one refused with the reason.
-    let auth_disabled =
-        rendered.authentication.get("disabled").and_then(|v| v.as_bool()) == Some(true);
-    if let Some(auth_type) = rendered.authentication_type.as_deref()
-        && auth_type != "none"
-        && !auth_disabled
-    {
-        return Err(js_error(format!(
-            "This request uses {auth_type} authentication, which needs plugins. \
-             Plugins aren't available in the browser yet"
-        )));
-    }
-
     let prepared = PreparedHttpSend {
         request: rendered,
+        auth_context_id: format!("{:x}", md5::compute(auth_context_id)),
         settings: HttpSendSettings::from(&settings),
         setting_events: settings.timeline_events(),
         cookie_jar,
@@ -544,6 +622,46 @@ pub async fn prepare_http_send(payload: JsValue) -> Result<JsValue> {
     prepared.serialize(&serde_wasm_bindgen::Serializer::json_compatible()).map_err(js_error)
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RenderTemplateReq {
+    template: String,
+    workspace_id: String,
+    environment_id: Option<String>,
+    ignore_error: Option<bool>,
+}
+
+/// Render one template string against an environment chain.
+///
+/// What `cmd_render_template` does on the desktop, for the same callers: the value previews
+/// under an editor, and anywhere the app shows what a template will become. `ignore_error`
+/// picks the same behaviour it picks there — a preview shows an empty string where a send
+/// would refuse, because a half-typed template is not yet a mistake.
+#[wasm_bindgen]
+pub async fn render_template(payload: JsValue, plugins: JsValue) -> Result<JsValue> {
+    let req: RenderTemplateReq = from_js(payload)?;
+
+    let environment_chain = with_host(|host| {
+        host.queries
+            .connect()
+            .resolve_environments(&req.workspace_id, None, req.environment_id.as_deref())
+            .map_err(js_error)
+    })?;
+
+    let vars = yaak_models::render::make_vars_hashmap(environment_chain);
+    let options = if req.ignore_error == Some(true) {
+        RenderOptions::return_empty()
+    } else {
+        RenderOptions::throw()
+    };
+
+    let rendered =
+        yaak_templates::parse_and_render(&req.template, &vars, &template_callback(plugins), &options)
+            .await
+            .map_err(js_error)?;
+    to_json(rendered).map(|v| JsValue::from_str(v.as_str().unwrap_or_default()))
+}
+
 /* -------------------------------------------------------------------------- */
 /* Blobs                                                                       */
 /* -------------------------------------------------------------------------- */

package-lock.json

@@ -16,6 +16,7 @@
         "packages/platform",
         "packages/plugin-runtime",
         "packages/plugin-runtime-types",
+        "packages/plugin-sandbox",
         "plugins-external/mcp-server",
         "plugins-external/faker",
         "plugins-external/httpsnippet",
@@ -1470,6 +1471,21 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@jitl/quickjs-ffi-types": {
+      "version": "0.32.0",
+      "resolved": "https://registry.npmjs.org/@jitl/quickjs-ffi-types/-/quickjs-ffi-types-0.32.0.tgz",
+      "integrity": "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg==",
+      "license": "MIT"
+    },
+    "node_modules/@jitl/quickjs-ng-wasmfile-release-sync": {
+      "version": "0.32.0",
+      "resolved": "https://registry.npmjs.org/@jitl/quickjs-ng-wasmfile-release-sync/-/quickjs-ng-wasmfile-release-sync-0.32.0.tgz",
+      "integrity": "sha512-XAX2jjZWWh3M0YaRqi82xMKNW/gkF6mo3MpW3UY2cmVxnQai1JuboVsJQVoLU629iEL4XWvHtO4h5lo7NRnAcg==",
+      "license": "MIT",
+      "dependencies": {
+        "@jitl/quickjs-ffi-types": "0.32.0"
+      }
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -5638,6 +5654,10 @@
       "resolved": "packages/plugin-runtime",
       "link": true
     },
+    "node_modules/@yaakapp-internal/plugin-sandbox": {
+      "resolved": "packages/plugin-sandbox",
+      "link": true
+    },
     "node_modules/@yaakapp-internal/plugins": {
       "resolved": "crates/yaak-plugins",
       "link": true
@@ -12799,6 +12819,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/quickjs-emscripten-core": {
+      "version": "0.32.0",
+      "resolved": "https://registry.npmjs.org/quickjs-emscripten-core/-/quickjs-emscripten-core-0.32.0.tgz",
+      "integrity": "sha512-QFnPfjFey8EqknSrSxe1hZrf1/8z7/6s1QzGOmKo6++02r7QRRX7ZoyNaZh7JuVjWsVW87KnQrbZqnHkOAzUyg==",
+      "license": "MIT",
+      "dependencies": {
+        "@jitl/quickjs-ffi-types": "0.32.0"
+      }
+    },
     "node_modules/railroad-diagrams": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz",
@@ -15859,6 +15888,17 @@
       "dev": true,
       "license": "MIT"
     },
+    "packages/plugin-sandbox": {
+      "name": "@yaakapp-internal/plugin-sandbox",
+      "version": "1.0.0",
+      "dependencies": {
+        "@jitl/quickjs-ng-wasmfile-release-sync": "^0.32.0",
+        "quickjs-emscripten-core": "^0.32.0"
+      },
+      "devDependencies": {
+        "esbuild": "^0.28.0"
+      }
+    },
     "packages/tailwind-config": {
       "name": "@yaakapp-internal/tailwind-config",
       "version": "1.0.0"

package.json

@@ -15,6 +15,7 @@
     "packages/platform",
     "packages/plugin-runtime",
     "packages/plugin-runtime-types",
+    "packages/plugin-sandbox",
     "plugins-external/mcp-server",
     "plugins-external/faker",
     "plugins-external/httpsnippet",

packages/common-lib/index.ts

@@ -2,3 +2,5 @@ export * from "./debounce";
 export * from "./eagerDebounceAsync";
 export * from "./formatSize";
 export * from "./templateFunction";
+export * from "./pluginForms";
+export * from "./responseBody";

packages/common-lib/pluginForms.ts

@@ -1,13 +1,25 @@
+/**
+ * The form handling every plugin runtime does, wherever it runs.
+ *
+ * A plugin declares its inputs as data, but any of them may compute itself
+ * from the values entered so far — so a runtime has to resolve those callbacks
+ * before a host can draw the form, then strip them, because a function cannot
+ * cross a process, a worker, or a sandbox boundary. That is the same work for
+ * the Node runtime and the QuickJS one, so it lives here rather than in either.
+ */
+
 import type {
   CallPromptFormDynamicArgs,
   Context,
   DynamicAuthenticationArg,
   DynamicPromptFormArg,
   DynamicTemplateFunctionArg,
+  TemplateFunctionPlugin,
 } from "@yaakapp/api";
 import type {
   CallHttpAuthenticationActionArgs,
   CallTemplateFunctionArgs,
+  FormInput,
 } from "@yaakapp-internal/plugins";
 
 type AnyDynamicArg = DynamicTemplateFunctionArg | DynamicAuthenticationArg | DynamicPromptFormArg;
@@ -73,3 +85,38 @@ export async function applyDynamicFormInput(
   }
   return resolvedArgs;
 }
+
+/**
+ * Drop the `dynamic` callbacks, recursively, leaving inputs that serialize.
+ *
+ * Called on the way out of a runtime, after [`applyDynamicFormInput`] has run
+ * them: what a host receives has to be data all the way down.
+ */
+export function stripDynamicCallbacks(inputs: { dynamic?: unknown }[]): FormInput[] {
+  return inputs.map((input) => {
+    // oxlint-disable-next-line no-explicit-any -- stripping dynamic from union type
+    const { dynamic: _dynamic, ...rest } = input as any;
+    if ("inputs" in rest && Array.isArray(rest.inputs)) {
+      rest.inputs = stripDynamicCallbacks(rest.inputs);
+    }
+    return rest as FormInput;
+  });
+}
+
+/** Select options used to carry `name` where they now carry `label`. */
+export function migrateTemplateFunctionSelectOptions(
+  f: TemplateFunctionPlugin,
+): TemplateFunctionPlugin {
+  const migratedArgs = f.args.map((a) => {
+    if (a.type === "select") {
+      type LegacyOption = { label?: string; value: string; name?: string };
+      a.options = a.options.map((o) => {
+        const legacy = o as LegacyOption;
+        return { label: legacy.label ?? legacy.name ?? "", value: legacy.value };
+      });
+    }
+    return a;
+  });
+
+  return { ...f, args: migratedArgs };
+}

packages/platform/src/web/commands.ts

@@ -17,15 +17,22 @@
  * up here as a type error rather than as a runtime surprise.
  */
 
+import type { HttpRequest } from "@yaakapp-internal/models";
+import type { JsonPrimitive } from "@yaakapp-internal/plugins";
 import type { RpcSchema } from "@yaakapp-internal/rpc-schema";
 import type { CapabilityName, RpcPayload } from "../types";
 import type { WorkerConnection } from "./connection";
 import { unsupported } from "./errors";
+import type { WebPlugins } from "./plugins";
 import { sendHttpRequest } from "./send";
 
 export type AppCmd = keyof RpcSchema;
 
-type Handler = (payload: RpcPayload, db: WorkerConnection) => Promise<unknown>;
+type Handler = (
+  payload: RpcPayload,
+  db: WorkerConnection,
+  plugins: WebPlugins,
+) => Promise<unknown>;
 
 /** Placeholder shown wherever the desktop would show a real filesystem path. */
 const NO_PATH = "";
@@ -41,6 +48,31 @@ function text(payload: RpcPayload, key: string): string {
   return typeof value === "string" ? value : "";
 }
 
+/** Form values as the plugin protocol carries them. */
+function values(payload: RpcPayload, key = "values"): Record<string, JsonPrimitive> {
+  const value = payload[key];
+  return value != null && typeof value === "object"
+    ? (value as Record<string, JsonPrimitive>)
+    : {};
+}
+
+/**
+ * The id a plugin keys its stored state on.
+ *
+ * The desktop hashes the id of whichever model the configuration was read from,
+ * so two requests inheriting one folder's authentication share a token cache.
+ * The preview paths here have no such model in hand and pass what they were
+ * given, which is enough to be stable per form.
+ */
+function contextId(payload: RpcPayload): string {
+  const model = payload.model;
+  if (model != null && typeof model === "object" && "id" in model) {
+    const id = (model as { id?: unknown }).id;
+    return typeof id === "string" ? id : "";
+  }
+  return "";
+}
+
 /**
  * Commands this host answers itself.
  *
@@ -73,10 +105,16 @@ const HANDLERS: Partial<Record<AppCmd, Handler>> = {
 
   // The tab renders and stores; a stateless server puts the bytes on the wire.
   // See send.ts for the whole shape of it.
-  cmd_send_http_request: (payload, db) => {
+  cmd_send_http_request: (payload, db, plugins) => {
     const requestId = str(payload, "requestId");
     if (requestId == null) throw new Error("cmd_send_http_request needs a requestId");
-    return sendHttpRequest(db, requestId, str(payload, "environmentId"), str(payload, "cookieJarId"));
+    return sendHttpRequest(
+      db,
+      plugins,
+      requestId,
+      str(payload, "environmentId"),
+      str(payload, "cookieJarId"),
+    );
   },
 
   /* -------------------------------- app ---------------------------------- */
@@ -146,22 +184,67 @@ const HANDLERS: Partial<Record<AppCmd, Handler>> = {
    * Both of these are polled once a second until they answer with something, so
    * an empty list is not a quiet no — it is a poll that never stops.
    *
-   * The auth list names what Yaak actually offers, so the picker tells the
-   * truth about the product even though the form behind each entry stays empty
-   * until plugins run here. Template functions get the opposite treatment: one
-   * provider contributing no functions. That settles the poll while putting
-   * nothing in the autocomplete, which is the honest answer — a function the
-   * user could insert but nothing could evaluate would be worse than none.
+   * Both now answer from the plugins actually loaded in the sandbox, which is
+   * the only answer that stays true: an authentication method in the picker
+   * that no loaded plugin can apply would be a promise this host cannot keep,
+   * and a template function offered in the autocomplete that nothing can
+   * evaluate would be worse than none.
    */
-  async cmd_get_http_authentication_summaries() {
-    return HTTP_AUTHENTICATION_SUMMARIES;
+  async cmd_get_http_authentication_summaries(_payload, _db, plugins) {
+    return plugins.httpAuthenticationSummaries();
   },
-  async cmd_template_function_summaries() {
-    return [{ pluginRefId: "web", functions: [] }];
+  async cmd_template_function_summaries(_payload, _db, plugins) {
+    return plugins.templateFunctionSummaries();
   },
 
-  async cmd_get_http_authentication_config() {
-    return { args: [], pluginRefId: "web" };
+  async cmd_get_http_authentication_config(payload, _db, plugins) {
+    const authName = str(payload, "authName");
+    const config =
+      authName == null
+        ? null
+        : await plugins.httpAuthenticationConfig(authName, values(payload), contextId(payload));
+    return config ?? { args: [], actions: [], pluginRefId: "web" };
+  },
+
+  async cmd_template_function_config(payload, _db, plugins) {
+    const name = str(payload, "functionName") ?? str(payload, "name");
+    if (name == null) return null;
+    return plugins.templateFunctionConfig(name, values(payload), contextId(payload));
+  },
+
+  async cmd_call_http_authentication_action(payload, _db, plugins) {
+    const authName = str(payload, "authName");
+    if (authName == null) return null;
+    const index = payload.actionIndex;
+    await plugins.callHttpAuthenticationAction(
+      authName,
+      typeof index === "number" ? index : 0,
+      values(payload),
+      contextId(payload),
+    );
+    return null;
+  },
+
+  /**
+   * Turn a pasted cURL command into a request.
+   *
+   * Routed through the same importer the desktop uses, in the sandbox, which
+   * is why this is a handler and no longer a refusal. The reshaping afterwards
+   * matches `cmd_curl_to_request` in crates/yaak-commands: the importer names a
+   * workspace of its own invention and mints an id, and both belong to the
+   * caller instead.
+   */
+  async cmd_curl_to_request(payload, _db, plugins) {
+    const resources = await plugins.import(text(payload, "command"));
+    const imported = resources?.httpRequests?.[0];
+    if (imported == null) {
+      throw new Error("Failed to import cURL command");
+    }
+    return {
+      ...imported,
+      id: "",
+      workspaceId: str(payload, "workspaceId") ?? imported.workspaceId,
+    } as HttpRequest;
   },
 
   async cmd_format_json(payload) {
@@ -176,13 +259,19 @@ const HANDLERS: Partial<Record<AppCmd, Handler>> = {
   },
 
   /**
-   * Rendering resolves variables and calls template functions, and the
-   * functions live in plugins. Handing the template back unrendered is what the
-   * preview then shows — the raw `${[...]}`, which is at least the thing the
-   * user typed rather than a wrong value.
+   * Resolve variables and call template functions, in the engine, exactly as
+   * `cmd_render_template` does on the desktop. The functions come back out to
+   * the sandbox as the render reaches them — see `templateBridge` in worker.ts.
    */
-  async cmd_render_template(payload) {
-    return text(payload, "template");
+  async cmd_render_template(payload, db) {
+    const workspaceId = str(payload, "workspaceId");
+    if (workspaceId == null) return text(payload, "template");
+    return db.renderTemplate({
+      template: text(payload, "template"),
+      workspaceId,
+      environmentId: str(payload, "environmentId"),
+      ignoreError: payload.ignoreError === true,
+    });
   },
 
   /* ------------------------------- bodies -------------------------------- */
@@ -224,21 +313,6 @@ const HANDLERS: Partial<Record<AppCmd, Handler>> = {
   },
 };
 
-/**
- * The auth methods Yaak ships as plugins today (plugins/auth-*). Listed so the
- * picker is truthful about the product; choosing one currently yields an empty
- * config form, because the plugin that defines the form isn't running.
- */
-const HTTP_AUTHENTICATION_SUMMARIES = [
-  { name: "apikey", label: "API Key", shortLabel: "API Key" },
-  { name: "aws", label: "AWS SigV4", shortLabel: "AWS" },
-  { name: "basic", label: "Basic Auth", shortLabel: "Basic" },
-  { name: "bearer", label: "Bearer Token", shortLabel: "Bearer" },
-  { name: "jwt", label: "JWT Bearer", shortLabel: "JWT" },
-  { name: "ntlm", label: "NTLM", shortLabel: "NTLM" },
-  { name: "oauth1", label: "OAuth 1.0", shortLabel: "OAuth 1" },
-  { name: "oauth2", label: "OAuth 2.0", shortLabel: "OAuth 2" },
-];
 
 /**
  * Commands this host declines, each with the reason a user would need.
@@ -253,7 +327,6 @@ const DECLINED: Partial<Record<AppCmd, [reason: string, capability: CapabilityNa
   // ones nothing stores, used for GraphQL introspection — take the same road but
   // return the body inline; not wired yet.
   cmd_send_ephemeral_request: ["Sending unsaved requests isn't available in the browser yet", null],
-  cmd_curl_to_request: ["Importing from cURL needs a plugin, which this host doesn't run", null],
 
   // Protocols that need a real socket.
   cmd_grpc_reflect: ["gRPC isn't available in the browser", "grpc"],
@@ -295,14 +368,12 @@ const DECLINED: Partial<Record<AppCmd, [reason: string, capability: CapabilityNa
   cmd_plugins_uninstall: ["Plugins aren't available in the browser yet", "plugins"],
   cmd_plugins_updates: ["Plugins aren't available in the browser yet", "plugins"],
   cmd_plugins_update_all: ["Plugins aren't available in the browser yet", "plugins"],
-  cmd_template_function_config: ["Template functions come from plugins, which this host doesn't run", "plugins"],
   cmd_template_tokens_to_string: ["Template functions come from plugins, which this host doesn't run", "plugins"],
   cmd_call_http_request_action: ["Plugins aren't available in the browser yet", "plugins"],
   cmd_call_websocket_request_action: ["Plugins aren't available in the browser yet", "plugins"],
   cmd_call_grpc_request_action: ["Plugins aren't available in the browser yet", "plugins"],
   cmd_call_workspace_action: ["Plugins aren't available in the browser yet", "plugins"],
   cmd_call_folder_action: ["Plugins aren't available in the browser yet", "plugins"],
-  cmd_call_http_authentication_action: ["Plugins aren't available in the browser yet", "plugins"],
 
   cmd_send_feedback: ["Feedback goes through the desktop app for now", null],
 };
@@ -329,9 +400,10 @@ export async function runCommand(
   cmd: string,
   payload: RpcPayload,
   db: WorkerConnection,
+  plugins: WebPlugins,
 ): Promise<unknown> {
   const handler = HANDLERS[cmd as AppCmd];
-  if (handler != null) return handler(payload, db);
+  if (handler != null) return handler(payload, db, plugins);
 
   const declined = DECLINED[cmd as AppCmd];
   if (declined != null) throw unsupported(cmd, declined[0], declined[1]);

packages/platform/src/web/connection.ts

@@ -50,6 +50,16 @@ export class WorkerConnection {
   /** True once the worker has said anything at all. */
   private heard = false;
 
+  /**
+   * Who answers a template function, once something can.
+   *
+   * The engine renders in the worker but the functions come from plugins in
+   * this tab's sandbox, so the worker asks back through this. Unset until the
+   * sandbox is up, and a render that arrives before then gets the same refusal
+   * a host with no plugins gives — which is the truth at that moment.
+   */
+  private templateFunctions: ((name: string, args: string) => Promise<string>) | null = null;
+
   constructor() {
     // Both are required and neither is faked. Without a shared worker every
     // tab would need its own SQLite over the same pages; without Web Locks
@@ -147,6 +157,9 @@ export class WorkerConnection {
       case "event":
         this.deliver(message.event, message.payload);
         return;
+      case "template_function":
+        void this.runTemplateFunction(message.id, message.name, message.args);
+        return;
     }
   }
 
@@ -159,6 +172,35 @@ export class WorkerConnection {
     });
   }
 
+  /** Hand the worker somewhere to send template functions. */
+  setTemplateFunctionHandler(handler: (name: string, args: string) => Promise<string>): void {
+    this.templateFunctions = handler;
+  }
+
+  private async runTemplateFunction(id: number, name: string, args: string): Promise<void> {
+    if (this.templateFunctions == null) {
+      this.post({
+        type: "template_function_result",
+        id,
+        error: `The template function \`${name}\` needs a plugin, and none are loaded yet`,
+      });
+      return;
+    }
+    try {
+      this.post({
+        type: "template_function_result",
+        id,
+        value: await this.templateFunctions(name, args),
+      });
+    } catch (err) {
+      this.post({
+        type: "template_function_result",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
   rpc<T>(cmd: string, payload: unknown): Promise<T> {
     return this.request<T>((id) => ({ type: "rpc", id, cmd, payload, label: this.label }));
   }
@@ -168,6 +210,11 @@ export class WorkerConnection {
     return this.request<T>((id) => ({ type: "prepare_http_send", id, payload }));
   }
 
+  /** See `render_template` in crates/yaak-web. */
+  renderTemplate(payload: unknown): Promise<string> {
+    return this.request<string>((id) => ({ type: "render_template", id, payload }));
+  }
+
   async blobGet(blobId: string): Promise<Uint8Array<ArrayBuffer> | null> {
     const buf = await this.request<ArrayBuffer | null>((id) => ({ type: "blob_get", id, blobId }));
     return buf == null ? null : new Uint8Array(buf);

packages/platform/src/web/index.ts

@@ -28,6 +28,7 @@ import type {
 import { commandSupport, runCommand } from "./commands";
 import { WorkerConnection } from "./connection";
 import { unsupported } from "./errors";
+import { WebPlugins } from "./plugins";
 import { requestPersistence } from "./storage";
 
 /** What this host can do, reported honestly. */
@@ -60,7 +61,9 @@ function capabilitiesFor(): PlatformCapabilities {
     // The browser already zooms the page, on the same keys, and remembers it
     // per site. The app stays out of the way.
     interfaceZoom: false,
-    plugins: false,
+    // Plugins run in a QuickJS sandbox, but only the bundled set: there is no
+    // installing them, so the plugin manager stays unavailable and says so.
+    plugins: true,
     encryption: false,
     updater: false,
     // Reading needs a permission prompt at first paint, which is a bad ask for
@@ -160,8 +163,14 @@ function createWindow(db: WorkerConnection): PlatformWindow {
 
 export function createWebPlatform(): Platform {
   const db = new WorkerConnection();
+  const plugins = new WebPlugins(db);
   const capabilities = capabilitiesFor();
 
+  // Rendering happens in the worker and template functions live in the sandbox,
+  // so the worker needs a way back here to call one. Registered before anything
+  // can render, which is why it is here rather than inside the first send.
+  db.setTemplateFunctionHandler((name, args) => plugins.callTemplateFunction(name, args));
+
   // Without this, IndexedDB is best-effort storage and a browser reclaiming
   // space may drop someone's workspaces. Asking is all we can do, and there is
   // nothing useful to do about a refusal.
@@ -231,7 +240,7 @@ export function createWebPlatform(): Platform {
       // `plugin:` commands are Tauri host plugins, not engine commands, and
       // never reached the router even on the desktop.
       if (cmd.startsWith("plugin:")) return hostPluginCommand<T>(cmd, payload);
-      return runCommand(cmd, payload ?? {}, db) as Promise<T>;
+      return runCommand(cmd, payload ?? {}, db, plugins) as Promise<T>;
     },
 
     async rpcStream<T, M>(
@@ -244,7 +253,7 @@ export function createWebPlatform(): Platform {
       const streamId = crypto.randomUUID();
       const unlisten = db.listen(`stream_${streamId}`, (p) => onMessage(p as M));
       try {
-        const result = (await runCommand(cmd, { ...payload, streamId }, db)) as T;
+        const result = (await runCommand(cmd, { ...payload, streamId }, db, plugins)) as T;
         return { result, unlisten };
       } catch (err) {
         unlisten();

packages/platform/src/web/plugins.ts

@@ -0,0 +1,351 @@
+/**
+ * The plugins this host runs, and everything they are allowed to reach.
+ *
+ * Two jobs. Outward: keep a sandbox, load the bundled plugins into it, and know
+ * which of them answers what — the app asks for "the bearer auth config" and
+ * this decides that means `auth-bearer`. Inward: answer the `ctx` calls those
+ * plugins make, which is where the sandbox stops being a sealed box and starts
+ * being a host. Everything a plugin can do to the world is in `hostRequest`
+ * below, by name, with a refusal for anything not listed.
+ *
+ * The plugins are bundled into the app rather than installed, for now — see
+ * `scripts/bundle-sandbox-plugins.mjs`. Which three, and why only three, is a
+ * decision that belongs to this slice and not to the sandbox: the runtime does
+ * not know how many plugins exist.
+ */
+
+import { PluginSandbox, type PluginSummary } from "@yaakapp-internal/plugin-sandbox";
+import type {
+  GetHttpAuthenticationConfigResponse,
+  GetHttpAuthenticationSummaryResponse,
+  GetTemplateFunctionConfigResponse,
+  GetTemplateFunctionSummaryResponse,
+  ImportResources,
+  InternalEventPayload,
+  JsonPrimitive,
+  PluginContext,
+} from "@yaakapp-internal/plugins";
+import type { WorkerConnection } from "./connection";
+import { SANDBOX_PLUGINS } from "./sandboxPlugins.generated";
+
+/** What a plugin's own storage is keyed under, matching the desktop's namespacing. */
+type KeyValueRequest = { key: string };
+
+export interface AppliedAuthentication {
+  setHeaders?: { name: string; value: string }[] | null;
+  setQueryParameters?: { name: string; value: string }[] | null;
+}
+
+export class WebPlugins {
+  private readonly db: WorkerConnection;
+  private sandbox: PluginSandbox | null = null;
+  private loading: Promise<void> | null = null;
+
+  /** Loaded plugin ids, by what they contribute. */
+  private readonly byTemplateFunction = new Map<string, string>();
+  private readonly byAuthName = new Map<string, string>();
+  private readonly importers: string[] = [];
+  private readonly summaries = new Map<string, PluginSummary>();
+
+  constructor(db: WorkerConnection) {
+    this.db = db;
+  }
+
+  /**
+   * Bring the sandbox up and load every bundled plugin, once.
+   *
+   * Called from every entry point rather than at construction, so a session
+   * that never touches a plugin never pays for QuickJS — and so a tab that
+   * cannot start the worker still boots the app, with plugin-shaped features
+   * failing individually instead of the page failing entirely.
+   */
+  ready(): Promise<void> {
+    this.loading ??= this.start();
+    return this.loading;
+  }
+
+  private async start(): Promise<void> {
+    const sandbox = new PluginSandbox({
+      onHostRequest: (envelope) => this.hostRequest(envelope),
+      onLog: ({ pluginRefId, level, message }) => {
+        // Prefixed, because otherwise a plugin's console output is
+        // indistinguishable from the app's own and blames the wrong code.
+        const write = level === "error" ? console.error : console.log;
+        write(`[plugin ${pluginRefId}] ${message}`);
+      },
+    });
+    this.sandbox = sandbox;
+
+    // In parallel: each is an independent QuickJS context and none of them
+    // observes the others.
+    await Promise.all(
+      SANDBOX_PLUGINS.map(async ({ name, source }) => {
+        try {
+          const summary = await sandbox.load(name, source);
+          this.summaries.set(name, summary);
+          for (const fn of summary.templateFunctions) this.byTemplateFunction.set(fn, name);
+          if (summary.authentication != null) this.byAuthName.set(summary.authentication, name);
+          if (summary.importer) this.importers.push(name);
+        } catch (err) {
+          // One bad bundle should cost its own features and nothing else.
+          console.error(`Failed to load plugin \`${name}\``, err);
+        }
+      }),
+    );
+  }
+
+  /* ------------------------------ what exists ------------------------------ */
+
+  async templateFunctionSummaries(): Promise<GetTemplateFunctionSummaryResponse[]> {
+    await this.ready();
+    return this.gather("get_template_function_summary_request", this.summaries.keys());
+  }
+
+  async httpAuthenticationSummaries(): Promise<GetHttpAuthenticationSummaryResponse[]> {
+    await this.ready();
+    return this.gather("get_http_authentication_summary_request", this.byAuthName.values());
+  }
+
+  /**
+   * Ask several plugins the same question and keep the answers that came back.
+   *
+   * A plugin that has nothing to say answers `empty_response`, which is not an
+   * answer and is dropped; one that throws is logged and dropped too, so a
+   * single broken plugin cannot empty the picker for all the others.
+   */
+  private async gather<T>(type: string, ids: Iterable<string>): Promise<T[]> {
+    const replies = await Promise.all(
+      Array.from(ids).map(async (id): Promise<{ type: string } | null> => {
+        try {
+          return await this.dispatch(id, { type } as InternalEventPayload);
+        } catch (err) {
+          console.error(`Plugin \`${id}\` failed to answer \`${type}\``, err);
+          return null;
+        }
+      }),
+    );
+    return replies.filter((r) => r != null && r.type !== "empty_response") as T[];
+  }
+
+  /* -------------------------------- calling -------------------------------- */
+
+  async templateFunctionConfig(
+    name: string,
+    values: Record<string, JsonPrimitive>,
+    contextId: string,
+  ): Promise<GetTemplateFunctionConfigResponse | null> {
+    await this.ready();
+    const id = this.byTemplateFunction.get(name);
+    if (id == null) return null;
+    return this.dispatch(id, {
+      type: "get_template_function_config_request",
+      contextId,
+      name,
+      values,
+    } as InternalEventPayload);
+  }
+
+  /**
+   * Run one template function.
+   *
+   * This is what the engine's render calls back into, so its contract is the
+   * engine's: a string, or a throw whose message says what went wrong. A
+   * function nothing provides is a throw naming it rather than an empty
+   * string, because a request sent with a silently blank token is worse than
+   * one that refuses to be sent.
+   */
+  async callTemplateFunction(name: string, argsJson: string): Promise<string> {
+    await this.ready();
+    const id = this.byTemplateFunction.get(name);
+    if (id == null) {
+      throw new Error(`No plugin provides the template function \`${name}\``);
+    }
+
+    const values = JSON.parse(argsJson) as Record<string, JsonPrimitive>;
+    const reply = await this.dispatch<{ value: string | null; error?: string | null }>(id, {
+      type: "call_template_function_request",
+      name,
+      args: { purpose: "send", values },
+    } as InternalEventPayload);
+
+    if (reply.error) throw new Error(reply.error);
+    return reply.value ?? "";
+  }
+
+  async httpAuthenticationConfig(
+    authName: string,
+    values: Record<string, JsonPrimitive>,
+    contextId: string,
+  ): Promise<GetHttpAuthenticationConfigResponse | null> {
+    await this.ready();
+    const id = this.byAuthName.get(authName);
+    if (id == null) return null;
+    return this.dispatch(id, {
+      type: "get_http_authentication_config_request",
+      contextId,
+      values,
+    } as InternalEventPayload);
+  }
+
+  async callHttpAuthenticationAction(
+    authName: string,
+    index: number,
+    values: Record<string, JsonPrimitive>,
+    contextId: string,
+  ): Promise<void> {
+    await this.ready();
+    const id = this.byAuthName.get(authName);
+    if (id == null) throw new Error(`No plugin provides \`${authName}\` authentication`);
+    await this.dispatch(id, {
+      type: "call_http_authentication_action_request",
+      index,
+      pluginRefId: id,
+      args: { contextId, values },
+    } as InternalEventPayload);
+  }
+
+  /**
+   * Apply an authentication method to a request that is about to be sent.
+   *
+   * The plugin is shown the request as it stands and hands back headers and
+   * query parameters to add — the same exchange the desktop has, at the same
+   * point in the send.
+   */
+  async applyHttpAuthentication(
+    authName: string,
+    request: {
+      contextId: string;
+      values: Record<string, JsonPrimitive>;
+      method: string;
+      url: string;
+      headers: { name: string; value: string }[];
+      body: string | null;
+    },
+  ): Promise<AppliedAuthentication> {
+    await this.ready();
+    const id = this.byAuthName.get(authName);
+    if (id == null) {
+      throw new Error(
+        `This request uses ${authName} authentication, which no plugin in the browser provides`,
+      );
+    }
+    return this.dispatch<AppliedAuthentication>(id, {
+      type: "call_http_authentication_request",
+      ...request,
+    } as InternalEventPayload);
+  }
+
+  /**
+   * Import whatever this text turns out to be.
+   *
+   * Every importer is asked and the first one that recognizes it wins, which
+   * is how the desktop's `import_data` decides too — an importer that does not
+   * recognize its input returns nothing rather than guessing.
+   */
+  async import(content: string): Promise<ImportResources | null> {
+    await this.ready();
+    for (const id of this.importers) {
+      try {
+        const reply = await this.dispatch<{ resources?: ImportResources }>(id, {
+          type: "import_request",
+          content,
+        } as InternalEventPayload);
+        if (reply.type === "import_response" && reply.resources != null) return reply.resources;
+      } catch (err) {
+        console.error(`Importer \`${id}\` failed`, err);
+      }
+    }
+    return null;
+  }
+
+  /* ------------------------------- internals ------------------------------- */
+
+  private async dispatch<T>(
+    pluginRefId: string,
+    payload: InternalEventPayload,
+  ): Promise<T & { type: string }> {
+    if (this.sandbox == null) throw new Error("The plugin sandbox is not running");
+    return this.sandbox.dispatch<T>(pluginRefId, this.context(), payload);
+  }
+
+  /**
+   * The context a plugin sees.
+   *
+   * `label` is null and stays null: it names a desktop window, and the calls
+   * that need one — `ctx.window.requestId()` and its neighbours — are refused
+   * rather than answered with a guess about which request the user is looking
+   * at. `workspaceId` is genuinely unknown here for the same reason; the
+   * commands that know it pass it themselves.
+   */
+  private context(): PluginContext {
+    return { id: "web", label: null, workspaceId: null };
+  }
+
+  /**
+   * Answer one `ctx` call.
+   *
+   * The list is short on purpose. What is here is what a plugin can do in a
+   * browser tab today; what is missing refuses by name, so a plugin that needs
+   * it fails with a sentence someone can act on rather than a hang or an
+   * undefined. Every addition to this list is a capability decision, which is
+   * why they are written out one at a time instead of forwarded wholesale.
+   */
+  private async hostRequest(envelope: string): Promise<string> {
+    const { pluginRefId, payload } = JSON.parse(envelope) as {
+      pluginRefId: string;
+      context: PluginContext;
+      payload: InternalEventPayload;
+    };
+
+    const reply = async (): Promise<InternalEventPayload> => {
+      switch (payload.type) {
+        /* A plugin's own storage, namespaced by plugin in the database. */
+        case "get_key_value_request": {
+          const value = await this.db.rpc<string | null>("web_plugin_kv_get", {
+            pluginName: pluginRefId,
+            key: (payload as unknown as KeyValueRequest).key,
+          });
+          return { type: "get_key_value_response", value } as InternalEventPayload;
+        }
+        case "set_key_value_request": {
+          const { key, value } = payload as unknown as { key: string; value: string };
+          await this.db.rpc("web_plugin_kv_set", {
+            pluginName: pluginRefId,
+            key,
+            value,
+          });
+          return { type: "set_key_value_response" } as InternalEventPayload;
+        }
+        case "delete_key_value_request": {
+          const deleted = await this.db.rpc<boolean>("web_plugin_kv_delete", {
+            pluginName: pluginRefId,
+            key: (payload as unknown as KeyValueRequest).key,
+          });
+          return { type: "delete_key_value_response", deleted } as InternalEventPayload;
+        }
+
+        /* A message for the user, delivered where every other one is. */
+        case "show_toast_request": {
+          const { type: _type, ...toast } = payload;
+          this.db.deliver("show_toast", toast);
+          return { type: "empty_response" };
+        }
+
+        default:
+          throw new Error(
+            `\`${payload.type}\` isn't something a plugin can do when Yaak runs in a browser yet`,
+          );
+      }
+    };
+
+    try {
+      return JSON.stringify(await reply());
+    } catch (err) {
+      return JSON.stringify({
+        type: "error_response",
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+}

packages/platform/src/web/protocol.ts

@@ -16,6 +16,18 @@ export type ToWorker =
    * async in the engine (rendering is), where every `rpc` command is not.
    */
   | { type: "prepare_http_send"; id: number; payload: unknown }
+  /**
+   * Render one template string. Async for the same reason `prepare_http_send`
+   * is: a template function is a call out to a plugin, and plugins are not here.
+   */
+  | { type: "render_template"; id: number; payload: unknown }
+  /** The tab's answer to a `template_function` call. */
+  | {
+      type: "template_function_result";
+      id: number;
+      value?: string;
+      error?: string;
+    }
   | { type: "blob_get"; id: number; blobId: string }
   | { type: "blob_put"; id: number; blobId: string; bytes: ArrayBuffer }
   | { type: "blob_delete"; id: number; blobId: string }
@@ -38,7 +50,16 @@ export type FromWorker =
   | { type: "result"; id: number; result: unknown }
   | { type: "error"; id: number; message: string }
   /** A backend event for the app — today only `model_writes`. Sent to every port. */
-  | { type: "event"; event: string; payload: unknown };
+  | { type: "event"; event: string; payload: unknown }
+  /**
+   * Render a template function, please.
+   *
+   * The one message that runs the other way. Rendering happens in the engine,
+   * here, but the functions it calls live in a plugin sandbox the tab owns —
+   * so the engine asks, and it asks the port that started the render rather
+   * than broadcasting, because only that tab is waiting.
+   */
+  | { type: "template_function"; id: number; name: string; args: string };
 
 /** What the worker registers itself under. Tabs on one origin share it. */
 export const WORKER_NAME = "yaak-db";

packages/platform/src/web/send.ts

@@ -33,7 +33,8 @@ import type {
 } from "@yaakapp-internal/models";
 import type { Frame, SendRequest } from "@yaakapp-internal/web";
 import type { WorkerConnection } from "./connection";
-import { serverIdentity, serverSendUrl, readFrames } from "./server";
+import type { WebPlugins } from "./plugins";
+import { readFrames, serverIdentity, serverSendUrl } from "./server";
 
 /* -------------------------------- shapes --------------------------------- */
 
@@ -51,11 +52,69 @@ type ResponsePatch = Partial<HttpResponse>;
 /** What `prepare_http_send` (crates/yaak-wasm) hands back. */
 interface PreparedHttpSend {
   request: HttpRequest;
+  /** Hashed id of the model the authentication came from; a plugin keys its state on it. */
+  authContextId: string;
   settings: HttpSendSettings;
   settingEvents: HttpResponseEventData[];
   cookieJar: CookieJar | null;
 }
 
+/**
+ * Apply the request's authentication method, if it has one.
+ *
+ * The desktop does this to the request it is about to put on the wire, after
+ * rendering and after building the sendable form of it. Here the sendable form
+ * is built by the proxy, so the plugin's answer is applied to the model instead
+ * — headers onto `headers`, query parameters onto `urlParameters` — and the
+ * proxy folds both in exactly as it would any others. The result on the wire is
+ * the same for a method that sets a header, which is every method whose plugin
+ * runs in the browser today.
+ *
+ * It is not the same for a method that *signs* the request, because the plugin
+ * is shown the request before the proxy assembles it: AWS SigV4 and OAuth 1.0
+ * would sign a URL and a header set slightly different from the ones sent. Both
+ * are refused rather than silently mis-signed — see the sandbox README.
+ */
+async function applyAuthentication(
+  plugins: WebPlugins,
+  prepared: PreparedHttpSend,
+): Promise<HttpRequest> {
+  const { request } = prepared;
+  const authType = request.authenticationType;
+  const disabled = request.authentication?.disabled === true;
+  if (authType == null || authType === "none" || disabled) return request;
+
+  const applied = await plugins.applyHttpAuthentication(authType, {
+    contextId: prepared.authContextId,
+    values: request.authentication as Record<string, never>,
+    method: request.method,
+    url: request.url,
+    headers: request.headers.filter((h) => h.enabled !== false),
+    // The desktop passes the body so signing schemes can hash it. This host
+    // does not have it in bytes at this point, and the schemes that would use
+    // it are the ones already refused.
+    body: null,
+  });
+
+  const headers = [...request.headers];
+  for (const header of applied.setHeaders ?? []) {
+    // Replace-or-append, case-insensitively, matching `insert_header` in
+    // crates/yaak-http: a plugin setting Authorization must not end up with the
+    // request's own Authorization also on the wire.
+    const at = headers.findIndex((h) => h.name.toLowerCase() === header.name.toLowerCase());
+    const entry = { name: header.name, value: header.value, enabled: true };
+    if (at >= 0) headers[at] = { ...headers[at], ...entry };
+    else headers.push(entry);
+  }
+
+  const urlParameters = [...request.urlParameters];
+  for (const param of applied.setQueryParameters ?? []) {
+    urlParameters.push({ name: param.name, value: param.value, enabled: true });
+  }
+
+  return { ...request, headers, urlParameters };
+}
+
 /** The desktop writes progress at most this often while a body streams in. */
 const PROGRESS_INTERVAL_MS = 100;
 
@@ -63,6 +122,7 @@ const PROGRESS_INTERVAL_MS = 100;
 
 export async function sendHttpRequest(
   db: WorkerConnection,
+  plugins: WebPlugins,
   requestId: string,
   environmentId: string | null,
   cookieJarId: string | null,
@@ -78,7 +138,7 @@ export async function sendHttpRequest(
   const unlistenCancel = db.listen(`cancel_http_response_${response.id}`, () => cancel.abort());
 
   try {
-    await runSend(db, response, requestId, environmentId, cookieJarId, cancel.signal);
+    await runSend(db, plugins, response, requestId, environmentId, cookieJarId, cancel.signal);
   } catch (err) {
     const message = cancel.signal.aborted ? "Request canceled" : errorMessage(err);
     await response.finish({ error: message });
@@ -90,6 +150,7 @@ export async function sendHttpRequest(
 
 async function runSend(
   db: WorkerConnection,
+  plugins: WebPlugins,
   response: ResponseWriter,
   requestId: string,
   environmentId: string | null,
@@ -101,7 +162,8 @@ async function runSend(
     environmentId,
     cookieJarId,
   });
-  await response.patch({ url: prepared.request.url });
+  const request = await applyAuthentication(plugins, prepared);
+  await response.patch({ url: request.url });
 
   // The first line of the timeline says what did the sending and where. A
   // request through a proxy shows a different origin to the server than the
@@ -111,7 +173,7 @@ async function runSend(
   timeline.push(prepared.settingEvents);
 
   const body: SendRequest = {
-    request: prepared.request,
+    request,
     settings: prepared.settings,
     cookies: prepared.cookieJar?.cookies ?? null,
   };

packages/platform/src/web/worker.ts

@@ -108,12 +108,44 @@ function bootOnce(): Promise<void> {
   return booted;
 }
 
+/**
+ * Template functions, which live somewhere this worker cannot reach.
+ *
+ * Rendering is the engine's, and the engine is here. The functions it calls
+ * come from plugins, which run in a sandbox the tab owns — so the engine is
+ * handed a function that asks the tab. It asks the port that started the
+ * render, not every port, because only that tab is waiting on the answer and
+ * only its sandbox has the plugins the render was started against.
+ *
+ * A failure comes back as a rejection, which the engine turns into a render
+ * error naming the function. That matters: rendering `${[ uuid.v4() ]}` to an
+ * empty string and sending it would be worse than not sending at all.
+ */
+const pendingTemplateFunctions = new Map<number, (result: string | Error) => void>();
+let nextTemplateFunctionId = 1;
+
+function templateBridge(port: MessagePort): (name: string, args: string) => Promise<string> {
+  return (name, args) =>
+    new Promise<string>((resolve, reject) => {
+      const id = nextTemplateFunctionId++;
+      pendingTemplateFunctions.set(id, (r) => (r instanceof Error ? reject(r) : resolve(r)));
+      send(port, { type: "template_function", id, name, args });
+    });
+}
+
 async function handle(port: MessagePort, message: ToWorker): Promise<void> {
   if (message.type === "goodbye") {
     ports.delete(port);
     return;
   }
 
+  if (message.type === "template_function_result") {
+    const settle = pendingTemplateFunctions.get(message.id);
+    pendingTemplateFunctions.delete(message.id);
+    settle?.(message.error != null ? new Error(message.error) : (message.value ?? ""));
+    return;
+  }
+
   // Every command waits for boot rather than the tab having to. Tabs post
   // the moment they load; the port queues; this drains once the DB is open.
   try {
@@ -122,7 +154,8 @@ async function handle(port: MessagePort, message: ToWorker): Promise<void> {
     send(port, { type: "error", id: message.id, message: bootError ?? "Database failed to open" });
     return;
   }
-  const { rpc, blob_get, blob_put, blob_delete, prepare_http_send } = engine!;
+  const { rpc, blob_get, blob_put, blob_delete, prepare_http_send, render_template } =
+    engine!;
 
   try {
     switch (message.type) {
@@ -143,10 +176,15 @@ async function handle(port: MessagePort, message: ToWorker): Promise<void> {
         return;
       }
       case "prepare_http_send": {
-        const prepared = await prepare_http_send(message.payload);
+        const prepared = await prepare_http_send(message.payload, templateBridge(port));
         send(port, { type: "result", id: message.id, result: prepared });
         return;
       }
+      case "render_template": {
+        const rendered = await render_template(message.payload, templateBridge(port));
+        send(port, { type: "result", id: message.id, result: rendered });
+        return;
+      }
       case "blob_get": {
         const bytes = blob_get(message.blobId);
         if (bytes == null) {

packages/plugin-runtime/src/PluginInstance.ts

@@ -7,6 +7,12 @@ import type {
   DynamicPromptFormArg,
   PluginDefinition,
 } from "@yaakapp/api";
+import {
+  applyDynamicFormInput,
+  migrateTemplateFunctionSelectOptions,
+  stripDynamicCallbacks,
+} from "@yaakapp-internal/lib/pluginForms";
+import { createResponseBody, decodeBase64Chunk } from "@yaakapp-internal/lib/responseBody";
 import {
   applyFormInputDefaults,
   validateTemplateFunctionArgs,
@@ -17,7 +23,6 @@ import type {
   DeleteModelResponse,
   FindHttpResponsesResponse,
   Folder,
-  FormInput,
   GetCookieValueRequest,
   GetCookieValueResponse,
   GetHttpRequestByIdResponse,
@@ -49,10 +54,7 @@ import type {
   UpsertModelResponse,
   WindowInfoResponse,
 } from "@yaakapp-internal/plugins";
-import { applyDynamicFormInput } from "./common";
 import { EventChannel } from "./EventChannel";
-import { migrateTemplateFunctionSelectOptions } from "./migrations";
-import { createResponseBody, decodeBase64Chunk } from "./responseBody";
 
 /**
  * A response as a plugin should see it.
@@ -1057,16 +1059,6 @@ export class PluginInstance {
   }
 }
 
-function stripDynamicCallbacks(inputs: { dynamic?: unknown }[]): FormInput[] {
-  return inputs.map((input) => {
-    // oxlint-disable-next-line no-explicit-any -- stripping dynamic from union type
-    const { dynamic: _dynamic, ...rest } = input as any;
-    if ("inputs" in rest && Array.isArray(rest.inputs)) {
-      rest.inputs = stripDynamicCallbacks(rest.inputs);
-    }
-    return rest as FormInput;
-  });
-}
 
 function genId(len = 5): string {
   const alphabet = "01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";

packages/plugin-runtime/src/migrations.ts

@@ -1,22 +0,0 @@
-import type { TemplateFunctionPlugin } from "@yaakapp/api";
-
-export function migrateTemplateFunctionSelectOptions(
-  f: TemplateFunctionPlugin,
-): TemplateFunctionPlugin {
-  const migratedArgs = f.args.map((a) => {
-    if (a.type === "select") {
-      // Migrate old options that had 'name' instead of 'label'
-      type LegacyOption = { label?: string; value: string; name?: string };
-      a.options = a.options.map((o) => {
-        const legacy = o as LegacyOption;
-        return {
-          label: legacy.label ?? legacy.name ?? "",
-          value: legacy.value,
-        };
-      });
-    }
-    return a;
-  });
-
-  return { ...f, args: migratedArgs };
-}

packages/plugin-sandbox/README.md

@@ -0,0 +1,275 @@
+# The Yaak plugin sandbox
+
+A QuickJS interpreter, a small set of globals, and one function that calls the
+host. That is the whole runtime. Everything else a plugin does — read a request,
+send one, store a token, ask the user something — is a message the host chose to
+answer.
+
+This document is the contract. It is written to be implementable twice: once
+here, in wasm, for the browser, and once in Rust with `rquickjs`, for the desktop
+and the CLI. **If the two hosts disagree about anything below, that is a bug in
+whichever one drifted, not a platform difference to work around.** The promise
+to plugin authors is that there is one sandbox and it behaves the same
+everywhere; a promise like that is only worth making if it is enforceable, which
+is why the browser runs QuickJS rather than the Worker's own JavaScript engine.
+
+## The engine
+
+**quickjs-ng**, and only quickjs-ng.
+
+There is no real choice: `rquickjs` — the Rust binding the desktop host will use
+— vendors quickjs-ng as a git submodule and offers no alternative. Picking
+Bellard's upstream for the browser would mean the two hosts run different
+engines, which is exactly the thing this design exists to prevent.
+
+| | Version | Notes |
+|---|---|---|
+| Browser (this package) | quickjs-ng **0.12.1** | via `@jitl/quickjs-ng-wasmfile-release-sync` 0.32.0 |
+| Desktop (planned) | quickjs-ng **0.15.1** | via `rquickjs` 0.12.2 |
+
+**The version skew is a known gap, and closing it is slice-2 work.** Three minor
+versions is small — the differences are bug fixes and `Temporal` progress, not
+semantics anything here depends on — but "identical everywhere" is not a claim
+that survives being approximate indefinitely. Whoever builds the Rust host
+should pin both sides to the same tag and add a test that asserts the version
+string matches.
+
+### Why the sync build, not ASYNCIFY
+
+`quickjs-emscripten` ships an ASYNCIFY variant that lets guest code call an async
+host function *synchronously*. We use the plain sync build instead:
+
+- ASYNCIFY is about twice the wasm size (1.08 MB vs 529 KB) and, measured,
+  **2.2x slower**.
+- It can only suspend for one host call at a time. A runtime that runs several
+  plugins would have to hold one wasm instance per in-flight call.
+- We do not need it. The guest gets real `await` anyway: a host function returns
+  a QuickJS deferred promise, the host resolves it, and the host drains the job
+  queue. `ctx.store.get(...)` is an ordinary `await` inside a plugin.
+
+The only thing lost is a host call that *looks* synchronous to the guest, and no
+Yaak plugin wants one — the whole `ctx` API has been async since it existed.
+
+## What exists inside the sandbox
+
+QuickJS gives you the language and nothing else. Everything below is either
+installed by `src/guest/globals.ts` or absent. **Both hosts must install exactly
+this list.**
+
+### From the engine
+
+`Object`, `Array`, `Function`, `String`, `Number`, `Boolean`, `Symbol`, `Math`,
+`JSON`, `Date`, `RegExp`, `Error` and subclasses, `Map`, `Set`, `WeakMap`,
+`WeakSet`, `WeakRef`, `Promise`, `Proxy`, `Reflect`, `BigInt`, `ArrayBuffer`,
+`SharedArrayBuffer`, `DataView`, all `TypedArray`s, `globalThis`,
+`queueMicrotask`, `performance`.
+
+Language level is ES2023 plus most of ES2024 — `Object.groupBy`,
+`Array.prototype.at`, `String.prototype.replaceAll`, async generators, private
+fields, `??=` all work.
+
+### Installed by the runtime
+
+| Global | Notes |
+|---|---|
+| `console` | `.log/.info/.warn/.error/.debug/.trace`. Arguments are formatted to a string **inside** the sandbox, so only strings cross out — a cycle or an exotic prototype is the guest's problem, not the host's. |
+| `setTimeout` / `clearTimeout` | The host holds the real timer; QuickJS has no clock to wake on. A sandbox torn down mid-wait takes its pending timers with it. |
+| `TextEncoder` / `TextDecoder` | UTF-8 only. Pure JavaScript, in-sandbox — a bridge would cost a copy each way. Lone surrogates encode to U+FFFD, matching the standard. |
+| `btoa` / `atob` | Latin-1, same narrow contract as the browser's. |
+
+### Deliberately absent
+
+`fetch`, `XMLHttpRequest`, `WebSocket`, `crypto`, `structuredClone`, `URL`,
+`URLSearchParams`, `setInterval`, `require`, `module`, `process`, `Buffer`,
+`std`, `os`, and every Node built-in.
+
+- **Network and storage are absent because they are `ctx`'s job.** A plugin that
+  could open its own socket would defeat the point of the sandbox and would not
+  work in a browser anyway.
+- **`setInterval` is absent** because an interval is a timer that rearms and
+  nothing in a plugin should be polling. Build one from `setTimeout`, visibly.
+- **`crypto` is absent, and this is the one real gap.** The decided direction is
+  pure-JavaScript `@noble/*` inside the sandbox: audited, dependency-free,
+  identical on both hosts, no host API to keep in sync. A `yaak.crypto` builtin
+  is the escape hatch **if** a hot path is measured, not before. Concretely,
+  `template-function-uuid` does not run in the sandbox today because its `uuid`
+  dependency reaches for `node:crypto`; that is a slice-2 conversion, not a
+  missing capability.
+- **`URL` is absent** only because nothing has needed it yet. It is a reasonable
+  future addition; it must be added to both hosts together.
+
+## The module contract
+
+A module arrives as **source text**, not a file — there is no filesystem, and in
+a browser there could not be one.
+
+It is evaluated as CommonJS, via `new Function("module", "exports", "require", source)`,
+and must assign `module.exports.plugin` (or `module.exports.default`). `new
+Function` rather than an ES module is deliberate: the bundle's top-level names
+cannot collide with the shell's, and the source needs no loader hook.
+
+`require` exists **only to throw**, naming the specifier. A bundle that still
+calls it was not bundled for this target, and saying which module is missing
+beats an `undefined` that surfaces ten frames later.
+
+Bundling requirements: CommonJS, no external modules, no Node built-ins, ES2022.
+`scripts/bundle-sandbox-plugins.mjs` does this today; what a real
+`yaakcli build --target sandbox` needs is listed at the bottom of that file.
+
+## The host interface
+
+Four functions, installed on `globalThis` before any plugin code runs. A Rust
+host must expose the same four with the same names and shapes.
+
+| Function | Direction | Shape |
+|---|---|---|
+| `__yaak_call(envelopeJson)` | guest → host | Returns a **promise** of the reply JSON. The one door out. |
+| `__yaak_log(level, message)` | guest → host | Both strings. Fire and forget. |
+| `__yaak_timer_start(id, ms)` | guest → host | Host calls `__yaak_guest.fireTimer(id)` when due. |
+| `__yaak_timer_cancel(id)` | guest → host | |
+
+And the guest exposes `globalThis.__yaak_guest`:
+
+| Method | Shape |
+|---|---|
+| `load(source, pluginRefId)` | Evaluate a module. Throws if it exports no `plugin`. |
+| `summary()` | What the module contributes, as plain data. |
+| `dispatch(envelopeJson)` | Returns a promise of the reply payload JSON. |
+| `fireTimer(id)` | |
+
+### Envelopes
+
+Both directions carry `InternalEventPayload` from
+`crates/yaak-plugins/src/events.rs`, **unchanged**. That is what makes a plugin
+unable to tell which runtime it is in.
+
+```jsonc
+// dispatch, host → guest
+{ "context": { "id": "...", "label": null, "workspaceId": "..." },
+  "payload": { "type": "call_template_function_request", "name": "...", "args": { ... } } }
+
+// __yaak_call, guest → host
+{ "pluginRefId": "auth-bearer",
+  "context": { ... },
+  "payload": { "type": "get_key_value_request", "key": "token" } }
+```
+
+`pluginRefId` rides on outgoing calls because one host handler serves every
+loaded module, and a plugin's stored state is namespaced by which plugin it is —
+the same namespacing `build_shared_reply` does in `crates/yaak/src/plugin_events.rs`.
+
+A throw inside a plugin becomes `{"type":"error_response","error":"..."}`, never
+a crash and never silence: whatever asked gets a message.
+
+## The `ctx` API
+
+Built entirely out of `__yaak_call`. See `src/guest/context.ts` — it is the same
+surface the Node runtime's `PluginInstance` builds, so it is not repeated here.
+
+What differs is which calls a **host** answers. The browser host answers a
+deliberately short list (`packages/platform/src/web/plugins.ts`) and refuses the
+rest by name. Refusing by name matters: a plugin that needs something it cannot
+have should fail with a sentence someone can act on.
+
+Answered in the browser today: `get_key_value`, `set_key_value`,
+`delete_key_value`, `show_toast`. Everything else — sends, model reads and
+writes, prompts, response bodies, window info — refuses. Those are capability
+decisions, not oversights, and each should be added one at a time.
+
+`ctx.window.openUrl` throws in *every* sandbox host: a plugin-opened window is a
+desktop affordance with no browser equivalent, and handing back a handle whose
+`close()` does nothing would be worse.
+
+## Isolation and limits
+
+One runtime per worker, **one context per module**. A context is the isolation
+boundary — its own globals, its own `Object`, its own prototypes — so two plugins
+cannot see or patch each other. Sharing the runtime is deliberate: the engine and
+its wasm instance are the expensive part; contexts are not.
+
+| Limit | Value | Why |
+|---|---|---|
+| Memory | 256 MB per runtime | Sized for an importer holding a large document and the objects it parses into. |
+| Stack | 2 MB | Deep recursion becomes a guest stack overflow, not a worker crash. |
+| Synchronous execution | 60 s | A watchdog for `while (true)`, **not** a limit on real work. |
+
+The watchdog bounds *synchronous* execution only. A plugin awaiting the host is
+not looping, so the clock stops for the duration of a host call and restarts
+when the guest resumes. It is generous because it costs nothing to be: plugins
+run in their own worker, so one stuck there blocks no database command and no
+frame. It is sized off the slowest real work measured — GitHub's 12.3 MB OpenAPI
+description takes about 2.5 s (`bench/import.mjs`) — with room for a document
+several times larger before a legitimate import looks like a hang.
+
+## Where the sandbox runs, and why not in the database worker
+
+In the browser: a **dedicated worker owned by the tab**, separate from the
+SharedWorker that owns the database.
+
+- Plugin work is slow by design, and the database worker answers every tab's
+  commands synchronously. A large import in there would stall every other tab's
+  reads.
+- A plugin that never returns can be ended with `terminate()`. You cannot do
+  that to the worker holding the database.
+- The capabilities plugins actually ask for — a prompt, a toast, the active
+  request — belong to a tab, not to a database. Routing through the tab is the
+  shorter path, not a detour.
+
+The cost is that `ctx.store` goes worker → tab → database worker. It is a message
+either way, and this is the direction where a stuck plugin costs nothing.
+
+Template rendering is the one flow that runs backwards: rendering happens in the
+engine, in the database worker, but the functions it calls live here. So the
+engine is handed a callback that asks the tab, which asks the sandbox. See
+`templateBridge` in `packages/platform/src/web/worker.ts`.
+
+## Plugins versus scripts
+
+The shell is **not plugin-shaped underneath**. `load` takes source; `dispatch`
+takes an event. What a module *is* — a plugin today, a workspace script later —
+is decided by the payloads the host sends, not by the runtime.
+
+That matters for one reason. A plugin is installed, so someone consented to it,
+and a plugin may one day escalate to a full Node runtime by asking. **A script
+arrives inside a workspace — as data, through an import, a git sync, a shared
+repository — with no consent moment at all.** So scripts get this sandbox and
+only this sandbox, forever, regardless of feature pressure. Any capability added
+below must be evaluated against the script case, which is the stricter one:
+"would I want this to run because someone opened a workspace a stranger sent
+them?"
+
+Expected differences when scripts arrive, none of them built yet:
+
+- A different payload set (`run_script_request` and friends) — same envelope.
+- A tighter host-call allowlist. A script should probably not reach `ctx.store`
+  at all, and certainly not another plugin's namespace.
+- A much shorter watchdog. A pre-request script that runs for a minute is broken;
+  an importer that does is working.
+
+## Performance
+
+QuickJS is an interpreter with no JIT. Measured on GitHub's 12.3 MB OpenAPI
+description (1220 requests imported, **identical output** in both engines):
+
+| | First run | Best of 6 |
+|---|---|---|
+| Node (V8) | 304 ms | 164 ms |
+| QuickJS sandbox | 2503 ms | 2017 ms |
+
+That is **8x on the first run** and about **12x once V8 has compiled** — well
+inside the 10–50x folklore, and the first-run number is the one a user waits for
+because an import happens once. Reproduce with:
+
+```bash
+node packages/plugin-sandbox/bench/import.mjs <spec.json> 6
+```
+
+**Conclusion: importers stay in the sandbox.** 2.5 s in a worker, behind a
+progress state, for the largest public API description that exists, is a fine
+trade for one runtime everywhere. Revisit if a real document is measured
+materially worse — the escape hatch is a host builtin for the hot path, not a
+second runtime.
+
+Boot cost is small: about 80–140 ms to instantiate the wasm and load a plugin,
+paid once and lazily, so a session that never touches a plugin never pays it.
+The wasm is 529 KB, next to the 4.3 MB SQLite one.

packages/plugin-sandbox/bench/import.mjs

@@ -0,0 +1,140 @@
+/**
+ * How much slower is an importer inside the sandbox?
+ *
+ * This is the number the tiered-runtime decision rests on. Template functions
+ * and auth signing are small enough that engine speed cannot matter; importing
+ * is not. Yaak's OpenAPI importer is first-party JavaScript, not Rust, so a
+ * large specification is parsed and walked by whatever engine the runtime uses
+ * — QuickJS in a browser tab, V8 on the desktop today. If the gap is large
+ * enough to be felt on a real document, importers need a different path before
+ * the corpus is ported.
+ *
+ * Usage:
+ *   node packages/plugin-sandbox/bench/import.mjs <spec.json> [iterations]
+ */
+
+import { build } from "esbuild";
+import { mkdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { pathToFileURL } from "node:url";
+import { bundlePlugin } from "../../../scripts/bundle-sandbox-plugins.mjs";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+const PLUGIN = "importer-openapi";
+
+const specPath = process.argv[2];
+const iterations = Number(process.argv[3] ?? 3);
+if (specPath == null) {
+  console.error("usage: node bench/import.mjs <spec.json> [iterations]");
+  process.exit(1);
+}
+
+const spec = readFileSync(specPath, "utf8");
+console.log(`Spec: ${specPath} (${(spec.length / 1024 / 1024).toFixed(1)} MB)`);
+console.log(`Iterations: ${iterations}\n`);
+
+/** The sandbox host, bundled for Node so this script can drive it directly. */
+async function loadHost() {
+  // Inside node_modules so the emitted bundle's own imports of the QuickJS
+  // variant resolve the way any other module's would.
+  const outDir = join(root, "node_modules", ".cache", "yaak-plugin-sandbox");
+  mkdirSync(outDir, { recursive: true });
+  const outfile = join(outDir, "host.mjs");
+  await build({
+    entryPoints: [join(root, "packages/plugin-sandbox/src/host/sandbox.ts")],
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node22",
+    outfile,
+    // Resolved from the repo at run time, so the wasm variant is the real one.
+    external: ["@jitl/*", "quickjs-emscripten-core"],
+  });
+  return import(pathToFileURL(outfile).href);
+}
+
+const ctxStub = { id: "bench", label: null, workspaceId: "wk_bench" };
+
+function stats(times) {
+  const sorted = [...times].sort((a, b) => a - b);
+  const mean = times.reduce((a, b) => a + b, 0) / times.length;
+  return { min: sorted[0], median: sorted[Math.floor(sorted.length / 2)], mean };
+}
+
+function report(label, times, resourceCount) {
+  const { min, median } = stats(times);
+  console.log(
+    `${label.padEnd(20)} first ${times[0].toFixed(0).padStart(5)} ms   ` +
+      `best ${min.toFixed(0).padStart(5)} ms   ` +
+      `median ${median.toFixed(0).padStart(5)} ms   (${resourceCount} requests)`,
+  );
+  // Every run, because the spread is the point: V8 compiles this workload
+  // across the first few passes and QuickJS, which does not compile at all,
+  // does not. Quoting one ratio would pick a winner by choosing when to look.
+  console.log(`${" ".repeat(20)} runs: ${times.map((t) => t.toFixed(0)).join(", ")} ms`);
+  return { first: times[0], best: min };
+}
+
+/* --------------------------------- Node ---------------------------------- */
+
+const nodeTimes = [];
+let nodeCount = 0;
+{
+  const { createRequire } = await import("node:module");
+  const require = createRequire(join(root, "package.json"));
+  const mod = require(join(root, "plugins", PLUGIN, "build", "index.js"));
+  const plugin = mod.plugin ?? mod.default;
+
+  for (let i = 0; i < iterations; i++) {
+    const started = performance.now();
+    const result = await plugin.importer.onImport(ctxStub, { text: spec });
+    nodeTimes.push(performance.now() - started);
+    nodeCount = result?.resources?.httpRequests?.length ?? 0;
+  }
+}
+const node = report("Node (V8)", nodeTimes, nodeCount);
+
+/* -------------------------------- QuickJS -------------------------------- */
+
+const quickTimes = [];
+let quickCount = 0;
+{
+  const { PluginSandboxHost } = await loadHost();
+  const source = await bundlePlugin(PLUGIN);
+
+  const host = new PluginSandboxHost(
+    async () => JSON.stringify({ type: "empty_response" }),
+    (log) => console.error(`[${log.level}] ${log.message}`),
+  );
+
+  const loadStarted = performance.now();
+  await host.load(PLUGIN, source);
+  console.log(`(sandbox boot + load: ${(performance.now() - loadStarted).toFixed(0)} ms)\n`);
+
+  for (let i = 0; i < iterations; i++) {
+    const started = performance.now();
+    const reply = JSON.parse(
+      await host.dispatch(
+        PLUGIN,
+        JSON.stringify({ context: ctxStub, payload: { type: "import_request", content: spec } }),
+      ),
+    );
+    quickTimes.push(performance.now() - started);
+    if (reply.type === "error_response") throw new Error(reply.error);
+    quickCount = reply.resources?.httpRequests?.length ?? 0;
+  }
+  host.dispose();
+}
+const quick = report("QuickJS (sandbox)", quickTimes, quickCount);
+
+console.log(
+  `\nFirst run (what a user waits for): ${(quick.first / 1000).toFixed(1)}s in the sandbox ` +
+    `vs ${(node.first / 1000).toFixed(1)}s in Node — ${(quick.first / node.first).toFixed(1)}x.`,
+);
+console.log(
+  `Best run (both warm): ${(quick.best / node.best).toFixed(1)}x, which is the ceiling once V8 has compiled.`,
+);
+if (nodeCount !== quickCount) {
+  console.log(`WARNING: request counts differ (${nodeCount} vs ${quickCount}) — not the same work.`);
+}

packages/plugin-sandbox/build-guest.mjs

@@ -0,0 +1,56 @@
+/**
+ * Bundle the guest shell into a string the host can evaluate.
+ *
+ * The shell runs inside QuickJS, which has no module loader and no filesystem,
+ * so it has to arrive as source text. Emitting it as a `.ts` module rather than
+ * a `.js` asset is what lets every consumer — Vite for the browser build, plain
+ * Node for the benchmarks — get at it the same way, with no loader plugin and
+ * no `?raw` import that only one bundler understands.
+ *
+ * The output is committed, like the wasm packages are, so a checkout builds
+ * without this step having run.
+ */
+
+import { build } from "esbuild";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const outDir = join(here, "src", "generated");
+
+const result = await build({
+  entryPoints: [join(here, "src", "guest", "index.ts")],
+  bundle: true,
+  write: false,
+  // A script, not a module: the host evaluates it with `evalCode`, and it
+  // announces itself by assigning `globalThis.__yaak_guest`.
+  format: "iife",
+  // Nothing here may reach for a Node built-in, and "browser" is the closest
+  // description of a target with globals and no filesystem. QuickJS itself has
+  // fewer globals than any browser, which is what `guest/globals.ts` is for.
+  platform: "browser",
+  // QuickJS is ES2023-complete, so nothing needs downleveling. Keeping the
+  // source as written also keeps stack traces from the guest readable.
+  target: "es2022",
+  minify: false,
+  legalComments: "none",
+});
+
+const source = result.outputFiles[0].text;
+
+mkdirSync(outDir, { recursive: true });
+writeFileSync(
+  join(outDir, "guest.ts"),
+  [
+    "// Generated by build-guest.mjs. Do not edit.",
+    "//",
+    "// The runtime shell, as source text, for evaluation inside QuickJS.",
+    "// Regenerate with `npm run build --workspace @yaakapp-internal/plugin-sandbox`.",
+    "",
+    `export const GUEST_SOURCE = ${JSON.stringify(source)};`,
+    "",
+  ].join("\n"),
+);
+
+console.log(`Bundled guest shell: ${(source.length / 1024).toFixed(1)} KB`);

packages/plugin-sandbox/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@yaakapp-internal/plugin-sandbox",
+  "version": "1.0.0",
+  "private": true,
+  "main": "src/index.ts",
+  "scripts": {
+    "bootstrap": "npm run build",
+    "build": "node build-guest.mjs"
+  },
+  "dependencies": {
+    "@jitl/quickjs-ng-wasmfile-release-sync": "^0.32.0",
+    "quickjs-emscripten-core": "^0.32.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.0"
+  }
+}

packages/plugin-sandbox/src/guest/context.ts

@@ -0,0 +1,370 @@
+/**
+ * `ctx`, as a plugin sees it, built entirely out of one call to the host.
+ *
+ * Every method here serializes a request payload, hands it out of the sandbox,
+ * and awaits a reply payload. That is the whole capability surface: the sandbox
+ * has no socket, no clock it owns, no storage and no DOM, so anything a plugin
+ * does to the world is a message the host chose to answer. The payload shapes
+ * are the ones in `crates/yaak-plugins/src/events.rs`, unchanged, so a plugin
+ * written for the Node runtime runs here without knowing which host it has.
+ */
+
+import type {
+  CallPromptFormDynamicArgs,
+  Context,
+  DynamicPromptFormArg,
+} from "@yaakapp/api";
+import {
+  applyDynamicFormInput,
+  stripDynamicCallbacks,
+} from "@yaakapp-internal/lib/pluginForms";
+import { createResponseBody, decodeBase64Chunk } from "@yaakapp-internal/lib/responseBody";
+import { applyFormInputDefaults } from "@yaakapp-internal/lib/templateFunction";
+import type {
+  DeleteKeyValueResponse,
+  DeleteModelResponse,
+  FindHttpResponsesResponse,
+  Folder,
+  FormInput,
+  GetCookieValueRequest,
+  GetCookieValueResponse,
+  GetHttpRequestByIdResponse,
+  GetHttpResponseBodyInfoResponse,
+  GetKeyValueResponse,
+  HttpRequest,
+  HttpResponse,
+  InternalEventPayload,
+  ListCookieNamesResponse,
+  ListFoldersResponse,
+  ListHttpRequestsRequest,
+  ListHttpRequestsResponse,
+  ListOpenWorkspacesResponse,
+  PluginContext,
+  PromptFormResponse,
+  PromptTextResponse,
+  ReadHttpResponseBodyChunkResponse,
+  RenderGrpcRequestResponse,
+  RenderHttpRequestResponse,
+  SendHttpRequestResponse,
+  TemplateRenderRequest,
+  TemplateRenderResponse,
+  UpsertModelResponse,
+  WindowInfoResponse,
+} from "@yaakapp-internal/plugins";
+
+/** What the host installs: one request out, one reply back. */
+export type HostCall = (
+  context: PluginContext,
+  payload: InternalEventPayload,
+) => Promise<Record<string, unknown>>;
+
+/**
+ * A response as a plugin should see it.
+ *
+ * `bodyPath` names a file on a host's disk. There is no disk here and there is
+ * none in a browser, and plugins address bodies by response id, so it is
+ * dropped rather than left for one to grow a dependency on.
+ */
+function forPlugin(httpResponse: HttpResponse): HttpResponse {
+  const { bodyPath: _bodyPath, ...rest } = httpResponse as HttpResponse & {
+    bodyPath?: string | null;
+  };
+  return rest;
+}
+
+export function newContext(call: HostCall, context: PluginContext): Context {
+  const send = <T>(payload: InternalEventPayload): Promise<T> =>
+    call(context, payload) as Promise<T>;
+
+  /** Read a body the host has stored, a chunk at a time, following it if it is still arriving. */
+  const storedBody = async (responseId: string) => {
+    const bodyInfo = () =>
+      send<GetHttpResponseBodyInfoResponse>({
+        type: "get_http_response_body_info_request",
+        responseId,
+      });
+    const info = await bodyInfo();
+
+    return createResponseBody(
+      {
+        responseId,
+        contentLength: info.contentLength,
+        contentType: info.contentType ?? null,
+        complete: info.complete,
+      },
+      async (offset, length) => {
+        const chunk = await send<ReadHttpResponseBodyChunkResponse>({
+          type: "read_http_response_body_chunk_request",
+          responseId,
+          offset,
+          length,
+        });
+        return decodeBase64Chunk(chunk.data);
+      },
+      { refresh: bodyInfo },
+    );
+  };
+
+  const windowInfo = async () => {
+    if (context.label == null) {
+      throw new Error("Can't get window context without an active window");
+    }
+    return send<WindowInfoResponse>({ type: "window_info_request", label: context.label });
+  };
+
+  const ctx: Context = {
+    clipboard: {
+      copyText: async (text) => {
+        await send({ type: "copy_text_request", text });
+      },
+    },
+    toast: {
+      show: async (args) => {
+        await send({
+          type: "show_toast_request",
+          // Defaulted here because null and undefined both become None in Rust.
+          timeout: args.timeout === undefined ? 5000 : args.timeout,
+          ...args,
+        });
+      },
+    },
+    window: {
+      requestId: async () => (await windowInfo()).requestId,
+      workspaceId: async () => (await windowInfo()).workspaceId,
+      environmentId: async () => (await windowInfo()).environmentId,
+      openUrl: async () => {
+        // A window is the host's to open, and the browser host has one tab. A
+        // plugin asking is told so rather than handed a handle that does
+        // nothing when it calls `close()`.
+        throw new Error("ctx.window.openUrl is not available in the sandbox runtime");
+      },
+      openExternalUrl: async (url) => {
+        await send({ type: "open_external_url_request", url });
+      },
+    },
+    prompt: {
+      text: async (args) => {
+        const reply = await send<PromptTextResponse>({ type: "prompt_text_request", ...args });
+        return reply.value;
+      },
+      form: async (args) => {
+        // The inputs a plugin declares may compute themselves from the values
+        // entered so far. The host draws a static form, so they are resolved
+        // against the defaults before it is drawn and the callbacks stripped
+        // — a function cannot cross the boundary, and one left in would
+        // serialize to nothing and take its input's shape with it.
+        const defaults = applyFormInputDefaults(args.inputs, {});
+        const callArgs: CallPromptFormDynamicArgs = { values: defaults };
+        const resolved = await applyDynamicFormInput(
+          ctx,
+          args.inputs as DynamicPromptFormArg[],
+          callArgs,
+        );
+        const reply = await send<PromptFormResponse>({
+          type: "prompt_form_request",
+          ...args,
+          inputs: stripDynamicCallbacks(resolved) as FormInput[],
+        });
+        return reply.values;
+      },
+    },
+    httpResponse: {
+      find: async (args) => {
+        const { httpResponses } = await send<FindHttpResponsesResponse>({
+          type: "find_http_responses_request",
+          ...args,
+        });
+        return httpResponses.map(forPlugin);
+      },
+      body: ({ responseId }) => storedBody(responseId),
+    },
+    grpcRequest: {
+      render: async (args) => {
+        const { grpcRequest } = await send<RenderGrpcRequestResponse>({
+          type: "render_grpc_request_request",
+          ...args,
+        });
+        return grpcRequest;
+      },
+    },
+    httpRequest: {
+      getById: async (args) => {
+        const { httpRequest } = await send<GetHttpRequestByIdResponse>({
+          type: "get_http_request_by_id_request",
+          ...args,
+        });
+        return httpRequest;
+      },
+      send: async (args) => {
+        const { httpResponse, body } = await send<SendHttpRequestResponse>({
+          type: "send_http_request_request",
+          ...args,
+        });
+
+        // A send with no request behind it saves nothing, so the reply carries
+        // the only copy of its body. A saved one is read back from the host
+        // like any other. Callers get the same thing either way.
+        if (body == null) {
+          return {
+            httpResponse: forPlugin(httpResponse),
+            body: await storedBody(httpResponse.id),
+          };
+        }
+
+        const bytes = decodeBase64Chunk(body);
+        return {
+          httpResponse: forPlugin(httpResponse),
+          body: createResponseBody(
+            {
+              responseId: httpResponse.id,
+              contentLength: bytes.byteLength,
+              contentType:
+                httpResponse.headers.find((h) => h.name.toLowerCase() === "content-type")?.value ??
+                null,
+              // The host waited for the whole send before replying.
+              complete: true,
+            },
+            async (offset, length) => bytes.slice(offset, offset + length),
+          ),
+        };
+      },
+      render: async (args) => {
+        const { httpRequest } = await send<RenderHttpRequestResponse>({
+          type: "render_http_request_request",
+          ...args,
+        });
+        return httpRequest;
+      },
+      list: async (args?: { folderId?: string }) => {
+        const payload: InternalEventPayload = {
+          type: "list_http_requests_request",
+          folderId: args?.folderId,
+        } satisfies ListHttpRequestsRequest & { type: "list_http_requests_request" };
+        const { httpRequests } = await send<ListHttpRequestsResponse>(payload);
+        return httpRequests;
+      },
+      create: async (args) => {
+        const response = await send<UpsertModelResponse>({
+          type: "upsert_model_request",
+          model: { name: "", method: "GET", ...args, id: "", model: "http_request" },
+        } as InternalEventPayload);
+        return response.model as HttpRequest;
+      },
+      update: async (args) => {
+        const response = await send<UpsertModelResponse>({
+          type: "upsert_model_request",
+          model: { model: "http_request", ...args },
+        } as InternalEventPayload);
+        return response.model as HttpRequest;
+      },
+      delete: async (args) => {
+        const response = await send<DeleteModelResponse>({
+          type: "delete_model_request",
+          model: "http_request",
+          id: args.id,
+        } as InternalEventPayload);
+        return response.model as HttpRequest;
+      },
+    },
+    folder: {
+      list: async () => {
+        const { folders } = await send<ListFoldersResponse>({ type: "list_folders_request" });
+        return folders;
+      },
+      getById: async (args: { id: string }) => {
+        const { folders } = await send<ListFoldersResponse>({ type: "list_folders_request" });
+        return folders.find((f) => f.id === args.id) ?? null;
+      },
+      create: async ({ name, ...args }) => {
+        const response = await send<UpsertModelResponse>({
+          type: "upsert_model_request",
+          model: { ...args, name: name ?? "", id: "", model: "folder" },
+        } as InternalEventPayload);
+        return response.model as Folder;
+      },
+      update: async (args) => {
+        const response = await send<UpsertModelResponse>({
+          type: "upsert_model_request",
+          model: { model: "folder", ...args },
+        } as InternalEventPayload);
+        return response.model as Folder;
+      },
+      delete: async (args: { id: string }) => {
+        const response = await send<DeleteModelResponse>({
+          type: "delete_model_request",
+          model: "folder",
+          id: args.id,
+        } as InternalEventPayload);
+        return response.model as Folder;
+      },
+    },
+    cookies: {
+      getValue: async (args: GetCookieValueRequest) => {
+        const { value } = await send<GetCookieValueResponse>({
+          type: "get_cookie_value_request",
+          ...args,
+        });
+        return value;
+      },
+      listNames: async () => {
+        const { names } = await send<ListCookieNamesResponse>({ type: "list_cookie_names_request" });
+        return names;
+      },
+    },
+    templates: {
+      render: async (args: TemplateRenderRequest) => {
+        const result = await send<TemplateRenderResponse>({
+          type: "template_render_request",
+          ...args,
+        });
+        // oxlint-disable-next-line no-explicit-any -- the caller knows its own shape
+        return result.data as any;
+      },
+    },
+    store: {
+      get: async <T>(key: string) => {
+        const result = await send<GetKeyValueResponse>({ type: "get_key_value_request", key });
+        return result.value ? (JSON.parse(result.value) as T) : undefined;
+      },
+      set: async <T>(key: string, value: T) => {
+        await send<GetKeyValueResponse>({
+          type: "set_key_value_request",
+          key,
+          value: JSON.stringify(value),
+        });
+      },
+      delete: async (key: string) => {
+        const result = await send<DeleteKeyValueResponse>({
+          type: "delete_key_value_request",
+          key,
+        });
+        return result.deleted;
+      },
+    },
+    plugin: {
+      reload: () => {
+        void send({ type: "reload_response", silent: true });
+      },
+    },
+    workspace: {
+      list: async () => {
+        const response = await send<ListOpenWorkspacesResponse>({
+          type: "list_open_workspaces_request",
+        });
+        return response.workspaces.map((w) => {
+          type WorkspaceInfoInternal = typeof w & { label?: string };
+          return {
+            id: w.id,
+            name: w.name,
+            // Kept for routing, hidden from plugin authors.
+            _label: (w as WorkspaceInfoInternal).label as string,
+          };
+        });
+      },
+      withContext: (handle: { id: string; name: string; _label?: string }) =>
+        newContext(call, { ...context, label: handle._label || null, workspaceId: handle.id }),
+    },
+  };
+
+  return ctx;
+}

packages/plugin-sandbox/src/guest/globals.ts

@@ -0,0 +1,267 @@
+/**
+ * The globals that exist inside the sandbox.
+ *
+ * QuickJS is the language and nothing else: it has `Promise`, `BigInt` and the
+ * ES2024 built-ins, and no `console`, no `setTimeout`, no `TextEncoder`. The
+ * platform globals a browser or Node would supply are not there because there
+ * is no platform — which is the point. What a plugin can reach is what this
+ * file installs, and every one of these has to exist identically on the Rust
+ * host too, so the list is kept short and boring on purpose.
+ *
+ * Two of them are implemented here in pure JavaScript rather than bridged to
+ * the host: the text codecs are twenty lines and a bridge would cost a copy
+ * each way for no gain. Timers cannot be — the sandbox has no event loop of its
+ * own — so those are the host's.
+ */
+
+declare const __yaak_log: (level: string, message: string) => void;
+declare const __yaak_timer_start: (id: number, ms: number) => void;
+declare const __yaak_timer_cancel: (id: number) => void;
+
+/* -------------------------------- console -------------------------------- */
+
+/**
+ * Arguments as a line of text, formatted here rather than at the host.
+ *
+ * Only strings cross the boundary, so a plugin logging an object gets it
+ * serialized inside the sandbox, where its own prototypes still exist and a
+ * cycle is this function's problem rather than the host's.
+ */
+function formatArgs(args: unknown[]): string {
+  return args
+    .map((arg) => {
+      if (typeof arg === "string") return arg;
+      if (arg instanceof Error) return arg.stack ?? `${arg.name}: ${arg.message}`;
+      try {
+        return JSON.stringify(arg, replacer()) ?? String(arg);
+      } catch {
+        return String(arg);
+      }
+    })
+    .join(" ");
+}
+
+function replacer(): (key: string, value: unknown) => unknown {
+  const seen = new WeakSet<object>();
+  return (_key, value) => {
+    if (typeof value === "bigint") return `${value}n`;
+    if (typeof value === "function") return `[Function ${value.name || "anonymous"}]`;
+    if (typeof value === "object" && value !== null) {
+      if (seen.has(value)) return "[Circular]";
+      seen.add(value);
+    }
+    return value;
+  };
+}
+
+function installConsole(): void {
+  const log = (level: string) => (...args: unknown[]) => __yaak_log(level, formatArgs(args));
+  (globalThis as Record<string, unknown>).console = {
+    log: log("log"),
+    info: log("info"),
+    warn: log("warn"),
+    error: log("error"),
+    debug: log("debug"),
+    trace: log("debug"),
+  };
+}
+
+/* --------------------------------- timers -------------------------------- */
+
+/**
+ * Timers, owned by the host.
+ *
+ * QuickJS has no clock to wake on: `executePendingJobs` drains microtasks and
+ * returns, so a `setTimeout` implemented in here would either never fire or
+ * spin. The host holds the real timer and calls back in, which also means a
+ * sandbox torn down mid-wait takes its pending timers with it.
+ */
+const timerCallbacks = new Map<number, () => void>();
+let nextTimerId = 1;
+
+function installTimers(): void {
+  const g = globalThis as Record<string, unknown>;
+
+  g.setTimeout = (callback: (...a: unknown[]) => void, ms?: number, ...args: unknown[]) => {
+    const id = nextTimerId++;
+    timerCallbacks.set(id, () => callback(...args));
+    __yaak_timer_start(id, Math.max(0, Number(ms) || 0));
+    return id;
+  };
+
+  g.clearTimeout = (id: number) => {
+    if (!timerCallbacks.delete(id)) return;
+    __yaak_timer_cancel(id);
+  };
+
+  // Same contract, and deliberately not repeating: an interval is a timer that
+  // rearms, and nothing in a plugin should be polling anyway. A plugin that
+  // wants one can build it from `setTimeout`, visibly.
+  g.setInterval = undefined;
+  g.clearInterval = undefined;
+}
+
+/** Called by the host when a timer it is holding comes due. */
+function fireTimer(id: number): void {
+  const callback = timerCallbacks.get(id);
+  timerCallbacks.delete(id);
+  callback?.();
+}
+
+/* ------------------------------- text codecs ------------------------------ */
+
+class SandboxTextEncoder {
+  readonly encoding = "utf-8";
+
+  encode(input = ""): Uint8Array {
+    const out: number[] = [];
+    for (let i = 0; i < input.length; i++) {
+      let code = input.charCodeAt(i);
+      // A surrogate pair is one code point; a lone surrogate becomes U+FFFD,
+      // which is what the standard encoder does rather than erroring.
+      if (code >= 0xd800 && code <= 0xdbff) {
+        const next = input.charCodeAt(i + 1);
+        if (next >= 0xdc00 && next <= 0xdfff) {
+          code = (code - 0xd800) * 0x400 + (next - 0xdc00) + 0x10000;
+          i++;
+        } else {
+          code = 0xfffd;
+        }
+      } else if (code >= 0xdc00 && code <= 0xdfff) {
+        code = 0xfffd;
+      }
+
+      if (code < 0x80) out.push(code);
+      else if (code < 0x800) out.push(0xc0 | (code >> 6), 0x80 | (code & 0x3f));
+      else if (code < 0x10000)
+        out.push(0xe0 | (code >> 12), 0x80 | ((code >> 6) & 0x3f), 0x80 | (code & 0x3f));
+      else
+        out.push(
+          0xf0 | (code >> 18),
+          0x80 | ((code >> 12) & 0x3f),
+          0x80 | ((code >> 6) & 0x3f),
+          0x80 | (code & 0x3f),
+        );
+    }
+    return new Uint8Array(out);
+  }
+}
+
+class SandboxTextDecoder {
+  readonly encoding = "utf-8";
+
+  decode(input?: ArrayBuffer | ArrayBufferView): string {
+    if (input == null) return "";
+    const bytes =
+      input instanceof Uint8Array
+        ? input
+        : ArrayBuffer.isView(input)
+          ? new Uint8Array(input.buffer, input.byteOffset, input.byteLength)
+          : new Uint8Array(input);
+
+    let out = "";
+    for (let i = 0; i < bytes.length; ) {
+      const byte = bytes[i]!;
+      let code: number;
+      let size: number;
+      if (byte < 0x80) {
+        code = byte;
+        size = 1;
+      } else if ((byte & 0xe0) === 0xc0) {
+        code = byte & 0x1f;
+        size = 2;
+      } else if ((byte & 0xf0) === 0xe0) {
+        code = byte & 0x0f;
+        size = 3;
+      } else if ((byte & 0xf8) === 0xf0) {
+        code = byte & 0x07;
+        size = 4;
+      } else {
+        out += "�";
+        i++;
+        continue;
+      }
+
+      if (i + size > bytes.length) {
+        out += "�";
+        break;
+      }
+      for (let k = 1; k < size; k++) {
+        const cont = bytes[i + k]!;
+        if ((cont & 0xc0) !== 0x80) {
+          code = -1;
+          break;
+        }
+        code = (code << 6) | (cont & 0x3f);
+      }
+      i += size;
+
+      if (code < 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) out += "�";
+      else if (code < 0x10000) out += String.fromCharCode(code);
+      else {
+        const c = code - 0x10000;
+        out += String.fromCharCode(0xd800 + (c >> 10), 0xdc00 + (c & 0x3ff));
+      }
+    }
+    return out;
+  }
+}
+
+function installTextCodecs(): void {
+  const g = globalThis as Record<string, unknown>;
+  g.TextEncoder = SandboxTextEncoder;
+  g.TextDecoder = SandboxTextDecoder;
+}
+
+/* ------------------------------ base64 helpers ---------------------------- */
+
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+function installBase64(): void {
+  const g = globalThis as Record<string, unknown>;
+
+  // Latin-1 in, base64 out — the same narrow contract the browser's have, so a
+  // plugin that reaches for them behaves the same here as it does there.
+  g.btoa = (input: string): string => {
+    let out = "";
+    for (let i = 0; i < input.length; i += 3) {
+      const a = input.charCodeAt(i);
+      const b = input.charCodeAt(i + 1);
+      const c = input.charCodeAt(i + 2);
+      if (a > 0xff || b > 0xff || c > 0xff) {
+        throw new Error("btoa: string contains characters outside of the Latin1 range");
+      }
+      const chunk = (a << 16) | ((Number.isNaN(b) ? 0 : b) << 8) | (Number.isNaN(c) ? 0 : c);
+      out += B64[(chunk >> 18) & 63]! + B64[(chunk >> 12) & 63]!;
+      out += Number.isNaN(b) ? "=" : B64[(chunk >> 6) & 63]!;
+      out += Number.isNaN(c) ? "=" : B64[chunk & 63]!;
+    }
+    return out;
+  };
+
+  g.atob = (input: string): string => {
+    const clean = input.replace(/[\t\n\f\r ]/g, "").replace(/=+$/, "");
+    let out = "";
+    let bits = 0;
+    let acc = 0;
+    for (const ch of clean) {
+      const value = B64.indexOf(ch);
+      if (value < 0) throw new Error("atob: string contains invalid characters");
+      acc = (acc << 6) | value;
+      bits += 6;
+      if (bits >= 8) {
+        bits -= 8;
+        out += String.fromCharCode((acc >> bits) & 0xff);
+      }
+    }
+    return out;
+  };
+}
+
+export function installGlobals(): { fireTimer: (id: number) => void } {
+  installConsole();
+  installTimers();
+  installTextCodecs();
+  installBase64();
+  return { fireTimer };
+}

packages/plugin-sandbox/src/guest/index.ts

@@ -0,0 +1,355 @@
+/**
+ * The runtime shell, as it exists inside the sandbox.
+ *
+ * This is the whole of what QuickJS evaluates before any untrusted code does:
+ * it installs the globals, loads one module, and answers events against it.
+ * The Node runtime's `PluginInstance` does the same job on the other side of a
+ * WebSocket; the difference is that this one has no filesystem to load from and
+ * no host objects to reach for, so the module arrives as source text and every
+ * capability arrives as a reply.
+ *
+ * It is deliberately not plugin-shaped underneath. `load` takes source and
+ * `dispatch` takes an event: what a module *is* — a plugin today, a workspace
+ * script later — is decided by the payloads the host sends, not by this file.
+ * Scripts are the reason that matters. A plugin is installed, so someone
+ * consented to it; a script arrives inside a workspace, as data, with no such
+ * moment, which is why scripts will never get a runtime other than this one.
+ */
+
+import type { PluginDefinition } from "@yaakapp/api";
+import {
+  applyFormInputDefaults,
+  validateTemplateFunctionArgs,
+} from "@yaakapp-internal/lib/templateFunction";
+import {
+  applyDynamicFormInput,
+  migrateTemplateFunctionSelectOptions,
+  stripDynamicCallbacks,
+} from "@yaakapp-internal/lib/pluginForms";
+import type {
+  GrpcRequestAction,
+  HttpAuthenticationAction,
+  HttpRequestAction,
+  ImportResources,
+  InternalEventPayload,
+  PluginContext,
+  TemplateFunction,
+} from "@yaakapp-internal/plugins";
+import { newContext } from "./context";
+import { installGlobals } from "./globals";
+
+declare const __yaak_call: (payloadJson: string) => Promise<string>;
+
+const { fireTimer } = installGlobals();
+
+/** The loaded module, and the id the host knows it by. */
+let mod: PluginDefinition = {};
+let pluginRefId = "";
+
+/**
+ * Evaluate a module's source.
+ *
+ * The bundles are CommonJS, so they are handed the three names that implies and
+ * nothing else. `require` is the interesting one: it exists only to fail, by
+ * name, because a bundle that still calls it did not get bundled for this
+ * target and the honest outcome is a message saying which specifier is missing
+ * rather than an undefined that surfaces ten frames later.
+ */
+function load(source: string, refId: string): void {
+  const module: { exports: Record<string, unknown> } = { exports: {} };
+  const require = (specifier: string) => {
+    throw new Error(
+      `Module "${specifier}" is not available in the sandbox runtime. ` +
+        `Plugins must be bundled with no external or built-in modules.`,
+    );
+  };
+
+  // `new Function` rather than an ES module so the bundle's own top-level names
+  // cannot collide with this shell's, and so the source can arrive as a string
+  // with no loader hook. Evaluating untrusted source is the entire job of this
+  // file; the isolation is the QuickJS context around it, not a lint rule.
+  // oxlint-disable-next-line no-implied-eval
+  const factory = new Function("module", "exports", "require", source);
+  factory(module, module.exports, require);
+
+  const loaded = (module.exports.plugin ?? module.exports.default) as PluginDefinition | undefined;
+  if (loaded == null || typeof loaded !== "object") {
+    throw new Error("Module did not export `plugin`");
+  }
+  mod = loaded;
+  pluginRefId = refId;
+}
+
+/** Everything a module contributes, without the functions that implement it. */
+function summary(): Record<string, unknown> {
+  return {
+    templateFunctions: (mod.templateFunctions ?? []).map((f) => f.name),
+    authentication: mod.authentication?.name ?? null,
+    importer: mod.importer != null,
+    filter: mod.filter != null,
+    themes: (mod.themes ?? []).length,
+    httpRequestActions: (mod.httpRequestActions ?? []).length,
+    workspaceActions: (mod.workspaceActions ?? []).length,
+    folderActions: (mod.folderActions ?? []).length,
+    grpcRequestActions: (mod.grpcRequestActions ?? []).length,
+    websocketRequestActions: (mod.websocketRequestActions ?? []).length,
+  };
+}
+
+const EMPTY: InternalEventPayload = { type: "empty_response" };
+
+/**
+ * Answer one event against the loaded module.
+ *
+ * Every branch mirrors the Node runtime's, because the payloads are the same
+ * payloads — a plugin cannot tell which runtime it is in, and that is the
+ * promise the whole design exists to keep. An unmatched event gets
+ * `empty_response` rather than silence, so a caller never waits forever for a
+ * capability this module doesn't have.
+ */
+async function dispatch(
+  context: PluginContext,
+  payload: InternalEventPayload,
+): Promise<InternalEventPayload> {
+  const ctx = newContext(hostCall, context);
+
+  if (payload.type === "boot_request") {
+    await mod.init?.(ctx);
+    return { type: "boot_response" };
+  }
+
+  if (payload.type === "terminate_request") {
+    await mod.dispose?.();
+    return { type: "terminate_response" };
+  }
+
+  if (payload.type === "import_request" && typeof mod.importer?.onImport === "function") {
+    const reply = await mod.importer.onImport(ctx, { text: payload.content });
+    if (reply != null) {
+      return { type: "import_response", resources: reply.resources as ImportResources };
+    }
+    return EMPTY;
+  }
+
+  if (payload.type === "filter_request" && typeof mod.filter?.onFilter === "function") {
+    const reply = await mod.filter.onFilter(ctx, {
+      filter: payload.filter,
+      payload: payload.content,
+      mimeType: payload.type,
+    });
+    return { type: "filter_response", ...reply };
+  }
+
+  if (payload.type === "get_themes_request" && Array.isArray(mod.themes)) {
+    return { type: "get_themes_response", themes: mod.themes };
+  }
+
+  /* --------------------------- template functions -------------------------- */
+
+  if (
+    payload.type === "get_template_function_summary_request" &&
+    Array.isArray(mod.templateFunctions)
+  ) {
+    const functions: TemplateFunction[] = mod.templateFunctions.map((f) => ({
+      ...migrateTemplateFunctionSelectOptions(f),
+      onRender: undefined,
+    }));
+    return { type: "get_template_function_summary_response", pluginRefId, functions };
+  }
+
+  if (
+    payload.type === "get_template_function_config_request" &&
+    Array.isArray(mod.templateFunctions)
+  ) {
+    const found = mod.templateFunctions.find((f) => f.name === payload.name);
+    if (found == null) return EMPTY;
+
+    const fn = { ...migrateTemplateFunctionSelectOptions(found), onRender: undefined };
+    payload.values = applyFormInputDefaults(fn.args, payload.values);
+    const resolved = await applyDynamicFormInput(ctx, fn.args, {
+      ...payload,
+      purpose: "preview",
+    } as const);
+
+    return {
+      type: "get_template_function_config_response",
+      pluginRefId,
+      function: { ...fn, args: stripDynamicCallbacks(resolved) },
+    };
+  }
+
+  if (payload.type === "call_template_function_request" && Array.isArray(mod.templateFunctions)) {
+    const fn = mod.templateFunctions.find((f) => f.name === payload.name);
+
+    if (
+      payload.args.purpose === "preview" &&
+      (fn?.previewType === "click" || fn?.previewType === "none")
+    ) {
+      return {
+        type: "call_template_function_response",
+        value: null,
+        error: "Live preview disabled for this function",
+      };
+    }
+
+    if (typeof fn?.onRender === "function") {
+      const resolved = await applyDynamicFormInput(ctx, fn.args, payload.args);
+      const values = applyFormInputDefaults(resolved, payload.args.values);
+      const error = validateTemplateFunctionArgs(fn.name, resolved, values);
+      if (error && payload.args.purpose !== "preview") {
+        return { type: "call_template_function_response", value: null, error };
+      }
+
+      const result = await fn.onRender(ctx, { ...payload.args, values });
+      return { type: "call_template_function_response", value: result ?? null };
+    }
+  }
+
+  /* --------------------------- http authentication ------------------------- */
+
+  if (payload.type === "get_http_authentication_summary_request" && mod.authentication) {
+    return { type: "get_http_authentication_summary_response", ...mod.authentication };
+  }
+
+  if (payload.type === "get_http_authentication_config_request" && mod.authentication) {
+    const { args, actions } = mod.authentication;
+    payload.values = applyFormInputDefaults(args, payload.values);
+    const resolved = await applyDynamicFormInput(ctx, args, payload);
+    const resolvedActions: HttpAuthenticationAction[] = [];
+    // oxlint-disable-next-line unbound-method
+    for (const { onSelect: _onSelect, ...action } of actions ?? []) resolvedActions.push(action);
+
+    return {
+      type: "get_http_authentication_config_response",
+      args: stripDynamicCallbacks(resolved),
+      actions: resolvedActions,
+      pluginRefId,
+    };
+  }
+
+  if (payload.type === "call_http_authentication_request" && mod.authentication) {
+    const auth = mod.authentication;
+    if (typeof auth.onApply === "function") {
+      const resolved = await applyDynamicFormInput(ctx, auth.args, payload);
+      payload.values = applyFormInputDefaults(resolved, payload.values);
+      return { type: "call_http_authentication_response", ...(await auth.onApply(ctx, payload)) };
+    }
+  }
+
+  if (payload.type === "call_http_authentication_action_request" && mod.authentication != null) {
+    const action = mod.authentication.actions?.[payload.index];
+    if (typeof action?.onSelect === "function") {
+      await action.onSelect(ctx, payload.args);
+      return EMPTY;
+    }
+  }
+
+  /* --------------------------------- actions ------------------------------- */
+
+  if (payload.type === "get_http_request_actions_request" && Array.isArray(mod.httpRequestActions)) {
+    const actions: HttpRequestAction[] = mod.httpRequestActions.map((a) => ({
+      ...a,
+      onSelect: undefined,
+    }));
+    return { type: "get_http_request_actions_response", pluginRefId, actions };
+  }
+
+  if (
+    payload.type === "get_websocket_request_actions_request" &&
+    Array.isArray(mod.websocketRequestActions)
+  ) {
+    const actions = mod.websocketRequestActions.map((a) => ({ ...a, onSelect: undefined }));
+    return { type: "get_websocket_request_actions_response", pluginRefId, actions };
+  }
+
+  if (payload.type === "get_grpc_request_actions_request" && Array.isArray(mod.grpcRequestActions)) {
+    const actions: GrpcRequestAction[] = mod.grpcRequestActions.map((a) => ({
+      ...a,
+      onSelect: undefined,
+    }));
+    return { type: "get_grpc_request_actions_response", pluginRefId, actions };
+  }
+
+  if (payload.type === "get_workspace_actions_request" && Array.isArray(mod.workspaceActions)) {
+    const actions = mod.workspaceActions.map((a) => ({ ...a, onSelect: undefined }));
+    return { type: "get_workspace_actions_response", pluginRefId, actions };
+  }
+
+  if (payload.type === "get_folder_actions_request" && Array.isArray(mod.folderActions)) {
+    const actions = mod.folderActions.map((a) => ({ ...a, onSelect: undefined }));
+    return { type: "get_folder_actions_response", pluginRefId, actions };
+  }
+
+  const called = await callAction(ctx, payload);
+  if (called) return EMPTY;
+
+  return EMPTY;
+}
+
+/** The five action kinds, which differ only in which list they index into. */
+async function callAction(
+  ctx: ReturnType<typeof newContext>,
+  payload: InternalEventPayload,
+): Promise<boolean> {
+  const lists = {
+    call_http_request_action_request: mod.httpRequestActions,
+    call_websocket_request_action_request: mod.websocketRequestActions,
+    call_grpc_request_action_request: mod.grpcRequestActions,
+    call_workspace_action_request: mod.workspaceActions,
+    call_folder_action_request: mod.folderActions,
+  } as const;
+
+  const list = lists[payload.type as keyof typeof lists];
+  if (!Array.isArray(list)) return false;
+
+  const action = list[(payload as { index: number }).index];
+  if (typeof action?.onSelect !== "function") return false;
+
+  await action.onSelect(ctx, (payload as { args: never }).args);
+  return true;
+}
+
+/** One outgoing request, JSON out and JSON back. */
+async function hostCall(
+  context: PluginContext,
+  payload: InternalEventPayload,
+): Promise<Record<string, unknown>> {
+  // The id rides along because the host multiplexes every loaded module
+  // through one handler, and a plugin's storage is namespaced by which plugin
+  // it is.
+  const replyJson = await __yaak_call(JSON.stringify({ pluginRefId, context, payload }));
+  const reply = JSON.parse(replyJson) as InternalEventPayload & { error?: string };
+  if (reply.type === "error_response") {
+    throw new Error(reply.error || `Host failed to handle ${payload.type}`);
+  }
+  const { type: _type, ...rest } = reply;
+  return rest as Record<string, unknown>;
+}
+
+/**
+ * What the host can reach.
+ *
+ * Named on `globalThis` because the host calls them by evaluating an
+ * expression, and kept to four: load a module, ask what it has, send it an
+ * event, wake a timer.
+ */
+(globalThis as Record<string, unknown>).__yaak_guest = {
+  load,
+  summary,
+  fireTimer,
+  dispatch: async (envelopeJson: string): Promise<string> => {
+    const { context, payload } = JSON.parse(envelopeJson) as {
+      context: PluginContext;
+      payload: InternalEventPayload;
+    };
+    try {
+      return JSON.stringify(await dispatch(context, payload));
+    } catch (err) {
+      // A throw from inside a plugin is an answer, not a crash: the host turns
+      // it into the same `error_response` the Node runtime sends, and whatever
+      // asked for this gets a message instead of a hang.
+      const error = (err instanceof Error ? err.message : String(err)).replace(/^Error:\s*/g, "");
+      return JSON.stringify({ type: "error_response", error });
+    }
+  },
+};

packages/plugin-sandbox/src/host/sandbox.ts

@@ -0,0 +1,384 @@
+/**
+ * The sandbox host: QuickJS, and the four things that cross into it.
+ *
+ * One QuickJS runtime holds one context per loaded module. A context is the
+ * isolation boundary — its own globals, its own `Object`, its own prototypes —
+ * so two plugins cannot see or patch each other, and neither can reach the
+ * worker's own scope. Sharing a runtime between them is deliberate: the engine
+ * and its wasm instance are the expensive part, contexts are not.
+ *
+ * The engine is `quickjs-ng`, not Bellard's, and the sync variant rather than
+ * the ASYNCIFY one. Both choices are recorded in this package's README along
+ * with what they cost; the short version is that the Rust host has no choice
+ * (rquickjs vendors quickjs-ng and offers no alternative), and the sync build
+ * still gives the guest real `await` through a deferred promise, at half the
+ * size and twice the speed.
+ */
+
+import variant from "@jitl/quickjs-ng-wasmfile-release-sync";
+import {
+  newQuickJSWASMModuleFromVariant,
+  type QuickJSContext,
+  type QuickJSRuntime,
+  type QuickJSWASMModule,
+} from "quickjs-emscripten-core";
+import { GUEST_SOURCE } from "../generated/guest";
+
+/**
+ * What a module may allocate.
+ *
+ * Sized for the job rather than for comfort: an importer holding a large spec
+ * and the objects it parses into is the high-water mark, and a plugin that
+ * wants more than this is doing something a plugin should not. Hitting it
+ * throws inside the sandbox and unwinds as an ordinary error.
+ */
+const MEMORY_LIMIT_BYTES = 256 * 1024 * 1024;
+
+/** Deep recursion is a stack overflow inside the guest, not a crash of the worker. */
+const STACK_SIZE_BYTES = 2 * 1024 * 1024;
+
+/**
+ * How long a module may run without yielding.
+ *
+ * This bounds *synchronous* execution only, and it has to: a plugin awaiting
+ * the host is not looping, it is waiting for us. So the clock is set when a
+ * dispatch begins and pushed back whenever the guest hands control back, which
+ * makes it a watchdog for `while (true)` rather than a limit on how long real
+ * work may take.
+ *
+ * Generous, because it costs nothing to be: a plugin runs in its own worker,
+ * so one stuck here blocks no database command and no frame. It is sized off
+ * the slowest real work measured (`bench/import.mjs`: GitHub's 12 MB OpenAPI
+ * description takes about four seconds), with room for a document several
+ * times larger before a legitimate import looks like a hang.
+ */
+const SYNC_BUDGET_MS = 60_000;
+
+export type HostRequestHandler = (envelopeJson: string) => Promise<string>;
+
+export interface SandboxLog {
+  pluginRefId: string;
+  level: string;
+  message: string;
+}
+
+let modulePromise: Promise<QuickJSWASMModule> | null = null;
+
+function quickjs(): Promise<QuickJSWASMModule> {
+  // Loaded once per worker, on first use. The wasm is ~529 KB and there is no
+  // reason to pay for it in a session where nothing calls a plugin.
+  modulePromise ??= newQuickJSWASMModuleFromVariant(variant);
+  return modulePromise;
+}
+
+/** One loaded module, and the context it lives in. */
+class LoadedPlugin {
+  readonly pluginRefId: string;
+  readonly context: QuickJSContext;
+  /** Set while a dispatch is running; the interrupt handler reads it. */
+  deadline: number | null = null;
+  private nextTimer = new Map<number, ReturnType<typeof setTimeout>>();
+  private disposed = false;
+
+  constructor(pluginRefId: string, context: QuickJSContext) {
+    this.pluginRefId = pluginRefId;
+    this.context = context;
+  }
+
+  /** Push the synchronous-execution deadline back; called whenever the guest yields. */
+  touch(): void {
+    if (this.deadline != null) this.deadline = Date.now() + SYNC_BUDGET_MS;
+  }
+
+  startTimer(id: number, ms: number, fire: () => void): void {
+    this.nextTimer.set(
+      id,
+      setTimeout(() => {
+        this.nextTimer.delete(id);
+        if (!this.disposed) fire();
+      }, ms),
+    );
+  }
+
+  cancelTimer(id: number): void {
+    const handle = this.nextTimer.get(id);
+    if (handle == null) return;
+    clearTimeout(handle);
+    this.nextTimer.delete(id);
+  }
+
+  dispose(): void {
+    if (this.disposed) return;
+    this.disposed = true;
+    for (const handle of this.nextTimer.values()) clearTimeout(handle);
+    this.nextTimer.clear();
+    this.context.dispose();
+  }
+}
+
+export class PluginSandboxHost {
+  private runtime: QuickJSRuntime | null = null;
+  private readonly plugins = new Map<string, LoadedPlugin>();
+
+  constructor(
+    private readonly onHostRequest: HostRequestHandler,
+    private readonly onLog: (log: SandboxLog) => void,
+  ) {}
+
+  /**
+   * Load one module's source under an id.
+   *
+   * Replaces whatever was loaded under that id, disposing it first, so a
+   * reload is a fresh context rather than a re-evaluation on top of the old
+   * one's globals.
+   */
+  async load(pluginRefId: string, source: string): Promise<Record<string, unknown>> {
+    const module = await quickjs();
+
+    if (this.runtime == null) {
+      this.runtime = module.newRuntime();
+      this.runtime.setMemoryLimit(MEMORY_LIMIT_BYTES);
+      this.runtime.setMaxStackSize(STACK_SIZE_BYTES);
+      // One handler for every context on the runtime. A plugin that is merely
+      // waiting has no deadline set, so it is never interrupted.
+      this.runtime.setInterruptHandler(() => {
+        const now = Date.now();
+        for (const plugin of this.plugins.values()) {
+          if (plugin.deadline != null && now > plugin.deadline) return true;
+        }
+        return false;
+      });
+    }
+
+    this.plugins.get(pluginRefId)?.dispose();
+
+    const plugin = new LoadedPlugin(pluginRefId, this.runtime.newContext());
+    this.plugins.set(pluginRefId, plugin);
+
+    try {
+      this.installHostFunctions(plugin);
+      this.evalOrThrow(plugin, GUEST_SOURCE, "yaak:sandbox-shell");
+      await this.callGuest(plugin, "load", [source, pluginRefId]);
+      return await this.callGuest(plugin, "summary", []);
+    } catch (err) {
+      plugin.dispose();
+      this.plugins.delete(pluginRefId);
+      throw err;
+    }
+  }
+
+  loaded(): string[] {
+    return Array.from(this.plugins.keys());
+  }
+
+  unload(pluginRefId: string): void {
+    this.plugins.get(pluginRefId)?.dispose();
+    this.plugins.delete(pluginRefId);
+  }
+
+  /** Send one event to one loaded module and wait for its reply payload. */
+  async dispatch(pluginRefId: string, envelopeJson: string): Promise<string> {
+    const plugin = this.plugins.get(pluginRefId);
+    if (plugin == null) throw new Error(`No plugin loaded as \`${pluginRefId}\``);
+    const reply = await this.callGuest(plugin, "dispatch", [envelopeJson]);
+    return reply as unknown as string;
+  }
+
+  dispose(): void {
+    for (const plugin of this.plugins.values()) plugin.dispose();
+    this.plugins.clear();
+    this.runtime?.dispose();
+    this.runtime = null;
+  }
+
+  /* ------------------------------ internals ------------------------------- */
+
+  private installHostFunctions(plugin: LoadedPlugin): void {
+    const { context } = plugin;
+
+    const define = (name: string, fn: Parameters<QuickJSContext["newFunction"]>[1]) => {
+      const handle = context.newFunction(name, fn);
+      context.setProp(context.global, name, handle);
+      handle.dispose();
+    };
+
+    define("__yaak_log", (levelHandle, messageHandle) => {
+      this.onLog({
+        pluginRefId: plugin.pluginRefId,
+        level: context.getString(levelHandle),
+        message: context.getString(messageHandle),
+      });
+    });
+
+    define("__yaak_timer_start", (idHandle, msHandle) => {
+      const id = context.getNumber(idHandle);
+      plugin.startTimer(id, context.getNumber(msHandle), () => {
+        // Waking a timer re-enters the guest, so it gets a fresh budget.
+        plugin.touch();
+        this.callGuestSync(plugin, "fireTimer", [id]);
+        this.pump(plugin);
+      });
+    });
+
+    define("__yaak_timer_cancel", (idHandle) => {
+      plugin.cancelTimer(context.getNumber(idHandle));
+    });
+
+    // The one door out. Everything a plugin does to the world arrives here as
+    // a JSON envelope and leaves as a JSON reply; the guest's whole `ctx` is
+    // built from this single function.
+    define("__yaak_call", (envelopeHandle) => {
+      const envelope = context.getString(envelopeHandle);
+
+      // While the host answers, the guest is suspended, not looping — so the
+      // watchdog stops until it comes back.
+      const wasWatching = plugin.deadline != null;
+      plugin.deadline = null;
+
+      const settle = this.onHostRequest(envelope).then(
+        (reply) => {
+          if (wasWatching) plugin.touch();
+          return context.newString(reply);
+        },
+        (err: unknown) => {
+          if (wasWatching) plugin.touch();
+          // Rejections come back as an error the guest can catch, which is
+          // what a host that cannot answer should look like from inside.
+          return context.newError(err instanceof Error ? err.message : String(err));
+        },
+      );
+
+      const deferred = context.newPromise(settle);
+      // Resolving a promise only queues its reactions; something has to run
+      // them, and inside a sandbox that something is us.
+      void deferred.settled.then(() => {
+        this.pump(plugin);
+        deferred.dispose();
+      });
+      return deferred.handle;
+    });
+  }
+
+  /** Drain the guest's microtask queue. */
+  private pump(plugin: LoadedPlugin): void {
+    const result = this.runtime?.executePendingJobs();
+    if (result?.error != null) {
+      this.onLog({
+        pluginRefId: plugin.pluginRefId,
+        level: "error",
+        message: `Unhandled error in sandbox: ${result.error.consume(
+          plugin.context.dump.bind(plugin.context),
+        )}`,
+      });
+    }
+  }
+
+  private evalOrThrow(plugin: LoadedPlugin, source: string, filename: string): void {
+    plugin.deadline = Date.now() + SYNC_BUDGET_MS;
+    try {
+      const result = plugin.context.evalCode(source, filename);
+      if (result.error != null) {
+        throw this.toError(plugin, result.error.consume(plugin.context.dump.bind(plugin.context)));
+      }
+      result.value.dispose();
+    } finally {
+      plugin.deadline = null;
+    }
+  }
+
+  /** Call `__yaak_guest.<method>(...args)`, awaiting the result if it is a promise. */
+  private async callGuest(
+    plugin: LoadedPlugin,
+    method: string,
+    args: (string | number)[],
+    // oxlint-disable-next-line no-explicit-any -- the caller knows the guest's shape
+  ): Promise<any> {
+    const { context } = plugin;
+    plugin.deadline = Date.now() + SYNC_BUDGET_MS;
+
+    const guest = context.getProp(context.global, "__yaak_guest");
+    const fn = context.getProp(guest, method);
+    const argHandles = args.map((a) =>
+      typeof a === "string" ? context.newString(a) : context.newNumber(a),
+    );
+
+    try {
+      const called = context.callFunction(fn, guest, ...argHandles);
+      if (called.error != null) {
+        throw this.toError(plugin, called.error.consume(context.dump.bind(context)));
+      }
+
+      const value = called.value;
+      const state = context.getPromiseState(value);
+      if (state.type !== "fulfilled" || state.notAPromise !== true) {
+        // A promise: hand control back so the guest can make progress, then
+        // wait for it on this side.
+        const resolved = context.resolvePromise(value);
+        value.dispose();
+        this.pump(plugin);
+        const settled = await resolved;
+        if (settled.error != null) {
+          throw this.toError(plugin, settled.error.consume(context.dump.bind(context)));
+        }
+        return settled.value.consume(context.dump.bind(context));
+      }
+
+      return value.consume(context.dump.bind(context));
+    } finally {
+      plugin.deadline = null;
+      for (const handle of argHandles) handle.dispose();
+      fn.dispose();
+      guest.dispose();
+    }
+  }
+
+  /** The timer path: fire and forget, because nothing is waiting on it. */
+  private callGuestSync(plugin: LoadedPlugin, method: string, args: number[]): void {
+    const { context } = plugin;
+    const guest = context.getProp(context.global, "__yaak_guest");
+    const fn = context.getProp(guest, method);
+    const argHandles = args.map((a) => context.newNumber(a));
+    try {
+      const called = context.callFunction(fn, guest, ...argHandles);
+      if (called.error != null) {
+        this.onLog({
+          pluginRefId: plugin.pluginRefId,
+          level: "error",
+          message: String(this.toError(plugin, called.error.consume(context.dump.bind(context)))),
+        });
+      } else {
+        called.value.dispose();
+      }
+    } finally {
+      for (const handle of argHandles) handle.dispose();
+      fn.dispose();
+      guest.dispose();
+    }
+  }
+
+  /**
+   * A dumped QuickJS error as a host `Error`.
+   *
+   * The guest's stack is kept in the message: it names lines in the plugin's
+   * own bundle, which is the only stack that means anything to whoever wrote
+   * it — the worker's own stack would just say "sandbox.ts".
+   */
+  private toError(plugin: LoadedPlugin, dumped: unknown): Error {
+    if (dumped != null && typeof dumped === "object") {
+      const { message, name, stack } = dumped as Record<string, string | undefined>;
+      const error = new Error(message ?? JSON.stringify(dumped));
+      if (name != null) error.name = name;
+      if (stack != null) error.stack = `${name ?? "Error"}: ${message ?? ""}\n${stack}`;
+      return error;
+    }
+    // An interrupted plugin surfaces as `null` with no error object at all,
+    // which would otherwise read as a mysterious empty failure.
+    if (dumped == null) {
+      return new Error(
+        `Plugin \`${plugin.pluginRefId}\` was stopped after running for ` +
+          `${SYNC_BUDGET_MS / 1000}s without yielding`,
+      );
+    }
+    return new Error(typeof dumped === "string" ? dumped : JSON.stringify(dumped));
+  }
+}

packages/plugin-sandbox/src/index.ts

@@ -0,0 +1,153 @@
+/**
+ * A tab's handle on its sandbox.
+ *
+ * Owns the worker, keeps track of what is loaded in it, and turns the two
+ * message flows into promises. The interesting half is `onHostRequest`: the
+ * caller supplies it, and it is the entire answer to "what can a plugin do
+ * here?" — this package deliberately has no idea. A browser host answers those
+ * against a wasm database and a send proxy; something else could answer them
+ * differently; a host that answers nothing still runs plugins that only compute.
+ */
+
+import type { FromSandbox, ToSandbox } from "./protocol";
+
+
+/** Answers one `ctx` call. Gets the JSON envelope, returns the JSON reply. */
+export type HostRequestHandler = (envelope: string) => Promise<string>;
+
+export interface PluginSandboxOptions {
+  onHostRequest: HostRequestHandler;
+  onLog?: (log: { pluginRefId: string; level: string; message: string }) => void;
+}
+
+/** What a module turned out to contribute, as reported after loading. */
+export interface PluginSummary {
+  templateFunctions: string[];
+  authentication: string | null;
+  importer: boolean;
+  filter: boolean;
+  themes: number;
+  httpRequestActions: number;
+  workspaceActions: number;
+  folderActions: number;
+  grpcRequestActions: number;
+  websocketRequestActions: number;
+}
+
+type Pending = { resolve: (value: unknown) => void; reject: (reason: Error) => void };
+
+export class PluginSandbox {
+  private readonly worker: Worker;
+  private readonly pending = new Map<number, Pending>();
+  private readonly options: PluginSandboxOptions;
+  private nextId = 1;
+
+  constructor(options: PluginSandboxOptions) {
+    this.options = options;
+
+    // `new URL("./worker.ts", import.meta.url)` is written inline because that
+    // exact syntax is what the bundler pattern-matches to know it must bundle a
+    // worker entry. Hoisted into a variable it ships as raw TypeScript.
+    this.worker = new Worker(new URL("./worker.ts", import.meta.url), {
+      type: "module",
+      name: "yaak-plugins",
+    });
+    this.worker.onmessage = (e: MessageEvent<FromSandbox>) => this.receive(e.data);
+    this.worker.onerror = () => this.failEverything("The plugin sandbox failed to start");
+  }
+
+  /** Load a module's source under an id, replacing anything already there. */
+  load(pluginRefId: string, source: string): Promise<PluginSummary> {
+    return this.request<PluginSummary>((id) => ({ type: "load", id, pluginRefId, source }));
+  }
+
+  unload(pluginRefId: string): Promise<void> {
+    return this.request<void>((id) => ({ type: "unload", id, pluginRefId }));
+  }
+
+  /** Send one event to one loaded module; resolves with its reply payload. */
+  async dispatch<T>(
+    pluginRefId: string,
+    context: unknown,
+    payload: unknown,
+  ): Promise<T & { type: string }> {
+    const envelope = JSON.stringify({ context, payload });
+    const reply = await this.request<string>((id) => ({
+      type: "dispatch",
+      id,
+      pluginRefId,
+      envelope,
+    }));
+    const parsed = JSON.parse(reply) as { type: string; error?: string };
+    if (parsed.type === "error_response") {
+      throw new Error(parsed.error || "Plugin failed");
+    }
+    return parsed as T & { type: string };
+  }
+
+  /**
+   * End the sandbox now.
+   *
+   * `terminate()` rather than a polite shutdown, on purpose: the reason to
+   * reach for this is a plugin that will not stop, and asking it to stop is
+   * exactly what does not work then.
+   */
+  dispose(): void {
+    this.worker.terminate();
+    this.failEverything("The plugin sandbox was shut down");
+  }
+
+  /* ------------------------------ internals ------------------------------- */
+
+  private request<T>(build: (id: number) => ToSandbox): Promise<T> {
+    const id = this.nextId++;
+    return new Promise<T>((resolve, reject) => {
+      this.pending.set(id, { resolve: resolve as (v: unknown) => void, reject });
+      this.worker.postMessage(build(id));
+    });
+  }
+
+  private receive(message: FromSandbox): void {
+    switch (message.type) {
+      case "result": {
+        const p = this.pending.get(message.id);
+        this.pending.delete(message.id);
+        p?.resolve(message.result);
+        return;
+      }
+      case "error": {
+        const p = this.pending.get(message.id);
+        this.pending.delete(message.id);
+        p?.reject(new Error(message.message));
+        return;
+      }
+      case "log":
+        this.options.onLog?.(message);
+        return;
+      case "host_call":
+        void this.answer(message.id, message.envelope);
+        return;
+    }
+  }
+
+  private async answer(id: number, envelope: string): Promise<void> {
+    let reply: ToSandbox;
+    try {
+      reply = { type: "host_result", id, reply: await this.options.onHostRequest(envelope) };
+    } catch (err) {
+      reply = {
+        type: "host_result",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      };
+    }
+    this.worker.postMessage(reply);
+  }
+
+  private failEverything(message: string): void {
+    for (const [id, p] of this.pending) {
+      this.pending.delete(id);
+      p.reject(new Error(message));
+    }
+  }
+}

packages/plugin-sandbox/src/protocol.ts

@@ -0,0 +1,27 @@
+/**
+ * The messages between a tab and its sandbox worker.
+ *
+ * Two request/reply flows in opposite directions. The tab asks the worker to
+ * load a module or send it an event; the worker asks the tab to answer a
+ * plugin's `ctx` call, because the tab is the only side with a database, a
+ * network and a user. Both carry payloads as JSON strings rather than objects:
+ * they have to be strings to cross into QuickJS anyway, and serializing once at
+ * the edge is cheaper than structured-cloning an object the worker will only
+ * stringify again.
+ */
+
+/** Tab → worker */
+export type ToSandbox =
+  | { type: "load"; id: number; pluginRefId: string; source: string }
+  | { type: "unload"; id: number; pluginRefId: string }
+  | { type: "dispatch"; id: number; pluginRefId: string; envelope: string }
+  /** The tab's answer to a `host_call`. */
+  | { type: "host_result"; id: number; reply?: string; error?: string };
+
+/** Worker → tab */
+export type FromSandbox =
+  | { type: "result"; id: number; result: unknown }
+  | { type: "error"; id: number; message: string }
+  /** A plugin wants something only the tab can provide. */
+  | { type: "host_call"; id: number; envelope: string }
+  | { type: "log"; pluginRefId: string; level: string; message: string };

packages/plugin-sandbox/src/worker.ts

@@ -0,0 +1,82 @@
+/// <reference lib="webworker" />
+
+/**
+ * The worker plugins run in.
+ *
+ * A dedicated worker, owned by the tab that made it — deliberately not the
+ * SharedWorker that owns the database, for three reasons. Plugin work is slow
+ * by design (see `bench/import.mjs`) and the database worker answers every
+ * tab's commands synchronously, so a large import in there would stall every
+ * other tab's reads. A plugin that never returns can be ended with
+ * `terminate()`, which is not something you can do to the worker holding the
+ * database. And the capabilities a plugin actually asks for — a prompt, a
+ * toast, the active request — belong to a tab rather than to a database, so
+ * routing through the tab is the shorter path anyway, not a detour.
+ *
+ * That leaves the database one hop further away than it would otherwise be:
+ * `ctx.store` goes worker → tab → database worker. It is a message either way,
+ * and this direction is the one where a stuck plugin costs nothing.
+ */
+
+import { PluginSandboxHost } from "./host/sandbox";
+import type { FromSandbox, ToSandbox } from "./protocol";
+
+const scope = self as unknown as DedicatedWorkerGlobalScope;
+
+function send(message: FromSandbox): void {
+  scope.postMessage(message);
+}
+
+/** Host calls waiting on the tab, by id. */
+const pendingHostCalls = new Map<number, (reply: string | Error) => void>();
+let nextHostCallId = 1;
+
+const host = new PluginSandboxHost(
+  (envelope) =>
+    new Promise<string>((resolve, reject) => {
+      const id = nextHostCallId++;
+      pendingHostCalls.set(id, (reply) => (reply instanceof Error ? reject(reply) : resolve(reply)));
+      send({ type: "host_call", id, envelope });
+    }),
+  (log) => send({ type: "log", ...log }),
+);
+
+async function handle(message: ToSandbox): Promise<void> {
+  if (message.type === "host_result") {
+    const settle = pendingHostCalls.get(message.id);
+    pendingHostCalls.delete(message.id);
+    settle?.(message.error != null ? new Error(message.error) : (message.reply ?? "{}"));
+    return;
+  }
+
+  try {
+    switch (message.type) {
+      case "load":
+        send({
+          type: "result",
+          id: message.id,
+          result: await host.load(message.pluginRefId, message.source),
+        });
+        return;
+      case "unload":
+        host.unload(message.pluginRefId);
+        send({ type: "result", id: message.id, result: null });
+        return;
+      case "dispatch":
+        send({
+          type: "result",
+          id: message.id,
+          result: await host.dispatch(message.pluginRefId, message.envelope),
+        });
+        return;
+    }
+  } catch (err) {
+    send({
+      type: "error",
+      id: message.id,
+      message: err instanceof Error ? err.message : String(err),
+    });
+  }
+}
+
+scope.onmessage = (e: MessageEvent<ToSandbox>) => void handle(e.data);

scripts/bundle-sandbox-plugins.mjs

@@ -0,0 +1,115 @@
+/**
+ * Bundle plugins for the sandbox runtime.
+ *
+ * A stand-in for `yaakcli build --target sandbox`, which does not exist yet.
+ * The difference from the Node target is small and entirely in the resolver:
+ * nothing may resolve to a Node built-in, because the sandbox has none — see
+ * `packages/plugin-sandbox/README.md` for the full contract. Bundling here
+ * rather than in the CLI keeps the CLI out of this slice; what the CLI would
+ * need is written down at the bottom of this file.
+ *
+ * Output is a generated TypeScript module holding each bundle as a string,
+ * which is how the browser host ships them today. That is the part most
+ * obviously temporary: see the note at the bottom.
+ */
+
+import { build } from "esbuild";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * The plugins the browser tier ships.
+ *
+ * Three, not the whole corpus: this slice is about the runtime existing and
+ * being proven, and each of these proves a different path through it — a
+ * template function, an importer, an authentication method.
+ */
+const PLUGINS = ["template-function-timestamp", "importer-curl", "auth-bearer"];
+
+/** Refuse Node built-ins loudly at build time rather than at first call. */
+const noNodeBuiltins = {
+  name: "no-node-builtins",
+  setup(build) {
+    build.onResolve({ filter: /^(node:|fs$|path$|crypto$|buffer$|process$|os$|util$|stream$)/ }, (args) => ({
+      errors: [
+        {
+          text:
+            `\`${args.path}\` is not available in the sandbox runtime. ` +
+            `Replace it with a pure-JavaScript equivalent.`,
+        },
+      ],
+    }));
+  },
+};
+
+export async function bundlePlugin(name, { dir = join(root, "plugins", name) } = {}) {
+  const result = await build({
+    entryPoints: [join(dir, "src", "index.ts")],
+    bundle: true,
+    write: false,
+    // CommonJS because that is what the shell evaluates: a `new Function` with
+    // `module`, `exports` and a `require` that only throws.
+    format: "cjs",
+    platform: "browser",
+    target: "es2022",
+    minify: false,
+    legalComments: "none",
+    plugins: [noNodeBuiltins],
+  });
+  return result.outputFiles[0].text;
+}
+
+async function main() {
+  const bundles = [];
+  for (const name of PLUGINS) {
+    const source = await bundlePlugin(name);
+    bundles.push({ name, source });
+    console.log(`${name}: ${(source.length / 1024).toFixed(1)} KB`);
+  }
+
+  const outFile = join(root, "packages", "platform", "src", "web", "sandboxPlugins.generated.ts");
+  mkdirSync(dirname(outFile), { recursive: true });
+  writeFileSync(
+    outFile,
+    [
+      "// Generated by scripts/bundle-sandbox-plugins.mjs. Do not edit.",
+      "//",
+      "// The plugins the browser tier loads into its sandbox, bundled for that",
+      "// target and inlined as source text.",
+      "",
+      "export interface SandboxPluginBundle {",
+      "  name: string;",
+      "  source: string;",
+      "}",
+      "",
+      "export const SANDBOX_PLUGINS: SandboxPluginBundle[] = [",
+      ...bundles.map((b) => `  { name: ${JSON.stringify(b.name)}, source: ${JSON.stringify(b.source)} },`),
+      "];",
+      "",
+    ].join("\n"),
+  );
+  console.log(`Wrote ${outFile}`);
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) await main();
+
+/*
+ * What `yaakcli build --target sandbox` would need, beyond this:
+ *
+ * 1. `Platform::Browser` in the rolldown options (crates-cli/yaak-cli/src/
+ *    commands/plugin.rs `bundler_options`), plus a resolver that fails on a
+ *    Node built-in instead of shimming it — a silent shim turns a missing
+ *    capability into a runtime error inside someone else's plugin.
+ * 2. A `runtime` field in the plugin manifest, so a plugin declares which
+ *    target it is for and the registry can refuse to install a `node` plugin
+ *    on a host that has no Node.
+ * 3. Both targets emitted for the same source where they both work, since a
+ *    desktop with a sandbox and a desktop with Node are the same install.
+ * 4. Distribution as files, not as inlined strings. Inlining is what this
+ *    script does because three small bundles cost less than an asset pipeline;
+ *    the corpus does not, and a plugin the user installs at runtime cannot be
+ *    inlined at build time at all.
+ */