| Class | Source | Authority |
|---|---|---|
trusted-package |
Plugin built-ins/patterns | Shipped code, executed through the same restricted runtime when source-based. |
capability-generated |
.workflow.json, authored inline, run snapshot |
No direct host access; effects only through WorkflowApi. |
trusted-local |
Project/personal .ts/.mjs/.js |
Full Node host authority; explicit one-shot confirmation before import. |
- Strict source contract and compile check.
- Static rejection of imports, require, process, filesystem, child processes/shell, network, alternate runtimes, timers, dynamic globals,
eval/Function, prototype-constructor access, and__proto__. - A separate QuickJS WebAssembly heap: no Node object, prototype,
Functionconstructor, module loader, or host Promise is injected. - Frozen guest API plus deterministic
Math/Dateguards. - Synchronous CPU slices, wall-clock timeout, memory, and stack limits. Wall timeout closes the bridge, aborts the owner run, and waits for child disposal.
- JSON clone on arguments, capability inputs/outputs and final result.
- Agent, concurrency and token limits enforced by the host.
Capability-generated code is isolated from Node authority by QuickJS/WASM and can affect the host only through validated WorkflowApi calls. Accepted host calls are tracked to quiescence: returning from run() does not detach fire-and-forget effects, and timeout closes the bridge before cancellation/drain. It is still an in-process component rather than an OS container. Never grant an unreviewed workflow write-capable child tools, and never load untrusted code as trusted-local.
Child execution remains governed by the selected DSH provider. Read-only tasks require provider toolFilter support. Structured output requires provider outputSchema support. Missing capabilities reject before child launch. Normal DSH tool approvals and sandbox policies continue to apply inside children.
- Workflow names use a strict kebab-case identifier.
- Catalog files must be ordinary files, not symlinks.
- All save/rename/delete/artifact paths are resolved below their configured roots.
- Capsule size and catalog count are bounded.
- Writes use a same-directory temporary file followed by atomic rename.
- Replacement writes complete first, then use a rollback-safe archive swap; failed swaps restore the old active capsule and clean the temporary file.
- Active runs cannot be deleted, including with force; force is reserved for non-terminal stale records after restart.
Open a private security report with the repository owner. Do not include tokens, proprietary workflow contents, full Session logs, or filesystem paths that reveal secrets in a public issue.