Illia PolosukhinandClaude Opus 4.5 32bfd24154 Add WASM sandbox secure API extension ...

Extends the WASM sandbox with HTTP API capabilities, secrets management,
tool aliasing, and leak detection. Key security principle: WASM never
sees credentials, injection happens at host boundary.

New modules:
- secrets: AES-256-GCM encrypted storage with HKDF key derivation
- leak_detector: Aho-Corasick + regex pattern matching for secret exfiltration
- capabilities: Extended capability system (HTTP, ToolInvoke, Secrets)
- allowlist: HTTP endpoint validation with glob patterns
- credential_injector: Host-boundary credential injection
- rate_limiter: Sliding window per-tool rate limiting
- storage: WASM binary storage with BLAKE3 integrity verification

Leak detection happens at two points:
1. Before HTTP request (prevents exfiltration via URL/headers/body)
2. After response (prevents exposure in outputs returned to WASM)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

2026-02-02 23:22:52 -08:00

..

V1__initial.sql

Simplify workspace to path-based storage, remove legacy code

2026-02-02 21:38:53 -08:00

V2__wasm_secure_api.sql

Add WASM sandbox secure API extension

2026-02-02 23:22:52 -08:00