feat: add restricted experimental WebAssembly tools #68

Merged

severus-snape merged 4 commits from feat/restricted-wasm-tools into main 2026-10-25 10:00:17 +00:00

Conversation 0 Commits 4 Files changed 9 +332 -1

severus-snape commented 2026-10-25 10:00:14 +00:00

Collaborator

Copy link

Experimental tool-only no-import Wasm runner, opt-in infrastructure config. No WASI or provided IO capabilities. Bounded regular module read1MiB, input/output64KiB, memory declaration maximum16MiB, table4096, global four concurrent calls, timeout/abort termination, per-invocation module snapshot reload. NOT OS isolation or total process-memory cap; compilation/V8 allocations remain outside limits. Existing trusted ESM lifecycle unchanged. Full385 tests/typecheck/build/diffcheck and compiled dist UTF8 worker smoke pass. PluginHost conflict rollback and real SDK approval-hook/allowlist tests included; no live model tool-use quality claim. Review b6dc4fb7e8d895fb672691b17743c9c0bf9b9aa3f58b0411b2868ccb82986ace passed. Existing P2 late-stop finalization confirmed, separate follow-up; expiry P2 also documented. No rollout.

Experimental tool-only no-import Wasm runner, opt-in infrastructure config. No WASI or provided IO capabilities. Bounded regular module read1MiB, input/output64KiB, memory declaration maximum16MiB, table4096, global four concurrent calls, timeout/abort termination, per-invocation module snapshot reload. NOT OS isolation or total process-memory cap; compilation/V8 allocations remain outside limits. Existing trusted ESM lifecycle unchanged. Full385 tests/typecheck/build/diffcheck and compiled dist UTF8 worker smoke pass. PluginHost conflict rollback and real SDK approval-hook/allowlist tests included; no live model tool-use quality claim. Review b6dc4fb7e8d895fb672691b17743c9c0bf9b9aa3f58b0411b2868ccb82986ace passed. Existing P2 late-stop finalization confirmed, separate follow-up; expiry P2 also documented. No rollout.

severus-snape added 4 commits 2026-10-25 10:00:14 +00:00

feat: add experimental no-import WebAssembly tool runner 5e158ab773

fix: bound Wasm declarations, file reads and concurrent calls 6d45652f71

test: cover Wasm plugin registration and runtime policy hooks 501680f192

fix: omit eval-only input type from Wasm worker arguments 050b2da3c0

severus-snape merged commit 5f38b074a5 into main 2026-10-25 10:00:17 +00:00

severus-snape deleted branch feat/restricted-wasm-tools 2026-10-25 10:00:17 +00:00

severus-snape referenced this pull request from a commit 2026-10-25 10:00:18 +00:00

Merge pull request 'feat: add restricted experimental WebAssembly tools' (#68) from feat/restricted-wasm-tools into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

harness/core!68

No description provided.