feat: Node.js plugin isolation via workerd sandbox#426

Merged

ascorbic merged 29 commits into

emdash-cms:mainfrom

BenjaminPrice:feat/node-plugin-isolation

May 22, 2026

Commits on May 3, 2026

feat(workerd): add LOADER spike validating miniflare for Node plugin isolation
BenjaminPrice
committed
feat(workerd): add WorkerdSandboxRunner with backing service and capnp config
BenjaminPrice
committed
feat(core): add isHealthy() to SandboxRunner and SandboxUnavailableError
BenjaminPrice
committed
feat(workerd): use core's HTTP access for redirect validation and SSRF protection
BenjaminPrice
committed
feat(core): add sandbox: false escape hatch and improve unavailability warnings
BenjaminPrice
committed
feat(workerd): add MiniflareDevRunner and extract shared bridge handler
BenjaminPrice
committed
test(workerd): add bridge handler conformance test suite
BenjaminPrice
committed
docs: update sandbox.mdx with Node.js workerd sandboxing instructions
BenjaminPrice
committed
fix(workerd): rewrite bridge handler for Cloudflare parity
BenjaminPrice
committed
test(workerd): add plugin integration tests exercising real plugin operations
BenjaminPrice
committed
chore: add changeset for SandboxRunner interface changes
BenjaminPrice
committed
fix(workerd,core): address multi-round review feedback
BenjaminPrice
committed
fix(workerd,core): address maintainer review feedback
BenjaminPrice
committed
fix(workerd): fix capnp identifier naming and integration test assertions
BenjaminPrice
committed
docs: add Node.js workerd sandbox setup to restructured docs
BenjaminPrice
committed
fix(workerd): enable Unix socket backing service
BenjaminPrice
committed

Commits on May 4, 2026

Commits on May 21, 2026