Node Permission Sandbox

A plugin runner that executes untrusted code in a child Node process under the permission model, so a plugin can read only a whitelisted data directory plus its own file and gets ERR_ACCESS_DENIED on any fs write, out-of-scope read, child process spawn, or worker thread. The child receives a clean env with no parent secrets, a JSON input payload, and a wall-clock timeout that ends in SIGKILL, and reports results over a structured stdout line protocol parsed back into a typed allowed, blocked, or killed outcome. Documents the load-bearing gotcha that allowlist paths must be realpath resolved, since on macOS the /tmp to /private/tmp symlink otherwise denies everything, and the honest ceiling that the network scope needs Node 24 (the runner detects the flag). Zero dependencies.