Permissions and lifecycle

Network and system services

The host provides bounded HTTP requests through the WIT host interface. Network access requires both a package declaration and a connection grant. Redirects are checked against the same destination policy. A provider must not assume that compiling a native networking crate grants socket or process access.

WASI support is deliberately limited. The plugin does not inherit Memona’s environment variables, local directories, credentials for other connections or subprocess access. Clock/randomness and standard-library plumbing are supplied only as permitted by the host. Filesystem imports do not imply that local host directories are mounted into the component.

Connections to local or private-network services require explicit configuration. Keep declared access as narrow as the service allows. Do not include tokens in URLs or diagnostics; use the connection’s secret fields.

Agent grants

Agent access is independent of network permission. Each connection is off, read-only, or read/write for Memona’s remote_files tool. The Rust host checks the current setting before discovery and every operation. Plugins cannot raise their own grants, and an agent’s permissive CLI mode cannot bypass them.

These controls do not sandbox the external agent’s independently available shell. An agent must use Memona’s tool to access a provider; virtual paths are not automatically mounted as system drives.

Resource limits and cancellation

Each guest instance has a 64 MiB linear-memory limit and a bounded execution budget. A plugin that loops forever or traps is stopped. Transfer sizes, queued work and operation duration are also bounded. Host I/O is asynchronous, but the WASI 0.2 guest interface can look synchronous to its Rust implementation.

Package validation and compilation use separate, short-lived workers with a 30-second deadline per job. The app shares a two-worker limit across both stages; the store permits two validation workers. Cancelling either stage kills and reaps its worker before the slot becomes available again. Only output from Memona’s own compiler worker can be loaded as compiled code; downloaded packages contain portable WASM components.

Worker memory is separate from the guest limit. Linux workers have a 2 GiB virtual-address-space ceiling; macOS workers receive 2 GiB beyond their startup mappings. Windows workers have a 2 GiB committed-memory ceiling. These are process allocation limits, not an identical resident-memory measurement on every OS.

Disabling or removing a plugin prevents new calls and cancels active work. Connection instances do not share mutable guest state or credentials. The backend may remain alive after windows close; all work ends when the backend itself exits.

Future frontend modules

A future Web Component runs in a browser context and has a different permission boundary. Serving JavaScript from a WASM component does not place that JavaScript inside the WASM sandbox. Version 1 does not execute frontend plugin modules.