Scope, milestones, risks, mockups, open questions.
WasmBox exists because installing desktop tools means trusting binaries with full system access, and existing sandboxes (Flatpak, Snap) ship heavy runtimes with OS-level integration. The goal is a single static binary that runs wasm32-wasip2 tools with zero ambient authority, verifiable hashes, and a registry protocol so trivial any static file host counts as one. It must be useful for humans piping JSON through jfmt and for AI agents that need a deterministic, sandboxed, auditable tool surface — both audiences are treated as first-class.
Concretely, the v0.3 line ships three things: the runtime + CLI (v0.1), agent-first manifest plus discoverable skill files (v0.2), and a compliance layer — run log, declarative policy, signed audit export — that turns WasmBox into provable evidence under EU AI Act Article 14 (v0.3). The runtime stays MIT; only the compliance crate is FSL.
WasmBox is not a container runtime. It does not virtualise the kernel, manage cgroups, or run native binaries. It is not a package manager for system tools — it cannot replace apt, brew, or even cargo install for things that need raw OS access. It is not a hosted marketplace; there is no account system, no centralised registry, no payment rails, and there will never be telemetry. Auto-update is explicitly forbidden — every hash change goes through user-visible confirmation.
| Version | Scope | Status |
|---|---|---|
0.1 |
Wasmtime runtime, CLI (install/run/list/search/info/verify/update/remove/permissions/audit/registry/hash), capability grants, SHA-256 verify, registry protocol, integration tests with wiremock + fixture wasm. | shipped |
0.2 |
Agent-first manifest section, machine-readable skill files (tools/<name>.md), --json on every command, demo registry with ten tools (jfmt, secretscan, compact, b64, errparse, hashit, epoch, yamlfmt, diffsummary, worldid-verify). |
shipped |
0.3.0 |
EU AI Act Article 14 layer: append-only run log, declarative policy with enforce/warn/disabled modes, signed Ed25519 audit export, agent shell wrapper that blocks raw jq/base64/sha256sum and redirects to sandboxed equivalents. |
shipped |
0.3.2 |
WASI HTTP outbound with per-host filtering — manifests declare network = ["api.example.com", ...] and the runtime rejects requests to any other host before they leave the sandbox. |
shipped (current) |
0.4 |
Leptos web dashboard as a WasmBox tool itself. Local HTTP server crate (crates/server) for web-UI tools. Spin integration for backend tools needing persistent KV. |
planned |
0.5 |
Optional Ed25519 publisher signatures on manifests (separate from audit-export signing). Cross-compile to x86_64-unknown-linux-musl for fully static Linux binary; binary size under 20MB via LTO + strip. |
planned |
| Risk | Likelihood | Mitigation |
|---|---|---|
| Wasmtime engine creation cost dominates short-lived tool runs. | medium | Engine is built once per wasmbox run invocation, not per call. Module cache deliberately invalidated on version change (no stale compile artifacts). |
| WASI Preview 2 outbound HTTP shape still evolving across Wasmtime releases. | medium | Pinned to wasmtime = "42" in workspace. Per-host filter is enforced by WasmBox in crates/runtime, so even an upstream API change cannot widen the allow-list silently. |
| Binary size (~26MB unstripped) too large for casual install. | medium | v0.5 goal: under 20MB via LTO + strip. Wasmtime is the dominant cost. Track via du -sh target/release/wasmbox in CI. |
| FSL licensing on the compliance crate confuses contributors who assume MIT for the whole workspace. | medium | License clearly stated in README, in crates/compliance/Cargo.toml, and in the audit page footer. Conversion to Apache 2.0 after two years. |
| Registry-protocol minimalism (plain HTTPS, no auth) means a hijacked registry can serve malicious manifests. | high impact | SHA-256 in manifest is the trust anchor — if a hijacker swaps a binary they must also rewrite the hash in the JSON, which is then visibly different on next wasmbox update. v0.5 publisher signatures add a second factor. |
| Agents bypass sandboxed tools and call raw system commands anyway. | medium | v0.3 agent shell wrapper blocks jq, yq, base64, sha256sum, date, trufflehog, python -c, node -e and redirects. Every block logged to run.log for audit evidence. |
$ wasmbox run crypts
crypts v0.2.0 — File encryption tool
Author: Aunova | License: MIT
Hash: sha256:a1b2c3d4... [VERIFIED]
Requested capabilities:
stdin: yes
stdout: yes
filesystem: ~/Documents (read+write)
network: []
Allow? [Y/n]
The prompt is rendered by crates/permissions and skipped only when stdin is non-TTY and --allow-all was passed. Otherwise the run exits with code 2 (permission denied).
.wasm tool consumable through the same registry, or as a built-in subcommand?