Server-Side WebAssembly Enables Safe, Near-Native Plugin Sandboxing in Node.js and Go

·1 views

WebAssembly (WASM), long associated with browser-based performance, is gaining traction in backend engineering as a secure runtime for executing untrusted third-party plugin code. Traditional alternatives such as Node.js vm modules, Docker containers, and embedded JS interpreters each carry significant trade-offs in security, latency, or language flexibility. By embedding lightweight WASM runtimes like Wasmtime or Extism into host applications written in Node.js or Go, developers can achieve isolated plugin execution with cold-start times under one millisecond and predictable memory limits. WASM instances operate on a deny-by-default security model, blocking file system access, network calls, and host memory reads unless explicitly permitted. Data exchange between host and plugin is handled through a pointer-based ABI over the instance's linear memory, and open-source frameworks like Extism and Wazero allow a functional host runtime to be configured in under 20 lines of code.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hybrid Retrieval Combines Keyword and Semantic Search to Improve RAG Systems

Vector search, which finds documents based on semantic similarity, struggles with exact-match queries such as error codes, product IDs, and technical terms. Hybrid retrieval addresses this by combining multiple search methods — including keyword matching and semantic similarity — to improve information retrieval accuracy. For instance, a keyword search can directly locate a document containing 'ERR-1042', while semantic search handles conceptually related but differently worded queries. Complex questions, such as diagnosing a payment service failure after a deployment, may require pulling from several document types simultaneously, something a single search method cannot reliably handle. Hybrid retrieval systems tackle this by running multiple retrieval strategies in parallel and merging the results for a more complete answer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds AI task router for OpenCode using TypeSafe's Jev model via OpenRouter

A developer has created a custom routing tool for OpenCode that uses TypeSafe's Jev AI model, accessed through the OpenRouter API, to classify implementation plans. The tool evaluates tasks against three criteria — coordination, uncertainty, and consequences — calculating complexity as the maximum of the first two. Based on this scoring, tasks are routed to either a 'lite' path for localized, straightforward changes or a 'build' path for complex, cross-cutting work requiring design judgment. The approach draws on published ideas around decomposed probabilistic questioning and structured JSON scoring vectors rather than single-shot problem solving. The complete source code, written in TypeScript as an OpenCode plugin, was shared publicly by the developer alongside the methodology.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Airport VS Code Extension Lets Developers Monitor Multiple AI Coding Agents at Once

A developer has released Airport, a free, open-source VS Code extension designed to simplify the management of multiple AI coding agents running in parallel. The tool addresses a common pain point where agents like Claude Code, Codex, and Devin become difficult to track across different projects and terminal windows. Airport provides a dedicated sidebar with live status indicators, showing which agent terminals require user attention and which are idle. It also includes features such as multi-workspace support, a dynamic files view, one-click agent launching, and session resume across workspace restarts. The extension is available on the VS Code Marketplace and on GitHub, and works by hooking into VS Code's shell integration API to monitor terminal output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agents Must Have an Execution Boundary Between Intent and Action

AI agents capable of modifying external systems pose a reliability and safety risk when their decisions directly trigger real-world side effects without structured controls. A core problem arises in scenarios like publishing a page, where a timed-out response can cause duplicate actions or unintended consequences if the agent retries without checks. The proposed solution is an execution boundary — a dedicated application layer that handles validation, authorization, policy enforcement, idempotency, approvals, and auditing separately from the AI model's reasoning. Rather than acting directly, the agent proposes a structured action object, and deterministic application code decides whether that action is permitted and safe to execute. This separation ensures the model contributes intent while the application retains full authority over consequential operations.

0 comments Read more at DEV Community