Sandbox isolation ships with the plugin hook-module feature, which is off.
What
When the plugin hook-module feature is enabled, each module runs in its own JavaScript context that cannot generate code, cannot import outside its own plugin folder, and is stopped if it overruns.
Details
- Console output is routed into the hook chain report; setTimeout and setInterval are shimmed and cancelled when the plugin unloads.
- Imports are limited to relative paths inside the plugin directory plus one synthetic types module; TypeScript and TSX sources are transpiled with Bun.
- Handlers get a budget that can be paused and resumed, and an abort grace period after which the hook is reported as a runaway.
- Matcher copying is capped by node count and nesting depth; values passed across the boundary are deep-frozen or cloned.
- Same off-by-default gate as the capability object; nothing here can be switched separately.
Evidence
core table: not an operation
Strings lifted out of the shipped bundle, so the claim above can be checked against them.