Security model
The security model is an authority split between sandboxed providers and the host runtime.
A provider is a Wasm component running behind the WIT boundary. It projects a system into paths, but it does not receive ambient authority to use the network, arbitrary host disk, Git, Docker, or credentials. External effects go through host-mediated callouts and explicit runtime grants.
Boundary
Section titled “Boundary”| Layer | Responsibility |
|---|---|
| Wasmtime/WASI | Runs provider components and controls the sandbox surface. |
| Host runtime | Owns FUSE, provider lifecycle, cache, callouts, credentials, and grants. |
| Capability checker | Decides whether a provider-requested HTTP, Git, Unix socket, or preopen operation is allowed. |
| Auth manager | Resolves, refreshes, and injects credentials into approved HTTP callouts. |
| Provider | Defines projection logic and requests host work through WIT. |
No ambient authority
Section titled “No ambient authority”No ambient authority means:
- no direct network access,
- no arbitrary host filesystem access,
- no direct credential-store access,
- no arbitrary Docker daemon access,
- no Git clone access unless granted.
It does not mean a provider can never see local bytes. For the db provider, omnifs init db preopens the selected database file’s parent directory read-only as /data, and the provider opens the configured guest-visible file inside it. Sibling files in that directory are inside the WASI preopen boundary, so mount only a directory boundary you are willing to grant.
Network and callouts
Section titled “Network and callouts”HTTP callouts are checked before dispatch. Provider manifests can use exact HTTPS host grants; the runtime checker also has an explicit * wildcard path for allow-all grants. Plain HTTP is denied. Literal private and link-local IP targets are denied. This is useful SSRF resistance, but do not treat it as proof that every DNS-based private-network case is impossible.
Container boundary
Section titled “Container boundary”The runtime FUSE mount is Linux. On macOS, omnifs uses a Linux container. The container needs FUSE privileges, including /dev/fuse and Linux capabilities required by the runtime path. Do not describe the container as a fully hardened sandbox.
Traceability caveat
Section titled “Traceability caveat”omnifs inspect and logs redact common secrets in URLs, headers, and Git remotes. Traces can still include paths, object names, remotes, provider errors, and provider output. Treat trace sharing as a disclosure decision.