🔗Related Posts
Search...
⌘KThis project is discontinued - it's a demo. All data is fake and resets on refresh.
Capability-based API with WASM is the right instinct. Default to zero host bindings and hand each plugin only what it asks for and the user approves. The mistake everyone makes early is a convenient "give me fs access" that becomes load-bearing.
And version the capability surface from day one. Retroactively taking away a permission plugins already depend on is brutal. Start strict - it is much easier to loosen than to tighten.
Separate process + IPC is heavier but gives you real OS-level isolation and you can kill a misbehaving plugin without taking down the app. We do WASM for cheap stuff, subprocess for anything that needs more.