Module process_sandbox 

ProcessSandbox — the out-of-process implementation of Sandbox.

Each plugin runs in its own subprocess. Confium writes length-prefixed JSON-RPC Request frames to the child’s stdin and reads Response frames from its stdout. A plugin that misbehaves (writes a truncated frame, returns malformed JSON, exits) is reported as an Error on the next call rather than crashing the host.

Capability state is held host-side: the host refuses to forward a call whose required capability is not currently granted. This is the minimum viable gate; a future revision can additionally restrict the child at the OS level (seccomp/AppSandbox) so even a compromised plugin cannot reach the network or filesystem.

See TODO.roadmap/08-security-model.md § “Track B: Out-of-process plugins”.

Structs

ProcessInstance

A loaded plugin subprocess plus its capability envelope.

ProcessSandbox

The out-of-process sandbox.