## Security Model

### Sandboxing

- Plugins run in isolated **Web Workers** (no DOM access)
- All host communication goes through a message-passing bridge
- Capabilities must be declared upfront in the manifest

### Permission Levels

1. **Safe** - No user prompt required:
   - `commands`, `notifications`, `statusbar`

2. **Moderate** - Currently allowed, future: user prompt:
   - `terminal:write`, `filesystem:read`, `filesystem:write`

3. **Restricted** - Requires whitelist in manifest:
   - `exec` - Must specify `execPatterns`
   - `http` - Must specify `httpDomains`