The Extension Sandbox

A permission model an extension must declare, not assume

An agent-authored extension runs with least-privilege permissions it must explicitly declare — network access, listener emission, database access are each opted into, not granted by default. The default sandbox is Node's own node:vm; isolated-vm or opt-in Docker isolation harden it further for a deployment that wants a stronger boundary than the default. Code mode's own execution VM adds no ambient globals, a hard call cap, and a wall-clock timeout — explicitly framed as a capability governor for a trusted operator agent, not a hard security boundary against a genuinely adversarial one.

Component v2 is the hardened portable path

Component v2 packages multi-file Python 3.12 or Node 20 code with a manifest that pins the entrypoint, operations, dependency lock, bundle hash, permissions, allowed domains, CPU, memory, timeout and temporary-storage limits, plus optional SBOM and healthcheck metadata. Installation stores the verified bundle by hash under AGENTIS_DATA_DIR/components/<hash> and rejects traversal, symlinks, checksum mismatches, missing locks, and missing entrypoints. Workflows invoke the pinned package with component_task.

Network mode is none by default. Even when a manifest requests network permission, execution fails closed unless the deployment configures both AGENTIS_COMPONENT_NETWORK and AGENTIS_COMPONENT_EGRESS_PROXY. Runtime readiness is inspectable at GET /v1/extensions/runtime-health; installation uses POST /v1/extensions/install-component.

A concurrency ceiling exists specifically against a fork-bomb via prompt injection

A process-global cap bounds how many sandboxed extension executions can run concurrently at once. The threat model behind it is concrete: a prompt-injected agent looping extension.test or an invoke call could otherwise exhaust host memory, CPU, or process slots — a fork-bomb reached through the sandbox rather than around it. Built-in extensions are trusted, carry their own budgets, and are deliberately not gated by this cap; it exists specifically for the sandboxed, untrusted-code path. Cancellation is real, not cosmetic: aborting a running extension disposes its isolate outright and resolves honestly as EXTENSION_ABORTED, rather than leaving an orphaned process consuming resources in the background.

Continue