pantoken / packages/plugin-kit/src / SandboxedPluginEntry

Interface: SandboxedPluginEntry

Beta

A sandboxed plugin entry: load the plugin from path and run its hooks in an isolated runtime rather than in the calling process.

• sandbox: 'thread' — separate V8 heap; prevents prototype pollution.
• sandbox: 'process' — full OS-capability isolation via Node.js --permission flags.

Properties

path

path: string

Beta

Absolute path to the plugin module. Must be importable by a Worker or child process.

---

sandbox

sandbox: "thread" | "process"

Beta

Isolation level. 'thread' is low-overhead; 'process' restricts fs/net access.

---

readPaths?

optional readPaths?: string[]

Beta

Additional fs-read grants for 'process' mode (default: workspace root). Must include any directories the plugin needs to load (e.g. its own node_modules).